We've recently moved from the old/free Okta Connect to a "real" Okta account with Identity Engine and I had what hopefully isn't a terribly stupid question.

Right now, we use AD as our source of truth for usernames/passwords and email addresses.

If possible, I would like to engage the password sync functionality to accomplish the following:

1> Sync AD passwords to Okta so they are available if agents are not.

2> Sync the password (now in Okta) to Google, for the same reason (allowing login if Okta unavailable)

2> Allow users to change password in Okta, sync the change to both Google and AD

Right now I don't need to create users but just synx the passwords. In the configuration for both AD and Google in the admin interface says something along the lines of "Creates a [integration] password for each assigned user and pushes it to [integration]"

The AD Password Sync utility seems to indicate that it will sync the password to Okta and then to any apps, but before I break anything I think I wanted some assurance that if I run AD Password Sync on my AD server that the existing AD passwords will be assigned to Okta users and pushed to Google rather than Okta pushing a password it creates on it's own?

Apologies if this isn't a clear question, I'm still coming up to speed on Identity Engine stuff.

Thanks