(Admin) GrantH.50375 (Customer) asked a question.
Deactivate Okta account when Azure Account is blocked
We are testing using Azure AD as an IdP with Okta. Auth and JIT are both working as expected. We have a requirement that any Okta accounts linked or provisioned via AAD are automatically deactivated in Okta when the account is blocked/disabled in AAD. The standard AAD IdP service in Okta doesn't support this.
I suspect it might be possible to achieve this using a runbook in Azure along the lines of the following:
If AAD user account is a member of group X and the account is blocked
Then deactivate the corresponding account in Okta via an Okta API call
Just wondering if anyone has done something similar to this or has any advice on other potential options?
Hello Grant
Usually this is not achievable out of the box if an O365 application is not used.
If you wish you could open a ticket with Okta Support to discuss the possibility of implementing this via Professional Services. A scoping call will be arranged and a confirmation on the above provided by PS who are better suited to answer this question.
Many Thanks,
Dan
Thanks Dan.
We're investigating a potential option of using an Azure Function App in conjuntion with EventHub to listen for AAD Audit events Block/Un-block which will trigger an API call to Okta to either Deactivate or Re-activate an associated account. In theory it should work but will see how we go in a test environment