Okta User Attribute Not Populating During Profile Source Imports

During profile source imports from applications like Active Directory, Workday, or BambooHR, Okta applies only the status change if the source application updates a user attribute and deactivates or suspends the user before the next import runs. Okta does not write the updated attribute to the user profile because Okta evaluates user status changes before attribute changes during an import. To resolve this, split the changes into two imports or update the attribute using the Okta Users API.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Profile Sourcing
• Active Directory
• Workday
• BambooHR
• Lifecycle Management

This is expected behavior because Okta evaluates user status changes before attribute changes during an import. When the import finds a deactivated or suspended user, Okta runs the lifecycle action configured under Provisioning > To Okta > Profile Lifecycle Sourcing. Okta does not apply the attribute update in the same import. The configurations map as follows:

• Deactivate: Okta deactivates the user and does not update the attribute.
• Suspend: Okta suspends the user and does not update the attribute.
• Do nothing: Okta keeps the user active, removes the profile source assignment, and does not update the attribute.

How are user attributes updated when a profile source deactivates a profile during an import?

Split the user profile updates into two imports or update the attribute outside the import using the Okta Users API with a custom automation, such as Okta Workflows. To split the updates into two imports, update the attribute while the user is active, run an import, and then deactivate the user before running a second import.

1. Keep the user active in the profile source application.
2. Update the attribute in the profile source application.
3. Run an import from the profile source application to Okta.
4. Confirm that Okta imports the attribute.
5. Deactivate the user in the profile source application.
6. Run an import from the profile source application to Okta.
7. Confirm that Okta updates the attribute and deactivates the profile.