Remove User Accounts and Revoke Access in Okta ISPM User Management
Last Updated:
Overview
Former users or deprovisioned employees continue to appear under the Okta Identity Security Posture Management (ISPM) User Management settings during routine access reviews. This occurs because Okta ISPM syncs user records and permissions through group memberships managed in the primary Identity Provider (IdP). Administrators must remove the user from all designated ISPM-mapped groups in the primary IdP to revoke access and remove the user from the console.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Okta Identity Security Posture Management (ISPM)
- Identity Provider (IdP) Integrations
- User Access Reviews and Governance
Cause
Okta ISPM syncs user records and permissions through group memberships managed in the primary IdP. A user continues to appear in the ISPM User Management menu if they remain part of an IdP group mapped to Okta ISPM.
Solution
Okta ISPM Does Not Support Directly Deleting Individual User Accounts From Within the Console
Group memberships in the primary IdP strictly drive user access and permissions.
How do administrators revoke user access in Okta ISPM?
Revoke access to the console by logging in to the primary IdP and removing the user from all designated Okta ISPM-mapped groups.
- Log in to the primary IdP, such as Okta or Microsoft Entra ID.
- Remove the user from all designated Okta ISPM-mapped groups.
