Grok Bot in Okta and Entra ID: App Assignment and Sign-in Rules

Two changes, and they do different jobs. Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. uses your Cursor account, so everything happens on the Cursor app you already have in your identity provider. Cursor single sign-on is SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition. 2.0 and works with Okta, Microsoft Entra, Google Workspace and OneLogin. The docs go into detail on Okta and Entra ID because those are where device-trust policies most often need attention.

The authentication rule doesn't apply to connected-app sign-in either. Connecting an app doesn't go through the computer, so a rule written for the computer browser has nothing to act on there. That distinction is worth holding onto, because the failures from each change look quite different in practice.

One prerequisite sits under both. A user needs to be a member of your Cursor team to use Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition., and your existing Cursor SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. applies. With auto-provisioning on, a user joins the team at first sign-in. Without it, provision the user and have them sign in to Cursor for a seat, or invite them from the Cursor dashboard. SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. is Enterprise only: provisioning is SCIM 2.0, and removing a user in your identity provider removes them from Cursor.

A user gets a Cursor account through assignment to your existing Cursor SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. app, plus the SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. app if you use SCIM. When Cursor is assigned only to engineering, everyone else fails with User is not assigned to this application, or their invite never completes. The fix is to widen assignment, and the docs say plainly not to create a second Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. application.

1. 1Go to Admin Console > Applications > Applications and open your existing Cursor app.
2. 2Open Assignments and select Assign > Assign to Groups, or Assign to People for individuals.
3. 3Add every group that should get Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition., not only engineering.
4. 4If you use SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition., assign the same groups to the Cursor SCIM app and push them. Users appear in Cursor only after they're assigned to the SCIM app.
5. 5Confirm each group is also assigned to the SAMLSecurity Assertion Markup Language. The XML-era enterprise standard that powers single sign-on: your identity provider vouches for you to each app. Older than OIDC but still what many enterprise tools speak. Press Enter for the full definition. app. SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. assignment without SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. assignment still blocks first sign-in.

Step five is the one that trips people up, I think, because SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. success makes the user visible in Cursor and it looks finished. If you use org-level identity in Cursor, map the directory group to the Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. team after it syncs, and use separate groups for app assignment and Group Push.

The Entra ID steps mirror Okta's, with a licensing condition on the group part.

1. 1Go to Microsoft Entra admin center > Enterprise applications and open your existing Cursor enterprise app.
2. 2Open Users and groups and select Add user/group.
3. 3Add every group that should get Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition., not only engineering.
4. 4If you use SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition., assign the same groups to the Cursor provisioning app. Turn provisioning on and scope it to assigned users and groups.
5. 5Confirm the assignment grants SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. rather than report-only access.

Group-based assignment requires Entra ID P1 or P2, and nested groups aren't included. Users must be explicitly assigned. Unassigning blocks SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. sign-in, and with SCIMSystem for Cross-domain Identity Management. A standard for automatically creating and removing user accounts when people join or leave. Press Enter for the full definition. it also removes them from Cursor.

The docs give three checks that the assignment works, in either identity provider:

• A user outside the original engineering assignment can open Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. and complete Cursor SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition. without the User is not assigned to this application error.
• With auto-provisioning on, that user appears on the Cursor team after first sign-in, without a manual invite.
• With auto-provisioning off, that user is on the team after they sign in to Cursor for a seat, or after you invite them from the dashboard.

Inside the hosted computer, members sign in to applications through your identity provider in the browser, so your session policies govern those sessions. The computer runs Linux, isn't enrolled in MDM, and device-trust agents such as Okta FastPass don't run on it. Any rule that requires FastPass, a registered or managed device, a compliant device, or a phishing-resistant factor only FastPass can satisfy fails there.

The docs are direct about the response: don't turn FastPass or device compliance off for the whole company. Add a higher-priority rule scoped to this unmanaged Linux session instead. It covers only the IdP-provisioned apps the Bot opens in the computer browser.

Two sign-in methods work in that browser:

• Password plus a second factor that works in a remote browser, such as Okta Verify push or an authenticator app.
• Passkeys stored in a password manager on the computer, installed with Team Setup Scripts (Enterprise only).

