You're on your way to the next level! Join the Kudos program to earn points and save your progress.
Level 1: Seed
25 / 150 points
1 badge earned
Challenges come and go, but your rewards stay with you. Do more to earn more!
What goes around comes around! Share the love by gifting kudos to your peers.
Keep earning points to reach the top of the leaderboard. It resets every quarter so you always have a chance!
Join now to unlock these features and more
The Atlassian Community can help you and your team get more value out of Atlassian products and practices.
When admins remove users from all groups, Okta will deactivate the Atlassian Account. Okta does this by updating the account activation status to false on Atlassian.
Atlassian will preserve group membership since the IdP only pushed an account status change.
This becomes an issue if, on reactivation, the user gets added to different groups than they belonged originally. Okta does not automatically trigger group removals.
User firstname.lastname@example.org belongs to the group Production-Confluence; the group is assigned to Atlassian Cloud app on Okta
Admin removes the user from group Production-Confluence
Okta will deactivate the Atlassian Account; Atlassian will keep the group membership with the user deactivated
Admin reactivates user email@example.com but is now on Production-StatusPage by adding the user to that group. This group is also assigned to Atlassian Cloud app on Okta
Okta changes the activation status of the account and adds the group Production-StatusPage to the user profile
The user now exists in two groups on Atlassian side, Production-Confluence, and Production-StatusPage, and will remain in that state until a Push Group is performed from the group that was removed from the user profile (Production-Confluence)
Okta does not have a provisioning cycle where it refreshes group membership. This is only done if a group push is manually triggered.
UPDATE: We received communication from our customers that Okta has a flag (GROUP PUSH INACTIVE APPUSER) that their engineering can enable on your tenant where user reactivations are handled differently: