Hi Kw,

Regarding the first point, have you configured Hub Services to use Workspace ONE Access? You will also have to configure Directory Services (in UEM) to use SAML with Workspace ONE Access as well? This also means you will need to configure the AirWatch app inside of WS1 Access.

Regarding point 2. Please make sure in the A/W Provisioning Application that the OG specified is the top OG.  Also, the groups you are trying to push from WS1 -> UEM, are these regular groups in Okta or assignment groups in Okta. This makes a difference. Okta does not support/recommend pushing the same groups that are using for assigning the WS1 application.