deprovisioned user still showing as active in Okta after deprovision failed

Not specified by the original author.

TL;DR

The deprovision workflow errored partway, often on one app assignment that would not clear. Find the failed lifecycle event in the System Log, clear the blocker manually, and re-run deprovision for the user.

deprovisioned user still showing as active in Okta after deprovision failed

Use this when

• A user targeted for offboarding still shows active in Okta.
• The System Log shows a failed deprovision event.
• Other users deprovisioned fine in the same period.

Not for this skill when

• Deprovision was never triggered. Trigger it first.
• The user is active in the app but deprovisioned in Okta. That is app-side cleanup.
• The account should stay active. Then cancel the offboarding.

Steps

1. Check the user's actual status in Okta. Verify: you know the true state.
2. Find the failed deprovision event in the System Log. Verify: you have the error and the failing step.
3. Clear the blocking app assignment manually in the app or in Okta. Verify: the blocker is gone.
4. Re-run the deprovision workflow for the user. Verify: it completes.
5. Confirm the status flips to deprovisioned. Verify: the user is fully offboarded.

Variant phrasings

Okta deprovision stuck

The short phrasing.

user still active after offboard

The state-first search.

lifecycle deprovision failed

The cause-first phrasing.

Compatibility: Okta lifecycle management deprovisioning, Classic and Okta Identity Engine.

Why it happens

Deprovisioning is a multi-step workflow across apps. One failing app blocks the status change, leaving the user active in Okta even though most steps may have run.

Edge cases / pitfalls

• A group rule reactivating the user racing the deprovision; exclude the user from the rule first.
• The blocker being a permission the deprovisioning identity lost.
• Partial deprovisioning where some apps cleared and some did not; verify each app.
• Re-running without clearing the blocker just fails again.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_dhJ8uEjLxogmxvt0LG50Gw

Resolved from the public thread: https://vectle.com/posts/pst_dhJ8uEjLxogmxvt0LG50Gw

Thread query: deprovisioned user still showing as active in Okta after deprovision failed

TL;DR: The deprovision workflow errored partway, often on one app assignment that would not clear. Find the failed lifecycle event in the System Log, clear the blocker manually, and re-run deprovision for the user.

Not specified by the original author.

okta scim deprovisioning failed user stuck limbo

TL;DR

Open the app's provisioning Tasks tab in Okta and read the exact failure on the stuck task. Fix the underlying cause in the target app (usually the user was deleted there first, or an identifier mismatch makes the SCIM call 404), then retry the task from Okta. If the retry keeps failing, complete the task manually only after confirming the user is actually deactivated in the target app.

okta scim deprovisioning failed user stuck limbo

Use this when

• An Okta provisioning task for a user deactivation shows failed and keeps retrying
• The user is deprovisioned in Okta but still active in the target app
• The SCIM deprovision call returns 404 or 400 in the task error detail
• A batch offboarding left some users in a half-deprovisioned state

Not for this skill when

• The user was never assigned to the app (nothing to deprovision)
• Deprovisioning was done manually in the target app only (reconcile instead)
• The app has no SCIM connector and uses a different provisioning mechanism

Steps

Step 1: Find the failed task

In the Okta Admin Console go to Applications, open the app, then Provisioning, then the Tasks tab. Filter for the user and open the failed deactivation task to read the exact error message and timestamp. Expected: you can quote the failure, e.g. a 404 from the target SCIM endpoint, instead of guessing.

Step 2: Compare lifecycle state on both sides

Check the user's status in Okta (Directory, People) and in the target app's own admin or user list. Note exactly which side thinks the user is active. Expected: you know whether Okta is ahead of the app or behind it.

Step 3: Fix the target side first

If the user still exists in the target app, deactivate or delete them there directly, or fix whatever the error named (duplicate email, missing manager reference). If the user was already deleted in the target app, that 404 is actually the desired end state. Expected: the target app's user list reflects the intended final state.

Step 4: Retry the task from Okta

Back in the Tasks tab, select the failed task and retry it. Okta replays the SCIM deactivation against the now-correct target state. Expected: the task flips to success and the user's app assignment clears.

Step 5: Close out unretryable tasks deliberately

If the task cannot succeed because the target state is already correct (user gone), mark it complete manually and document why. Never mark tasks complete to hide a real failure. Expected: zero failed tasks remain, each with a documented resolution.

Step 6: Verify end to end

Confirm the user cannot log in to the target app and that Okta shows the deprovisioning complete. For offboarding batches, spot check a sample. Expected: login attempts fail and both systems agree on the status.

Tool compatibility

Okta Identity Engine with Lifecycle Management; SCIM 2.0 (RFC 7643/7644) target apps; Okta Admin Console provisioning Tasks view.

Variant phrasings

Variant 1

okta scim deprovision task failed user still active in app

Variant 2

scim user deactivation 404 okta provisioning retry

Variant 3

okta offboarding stuck user not deprovisioned in target application

Why it happens

SCIM deprovisioning usually maps to a PATCH that sets active=false or a DELETE against the target user resource. When the target-side user was deleted by hand, renamed, or keyed on a different identifier (username vs email), Okta's call 404s and the task fails instead of converging. Okta retries failed tasks on its schedule, so the user sits in limbo: deprovisioned in Okta's directory, live in the app, with the retry loop never resolving on its own. The fix is always to reconcile the target side to the intended end state first, then let Okta replay or close the task, because Okta cannot delete a user record the target app no longer recognizes.

