Unable to Remove Users From Directory Linked Group Without Deactivating the Directory Profile in Okta
Last Updated:
Okta Classic Engine
Directories
Okta Identity Engine
Overview
Removing a user from a directory-linked Okta group deactivates their Active Directory (AD) or LDAP profile if the Deactivate Users setting is active. Clearing this setting in the provisioning configuration prevents the profile deactivation. Okta disables the user's AD or LDAP profile immediately after removing the user from the directory-linked Okta group.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Groups
- Active Directory Integration
- LDAP Integration
Cause
Okta disables the directory profile when removing the user from the group that granted the directory assignment because the user has a group assignment to the AD or LDAP integration through a directory-linked group and the Deactivate Users setting is active.
Solution
How is the directory profile deactivation prevented?
Navigate to the provisioning settings of the affected directory integration and clear the Deactivate Users setting.
- Go to Directory and select Directory Integrations.
- Choose the affected AD or LDAP integration.
- Navigate to the Provisioning tab and select To App.
- Clear the Deactivate Users setting.
