Okta Scheduled Active Directory Incremental Import Converted Into a Full Import

Scheduled Active Directory (AD) imports run as incremental imports, scanning only user and group objects with a uSNChanged attribute value updated since the last import. Okta automatically converts an incremental import into a full import when specific directory changes occur, such as Organizational Unit (OU) modifications, LDAP filter updates, or changes in domain controller connectivity. The System Log displays an entry when this conversion happens.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Active Directory (AD)
• Organizational Unit (OU)
• Imports

Why is an incremental import converted into a full import?

Okta automatically converts an incremental import into a full import when it detects specific directory changes, filter updates, or connectivity changes.

• A container or OU is selected or cleared in the directory integration settings in the Okta Admin Console.
• A selected OU is removed from AD while the import is taking place.
• An update is made to the AD LDAP import filter.
• The Okta AD Agent cannot access the same AD Domain Controller used in the previous import job.

The System Log records a specific entry indicating the conversion of an incremental import to a full import.