Okta generates a provisioning error when the target Organizational Unit (OU) is not also selected as an import OU in the directory integration settings or when the distinguishedName attribute maps incorrectly. Resolve this issue by aligning the OU selected in the provisioning group with the directory integration settings or by removing the distinguishedName attribute mapping. The following error displays next to the user under the Directory Assignment list or under Dashboard > Tasks:
Automatic provisioning of user "username " to app Active Directory failed: Error provisioning AD user: Target OU is not an import OU
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Directories
- Active Directory (AD)
- Provisioning
Two possible causes trigger this error:
- The group that provisions users to Active Directory (AD) creates users in an Organizational Unit (OU) that is not selected in the directory integration within Okta.
- The Directory provisioning settings map the distinguishedName attribute.
What steps resolve the error "Target OU is not an Import OU" during Active Directory provisioning?
Correct the AD OU configuration or distinguishedName attribute mapping to resolve this error.
How to confirm the Organizational Unit configuration?
Review the Organizational Unit selection for the directory integration in Okta and verify the OUs selected in the group that provisions to Active Directory.
- Navigate to Directory > Directory Integrations and select the appropriate directory integration.
- Select Provisioning > Integration.
- Review the selected OUs next to User OUs connected to Okta.
- Navigate to Directory > Groups and open the provisioning group.
- Select the Directories tab.
- Select the pencil icon next to the directory and expand the Organizational Units under Default Attributes.
The OU selected in the provisioning group must also be selected in the directory integration User OUs. Change the OU in the provisioning group to match the integration selection, or add the OU selected in the provisioning group to the directory integration.
How to confirm the distinguishedName configuration?
Check the directory attribute mappings to ensure the distinguishedName attribute is not configured, and remove the mapping if it exists.
- Navigate to Directory > Directory Integrations > [AD Instance] > Provisioning > To App.
- Verify whether the distinguishedName attribute is configured in the directory attribute mappings.
- Remove the mapping if the attribute maps to a value.
- Save the configuration and retry provisioning.
