In some cases, users may fail to assign/provision to the Okta Access Requests application with the following error message:

Automatic provisioning of user <user> to app Okta Access Requests failed: Error while creating user Conflict. Errors reported by remote server: There is already an active user in this org with this Okta User ID.

• Okta Identity Governance
• Okta Access Requests Application

This usually happens when an account is reactivated (re-added to the Access Requests application) with a different username/email than originally provisioned, and the user did not properly deprovision originally. The account on the Access Requests side still has the old email, but cannot establish a match; therefore, it attempts to create a new profile.

If the admin knows the old username/email (possibly different email domain, name change, or email format change), they can follow the steps below to force an update on the Okta Access Requests app and get the user provisioned and re-synced:

1. Navigate to Directory > People and select the profile of the affected admin.

2. Click on the Applications tab and locate the Access Requests app.

3. Edit the application assignment (click the pencil icon or Edit).

4. Change the Username and Email fields to the old value (the one that should currently be matching the Access Request side).

5. Click Save.

6. Confirm that the user's "push" to the Access Request app completes successfully without errors.

7. Once the push is successful, return to the application assignment settings for that user.

8. Revert the username and email mapping back to the defaults (ensure it reflects the new email/username).

9. Click Save to finalize the configuration.