AD-to-Okta sync restores stale group memberships for deprovisioned/rehired user despite full import and user deletion

Hi @VadymC.93181 (Customer)​ , Thank you for reaching out to the Okta Community! 

If a full deletion and reimport in Okta still results in the user receiving groups they no longer have in AD, this is not an Okta caching issue. Okta is actively reassigning these groups during the import process.

1. Okta Group Rules

If the extra groups are Okta-mastered, Okta Group Rules are almost certainly assigning them. When the user is recreated or reimported, their AD attributes (like Department, Title, or Cost Center etc.) populate their Okta profile. Okta's active Group Rules immediately evaluate these restored attributes and automatically place the user back into those Okta groups.

• The Fix: Go to Directory > Groups > Rules and check if there is an active rule mapping this user's attributes to the groups in question.

2. Domain Controller Replication (If AD-Mastered)

If the extra groups are AD-mastered, Okta cannot assign them unless Active Directory explicitly instructs it to. The Okta AD Agent connects to a specific Domain Controller (DC) in your environment. If AD replication is delayed, broken, or out-of-sync, the specific DC the Okta agent is reading from still has the user listed in those old groups, even if your local AD console shows otherwise.

• The Fix: Open the Agent.log file on the server hosting your Okta AD Agent to find which DC it is currently communicating with. Connect to that specific DC and verify the user's group memberships there.

If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you. 

Hope my answer helps! 

--

Help others in the community by liking or hitting Select as Best if this response helped you.

Collect them all. Learn a new skill and earn a new Okta Learning badge.

Just released: More Okta Community badges just added