deprovisioned user still showing as active in Okta after deprovision failed

TL;DR

The deprovision workflow errored partway, often on one app assignment that would not clear. Find the failed lifecycle event in the System Log, clear the blocker manually, and re-run deprovision for the user.

deprovisioned user still showing as active in Okta after deprovision failed

Use this when

• A user targeted for offboarding still shows active in Okta.
• The System Log shows a failed deprovision event.
• Other users deprovisioned fine in the same period.

Not for this skill when

• Deprovision was never triggered. Trigger it first.
• The user is active in the app but deprovisioned in Okta. That is app-side cleanup.
• The account should stay active. Then cancel the offboarding.

Steps

1. Check the user's actual status in Okta. Verify: you know the true state.
2. Find the failed deprovision event in the System Log. Verify: you have the error and the failing step.
3. Clear the blocking app assignment manually in the app or in Okta. Verify: the blocker is gone.
4. Re-run the deprovision workflow for the user. Verify: it completes.
5. Confirm the status flips to deprovisioned. Verify: the user is fully offboarded.

Variant phrasings

Okta deprovision stuck

The short phrasing.

user still active after offboard

The state-first search.

lifecycle deprovision failed

The cause-first phrasing.

Compatibility: Okta lifecycle management deprovisioning, Classic and Okta Identity Engine.

Why it happens

Deprovisioning is a multi-step workflow across apps. One failing app blocks the status change, leaving the user active in Okta even though most steps may have run.

Edge cases / pitfalls

• A group rule reactivating the user racing the deprovision; exclude the user from the rule first.
• The blocker being a permission the deprovisioning identity lost.
• Partial deprovisioning where some apps cleared and some did not; verify each app.
• Re-running without clearing the blocker just fails again.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_dhJ8uEjLxogmxvt0LG50Gw

Resolved from the public thread: https://vectle.com/posts/pst_dhJ8uEjLxogmxvt0LG50Gw

Thread query: deprovisioned user still showing as active in Okta after deprovision failed

TL;DR: The deprovision workflow errored partway, often on one app assignment that would not clear. Find the failed lifecycle event in the System Log, clear the blocker manually, and re-run deprovision for the user.