Okta Privileged Access and Advanced Server Access Username Fails to Update After Reprovisioning

An Okta Privileged Access (OPA) or Advanced Server Access (ASA) username update failure occurs because the username attribute is immutable in the backend database. Deprovisioning the user, contacting Okta Support for a backend deletion, and reprovisioning the user resolves the issue. When an administrator updates the username mapping configuration in Okta, newly provisioned users receive the correct naming convention. However, previously provisioned users retain their original usernames, even after deprovisioning and reprovisioning the accounts.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Privileged Access (OPA)
• Advanced Server Access (ASA)

This issue occurs because the username attribute is immutable. While Okta allows updates to other profile attributes, such as unixUserName and windowsUserName, the primary username remains unchanged. When an administrator deprovisions a user from OPA or ASA, Okta marks the user as deleted in the backend database. When reprovisioning the user, Okta reactivates the same user profile from the backend database and retains the original username.

How is the username updated for previously provisioned users?

Deprovision the user, open a case with Okta Support to request a backend deletion, and reprovision the user with the new username mapping by completing these steps.

1. Deprovision the user from OPA or ASA so the Okta user is no longer assigned to the application, and the user displays as Deleted in the OPA or ASA dashboard.
2. Open a case with Okta Support to request an OPA or ASA user deletion. Provide a screenshot showing the user in a Deleted status in the OPA or ASA dashboard, the name of the relevant OPA or ASA team, and the associated Okta tenant URL.
3. Wait for Okta Support and Okta Engineering to complete the backend user deletion.
   •  NOTE: The user remains unable to access OPA or ASA during this time.
4. Reprovision the user to OPA or ASA with the desired username mapping once the deletion is complete.