An Okta Active Directory (AD) import fails when a group rule assigns users to the Okta Privileged Access (OPA) application because the imported user's email address matches an existing AD account in OPA. When running an import and confirming the user, the action fails with the following error messages.

One or more assignment actions could not be performed

Validation failed on assigning newly-created user to app:

Resolve this issue by changing the imported user's email address to a unique value.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Privileged Access (OPA)
• Active Directory (AD)
• Directories

AD accounts in the OPA application cannot share a username/email with assigned users. If a group rule assigns the users to the OPA application, this conflict occurs and causes the import to fail.

How is the import failure identified?

Capture the Okta Request ID value from the browser developer tools and provide this to Okta Support via a case.

1. Right-click on the screen before confirming the imported users and select Inspect to open the developer tools.
   
     
   
   
2. Select the Network tab at the top of the screen to view network requests.
   
     
   
   
3. Select Confirm to send the request and generate the error.
   
    
   
   
4. Copy the value for X-Okta-Request-Id. (An example value would be 4eaebc3f6417829fd575ee81d0b84549.)
5. Open a case with Okta Support and provide this ID in the case description.
   Since Okta does not actually import the user, there are no System Log events to provide.

How is the email conflict resolved?

Verify the email address conflict in the OPA application and change the imported user's email address to a unique value.

1. Navigate to the OPA application and go to Resource Administration > Integrations > <domain> Accounts.
2. Verify if the imported user's email address matches an existing account.
   In the example image below, the interface highlights this conflict in blue and denotes it as user@domain.com.
   
   
   
   NOTE: Searching the email in the search bar does not find the account email. Search these through AD/LDAP queries instead. In our example, Okta returns no results when searching user@domain.com.
   
    
   
   
3. Select the profile in OPA to view the attributes and verify that the pre-existing account has the same email address.
   In our example, the User Login account is the cause of the issue.
   
    
   
   
4. Observe that searching a regular user does not show a match.
   
    
   
   
5. Change the imported user's email address to a non-matching value to resolve the conflict with the imported AD accounts in OPA.