Rocky (Customer) asked a question.
Expired Active Directory accounts are still active in Okta
Hey Okta Community,
We are using Active Directory as a master. When we manually disable an AD account, the Okta AD sync tool kicks in and that Okta user account is disabled as expected. Downstream apps are deprovisioned and access is revoked. However, when an AD account expires on a date specified in the user's AD properties, the Okta account remains active and the user can still log in and access all downstream apps.An AD import does not help. We have several contractors and we need to confirm that their Okta access is revoked on the same date that their AD accounts expire. Is there way to let Okta know that Disabled Accounts = Expired Accounts? Thanks in advance,
ditto - could we get a definitve answer as to how Okta handles "expired active directory accounts"? can't find much on it in the help center...
for reference: https://docs.microsoft.com/en-us/windows/desktop/adschema/a-accountexpires
+1
+1
I don't think this is so much a missing feature as it is an expected feature. For my organization, we use account expiration as a "hold" on accounts for contingent workers. So, managers aren't perfect at telling us when contingent workers come and go so we set a max three month period for account expiration. This way, we have a fail-safe to remove their ability to use resources until the manager reconfirms their employment. If they are still working for us, we update the expiration and they didn't lose anything as their Okta account remains intact (including Okta Verify, secret questions and answers...). If they aren't working for us any longer, we've effectively cut off their access and then we can follow up with the managers and complete the paperwork needed then complete the AD account disable and Okta cleanup.
What I'd like to see though is potentially the reverse for the account expiration ownership. Setting an expiration in Okta which suspends the Okta account and disables the AD account or other connected directory services. But giving the ability to renew or extend.
-David