If you leverage _and_ LDAP groups via the Okta connection, a lookup is done for every possible group membership one after the other on multiple different UI element clicks in browser. It is INSANELY inefficient and destroys your rate limit. You need to convert them all to standard groups with the name of the group that's passed along in by SAML. You lose the ability to use group based limitations in Self Service, but it's the only option.
