Global settings

The Global Parameters page, which controls group import and user lifecycle behavior.

The Global Parameters page.

Include built-in groups

Imports groups of the Okta type BUILT_IN. They are read-only.

Include app groups

Imports groups of the Okta type APP_GROUP, which are created and owned by application and directory integrations. They are read-only.

OKTA_GROUP groups are always imported when the group object type is selected, and they are the only groups the management agent can create, update, delete, or change the membership of.

Run a Full Import and Full Synchronization after changing either setting, because both change what an import returns.

User deprovisioning action

This setting applies when MIM exports a delete for a user. It changes what an import returns as well, so decide on it before you design your deprovisioning rules.

Deactivate

This is the default. A staged delete deactivates the user in Okta but leaves it in place, where it can be reactivated or removed manually later.

Deactivated users are not presented to MIM at all, so a delta import confirms the delete.

Delete

A staged delete deactivates the user and then permanently deletes it. A deleted user cannot be recovered.

Because deactivated users can be a normal, permanent state under this setting, they are imported like any other user. Only a full import can confirm the permanent delete, since Okta cannot return an object that no longer exists.

The management agent cannot reactivate a deactivated user. Under Deactivate, the object leaves the connector space, so a later reprovision is exported as a create, and Okta rejects it because the login is still in use. Reactivate the user in Okta first.

Activate new users

Activates a user immediately after the export creates it. If you leave this off, new users stay in the STAGED state.

Send activation email to new users

Instructs Okta to send its activation email to the new user. This only applies when Activate new users is selected.