Workday Mastered User Gets Disconnected from Active Directory Environment and Attributes Stop Updating as Well as Delegation Authentication Fails for AD

A Workday-mastered user can no longer authenticate into Okta using Delegated Authentication, and/or modifications to Workday attributes are not successfully pushed from Workday > Okta > Active Directory (AD).

• Workday as a Primary Source of Truth, with Active Directory as the Secondary Source of Truth
• Okta Integration Network (OIN)
• Active Directory (AD)

Remove the user from Okta, run an import from AD to Okta, then run an import from Workday to Okta:

NOTE: Okta recommends documenting or creating a screenshot of the end user's application assignments to assist in re-assigning these applications later. If there are numerous users, it is suggested to perform these steps during a planned maintenance window.

1. Verify that the Provisioning tab for the applications that the end user is assigned to does not have the "Deactivated" option enabled - otherwise, the steps below may deactivate that user's account in downstream applications.
2. Deactivate, then delete the affected user(s) from Okta.
3. Run an incremental import from Active Directory, which reloads the missing user account (now becomes mastered by AD).
4. Run an import from the Workday application, which links the Workday user to the AD user account (now becomes mastered by Workday - which is the desired outcome).
5. After doing the above on affected user accounts, Workday > Okta > AD attributes for the user will populate.