Reconcile entitlement drift

Review entitlement drift detected during an app's import, and take action based on the provided context.

About this task

Early Access release. See Enable self-service features.

After each scheduled or manual import, Okta compares the entitlements a user has in the downstream app against what Okta last assigned, and surfaces the differences as entitlement drift. Drift can be additive (the user gained an entitlement that Okta didn't assign) or subtractive (the user lost an entitlement that Okta assigned).

Entitlement drifts are listed on the Entitlements sub-tab of the Import tab of the app. Each diff in the list includes the affected username, when the import occurred, whether the diff is additive or subtractive, which entitlement changed, whether the change was accepted or rejected, and the decision maker. For accepted diffs, available actions are displayed, while you can choose to view the justification for rejected diffs. The list is sorted by detection time, from most recently detected to oldest.

Note: Every action taken is recorded as a System Log event with the actor, timestamp, action taken, and justification, if one was provided. Entitlement drifts revoked by automated rules are tagged with Okta System as the actor.

Before you begin

You have an admin role with permission to manage the app and view its import results.
Identity reconciliation and entitlement reconciliation must be enabled for the app. See Enable identity reconciliation. Entitlement reconciliation requires that Entitlement Management is enabled for the app.

Procedure

In the Admin Console, go to Applications and Resources > Applications.
Select the app.
Go to the Import tab and then go to the Entitlements sub-tab.
Review the list of entitlement diffs.
- If an unwanted change was automatically accepted, you can click Reject to undo it.
- For a change that was rejected, click View justification to read the decider's reason for the rejection.

What to do next

Reviewed entitlement drift is reflected in the entitlement reconciliation report and in the entitlement's System Log events.