The import roadblock event is triggered when a high number of app unassignments occur during user import. The number of app unassignments is determined by the specified import safeguards. An import safeguard is the maximum percentage of application users in an org that can be unassigned while allowing the import to proceed.

• Import Roadblocks
• Import Safeguards
• Import Safeguards Notification

The import safeguard settings will stop an import before changes are made if a certain number of app unassignments or user deactivations will occur as a result of the import. The threshold is represented in the percentage of total users. This setting can be found under the Provisioning tab in the "To Okta" section for any app that has provisioning enabled.

The following message is received when the import starts. 

More details about the import can be found under Reports > Import Monitoring. The import can be canceled until the cause of the change can be identified, or the import can be resumed if the changes are expected.

• If additional information regarding the users and/or groups that caused the roadblock is needed, please open a case with Okta Support. 

NOTE: As long as the roadblock import is present on the Okta tenant, all imports from all apps will be blocked. The only way of going forward is to either:

• Cancel the roadblock import and investigate on the app side why the users are being removed.
• Resume the import if agreeing with the unassignments.

Keep in mind that if the application that manages the import is set as a profile source with the ability to deactivate users in Okta, this import will remove the app assignments and deactivate the Okta accounts.

Additionally, administrators are notified when a "High Number of App unassignment" has occurred. If the administrator does not receive any notification, perform the following steps:

1. To search for email delivery/notification for "High Number of App unassignment", use the following filter on the system log:

• • debugContext.debugData.category eq "email.bulkAppUnassignmentAppLevelRoadblock"

2.  After running the filter on the system log, verify if there is Email delivery FAILURE: bounce of Email delivery FAILURE: dropped.

3. Follow How to Unblock an Email Address from the Okta Email Address Bounce List via API.

Related References

• Import safeguards
• Enable or disable import safeguards
• Change threshold for import safeguard