Updating an Okta AppUser Username Manually Creates a New AppUser Assignment
Last Updated:
Overview
Manually changing an AppUser username may cause Okta to remove the AppUser and assign a new one with the updated username. If the application has provisioning enabled and the Deactivate Users feature enabled, Okta deactivates the old account. This creates a new user in the downstream application instead of updating the original user profile. To resolve this, administrators must update the Application Username format using an Okta Expression Language (OEL) expression and reassign the user to trigger a provisioning update.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Provisioning
- Application Assignments
Cause
In some cases for security reasons, manually changing the AppUser username directly on the assignment triggers a removal and reassignment action in Okta by design. When an application has provisioning enabled, this action creates a new user in the downstream application rather than updating the existing user profile.
Okta Admins can identify this manual change in the System Log by searching for the application.user_membership.change_username event. The actor logged in this event indicates which administrator account authorized the change. In contrast, when Okta updates the username automatically or updates other attributes, Okta generates the application.user_membership.update event. This system update event does not result in the removal and reassignment of the AppUser.
Solution
How is an AppUser username updated without creating a new AppUser assignment?
Update the application username format using an Okta Expression Language (OEL) expression, reassign the user to trigger the provisioning update, and revert the format to its original state by following the instructions below. This example assumes the default Application username format starts as Okta Username.
- Navigate to the Sign On tab of the application.
- Update the Application username format using an OEL expression that checks for the specific user and applies the exception, leaving all other users unaffected. Use the following example expression, replacing the placeholders with the appropriate values:
NOTE: Changing the application username format alone does not trigger an update for existing users. Administrators must select the Update Now button to apply the update to existing users.
- To avoid running the update task for all users, remove the application assignment for the specific user, then reassign the application to that user. This triggers Okta to check for the existing user by the original application username and enables provisioning to pick up the original external ID.
- Once Okta successfully provisions the user, revert the Application username format back to Okta Username.
- Select Update Now to apply the reverted format to the newly assigned user.