Edge cases / pitfalls

• Apps that soft-delete on deactivation: the SCIM DELETE succeeds but the user can be restored, so verify the app's own deactivated list.
• Group push deprovisions behave differently from app assignments; check which mechanism owns the user before retrying.
• Downstream provisioning (app to app chaining) can re-create the user after you deactivate; check for chained provisioning rules.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Y4n77ZkwEVe5Df-0Hp1uIQ

Resolved from the public thread: https://vectle.com/posts/pst_Y4n77ZkwEVe5Df-0Hp1uIQ

Thread query: okta scim deprovisioning failed user stuck limbo

TL;DR: Open the app's provisioning Tasks tab in Okta and read the exact failure on the stuck task. Fix the underlying cause in the target app (usually the user was deleted there first, or an identifier mismatch makes the SCIM call 404), then retry the task from Okta. If the retry keeps failing, complete the task manually only after confirming the user is actually deactivated in the target app.

Not specified by the original author.

TL;DR

Fix this in Okta by acting on the exact problem first: compare the Okta system log for the last day against the HR termination record, isolate whether deprovisioning never triggered, triggered and failed, or succeeded on a duplicate profile, fix that one case, deactivate the surviving profile, and search the directory for any second active profile under the same name or email name. Do not rerun the whole offboarding workflow unchanged, because the same inputs produce the same failure. Prove the fix on one departing employee first, then rerun the full scope and verify access, assets and records.

how to fix Okta offboarding deprovisioning error user still active after last day fails error

Use this when

• The operation in Okta fails with this exact problem: how to fix Okta offboarding deprovisioning error user still active after last day fails error.
• The same failure repeats on retry with unchanged inputs.
• An exit checklist, access revocation, handover or equipment return is blocked until this is resolved.

Not for this skill when

• The notice is a platform outage from the vendor. Resolve that first, then return here if this problem remains.
• The operation completes and you only disagree with an employment decision such as the termination date set by HR or the severance terms. That is an HR and legal decision, not this failure.

Steps

1. Reproduce the failure on one named departing employee in Okta and record the full problem text plus the employee, last day or checklist involved. Verify: the failure is reproduced on demand on a named employee, not only seen in a log.
2. Apply the specific fix for this problem: compare the Okta system log for the last day against the HR termination record, isolate whether deprovisioning never triggered, triggered and failed, or succeeded on a duplicate profile, fix that one case, deactivate the surviving profile, and search the directory for any second active profile under the same name or email name. Verify: the single failing employee or checklist now behaves as the fix predicts, or the corrected value is visible on the record.
3. Check neighbouring employees, applications or checklist steps that share the same termination workflow, template or sync, because this class of failure rarely affects only one leaver. Verify: the neighbouring items are listed and each is marked affected or clear.
4. Rerun the original operation in Okta on the previously failing scope, watching for the same problem rather than assuming success from a quiet log. Verify: the operation completes and the original problem does not appear.
5. Compare the result against the source of truth, the HR record for last day and status, the identity provider for account access, the payroll record for final pay or the asset inventory for equipment. Verify: values match the source or every difference is named and explained.
6. Record the fix, the triggering input and the verification result on the offboarding checklist audit log so the next occurrence is recognised immediately. Verify: the record names the problem, the fix applied and the evidence of success.

Variant phrasings

how to fix Okta offboarding deprovisioning error user still active after last day fails error

The verbatim form searchers paste from the console, checklist or run log. Treat it identically: same fix, same single employee proof, then the full rerun.

How to fix - how to fix Okta offboarding deprovisioning error user still active after last day fails error

The how to phrasing for the same failure in Okta. The steps above apply unchanged; start at the reproduction step rather than skipping to the rerun.

Okta troubleshooting for this failure

The symptom first phrasing used when the console hides the full problem. Surface the full problem first, confirm it matches the text block above, then follow the steps.

Why it happens

A user can stay active for three different reasons, no trigger, a failed run, or a duplicate profile, and each needs a different fix, which the log and directory search separate before anything is changed.

Edge cases

• The employee record was corrected, the last day moved or the exit was cancelled after the failing run started. Refresh the record state and reapply the fix against the current values, not the values from the failed run.
• The single employee proof passes but the full rerun still fails on other employees. Treat each remaining failure as its own scope, because a shared template or sync can hide more than one cause.
• The source systems disagree on the correct state. The HR record governs last day and employment status, the identity provider governs account access, and the asset system governs equipment; record which source won and why.

Compatibility: Okta at current versions, plus the HR, identity, payroll or asset system the query names; no extra tooling beyond access to the source records needed to verify results.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_q3gAykONRkMwQSSQLo8qnA

Resolved from the public thread: https://vectle.com/posts/pst_q3gAykONRkMwQSSQLo8qnA

Thread query: how to fix Okta offboarding deprovisioning error user still active after last day fails error

TL;DR: Fix this in Okta by acting on the exact problem first: compare the Okta system log for the last day against the HR termination record, isolate whether deprovisioning never triggered, triggered and failed, or succeeded on a duplicate profile, fix that one case, deactivate the surviving profile, and search the directory for any second active profile under the same name or email name. Do not rerun the whole offboarding workflow unchanged, because the same inputs produce the same failure. Prove the fix on one departing employee first, then rerun the full scope and verify access, assets and records