Okta requires all base user attributes for Just-In-Time (JIT) provisioning. However, administrators can perform JIT provisioning without certain required attributes, such as first name and last name, by disabling the attribute requirement in the user profile settings.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Just-In-Time (JIT) Provisioning
• Universal Directory

Can Just-In-Time provisioning occur without all of the Okta-required attributes?

Clear the attribute requirement in the user profile settings to perform JIT provisioning without certain Okta-required attributes.

1. Navigate to the user profile settings.
2. Clear the Attribute required checkbox for attributes such as firstName and lastName.

By disabling this requirement, Okta no longer enforces the presence of these attributes during JIT provisioning, allowing user creation without them.

NOTE: Some applications or downstream systems may still require these attributes. Ensure this change aligns with the overall provisioning strategy.

Related References

• OpenLDAP LDAP integration reference
• Add and update users with Active Directory Just-In-Time provisioning
• Okta Base User Required Attributes