Okta Admin Accounts Cannot Be Deactivated by Import
Last Updated:
Overview
When an external Human Resources (HR) application sources a user with administrator rights, deactivating the user in the source application does not deactivate the user in Okta. Instead, the user becomes an active Okta-sourced user because Okta prevents the deactivation of administrator accounts via imports. Administrators must manually remove the administrator role from the user in Okta to allow the import to deactivate the account.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Administrator Accounts
- User Lifecycle Management
- Imports
Cause
Okta prevents the deactivation of administrator accounts via imports, even when the application sourcing the user initiates the deactivation.
Solution
How does an import deactivate an administrator account?
Administrators must manually deactivate Okta administrator accounts or remove the administrator role from the user before the source application initiates a change. Remove the administrator role from the user account in the Admin Console and run an import from the source application to deactivate the user.
- Navigate to the Okta Admin Console.
- Remove the administrator role from the target user account.
- Run an import from the source application to deactivate the user in Okta.
