Update okta.mdx (#17696)

* Update okta.mdx

add callout about matching up OIDC and SCIM groups

* Update okta.mdx

---------

Co-authored-by: ranbel <[email protected]>

Author: kennyj42

src/content/docs/cloudflare-one/identity/idp-integration/okta.mdx

@@ -133,6 +133,10 @@ The Okta integration allows you to synchronize IdP groups and automatically depr
 
 14. In the **Assignments** tab, add the users you want to synchronize with Cloudflare Access. You can add users in batches by assigning a group.
 
+	:::note
+	Groups in this SCIM app integration should match the groups in your base [OIDC app integration](/cloudflare-one/identity/idp-integration/okta/#set-up-okta-as-an-oidc-provider). Because SCIM group membership updates will overwrite any groups in a user's identity, assigning the same groups to each app ensures consistent policy evaluation.
+	:::
+
 15. In the **Push Groups** tab, add the Okta groups you want to synchronize with Cloudflare Access. These groups will display in the Access policy builder.
 
 Provisioning will begin immediately. To verify the integration, select **View Logs** in the Okta SCIM application.