<iframe src="https://www.googletagmanager.com/ns.html?id=GTM-M74D8PB" height="0" width="0" style="display:none;visibility:hidden">
Loading
Skip to NavigationSkip to Main Content
System Status
Announcements
Announcements
Search
Search
Select Language
Knowledge Base
Knowledge Articles
Support Videos ↗
Documentation
Product Documentation ↗
Developer Documentation ↗
Product Release Notes ↗
Community
Events & Webinars
Okta Ideas ↗
Resources
Product Hub
Customer Success Hub
Product Release Update
Learning
Okta Learning ↗
Get Support
Open a Case
HomeCommunityForum
0D54z00009IKo1SCATOkta Classic EngineLifecycle ManagementAnswered2023-06-09T17:03:23.000Z2023-06-05T22:30:15.000Z2023-06-09T17:03:23.000Z

AbhishekS.61996 (H1 Insights) asked a question.

June 5, 2023 at 10:30 PM
Users in "Pending user action" status in the target org after the users were assigned to the Org2Org app in the connected org

Hi all,

I'm trying to import users with their existing passwords from a connected org (Spoke) to a destination org (Hub) using Org2Org functionality. The org2org app is installed in the connected org and the "Sync Okta Password" is checked.

When I assigned existing users in the connected org to this Org2Org app, I had expected that the users will be seamlessly able to sign in to the target app. But these users are appearing in "Pending user action" status instead and are unable to login to the target app using the connected org passwords.

Is this not the expected flow when Org2Org app is used to import users from one org to another? Do I need to send the users an activation link to their email again? It will confuse the users why they are being asked to sign in again.

  • 3 answers
  • 772 views

  • User16594883467582706479 (Customer Support Online Experience)

    Hi, @AbhishekS.61996 (H1 Insights)​ 

     

    Thank you for posting on our Community page!

     

    I did some research and found this article that might be of help:

    https://support.okta.com/help/s/article/what-do-the-org2org-initial-status-options-do?language=en_US

     

    Thank you for reaching out to our Community and have a great day!

    _____________________________________________________________________________

    Watch and Learn: New Okta how-to videos, plus what's new this month in the May newsletter.

    _____________________________________________________________________________

    Community members help others by clicking Like or Select as Best on responses. Try it today.

    _____________________________________________________________________________

    Expand Post
    Selected as Best

  • User16594883467582706479 (Customer Support Online Experience)

    Hi, @AbhishekS.61996 (H1 Insights)​ 

     

    Thank you for posting on our Community page!

     

    I did some research and found this article that might be of help:

    https://support.okta.com/help/s/article/what-do-the-org2org-initial-status-options-do?language=en_US

     

    Thank you for reaching out to our Community and have a great day!

    _____________________________________________________________________________

    Watch and Learn: New Okta how-to videos, plus what's new this month in the May newsletter.

    _____________________________________________________________________________

    Community members help others by clicking Like or Select as Best on responses. Try it today.

    _____________________________________________________________________________

    Expand Post
    Selected as Best

  • NiallM.34104 (Atlas Identity)

    The usual setup for a Hub/Spoke is that the Spoke users never log into the Hub with a password. A routing rule is setup to always redirect a Spoke user to the Spoke to authenticate before routing back to the Hub as an authenticated user. No password to deal with in the Hub.

  • AbhishekS.61996 (H1 Insights)

    I see. Totally makes sense in the general scenario.

    My use case is a bit convoluted. We are migrating our users from an Okta preview instance to an Okta prod instance. We do not want them to sign up again. I see that Org2Org application is the only option here. The preview instance, which has all our users, becomes the Spoke, and the empty prod instance becomes the hub. I installed the Org2Org app in the spoke, assigned all users to this app, and was able to migrate all users to the hub (my prod instance). I set it up so they won't get any activation emails or security questions. This way, users won't know anything, and it's seamless for them.

    Now that we have migrated our users to prod, we inactivated the Org2Org app. Wish there was a more straightforward way of migrating users from one org to another org.

     

    Expand Post
This question is closed.
Loading
Users in "Pending user action" status in the target org after the users were assigned to the Org2Org app in the connected org