Okta Deactivates SCIM Users When an Administrator Updates the Username in the Application Profile
Last Updated:
Overview
When an administrator updates a username directly in a System for Cross-domain Identity Management (SCIM) application user profile, Okta deactivates the existing user and creates a new account. This reassignment flow occurs because the application lacks active password synchronization. Enable password synchronization for the SCIM application or update the username in Okta Universal Directory (UD) to allow in-place username updates.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- SCIM
- Provisioning
Cause
When a SCIM application lacks active password synchronization, Okta assumes it cannot safely update the username in place. As a result, Okta triggers a reassignment flow that deactivates the old user and creates a new user with the new username.
Solution
How does an administrator update the username without deactivating the user account?
Prevent the reassignment flow by updating the username directly in Okta UD or by enabling password synchronization for the application.
An administrator can update the username in Okta UD.
Update the username directly in the Okta user profile to trigger a standard update request to the SCIM application.
- Navigate to the Directory and choose People.
- Select the user.
- Select the Profile tab and choose Edit.
- Enter the new username and select Save.
An administrator can enable password synchronization for the application.
Enable password synchronization in the application provisioning settings to allow in-place username updates from the application profile.
- Navigate to Applications & Resources and select the SCIM application.
- Select the Provisioning tab.
- Choose To App in the left settings menu.
- Select Edit.
- Select the Enable checkbox for Sync Password.
- Select Save.
