<iframe src="https://www.googletagmanager.com/ns.html?id=GTM-M74D8PB" height="0" width="0" style="display:none;visibility:hidden">
Loading
Skip to NavigationSkip to Main Content
System Status
Announcements
Announcements
Search
Search
Select Language
Knowledge Base
Knowledge Articles
Support Videos ↗
Documentation
Product Documentation ↗
Developer Documentation ↗
Product Release Notes ↗
Community
Events & Webinars
Okta Ideas ↗
Resources
Product Hub
Customer Success Hub
Product Release Update
Learning
Okta Learning ↗
Get Support
Open a Case
HomeCommunityForum
0D54z00008dHSadCAGOkta Identity EngineWorkflowsAnswered2023-09-01T18:12:22.000Z2023-01-06T19:34:09.000Z2023-01-10T21:55:30.000Z

CodyP.43892 (Customer) asked a question.

January 6, 2023 at 7:34 PM
Updating deprovisioned accounts

I am using Okta workflows to update a custom attribute across all Okta accounts in my org. I am running into an issue where I have specifically targeted deprovisioned accounts (for both former users and retired service accounts) to have this attribute updated, as these accounts were being skipped over in the flow's first iteration.

 

I am using If/Else logic to separate Active and Deprovisioned accounts by specifically defining the Status == DEPROVISIONED as the 'If' logic. The flow updates active accounts as expected, but is receiving a 404 error for the deprovisioned accounts.

 

So far, I've been unable to find mention online of updating deprovisioned accounts. Has anyone discovered a workaround for this?

  • 2 answers
  • 1.02K views

  • flaviu.vrinceanu1.5628408972654734E12 (Customer Success Service Delivery)

    Hi @CodyP.43892 (Customer)​,

     

    Thank you for posting on the Okta community page!

     

    I have done some research and unfortunately, the functionality to update a custom attribute for accounts that are in a DEPROVISONED state is not currently supported. A way in which you could update those accounts, would be by re-activating them in order to perform the update and then to deactivate the users.

     

    ------------------------------------------------------------------------------------------------------------------------------------------------

    Community members help others by clicking Like or Select as Best on responses. Try it today.

    Expand Post
    Selected as Best

  • flaviu.vrinceanu1.5628408972654734E12 (Customer Success Service Delivery)

    Hi @CodyP.43892 (Customer)​,

     

    Thank you for posting on the Okta community page!

     

    I have done some research and unfortunately, the functionality to update a custom attribute for accounts that are in a DEPROVISONED state is not currently supported. A way in which you could update those accounts, would be by re-activating them in order to perform the update and then to deactivate the users.

     

    ------------------------------------------------------------------------------------------------------------------------------------------------

    Community members help others by clicking Like or Select as Best on responses. Try it today.

    Expand Post
    Selected as Best

  • DonF.81354 (Customer)

    Unfortunately, this has been a struggle of mine as well, but it has been confirmed to me several times over by support that you cannot write to a deactivated Okta account.

     

    The only workaround that I am aware of (and it is not ideal) would be to temporarily activate said account, update the attribute in question, and then deactivate the account again. While this would be rather easy to do with a workflow (or API), it may not be acceptable depending on your security requirements.

     

    Another option, again not ideal, is that you can modify the attributes of accounts that are suspended. While not going to work in every case, my own org has found use in this capability.

     

    I do hope this helps. Thanks!

    Expand Post
This question is closed.
Loading
Updating deprovisioned accounts