User16038803406511591887 (Customer) asked a question.
AD Accounts Out of Sync
We have AD integrated as a master for Okta, there is a 3rd party tool that runs on our on-premise servers that identifies accounts that have been inactive for 90 days, when it does so it does not move the object to a different ou or remove any groups. (not sure if that will be relevant)
at first we would see an account that was reactivated become out of sync in okta, the password in AD would not work and groups would not be updated within the Okta console. we would then delete the account in okta and re-sync to re-import the ad account then go about our day.
now we are seeing objects show in our dashboard as 'Application assignments need additional information' and these are okta accounts that are still active though they do not have all the groups they should have. and when you check AD you find that the AD account is disabled. Doing an incremental import does not update these objects to reflect they are disabled but it does advise us that there are x number of existing objects 'unchanged'
Thankfully the apps these accounts that should be disabled do not have access to anything sensitive but the fact that they can still utilize their accounts at all is disturbing to say the least.
Hi @User16038803406511591887 (Customer) , Thank you for reaching out to the Okta Community!
If you have multiple AD servers and multiple Okta AD agents running for redundancy, you need to ensure that replication across the servers is always up to date.
If that is ok, it might be that you are reliant on incremental/scheduled imports which is great for day-to-day operations but it is reliant on the uSNChanged attribute for the synced objects. So if that attribute does not change, the object (user or group) is not updated on the next incremental/scheduled import.
I recommend running a couple of full imports too see if it helps sync up things.
If that does not help, an in-depth investigation might be required.