Why the External ID Is Necessary for Okta Provisioning to Downstream Applications
Last Updated:
Overview
System for Cross-domain Identity Management (SCIM) capable applications require an external ID when provisioning users to downstream applications. Okta requires this external ID to push updates or deactivate users in the downstream application. Administrators must review the service provider documentation and ensure they enable provisioning before assigning users to generate the required external ID.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Provisioning
- External ID
Solution
Why is the external ID necessary for Okta provisioning?
Users lacking an external ID experience disrupted provisioning functionality, as Okta is unable to push updates or deactivations. Review the service provider documentation regarding Create, Read, Update, and Deactivation (CRUD) operations for the specific Application Programming Interface (API). Review the following image for a sample external ID from a Salesforce integration.
Review the external ID requirements and behaviors to ensure successful downstream provisioning.
- Administrators must enable provisioning before assigning users to the Okta application to receive an external ID.
- Okta cannot provision the user downstream if administrators modify provisioning options without an external ID in the user profile, such as in a Microsoft Office 365 application instance.
- Users must have an external ID in the user profile for the application instance for downstream provisioning to function. Every application with provisioning enabled generates a unique external ID once Okta adds the user to the application instance.
The External ID Corresponds to the Downstream Application User ID and Functions in Mappings
The external ID usually corresponds to the user ID from the downstream application. Administrators can use the external ID in Okta mappings by using appuser.externalId.
Why might the external ID change for the same user?
The external ID might differ if the provisioning flow occurs multiple times for the same user, to the same application, with the same username. Identify the reasons an external ID differs for the same user by reviewing the following common causes.
- The downstream application completely deleted the previous user account.
- The application provisioning API always uses a new external ID during provisioning and cannot use the previous external ID by design.
