lr6h2 (lr6h2) asked a question.
The user status does not change after the password expires
Hello,
I have an issue with the user's account status after the password has expired.The password should expire after 7 days and I added an automation to prompt the user by email when the password expires . The user does receive the email but the status is always ACTIVE and never changes to PASSWORD EXPIRED.
By downloading the PASSWORD HEALTH, the status is also active.
Users are managed directly in Okta.
Thank you in advance for your help.
BR,
L.D
I noticed similar behavior earlier today. The Okta-mastered service account that I use to install our AD agents showed a status of Active, yet when I attempted to sign in using that account, it failed. Only then did the status of that account change to password expired - which was correct since we have a 90-day expiration policy and the last time I used that account was on Sept 1. It would seem that password expiration is only calculated/detected during login, therefore the account status change to password expired will only occur at the first login attempt after the password has already expired.
And that kinda makes sense. There is no password expiration date stored in the account. It is only during login that the password policy is evaluated, the expiration date is calculated and only then does Okta decide if that account's password is expired.