2o03e (2o03e) asked a question.
Sync passwords from OKTA to AD
Hi team,
I am trying to Sync accounts from OKTA to a new Active Directory domain for legacy application support however the accounts in AD are all flagged as “User must change password at next logon”
I have followed the below documentation with describes this scenario, however does not contain a fix other than “the user must first log onto Okta in order for the password to be pushed from Okta to AD”, which I have tried.
https://help.okta.com/en/prod/Content/Topics/Directory/Security_Using_Sync_Password.htm
did you disable the change flag and try it?
Yes, first thing i tried, but no dice unfortunately
Found the issue, Directory > Directory Integrations > Active Directory > Provisioning. > To App, click Edit, scroll to the Sync Password section and select Enable.
If an Okta user is pushed to AD after they have activated their Okta account, the AD user object is in a "User must change password at next logon" state until the Okta password is next reset.