Deleted Group in Active Directory is Not Showing as Deleted in Okta after Scheduled Import
Mar 28, 2025
Okta Classic Engine
Directories
Okta Identity Engine
Overview
After a group is deleted in Active Directory (AD), that group is not removed in Okta as expected after a scheduled import.
Applies To
- Directories
- Active Directory (AD)
- Scheduled Imports
Cause
Scheduled imports are incremental by default.
- When an incremental import is performed, Okta runs an LDAP query to search for groups with a specific value for the attribute
uSNChanged. This limits the import to groups in synced OUs modified since the last incremental import and does not include deleted groups. - See How AD Incremental Imports Work for more information on incremental AD imports.
If a group is deleted in Active Directory, an Incremental Import will not see this change.
- This is because an incremental import does not scan every object in an OU, so it is unaware of objects that have been deleted.
Solution
Run a manual Full Import from the Okta Admin dashboard.
