This article explains the difference between the Activate Okta user (user.lifecycle.activate) and Reactivate Okta user (user.lifecycle.reactivate) events in the Okta System Log.

• System Log
• User Lifecycle Management

A "Reactivate Okta user (user.lifecycle.reactivate)" event is created only when triggered by a provisioning job or an import from an app integration.

• The actor for this event may appear as the admin who revalidated the API connection, the admin who initiated the action, or Okta System (SystemPrincipal).
• This event is not triggered when a user in a RECOVERY (Password Reset) state successfully resets their password.

An "Activate Okta user (user.lifecycle.activate)" event is created when a user transitions to an ACTIVE state through one of the following methods:

• An admin manually activates a user from the Okta Admin Console. The actor is the administrator who performed the action.
• A user in the PROVISIONED (Pending User Action) state completes their profile setup using an activation email.
• A user is reactivated through an app integration, such as Workday, via a provisioning job or import. A user.lifecycle.reactivate event occurs first, followed immediately by a user.lifecycle.activate event. Both events share the same TransactionID, indicating they are part of the same action.
  •  The actor for this event is typically the administrator who last revalidated the API connection, but this can differ based on the provisioning source.

NOTE: An import from a profile source does not change a user's status if they are in a PROVISIONED (Pending User Action) or SUSPENDED state. Manual action is required to change their status. For example, the user.lifecycle.unsuspend event is triggered only when a user is manually unsuspended.

Related References

• Event Types