## TL;DR
Link the hire to the existing application account instead of forcing a second create. In Okta, open the application assignment for the affected user, use Import or the provisioning log to find the matching app profile, confirm the username and email match the Okta universal profile, then choose Link or Match and re-run provisioning. Only delete the orphan app account when it is a confirmed stray with no sessions, data, or license history.

```text
user already exists in application
```

## Use this when
- An Okta provisioning task fails for one user while other hires provision cleanly.
- The target app already holds an account with the same username or email as the new hire.
- The System Log shows a create failure and the app assignment stays in an error state.

## Not for this skill when
- The user cannot sign in to Okta at all. Fix authentication first, then return to provisioning.
- The failure affects every assignee at once. Check the app provisioning credentials and API connection instead.

## Steps
1. Open Okta Admin Console, go to Applications, open the target app, and check Assignments and the Provisioning tab error list for the affected hire. Note the exact username the push tried to use and the timestamp of the failure so you compare the right records later. Verify: the error entry names the same user and app shown in the query
2. Search the target application directory or its admin console for that username and email, including deactivated and suspended accounts, because Okta treats a dormant account as an existing account. Record its app user id and status before changing anything. Verify: you find exactly one pre-existing account or confirm none exists outside Okta search results
3. In Okta, open Directory, People, open the hire profile, and compare login, email, first name, and last name with the app profile field by field. Fix any case, suffix, or domain difference in the authoritative source, usually the HR feed or Okta profile mapping, rather than editing only one side. Verify: all four fields match character for character after the correction
4. Return to the app Provisioning settings and run Import if the integration supports it, then match the imported app user to the Okta user and select the link option instead of create. If Import is unavailable, unassign the user, save, reassign, and pick the existing profile when prompted. Verify: the assignment changes from error to active without a new create call
5. Re-run provisioning for that single user from the app Tasks view and watch the System Log for a successful update event rather than another create attempt. Check the target app to confirm profile attributes updated and no second account appeared. Verify: the log shows an update success and the app still holds exactly one account for the hire
6. Document the match rule you used, for example email as the match key, in the provisioning runbook so the next rehire or contractor conversion links automatically. If duplicates keep appearing, tighten the profile mapping so the match attribute is required and unique. Verify: a test assignment for a known existing user links instead of erroring

## Why it happens
Okta provisioning defaults to creating a new app account when no link exists between the Okta user and the app profile. Rehires, pre-provisioned vendor accounts, manual admin creates, and earlier partial runs all leave an account in the target app before Okta pushes. Because the create uses a username or email the app already holds, the app rejects it as a duplicate. Linking establishes the persistent identifier pair Okta needs, so later pushes become updates. The fix is therefore identity matching, not retrying the create, which will fail identically on every cycle until the link exists.

## Variants and edge cases
### Okta user already exists in application for rehires
Rehires are the classic case because the old app account was suspended rather than deleted. Reactivate and link that account so group memberships, historical records, and audit trails stay attached to one identity instead of splitting across two accounts.

### Username matches but email differs
When the login matches and the email does not, trust the HR source of truth and update the stale app email before linking. Linking on a mismatched email creates password reset and notification problems that surface weeks later as apparent sign-in failures.

### No account found in the app yet Okta still errors
Check for a soft-deleted or archived account in the target app, including recycle or trash views, and check a second tenant or sandbox that shares the same provisioning connection. Restore or fully purge the hidden record, then link or create once.

Compatibility: Applies to Okta Classic and Identity Engine orgs using app provisioning with Create and Update enabled, including Salesforce, Microsoft 365, and custom SCIM apps. Requires an Okta admin role with application assignment rights.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_OQYUBZbmNaH4Q4daRmUNsw