When admins remove users from all groups, Okta will deactivate the Atlassian Account. Okta does this by updating the account activation status to false on Atlassian.
Atlassian will preserve group membership since the IdP only pushed an account status change.
This becomes an issue if, on reactivation, the user gets added to different groups than they belonged originally. Okta does not automatically trigger group removals.
User testexample@somedonain.com belongs to the group Production-Confluence; the group is assigned to Atlassian Cloud app on Okta
Admin removes the user from group Production-Confluence
Okta will deactivate the Atlassian Account; Atlassian will keep the group membership with the user deactivated
Admin reactivates user testexample@somedonain.com but is now on Production-StatusPage by adding the user to that group. This group is also assigned to Atlassian Cloud app on Okta
Okta changes the activation status of the account and adds the group Production-StatusPage to the user profile
The user now exists in two groups on Atlassian side, Production-Confluence, and Production-StatusPage, and will remain in that state until a Push Group is performed from the group that was removed from the user profile (Production-Confluence)
Okta does not have a provisioning cycle where it refreshes group membership. This is only done if a group push is manually triggered.
UPDATE: We received communication from our customers that Okta has a flag (GROUP PUSH INACTIVE APPUSER) that their engineering can enable on your tenant where user reactivations are handled differently:
Fernando S
1 comment