Okta Active Directory Import Fails With Conflict Error for New Users
Last Updated:
Overview
When running imports from Active Directory (AD) into Okta, newly imported AD users may display a conflict error on the Active Directory Import tab. This error occurs when a conflicting AppUser ID is present in the import data, preventing the system from correctly identifying the user profile. Resolving this issue requires updating the custom expression, clearing unconfirmed users, and performing a full import. When this failure occurs, Okta generates the following error message:
This choice creates a conflict
Applies To
- Active Directory (AD)
- Provisioning
- Okta Expression Language
- Profile Editor
- Universal Directory
- Okta Classic Engine
Cause
This error occurs when a conflicting AppUser ID is present in the import data, preventing the system from correctly identifying the user profile. For example, if the expression is set to active_directory.samAccountName, the mapping preview provides the correct value for users already imported to Okta from AD. However, new users imported from AD get stuck on the import tab with a conflict error. To avoid this, the following expression should be used instead: appuser.samAccountName+"@test.com".
This happens because active_directory.samAccountName is the variable name for the SAM Account Name attribute, which accesses the application user profile attribute. Since new users are waiting for confirmation and are not yet created in Okta, the user AD application profile is not accessible in Okta, resulting in the error. Existing users do not receive the error because they already have an AD application profile created in Okta. More details on these attributes can be found in Application User Profile.
Solution
How is the Active Directory import conflict error resolved?
To resolve this issue, review the custom expression used for the Okta Username Format and ensure that it is within the format specified in the Okta Expression Language documentation.
Clear the unconfirmed users, perform a full import, and then re-match the user.
- In the Admin Console, go to Directory > Directory Integrations > Active Directory.
- Select the Import tab.
- Click Clear Unconfirmed Users.
NOTE: This action removes all unconfirmed users from the import list.
- Perform a full import.
- Match the user.
