gedgmond (Habitat for Humanity International) asked a question.
Account unlock propagation
When a user gets locked, I see the lock get propagated into Okta. However, when our external end user support organization unlocks them, I do not see this unlock propagate into Okta, where they remain locked. Is there a setting for this? Also, I have Okta-mastered people who lock themselves by saving (wrong) passwords in their phones. What is the process to enable them to self service (assuming they have a secondary email and secret question)?
Geoff,
What you're seeing with account unlocking is expected behavior. There is a setting on your Okta password policies for these AD users which would unlock them in both Okta and AD when you unlock the account via Okta.
To enable self service, go to your Okta Admin portal > Security > Authentication > select the appropriate password policy for the users in question > and configure the options found in the ACCOUNT RECOVERY section according to your organization's needs.
BJ Lillo
Senior Technical Support Engineer
Okta Global Customer Care