Reconcile unmanaged accounts

Review accounts detected during an app's import, and take action based on the provided context.

About this task

Early Access release. See Enable self-service features.

When identity reconciliation is enabled for an app, Okta identifies unmanaged accounts as those found during import that exist in the app that weren't provisioned by Okta, or those with an account status not set by Okta. Each unmanaged account falls into one of three types.

Account that matches an active Okta user
These are accounts that bypassed governance when they were created. These may have been created as exceptions or by someone not following the correct process.
Account that matches a deactivated Okta user
Accounts found in the downstream app that are linked to a deactivated Okta user may imply that they weren't offboarded correctly, and may be orphan accounts.
Account that doesn't match any known Okta identity
These are accounts that were created out of band in the downstream app. The imported account is marked as No Match on the Import page. The action you choose to take depends on the nature of the account.

Before you begin

  • You have an admin role with permission to manage the app and view its import results.
  • Identity reconciliation must be enabled for the app. See Enable identity reconciliation.

Procedure

  1. In the Admin Console, go to Applications and Resources > Applications.
  2. Select the app.
  3. Go to the Import tab.
  4. The Accounts tab of the Reconcile import diffs lists the unmanaged accounts to reconcile. Review the list of unmanaged accounts, and use the category filters to narrow the list if needed. If Entitlement Management is enabled on the app, you can click View Entitlements for an account to see additional context about the account.
  5. You can choose to act on a single account by selecting an action from its Action dropdown list, or you can select multiple accounts and choose an action from the dropdown list labeled n selected, where n is the number of selected accounts. If your org requires justification for decisions, enter a reason when prompted.
    For accounts that match an active Okta user:
    • If you want to keep the account that was created outside of governance, click Confirm. This updates the list of users for the app in Okta to include the user.
    • Alternatively, you might want to disallow any accounts from being created outside of governance. In that case, click Revoke to deactivate and remove the account from the downstream app. Depending on the circumstance, it may be beneficial to investigate why governance was bypassed when creating the account.

    For accounts that match a deactivated Okta user: Select Revoke to deactivate and remove the account from the downstream app. Investigate why the account wasn't removed during offboarding.

    For accounts that don't match any known Okta identities:
    • If the account is a service account, break-glass account, local account, or a similar known account that was purposefully created and is needed for operations, choose Ignore. After you ignore an account, Okta remembers the decision and suppresses that account from future import notifications. It won't reappear as a new finding on later imports. Ignored accounts remain visible in a dedicated list in the app's admin view and in reports, filtered separately from actionable accounts, so you can revisit them at any time. You can view the accounts that have been ignored by selecting the Ignored status in the search filter.
    • If the account is suspicious, or is unnecessary, select Revoke to remove the account from the downstream app.

What to do next

Every action taken, including confirming, ignoring, or revoking accounts, are reflected in the account reconciliation report and in the account's System Log events. Each entry contains the actor, timestamp, action taken, and justification, if one was provided.

To periodically review unmanaged accounts, reduce identity access drift, and establish an audit trail of reviewer decisions, see Certify unmanaged accounts.