Hi Andrew!

Per the following documentation:

https://help.okta.com/en/prod/Content/Topics/Apps/Provisioning_Deprovisioning_Overview.htm

There are multiple apps that support deprovisioning, from the app to Okta, such that if a user is removed or deactivated on the app side, then the user will get deactivated on the Okta side.

Please let me know if this information helps, or if you have any questions.

Thank you,

Brandon Wendorf

Technical Support Engineer

Thanks for your answer Brandon. I was not specific enough so just to clarify for future readers. It looks like Okta does not support auto deprovisioning with SCIM across IDPs. They do however support imports so in our situation our customer would deprovision the user in question, then run an import, which would hit our SCIM server. I also figured out that SCIM is the only way to get this sort of cross idp user integration.

Here is the example SCIM server I forked and setup with a provisioning agent and Docker for anyone interested in firing up a quick PoC https://github.com/quantumew/sample-node-scim-server

Hi Andrew - Trying to understand your concept from Implementation perspective:

Let's say,

I have Integrated Ping (IDP) with OKTA (SP) via SAML inbound fed, leveraging the JIT to create ping users on FLY in OKTA (SP) for app access.

Now,

What would be my next step(s) to ensure my SP in sync with IDP when Ping deactivate the users...

Thank you in advance.