Okta Active Directory Import Fails With Conflict Error for New Users
Last Updated:
Overview
An Active Directory import conflict error occurs for new users when a conflicting application user ID is present in the import data, preventing Okta from correctly identifying the user profile. Resolve this issue by updating the custom expression, clearing unconfirmed users, and performing a full import. Okta generates the following error message during the import process:
This choice creates a conflict
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Active Directory (AD)
- Provisioning
- Okta Expression Language
- Profile Editor
- Universal Directory
Cause
This error occurs when a conflicting AppUser ID is present in the import data, preventing the system from correctly identifying the user profile. For example, if the expression is set to active_directory.samAccountName, the mapping preview provides the correct value for users already imported to Okta from AD. However, new users imported from AD get stuck on the import tab with a conflict error. To avoid this, the following expression should be used instead: appuser.samAccountName+"@test.com".
This happens because active_directory.samAccountName is the variable name for the SAM Account Name attribute, which accesses the application user profile attribute. Since new users are waiting for confirmation and are not yet created in Okta, the user AD application profile is not accessible in Okta, resulting in the error. Existing users do not receive the error because they already have an AD application profile created in Okta. More details on these attributes can be found in Application User Profile.
Solution
How is the Active Directory import conflict error resolved?
Review the custom expression configured for the Okta Username Format and ensure it matches the format specified in the Okta Expression Language documentation, such as using appuser.samAccountName+"@<test.com>" instead of active_directory.samAccountName.
Clear the unconfirmed users, perform a full import, and re-match the user by navigating to the Active Directory integration settings in the Admin Console.
- In the Admin Console, go to Directory > Directory Integrations > Active Directory.
- Select the Import tab.
- Click Clear Unconfirmed Users.
NOTE: This action removes all unconfirmed users from the import list. - Perform a full import.
- Match the user.
