I have implemented custom security and when done its very nice because it just works and you don't have to worry about it. Many steps to get it to that point though. The documentation you reference does highlight all the steps. There are more detailed blogs when searching google. Another option you can explore is a limited…

Responding to bwdata… To be clear, the information I want is Group to (licensed/data/duty) Application Roles. Group is in OCI but Application Roles are only in FDI so getting an export from OracleIdentityCloudService won't work because OCI doesn't know about Application Roles… Only FDI does. Responding to Krishna Prasad…

My goal is to get the data. I don't really care how it's done. I would think exposing the database table(s) this information is on would be the simplest (and quickest) for Oracle (I assume it's just a DB grant or two). That way people like myself can get to the data.

I saw this behavior during an upgrade in late 2024. The upgrade did add items back even to CUSTOM groups. We created an SR and the resolution was it was a bug and will be fixed in early 2025. As John indicated, seeded groups will still be updated. But custom groups shouldn't be. I don't know if its fixed yet or not so…