Blank Username for New Assignments after Username Format Change to active_directory.objectSid
Oct 3, 2025
Lifecycle Management
Okta Classic Engine
Okta Identity Engine
Overview
This article addresses an issue where users assigned to an application via a new group have a blank or null username. This occurs after the application's username format was changed (for example, from user.employeeNumber to active_directory.objectSid) and existing user profiles were updated using the Update Now function.
Applies To
- Universal Directory
- Active Directory
- Application Username
- Lifecycle Management
Cause
This behavior occurs because the trigger to update the application username is not configured to run when new assignments are created. While running Update Now updates the usernames for currently assigned users, it does not affect users who are assigned to the application later through group membership.
Solution
Use one of the following options to resolve this issue.
Option 1: Enable Automatic Username Updates.
This option ensures the application username is updated automatically when a user is created or updated.
- In the Admin Console, navigate to the application's Sign On tab.
- In the Credentials Details section, click Edit.
- For the Application username format setting, select Update application username on: Create and update.
- Click Save.
NOTE: This setting affects all users assigned to the application. When any user's Okta profile is updated, their application username will be re-evaluated and updated accordingly.
Option 2: Use a Custom Mapping.
This option involves mapping the Active Directory value to an Okta attribute first and then using that Okta attribute for the application username.
- In Directory > Profile Editor > Active Directory > Mappings > Active Directory to Okta, map the required Active Directory attribute (for example, objectSid) to a custom Okta User Profile attribute.
- Navigate to the application's Sign On tab and click Edit in the Credentials Details section.
- Set the Application username format to Custom.
- Enter an expression to use the custom Okta attribute that now contains the desired value from Active Directory.
- Click Save.
