Okta users are created from imported Workday users. Workday doesn't manage users after they've been imported into Okta. Any updates made to the user in Workday don't affect the associated Okta user. Okta groups are created from imported Workday Provisioning Groups, which you can then use to assign apps.