Administrators can disconnect users individually or in bulk to manage authentication sources. Disconnecting a user from Active Directory (AD) using the Okta Admin Console requires selecting specific password reset options.
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Active Directory (AD)
- User Management
How are users disconnected from Active Directory in Okta?
To disconnect users from Active Directory, navigate to the Okta Admin Console, locate the user or users, select the disconnect action, and choose the appropriate password reset options, as detailed in the video demonstration or the written instructions.
How is a single user disconnected from Active Directory?
Disconnect a single user from Active Directory by navigating to the user profile in the Okta Admin Console, selecting the disconnect action, and choosing the appropriate password reset option.
- In the Okta Admin Console, go to Directory, and then select People.
- Select the user to disconnect from AD.
- Select More Actions, and then choose Disconnect from AD.
- Select a password option on the confirmation screen.
- Choose Reset password now to send a password reset email to the user. By default, the link in the email expires after one hour.
- Choose Don't reset password if the password requires a later reset or if the user requires reconnection to another source for Delegated Authentication. The user cannot sign in until the password is set.
How are multiple users disconnected from Active Directory in bulk?
Disconnect multiple users from Active Directory simultaneously by selecting the desired users in the Okta Admin Console, executing the bulk disconnect action, and applying a password reset option.
- In the Okta Admin Console, go to Directory, and then select People.
- Select More Actions, and then choose Disconnect from AD.
- Select the users to disconnect, and then select Disconnect Selected.
- Select a password option on the confirmation screen.
- Choose Reset password now to send a password reset email to the users. By default, the link in the email expires after one hour.
- Choose Don't reset password if the password requires a later reset or if the users require reconnection to another source for Delegated Authentication. The users cannot sign in until the password is set.
NOTE: To switch users back to an AD-sourced state, re-import the users to link the Okta accounts to the AD accounts.