Requiring managed devices for Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. sign-in itself still works. A device-aware sign-in policy applies to Grok Bot because it uses your Cursor SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition., and that policy gates sign-in on the member's device, not the hosted computer. The broader picture of how the computer, approvals and credentials fit together is in Grok Bot security and privacy.

In Okta Identity Engine, the computer matches the Other Desktop device platform. There's no Linux checkbox, which is easy to go looking for. Repeat these steps for each IdP-provisioned app the Bot opens in the computer browser.

1. 1Go to Admin Console > Security > Authentication Policies and open the policy attached to the app. To find it, open Applications, then the app, then Sign On.
2. 2Add a rule above the FastPass, managed-device and deny catch-all rules, and name it so you can find it later, for example Grok Bot computerThe persistent cloud computer shared by all Grok Bots on one user's account, including its files, browser sessions and command-line credentials. Press Enter for the full definition. (Linux).
3. 3In the IF conditions, scope the rule to a group. The Cursor-assigned group works if you don't want the rule company-wide.
4. 4Set Device platform to Other Desktop and Device state to Any. Don't require Registered, Managed, or a device assurance policy that depends on FastPass.
5. 5In the THEN conditions, set access to Allowed after successful authentication with Password + Another factor. Don't require phishing-resistant or hardware-protection factors.
6. 6Save the rule and confirm it sits above the unmanaged-device deny catch-all.

If several apps share one FastPass-on-managed-devices policy, add the Linux rule to the shared policy and scope it by group, or give those apps their own policy. On Classic Engine, allow Other Desktop without requiring Device Trust = Trusted.

Entra ID has no FastPass, so the problem shows up as grants instead. The ones that block the computer browser are a compliant device, a hybrid joined device, a phishing-resistant authentication strength only a platform or managed passkey can meet, and an approved client app or app protection policy.

1. 1Go to Microsoft Entra admin center > Protection > Conditional Access > Policies.
2. 2Find every policy that applies those grants to the IdP apps the Bot needs.
3. 3Leave those policies on. Add a higher-priority policy for Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. users on Linux, or exclude them from the blocking policies.
4. 4In the new policy, set users to the Cursor-assigned group and target the IdP apps they must open on the computer. Select All resources only if you accept that scope.
5. 5Under Device platforms, include Linux and exclude Windows and macOS.
6. 6Set the grant to Require multifactor authentication only.
7. 7Start the policy in report-only mode, then turn it on.
8. 8On existing compliant-device policies, exclude the group or exclude Linux.

If you need phishing resistance without a managed device, use an authentication strength a synced passkey can satisfy, and test sign-in from the computer before enforcing it.

The change is working when a user can sign in to IdP-provisioned apps from the Bot's computer without a FastPass or device-compliance error, connected-app sign-in works as before, and laptop sign-ins are unchanged. Revocation stays with you either way. Revoking the user in your identity provider ends their in-computer application sessions, and an organization admin can terminate the member's computer at any time, as described in managing Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. computers.

Cursor lists three, and all of them come back to the computer being an unmanaged Linux machine or to Entra licensing.

• Okta FastPass doesn't run on Linux, so the Bot's computer can't satisfy FastPass or managed-device rules.
• The computer isn't enrolled in MDM by default.
• Group-based assignment in Entra ID requires P1 or P2 and doesn't include nested groups.

When a sign-in fails, the useful first question is which of three paths it was on. Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. sign-in runs on the member's own device through Cursor SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition., so app assignment and your device-aware policy govern it. Sign-in to an IdP-provisioned app runs in the computer browser, so the scoped Linux rule governs it. Connecting an app doesn't touch the computer at all. An error like User is not assigned to this application points at the first path, and a FastPass or device-compliance error points at the second.

The rule changes only how members can sign in from the computer. Your session policies still govern the sessions that result, and revoking the user in your identity provider ends them.

Where this lands in the overall rollout order, between clearing the network and turning Grok BotAn early AI teammate product from SpaceXAI and Cursor that works across apps on a persistent cloud computer and asks for approval on selected actions; launch materials describe it as beta, but Cursor says Beta Services terms do not apply. Press Enter for the full definition. on, is laid out in the deployment guide.