Unable to Move Active Directory Users Between OUs Using Directory Linked Okta Groups

Granting the correct permissions to the Okta Active Directory (AD) Agent service account resolves an issue where Okta fails to move a user between Organizational Units (OUs) due to insufficient privileges.

When a user belongs to multiple directory-linked groups, the priority of the group in the Assignment tab dictates the OU where Okta creates the user. When a user loses membership in a higher-priority group, Okta attempts to remove the user from the connected OU and create them in the OU connected to the current highest-priority group.

If the Okta AD Agent service account lacks sufficient permissions, Okta fails to move the user and generates an error.

Access is denied

An access denied error displays on the user profile when the Okta AD Agent service account lacks sufficient permissions to move the user.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Provisioning Groups
• Active Directory (AD)

The Access is denied error occurs because the Okta AD Agent service account lacks sufficient privileges to move the user between OUs.

What permissions does the Okta Active Directory Agent require to move users between OUs?

The Okta Active Directory (AD) Agent requires specific permissions to provision and delete users in the target Organizational Unit (OU).

Provision User

Grant the Okta AD Agent service account the following permissions to provision users in the target OU.

• Create Child permission for user objects on the target OU.
• Reset Password control access right for user objects within the target OU.
• Write property permissions on user objects within the target OU for the following attributes:
  • mail
  • userPrincipalName
  • sAMAccountName
  • givenName
  • sn
  • userAccountControl
  • pwdLastSet
  • lockoutTime
  • cn
  • name
• Write property permissions on user objects within the target OU for all other attributes mapped on the AD user profile in Okta.

Delete User

Grant the Okta AD Agent service account the following permissions to delete users in the target OU.

• Delete child permissions for user objects on the target OU.