Okta Not Deactivating Users Disabled in Active Directory when Skip Users During Import is Enabled

This article explains why an Okta user whose Active Directory (AD) account is disabled will not be deactivated in Okta after an import when Do not import users is selected in the directory's Provisioning settings.

• Directories
• Active Directory (AD)
• Imports
• Profile Refresh

When the directory settings' option Skip users during import is selected, Okta will not scan any user objects during import.

• Just-in-Time (JIT) provisioning is responsible for creating, updating, and removing users.
• JIT provisioning creates users when they log into Okta with their AD credentials for the first time and updates the user profile each time the user logs into Okta.
• JIT will also sync the profile with AD when an Okta Admin views the user's Profile page in the Okta Admin Dashboard.

When Skip users during import is selected, it is possible to deactivate an Okta user with a disabled AD account only via JIT profile refresh or via an API call.

• After the AD object is disabled, viewing the user's profile in the Okta Admin Dashboard will deactivate the Okta user if the setting for When a user is deactivated in the app is set to Deactivate in the AD To Okta provisioning settings of the directory.
• To deactivate a user via API, see the Okta Developer Deactivate User documentation.