Import safeguards

App users are frequently unassigned during an import, but you may not realize the amount until the entire import is complete. Import safeguards let you specify the maximum percentage of app users in an org that can be unassigned while still allowing the import to continue. If the maximum percentage of unassigned users is reached, the import stops.

Safeguards aren't triggered in the following situations:

An import job changes a property that's used in a group rule (for example, to assign a user to a group).
A user is individually assigned to an app and is removed during an import. App-level safeguards don't cover individual assignments.

You can apply safeguards at the app level and the org level.

App-level import safeguards

App-level import safeguards apply to apps in your org with more than 100 users. The safeguards are enabled by default and set at 20 percent. If you change the import safeguard setting in one app to 15 percent, the new setting applies to all apps.

Deactivated users are included in the calculation, regardless of the lifecycle state that you set when importing.

Note:

App-level safeguards monitor group-based assignment changes and only check apps assigned by groups when the groups are imported from Active Directory (AD). Safeguards are triggered by group deletions and group membership removals. If an app is assigned to an Okta-managed group with users imported from AD, then AD user deactivation doesn't count in app-level safeguard calculations. App-level safeguards aren't triggered when assignment changes occur to apps that were individually assigned to a user.

Org-level import safeguards

An org-level import safeguard applies to all users assigned to all apps in your org. A minimum of 100 app assignments are required to activate an org level import safeguard. Org-level safeguards are enabled by default and set at 20 percent. Deactivated users are included in the calculation, regardless of the lifecycle state that you set when importing.

Note:

Org-level safeguards apply to user deletions and unassignments regardless of which configuration is chosen for When a user is deactivated in the app under Profile & Lifecycle Sourcing. This includes when the configuration is set to Do Nothing.

Priority of import safeguards

When both the app-level and org-level import safeguards are set, the user import stops whenever the first limit is reached. If the limits are the same, the app-level safeguard takes priority.