scim 409 conflict "user already exists" during okta provisioning
Resolves SCIM 409 user already exists conflicts during Okta provisioning: matching, importing, or merging the duplicate identity. Use when provisioning fails with a 409 conflict. Not for 404 or authentication errors against the SCIM endpoint.
TL;DR
The app already has a user with the same identifying attribute, so SCIM create fails with 409. Match on the right attribute, import the existing user into Okta management, or merge the duplicates, then retry provisioning.
The query
scim 409 conflict "user already exists" during okta provisioningUse this when
- Okta provisioning fails with 409 user already exists
- the user was created manually in the app before SCIM
- provisioning worked for others but fails for one user
Not for
- SCIM endpoint authentication failures
- schema or attribute mapping errors
- deprovisioning failures
Steps
- Identify the matching attribute Okta uses, usually userName or email, and find the duplicate in the app. Expected output: the existing app-side user is located.
- Check whether the existing account is the same person or a true collision. Expected output: identity confirmed as same person or different person.
- If same person, use Okta import to bring the app user under management and link it. Expected output: the accounts are linked with no duplicate.
- If different people, fix the colliding attribute (often a reused email) before retrying. Expected output: the collision is resolved.
- Retry provisioning. Expected output: the create or update succeeds without 409.
Applies to
Okta Lifecycle Management SCIM provisioning, SCIM 2.0 apps, current Okta versions.
Variant phrasings
409 for every user in a new integration
The matching attribute is wrong globally; switch userName to email or the app ID.
409 after a rehire
The old app account was never deprovisioned; link or remove it first.
Why it happens
SCIM create is not idempotent against pre-existing accounts. Manual app-side creation before the integration, or a wrong match attribute, guarantees collisions.
Edge cases
- Some apps match case-sensitively; differing letter case in an email-style login name can still collide.
- Import first, then enable provisioning, on every new SCIM integration.
- Keep a list of manually created accounts to import during rollout.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_wEopQyCQeYO-gnjEXiQStA