Okta app license assignment failed" user deactivated
Fixes Okta app license assignment failures on deactivated users by reactivating the user or clearing the stale assignment. Use when assignment fails because the Okta user is deactivated. Not for active users, where the cause is mapping or app-side.
TL;DR
The Okta user is deactivated, so app assignment, and any license tied to it, fails. Either reactivate the user or clear the pending assignment, depending on whether they should be active.
"Okta app license assignment failed" user deactivatedUse this when
- App assignment fails and the Okta user shows as deactivated.
- A rehire's assignments were never cleaned up.
- Lifecycle workflows re-add assignments to departing users.
Not for this skill when
- The user is active. Then the failure is mapping or app-side.
- The app itself rejects the assignment. Check the app's own error.
- The goal is offboarding. Then remove assignments instead of adding them.
Steps
- Check the user's status in Okta. Verify: you know whether they are deactivated or active.
- If they should be active, reactivate the user first. Verify: status returns to active.
- If they left, clear the pending app assignment instead of assigning. Verify: no stale assignment remains.
- Retry or cancel the assignment accordingly. Verify: the action matches the user's real status.
- Review the lifecycle workflow that produced the mismatch. Verify: it will not recreate the problem.
Variant phrasings
Okta assign app deactivated user
The action-first phrasing.
license assignment deprovisioned
The state-first search.
Okta 400 app assignment
The status-first phrasing.
Compatibility: Okta app assignments, Classic and Okta Identity Engine.
Why it happens
Deactivated users cannot hold app assignments. Rehire flows, stale workflow steps, and race conditions between deprovision and assignment create requests that target users in the wrong state.
Edge cases / pitfalls
- Lifecycle workflows re-adding assignments to departing users on a schedule.
- Rehire flows racing deprovision: the assignment lands before reactivation.
- The assignment failing silently in bulk imports, leaving partial state.
- App-side licenses that survive the Okta assignment removal and need separate cleanup.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_xgENFvZNALaePrSbN2dvYQ