DarshanD.83150 (Customer) asked a question.
Issue with Okta Sending Deactivated Users in Group PUT Call to SCIM Server
We are encountering an issue with Okta's SCIM integration related to group synchronization. Here's the scenario:
- When a user is deactivated in Okta, it correctly sends a SCIM PUT request to our SCIM server with "active": false.
- Our SCIM implementation handles this by removing the user’s group memberships and deactivating their access.
- However, in subsequent PUT requests for group updates, Okta continues to include this deactivated (and effectively deleted) user in the group membership list.
- Since the user ID no longer exists in our system (as it was removed on deactivation), our SCIM service returns a 400 Bad Request, causing the group sync to fail.
Question:
Is this the expected behavior from Okta—to continue sending deactivated users in group membership during group PUT calls? If so, how should SCIM services handle such cases where the user referenced in the group no longer exists in the system? Is there a recommended approach to prevent group sync failures in this scenario?
Thanks
Hi @DarshanD.83150 (Customer) , Thank you for reaching out to the Okta Community!
Something similar was discussed in an older post.
I would recommend checking with our colleagues on the dedicated Okta Developer Forum via devforum.okta.com to discuss the behaviour and confirm bug vs configuration issue/limitation scenarios. Custom SCIM deployment would be more their purview.
Regards.
--
Help others in the community by liking or hitting Select as Best if this response helped you.
Collect them all. Learn a new skill and earn a new Okta Learning badge.
This month's AMA topic: Okta Device Access. Ask away today.
Hi @Mihai N. (Okta, Inc.) As suggested, I have logged the ticket on the dev forum, and it's been 2 days now without any reply. Could you please suggest what can be done now?
Here is the devforum ticket for reference - Issue with Okta Sending Deactivated Users in Group PUT Call to SCIM Server - Questions / SCIM - Okta Developer Community