MatthewH.10249 (State of Iowa) asked a question.
We have an Org2Org app set up in our WFI tenant with provisioning to our CIAM tenant as we want WFI users in CIAM but don't want CIAM users in WFI. We have had this in place for some time now and things have been working well. We recently created Workflows in WFI to delete any deactivated users if they have been deactivated for 2 weeks or more. These Workflows are working fine but we noticed that when the accounts get permanently deleted from the WFI tenant they are not getting deleted from the CIAM tenant via the Org2Org provisioning as we had expected. In the provisioning section of the Org2Org app on the WFI tenant there is a "Deactivate Users" checkbox we have checked and while it does not say delete we made the assumption it would. I found the following documentation that talks about SCIM provisioning and how some apps may not delete so that must be the case for Org2Org apps.
https://help.okta.com/en/prod/Content/Topics/Provisioning/lcm/con-okta-prov.htm
"When an assignment is removed (deprovisioned) from a user in Okta, Okta does not delete the user’s account. The account is put into a deactivated state in the external application and the user's access to the app integration is removed from Okta. Some external applications may support deleting the user’s account in the external application."
So getting to my question, is there anything we can do with our Org2Org provisioning to get accounts to be automatically deleted from the CIAM tenant when deleted from the WFI tenant or will we need to create Workflows for both tenants?
Hi Matthew,
You are correct in that Okta will not automatically delete user's in the second org but will deactivate them. Deletion is not a supported feature : https://help.okta.com/en/prod/Content/Topics/Provisioning/org2org/org2org-supported-features.htm.
You could create a Workflow that deletes these deactivated users in your CIAM org. Using a connection to that org in your WFI org may be helpful here to delete the users: https://help.okta.com/wf/en-us/Content/Topics/Workflows/connector-reference/okta/overviews/authorization.htm.