nkt8m (nkt8m) asked a question.
Hello, I'm working on a project using Okta in tandem with Workday and Zendesk. Currently we have it that once in workday that a user is listed as deactivated / terminated / offboarding they immediately are removed from groups within Okta. We are currently using additional Bookmark apps to list people of their access within programs that while not directly using Okta we use as a way to monitor their access even if its not using SSO.
My specific inquiry is if there is a way that we are able to get a log of all of the applications groups a user is in before they are deprovisioned and able to acquire that list for someone to manually be able to deprovision the non Okta apps.
Currently, once someone is set to be deactivated they are automatically removed from all the apps and unable to monitor which ones they had access to.
You could write a workflow for this. However you would need a "trigger" for when this would occur that wouldn't avoid making it manual. I'd recommend when you know that a user is going to be deactivated, add an attribute to their Okta profile that says "staged for deactivation" or something like that. That could be updated by Workday right before they're deactivated. Once that attribute/boolean gets updated, trigger a workflow that pulls all the user groups, and then you could clean up that API response so it's a simple list, and send that response to an email list. That's my off the cuff solution 🙂
Hope that helps!