v0xxc (v0xxc) asked a question.
Okta sets AD lastLogonTimestamp even without login of the user
Hello all,
I've just read that Okta sets the lastLogonTimestamp into AD when an AD mastered user logs into Okta. Makes sense.
I got reported almost 100 users which I should deactivate in AD as they're blue collar workers without PC access (reported with PC access from our Talentsoft HR). Just to be sure I counterchecked the lastLogonTimestamp of a handful users. All the times were in the night around from 1 to 3 AM. All 100 have logonCount = 0.
They neither know their login username nor password as I created them beforehand so Okta knows about their reserved username for Yammer (our usernames are name based). If the lastLogonTimestamp would be somewhat reasonable spread throughout working times, could be somewhat explainable.
Is there any known Okta mechanism that sets the lastLogonTimestamp even when no user really logs in? Bug or feature?
Kind regards
Dominik
Hi Dominik,
In the Okta Admin console, go to Directory > Directory Integrations > Active Directory. What do you have for Schedule Import? Do you have JIT Provisioning enabled?
We do an incremental import every hour. JIT is active.
I don't know if thats relevant, but we have two domains and Okta HR tenant filled by Talentsoft. In profile master: 1st is older and smaller domain, 2nd newer / larger domain and 3rd Okta HR tenant