Okta Users Unexpectedly Deactivated or Suspended After an Active Directory Full Import

A full import from Active Directory (AD) can deactivate or suspend active Okta users when an administrator removes a required attribute from the AD object, and the directory integration lifecycle settings are configured to deactivate or suspend users. Resolve this issue by identifying the missing required attribute, repopulating the data, and performing another full import.

• Okta Classic Engine
• Active Directory (AD)
• AD Full Import
• Active Directory-sourced users
• User Lifecycle Settings

A required attribute, such as firstName, lastName, or login, was removed from the user's AD object, and the Okta directory lifecycle settings are configured to deactivate or suspend the Okta user during a full import.

 
NOTE: A scheduled import or a manually performed incremental import will not result in this issue.

How is the unexpected deactivation or suspension of Active Directory users resolved?

Identify the missing required attribute, repopulate the missing data in Active Directory, verify the lifecycle settings, and perform a full import to reactivate the Okta user.

1. Check the corresponding AD object of the user to determine if an administrator changed it and removed one of the required attributes (firstName, lastName, login).
2. Alternatively, perform a System Log query to identify any skipped users.
   • Enter the following query into the System Log search field to locate skipped users.

     eventType eq "system.agent.ad.import_user" and outcome.result eq "SKIPPED"

3. If the query returns results, expand the System Log entries individually and examine the Outcome > Reason section to identify the missing required attribute.
4. Repopulate the missing data for the required attribute in Active Directory.
5. Navigate to the Active Directory Settings > Lifecycle Settings section and verify that the appropriate reactivation option is enabled.

The following image displays the lifecycle settings configuration required to reactivate a user upon import.

6. Perform a full import to reactivate the Okta user.