Okta Org2Org Attribute Fails to Populate From Source to Target Tenant

An Okta Org2Org attribute fails to populate from a source tenant (Spoke) to a target tenant (Hub). This issue occurs due to incorrect Org2Org provisioning configurations, attribute sourcing priorities, or stuck tasks. Resolving this issue requires verifying the provisioning settings, checking the attribute mapping configurations, and clearing any stuck tasks in the Okta Admin Console.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Org2Org
• Provisioning

The issue occurs due to incorrect Org2Org provisioning configurations, attribute sourcing priorities, data constraints, or stuck provisioning tasks.

1. Check "Update User Attributes" in the Hub

Verify the Org2Org application configuration allows updates to existing users in the Spoke tenant by navigating to the application provisioning settings and enabling the update feature.

1. Go to Applications > Applications and select the Org2Org application.
2. Navigate to the Provisioning tab and select To App.
3. Select the Update User Attributes checkbox to enable the feature.

NOTE: If this setting remains disabled, Okta only pushes attributes when the user is newly created.

2. Check Attribute Mastering in the Spoke

Ensure the Hub tenant allows the Spoke tenant to update the attribute by checking the profile source priority in the Profile Editor.

1. In the Hub tenant, navigate to Directory > Profile Editor.
2. Select User (Okta).
3. Locate the affected attribute and select the Information icon.
4. Ensure the Source priority allows the Spoke (Org2Org) to make changes to the field. If another application has a higher priority for these specific users, Okta ignores the push from the Spoke.

3. Use the Mapping "Preview" Tool

Determine if the Spoke tenant attempts to send the data by using the mapping preview tool in the Org2Org application.

1. In the Spoke tenant, navigate to the Org2Org application.
2. Go to the Provisioning tab and select To App.
3. Scroll to the bottom of the page and select Go to Profile Editor.
4. Select Mappings and choose the Spoke to Hub direction.
5. Use the Preview search at the bottom of the screen to look up an affected user.
6. If the attribute field contains no data, the Spoke tenant does not see the data. Check the Spoke user profile.
7. If the attribute field contains a value, the Spoke tenant recognizes the value but fails to push it, indicating a synchronization state issue.

4. Check for "Stuck" Tasks

Clear any blocked provisioning updates by checking the Tasks dashboard for errors and retrying the failed tasks.

1. In the Spoke tenant, navigate to Dashboard > Tasks.
2. Look for any provisioning errors related to the affected users.
3. Select the affected tasks and choose Retry Selected to clear the blockage.

5. Data Constraints

Ensure the attribute values in the Spoke tenant match the exact formatting accepted by the Hub tenant by checking for data constraints.

1. Check if the Hub tenant enforces any data constraints on the attribute, such as a dropdown menu list or character limits.
2. Verify the affected users in the Spoke tenant to ensure their attribute values match the exact formatting accepted by the Hub tenant.

6. Verify the mapping is set to 'Apply on Create and Update'

Configure the attribute mapping in the Hub tenant to update existing profiles by adjusting the mapping settings in the Profile Editor.

1. Log in to the Okta Admin Console of the Spoke tenant.
2. Navigate to Directory > Profile Editor.
3. Locate the Org2Org application in the list and select Mappings.
4. Select the tab that routes from Spoke to Tenant.
5. Scroll down the list to find the mapping for the affected attribute.
6. Select the directional arrow icon in the middle column between the Spoke attribute and the Hub attribute.
7. Select the radio button for Apply mapping on user create and update.
8. Select Save Mappings at the bottom of the page.
9. If Okta displays a banner to apply updates, select Apply updates now to push the change to existing users.

7. Forced Re-Sync (The "Nudge")

Force Okta to re-evaluate the user and trigger a synchronization by editing the user profile or using the force synchronization utility.

• Option A: In the Spoke tenant, navigate to the user profile within the Org2Org application assignment. Select Edit, modify a non-essential field, and save the changes to trigger the synchronization.
• Option B: In the Spoke tenant, navigate to Applications > Applications and select the Org2Org application. Go to the Provisioning tab, select To App, and trigger a forced synchronization by selecting Force Sync.

8. Check System Logs

Search the System Log in both the Hub and Spoke tenants to identify any underlying errors preventing the attribute update.

1. Navigate to Reports > System Log.
2. Search for the affected user or the Org2Org application.
3. Review the log events for any provisioning failures or attribute mapping errors.