test2t.42872 (Customer) asked a question.
suspense or deactivate user dynamically based on AD profile status
it was mentioned there's option to set 1, deactivate, 2 suspense, 3 do nothing on okta profile based on AD profile status. Is status attribute on AD is set to be the default attribute? Can it be customized? we have AD status set to disabled for disabled users as well as suspense users, i.e. user on temporary leave, is it possible to configure the system to determine okta status based on mulitple attribute on AD and assign status on Okta accordingly? If not, what would be the recommendation in automate this instead of manually manage the status on Okta?
Hi Muli,
Thank you for reaching out to Okta Support, my name is Stefan. The changes you are inquiring happens if you enable AD Profile Master and more details on this can be found on the article bellow :
https://help.okta.com/en/prod/Content/Topics/Directory/Directory_AD_Enable_Profile_Master.htm
On the setup page you only have those 3 option to choose what happens when an user is suspended/deactivated in your AD . Currently those 3 options are available .
The way okta identifies the status of an AD user is through an Import , and if the user shows as suspended/deactivated , Okta will follow the action you requested in the AD Setup within Okta.
If you feel more clarification would be needed ,please open a ticket with us and we will gladly answer any additional questions you may have.
Thank You,
Stefan Boca
Technical Support Engineer
Okta Global Customer Care