Enable identity reconciliation

Configure identity reconciliation for an app so that Okta can reconcile mismatched accounts and entitlements between the downstream app and Okta during import.

About this task

Early Access release. See Enable self-service features.

When you enable identity reconciliation for an app, Okta compares the accounts that it finds in that app on import against what Okta last assigned, and surfaces any differences for you to review. If entitlement reconciliation is enabled for the app, Okta also compares the entitlements in the app and provides a list of entitlement differences for you to review.

Before you begin

You have an admin role with permission to manage the app and its provisioning settings.
The app must support provisioning (To Okta) imports.

Procedure

In the Admin Console, go to Applications and Resources > Applications.
Select the app.
Got to the Provisioning tab.
Select To Okta under Settings.
In the Account Reconciliation section, click Edit.
Select Enable for Reconciliation features.
Optional. Select Require justification for all account decisions to require decision makers to provide their reasoning for each decision
Optional. Choose to set the auto-confirm and user matching rules. These aren't executed on the first import.
Optional. If Entitlement Management is enabled for the app, you can choose to enable entitlement reconciliation by enabling Reconciliation rules in the Entitlement reconciliation section.
Click Save.
Identity reconciliation is enabled for the app.
Run an import for the app to establish the reconciliation baseline. If you're onboarding an app for the first time, enable account reconciliation and entitlement reconciliation, but don't set any auto-revoke rules, as this may result in users losing access.

Note: If the app had accounts that were pending confirmation on the Import tab before you enabled identity reconciliation, those unconfirmed accounts won't appear in the reconciliation view. Okta doesn't carry forward pre-existing unconfirmed accounts. Run a new import (or wait for the next scheduled import) after enabling identity reconciliation to have Okta detect and surface those accounts again.

On the first import after you enable identity reconciliation, Okta automatically accepts and logs all existing entitlements and accounts in the downstream app as the starting state. Auto-revoke rules don't run on this first import, regardless of configuration, to avoid mass revocation of legitimate access during onboarding. Only new changes found in each subsequent import are detected as drift.
In the Account reconciliation section, define the rules for how Okta handles imported accounts that exist in the downstream app but don't match an account in Okta.
To require a reason for each manual decision, select Require justification for all decisions.
In the Entitlement reconciliation section, define the rules for how Okta handles entitlement grants that a user has in the downstream app but that don't match Okta.
These rules are disabled by default. Toggle Reconciliation rules to enable them, then choose whether to automatically accept or reject added entitlements and removed entitlements, independently.