<iframe src="https://www.googletagmanager.com/ns.html?id=GTM-M74D8PB" height="0" width="0" style="display:none;visibility:hidden">
Loading
Skip to NavigationSkip to Main Content
0D50Z00008C3jVQSAZOkta Classic EngineLifecycle ManagementAnswered2025-06-14T13:45:02.000Z2016-05-31T19:56:59.000Z2017-06-19T16:55:37.000Z
  • This is odd. This should never be the case. Email update is just like any other attribute change.  But system logs should say what triggered this. You should probably work with Okta support.
  • Parth Swadas (Customer)

    Email ID update should never deactivate user in OKTA.

     

    But if there are any changes related to user OU in AD, it might cause deactivation if the OU is not imported in OKTA.

     

    /Parth
  • wjt35 (wjt35)

    We found the use of the Email Address to be a HIGHLY unreliable matching and mapping mechanism (and to be honest, I'm a little frustrated by OKTA's continued requirement for it).

     

    I'm thinking you might be mapping the AD mail attribute to the OKTA userid.  In our environment, everyone has an UPN, but only some have email.  If they have both, they are always the same.  

     

    We have taken to using the UPN of the user as the UserID in OKTA, and if there is no email, we map the UPN to their okta Email as well.  The way we did it is mapping the following from the AD user to the Email attribute in OKTA:

     

    appuser.email != null ? String.toLowerCase(appuser.email) : String.toLowerCase(appuser.userName)

     

    That says "if the email is null, put the lowercasee "username" (aka UPN)

     

    HTH!

    Expand Post
This question is closed.
Loading
How to prevent user accounts being deactivated when their email is updated in AD