Is there a way to only create deprovisioning tasks for specific apps?
It would be useful if Okta would only create deprovisioning tasks for apps that attempt to automatically deprovision users but fail; is there any way to do this? Or at least to specify which apps create deprovisioning tasks?
What you described above is the expected behavior when deprovisioning an app. The deprovisioning tasks that show up in the dashboard are dependent on the API call Okta gets back from the target app.
Users are automatically deprovisioned from supported apps when their account is deactivated in AD or Okta. If you have apps with provisioning enabled, you can turn off the "Deactivate Users" feature from the Provisioning tab.
If you feel like this could use a bit more clarity on either side, I would suggest opening a ticket with the Okta Support team and try to get someone on the phone to ensure you get the answers you're looking for. Our engineers are available 24/7/365.