Okta Active Directory Imported Users Remain Unconfirmed with Auto-Confirm Exact Matches Enabled
Last Updated:
Overview
When an administrator configures the Active Directory (AD) integration with the auto-confirm exact matches setting enabled, imported users may remain unconfirmed because this setting applies only to existing Okta accounts. The import row displays a NO Okta user matches found message and a NEW Okta user card, indicating that Okta must create a new profile from the AD record. Enable the auto-confirm new users setting to automatically confirm new AD imports.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Active Directory (AD) Integration
- Directory Integrations
Cause
Okta sorts each imported user into one of three outcomes, and each outcome has a specific auto-confirm setting.
| Match Result | Meaning | Auto-Confirm Setting |
|---|---|---|
| Exact | An existing Okta account matches on the selected rule. | Auto-confirm exact matches |
| Partial | An existing Okta account matches on the first and last name only. | Auto-confirm partial matches |
| No match | Okta finds no existing account and creates a new user. | Auto-confirm new users or Auto-activate new users |
Okta classifies the imported user as a No match when no Okta account exists for the user. The auto-confirm exact matches setting never applies to this scenario. The auto-confirm feature functions correctly, but the setting that covers new users remains disabled.
Solution
Verify the user account status in the directory.
Search the directory to confirm that no Okta account exists for the imported user.
- Navigate to Directory, and then select People in the Admin Console.
- Search for the email or username of the user.
- Confirm that no Okta account exists.
NOTE: If an account exists but the row displays a NO match message, compare the primary email of the account character by character with the imported email. Check for aliases, a different domain, a secondary-only email, or a deactivated user.
What steps are required to configure the auto-confirm settings for new users?
Update the provisioning settings in the Active Directory integration to automatically confirm or activate new users.
- Navigate to Directory, and then select Directory Integrations.
- Select the Active Directory integration.
- Select the Provisioning tab, and then select To Okta.
- Scroll to the User Creation & Matching section, and then select Edit.
- Choose Auto-confirm new users to create the Okta account and link it to the AD user without administrator review, or choose Auto-activate new users to create, link, and activate the account.
- Select Save.
- Run a manual import.
What considerations apply before enabling the auto-confirm options?
Review the activation email and username format settings before enabling the auto-confirm options.
- Activation emails: The auto-activate setting sends activation emails to users. Use the Activation emails setting under the General section of the To Okta tab to prevent this behavior. Okta recommends suppressing activation emails during the initial AD setup.
- Okta username format: Review the Okta username format under the General section of the To Okta tab. Okta generates the new username from this format, which may differ from the AD username. Okta advises matching the format used for earlier imports to prevent errors for existing users.
- Multiple attributes: Exact-match criteria that use multiple attributes require every selected attribute to match.
- Scheduled imports: The auto-confirm exact matches setting does not apply on later scheduled imports because Okta does not re-evaluate matching conditions. Run a manual import if users with existing Okta accounts remain unconfirmed.
- CSV imports: The auto-confirm feature does not apply to Comma-Separated Values (CSV) imported user lists.
Related References
- Configure Active Directory import and account settings
- Okta Scheduled Imports Fail to Auto-Confirm Exact User Matches
- Okta Partial Match Settings Fail to Auto-Confirm New Active Directory Users
