Hello,

We recently created the provisioning integration between our HRIS system and Okta, we have been AD-mastered until now, but want to now take advantage of this new integration and become Okta mastered. We have a few questions that we have posted over to support but haven't gotten any luck yet on a response.

Hoping the communitiy can help us out and guide us in the right direction, here are our questions:

• Can we keep delegated authentication for users that were created in Okta from our HIRS system integration, these are Okta mastered users with their profile source by our HIRS system, the next step will be for the users to be created in AD but we wouldn't like to cutover and enforce all our users to set up passwords in Okta at once. So we are hoping we can keep delegated authentication on, is this doable?
• ObjectGUID and DN are required attributes so that Okta can create the users in AD. How can we map this information and how do we determine the correct user OU where the user should land? The mapping doesn't have any of this information.
• We have the manager's employee number from our HIRS system, can we do some kind of lookup of the managers UPN using the employee ID? couldn't find any lookup functions within the expression language dictionary.

Any assistance with the above will be greately appreciated, we've gone over tons of documentation while waiting to hear from support but still no success.

Regards,

Luis Chavez Saenz

Sr. Infrastructure Engineer