Okta Administrators Can Modify Read-Only Custom Attributes
Last Updated:
Overview
This article clarifies why Okta admins can modify read-only custom attributes, including modifying them through Okta API calls.
Applies To
- Universal Directory
- Lifecycle Management
- Custom Attribute
- Administrator Roles and Permissions
- Okta API Call
- Okta Classic Engine
- Okta Identity Engine (OIE)
Solution
Read-only custom attributes can be modified by Okta Admins who have the appropriate user management permissions. This is also doable via API as long as the API token associated can perform Okta user management functions. The API token will inherit the permissions of the Admin who creates it.
The Read Only functionality is intended specifically for what Okta End Users see in their profile in the Okta End-User Dashboard. The Read Only custom attribute is viewable in the Okta End-User Dashboard > Settings > click Edit beside Personal Information.
NOTE: Please ensure that the appropriate Administrator role is assigned to adhere to Principles of Least Privilege. This will help avoid mistakes being performed by Admins and will help improve overall Okta security.
