Okta App Sign-On Policies Cannot Be Deleted Due to Incorrect Application Count Following OIE Migration

An administrator cannot delete unused App Sign-On policies within the Okta Admin Console. The user interface displays an application count greater than zero, but the Applications tab under the policy is entirely empty. Because Okta detects a non-zero count, the Delete action remains disabled. Orphaned application mappings remaining from an Okta Classic Engine to Okta Identity Engine (OIE) migration prevent the deletion of unused App Sign-On policies. Verify the application mapping and delete the policy via the Okta Application Programming Interface (API).

• Okta Identity Engine (OIE)
• App Sign-On Policies
• Okta API

A confirmed user interface bug caused by legacy database inconsistencies during a Classic-to-OIE migration causes this behavior. Legacy, deleted, or system-level applications (specifically impacting the Okta Help Center and CSV Directory components) link to the policy metadata at the database level, creating a superficial display discrepancy. The applications themselves no longer exist in the tenant.

How is the true application mapping verified via the Okta API?

Verify that no active production applications utilize the policy by checking the application targets via the Okta API.

1. Using Postman or curl, run the following GET request:

GET https://<OktaDomain>/api/v1/policies/<policyId>/app

2. Inspect the JSON response payload.
3. Confirm that the API returns a completely empty array ([]), which indicates that no active applications utilize this policy, and it is safe to proceed with deletion.

NOTE: If the API returns active application objects, re-assign those applications to a different policy before proceeding.

How is the policy deleted via the Okta API?

Remove the policy programmatically to bypass the disabled user interface button.

1. Send the following DELETE request using an administrator account with Super Admin privileges:

DELETE https://<yourOktaDomain>/api/v1/policies/<policyId>

2. Verify a successful 204 No Content response code, confirming Okta successfully deleted the policy.