This article presents the difference between Okta-Sourced profile attributes and AD-Sourced profile attributes.

• Okta-Sourced Profile Attributes
• AD-Sourced Profile Attributes
• Active Directory

Okta-Sourced Attributes do not appear in authentication responses for AD-Sourced users.

This is an expected behavior. When users are sourced from Active Directory the password details are not stored in Okta. The passwordChanged attribute is an Okta attribute which means that it will not be included in the authentication response for AD-sourced users since the password details are handled on the AD side.

To let Okta discover attributes, they must be added to a user object, a parent object, or an auxiliary object in the directory.

When the schema discovery is completed, a list of the attributes that Okta has permission to discover in the directory is available.