Active Directory User Skipped During Okta Import

When importing a new user from Active Directory (AD) into Okta, the import process skips the user. This issue occurs because a required attribute is missing in AD. Identify the missing attribute in the System Log and populate it in AD or mark it as optional in Okta.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Active Directory (AD)
• Directories
• Imports

The AD user is missing a required attribute, such as the lastName attribute. This frequently occurs when importing test users or service accounts that only have a first name populated. Okta skips the user during the import process when a required attribute is null.

How is the missing attribute identified?

Search the System Log for skipped import events and review the outcome reason to identify the missing attribute.

1. Navigate to Reports and select System Log.
2. Enter the following query to find skipped AD import events:

   eventType eq "system.agent.ad.import_user" and outcome.result eq "SKIPPED"

3. Expand the event and navigate to Outcome > Reason.
4. Review the reason to identify the missing attribute.
   • For example: Expected required AD attribute: sn, (Okta attribute: lastName) to not be null.

Resolve the Missing Attribute Issue

Update the user profile in AD to include the missing attribute or modify the Okta profile requirements.

• Populate the missing attribute for the user in AD.
• Alternatively, navigate to Directory > Profile Editor in the Okta Admin Console and mark the attribute as optional if the attribute is not strictly required.
• Run the AD import again to successfully import the user.