When an attribute changes in Okta, the update fails to synchronize to the provisioned application. Incorrect API credentials, incorrect attribute mappings, or a missing external ID on the user assignment cause this issue. Resolve this by verifying the API integration credentials, enabling the Update User Attributes feature, correcting the attribute mappings, or reassigning the affected users.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Profile Editor
• Provisioning

Incorrect API credentials, incorrect attribute mappings, or a missing external ID in the user assignment cause failures to update user attributes. Assigning users to applications before enabling the provisioning feature typically results in a missing external ID, preventing full synchronization between Okta and the application.

How are API credentials verified for provisioning?

Verify the API credentials in the Okta Admin Console to ensure the integration possesses sufficient permissions to update users in the application.

1. In the Okta Admin Console, navigate to Applications > Applications.
2. Select the application.
3. Select the Provisioning tab.
4. Select Integration under Settings.
5. Verify the credentials for the API integration are correct and belong to an administrator account with permissions to update attributes and provision users.

Enable the Update User Attributes Feature in the Application Settings

Enable the Update User Attributes feature in the application settings to ensure Okta sends new attribute values to the application.

1. In the Okta Admin Console, navigate to Applications > Applications.
2. Select the application.
3. Select the Provisioning tab.
4. Select To App under Settings.
5. Select Edit.
6. Select the Enable checkbox next to Update User Attributes.
7. Select Save.

Review the following image for the location of the Update User Attributes setting.

How are attribute mappings verified in the Profile Editor?

Verify the application attribute maps to the correct Okta attribute in the Profile Editor to ensure successful synchronization.

1. In the Okta Admin Console, navigate to Directory > Profile Editor.
2. Locate the application and select Mappings.
3. Select the Okta User to <Application Name> tab.
4. Verify the application attribute maps to the correct Okta attribute.

NOTE: Use the Preview option at the bottom of the mapping page to view the attribute value Okta sends to the application for each user.

Review the following image for the attribute mapping preview option.

Reassign Users to Generate the Missing External ID

If the mappings are correct but attributes fail to update, the user might lack an external ID. Unassign and reassign the affected users in the Okta Admin Console to generate the missing external ID and synchronize the user with the application account.

NOTE: Test these steps with a single test user before applying changes to production users and groups. Disable the Deactivate Users option on the Provisioning tab to avoid deactivating users in the application during this process.

1. In the Okta Admin Console, navigate to Applications > Applications.
2. Select the application.
3. Select the Assignments tab.
4. Locate the affected user and select the X icon to unassign them.
5. Select Assign and reassign the user to the application.

If the unassign icon is unavailable, group membership assigns the user to the application. Convert the group assignment to an individual assignment to allow for user removal.

1. Select the Edit icon next to the user name.
2. Change the Assignment Master from Group to Administrator.
3. Select Save.

Review the following image for the Assignment master setting.

Related References

• Okta Integration Network
• Provisioning and Deprovisioning Overview