User Management in Okta Universal Directory
User management
This domain tests how Okta Universal Directory stores identities and how lifecycle actions, groups, and profile mappings control access. Questions often ask which status a user is in after an import, why a group rule did or did not fire, and how an attribute reaches an app.
Core rules
- Every Okta user has a profile in the Universal Directory. Base attributes include login, email, first name, and last name; custom attributes are added in the profile editor and mapped to app profiles.
- Statuses matter: STAGED means created but not activated; ACTIVE can sign in; SUSPENDED is a temporary block that keeps assignments; DEACTIVATED blocks sign-in but keeps the profile for reactivation; DEPROVISIONED is permanent and removes the profile.
- Activation can happen by email link, by an admin setting a password, or by just-in-time provisioning from an app.
- Groups are the scalable assignment unit. Okta groups and imported Active Directory groups can be assigned to apps and policies. Group rules evaluate a user's profile when the user is created or updated and add matching users to the group.
- Deactivating a user revokes sessions; deprovisioning is irreversible.
Worked example
A CSV import creates user Ana with department "Sales" and status STAGED. A group rule says department equals Sales -> group Sales-All. The CRM app is assigned to Sales-All. Ana activates by email. She can now launch CRM. Reasoning: the rule fires on user create/update, group assignment supplies app access, and STAGED users cannot sign in until activation.
Traps
Do not confuse suspend with deactivate: suspension is reversible and keeps assignments, while deactivation blocks sign-in, revokes sessions, and is also reversible. Deprovisioning is not reversible. A group rule alone does not grant app access; the app must be assigned to that group. Changing the login attribute can break app accounts if the app profile mapping does not update.