Okta Does Not Automatically Remove Deactivated Users From Groups
Last Updated:
Overview
When a Group Rule adds a user to an Okta group and the user is later deactivated, Okta does not automatically re-evaluate the criteria. Administrators must manually remove the deactivated user using the Okta Groups Application Programming Interface (API). The issue occurs when a deactivated user remains in an Okta group, resulting in unexpected group memberships.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Group Rules
- Okta Groups
- Deactivated Users
Cause
Okta Group Rules dynamically manage group memberships based on specific criteria. When a user meets the criteria of a Group Rule, Okta adds the user to the group. However, deactivation changes the user state in Okta but does not automatically trigger a re-evaluation of the Group Rule criteria. As a result, the user remains in the group despite lacking an active status.
Solution
How does an administrator remove a deactivated user from an Okta group?
Remove a deactivated user from an Okta group by identifying the unique group and user identifiers, then executing a removal request via the Okta Groups API.
- Identify the Group ID by locating the unique identifier in the Okta Admin Console or retrieving it through the Okta API.
- Identify the User ID by obtaining the unique identifier of the deactivated user from the Okta Admin Console or the Okta API.
- Utilize the Okta Groups API endpoint to remove the user from the group by providing the Group ID and User ID as parameters.
NOTE: This recommended solution adds users to the group rule's exception list.
