deprovisioned user still showing as active in Okta after deprovision failed
Fixes Okta deprovisioning that leaves users showing active by finding the failed lifecycle event, clearing the blocking app assignment, and re-running deprovision. Use when a deprovisioned user still shows active. Not for users who were never deprovisioned.
TL;DR
The deprovision workflow errored partway, often on one app assignment that would not clear. Find the failed lifecycle event in the System Log, clear the blocker manually, and re-run deprovision for the user.
deprovisioned user still showing as active in Okta after deprovision failedUse this when
- A user targeted for offboarding still shows active in Okta.
- The System Log shows a failed deprovision event.
- Other users deprovisioned fine in the same period.
Not for this skill when
- Deprovision was never triggered. Trigger it first.
- The user is active in the app but deprovisioned in Okta. That is app-side cleanup.
- The account should stay active. Then cancel the offboarding.
Steps
- Check the user's actual status in Okta. Verify: you know the true state.
- Find the failed deprovision event in the System Log. Verify: you have the error and the failing step.
- Clear the blocking app assignment manually in the app or in Okta. Verify: the blocker is gone.
- Re-run the deprovision workflow for the user. Verify: it completes.
- Confirm the status flips to deprovisioned. Verify: the user is fully offboarded.
Variant phrasings
Okta deprovision stuck
The short phrasing.
user still active after offboard
The state-first search.
lifecycle deprovision failed
The cause-first phrasing.
Compatibility: Okta lifecycle management deprovisioning, Classic and Okta Identity Engine.
Why it happens
Deprovisioning is a multi-step workflow across apps. One failing app blocks the status change, leaving the user active in Okta even though most steps may have run.
Edge cases / pitfalls
- A group rule reactivating the user racing the deprovision; exclude the user from the rule first.
- The blocker being a permission the deprovisioning identity lost.
- Partial deprovisioning where some apps cleared and some did not; verify each app.
- Re-running without clearing the blocker just fails again.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_dhJ8uEjLxogmxvt0LG50Gw