OKTA users removed from AD group do not go away when removed from that AD grouo

[Mike Bell]

I have Atlassian Access setup with OKTA auth via AD push groups. Everything is working as expected... When I add users to AD group they appear in managed accounts and they can access what is setup via the groups.

The issue is when I remove a user from the AD group, that account in Atlassian Access Managed groups shows as DEACTIVATED, but does not go away. I am unable to delete the account either. Will this account go get removed from Atlassian access after a specific amount of time has passed? 

Thanks,

Mike

[Mike Bell · Accepted solution]

I found other issues with this user that may bar it from being an actual repeatable issue. I will try this again shortly to see if this was a on-off or not. 

[Trudy Claspill]

I am working in an environment with a similar configuration.

What I have observed is that when the user account has been deactivated in AD and the synch then happens to Atlassian Access, the user's account shows as Deactivated in Cloud. If the user is then removed from User Groups in AD, the synch to Atlassian Access does not remove them from the same groups in Cloud.

When I asked the infrastructure team (the internal team that set up AD, Okta, and Atlassian Access), they told me that if the user is first deactivated in AD, then any subsequent group membership changes will be ignored in the synch process to Atlassian Access.

I don't know if that is due to a specific configuration in the environment, or if that is built-in/standard functionality of this sort of integration.