Import safeguards
App users and their entitlements are frequently unassigned during an import, but you may not know this until the import completes. Import safeguards let you specify the maximum percentage of app users in an org that can be unassigned while still allowing the import to continue. If the maximum percentage of unassigned users is reached, the import stops.
- An import job changes a property that's used in a group rule (for example, to assign a user to a group).
- A user is individually assigned to an app and is removed during an import. App-level safeguards don't cover individual assignments.
You can apply safeguards at the app level and the org level.
App-level import safeguards
App-level import safeguards apply to apps in your org with more than 100 users. The safeguards are enabled by default and set at 20%. If you change the import safeguard setting in one app to 15%, the new setting applies to all apps.
Deactivated users are included in the calculation, regardless of the lifecycle state that you set when importing.
App-level safeguards monitor group-based assignment changes and only check apps assigned by groups when the groups are imported from Active Directory (AD). Safeguards are triggered by group deletions and group membership removals. If an app is assigned to an Okta-managed group with users imported from AD, then AD user deactivation doesn't count in app-level safeguard calculations. App-level safeguards aren't triggered when assignment changes occur to apps that were individually assigned to a user.
Org-level import safeguards
An org-level import safeguard applies to all users and apps in your org. A minimum of 100 app assignments is required to activate an org level import safeguard. Org-level safeguards are enabled by default and set at 20%. Deactivated users are included in the calculation, regardless of the lifecycle state that you set when importing.
Org-level safeguards apply to user deletions and unassignments regardless of which configuration is chosen for When a user is deactivated in the app under Profile & Lifecycle Sourcing. This includes when the configuration is set to Do Nothing.
Entitlement import safeguards
Early Access release
An entitlement import safeguard allows you to protect entitlements (for example, roles or licenses) within a specific app. This safeguard prevents an import from accidentally removing access levels from users.
Unlike app-level safeguards, an entitlement safeguard is configured per app and doesn't require a minimum number of users to activate. This safeguard is disabled by default, so you need to enable it. After you enable this safeguard, you can select one of two threshold types:
-
Percentage threshold: This is the default option. Stops the import if the number of unassigned entitlements exceeds a specific percentage of the total entitled users for that app. This is set at 10% by default.
-
Absolute count threshold: Stops the import if the number of unassigned entitlements exceeds a fixed number of users. This is set at 100 users by default.
Additionally, you can enable Prevent changes to the entitlement schema. When active, this automatically blocks any import that attempts to modify or delete the entitlement types themselves (for example, deleting a role from the system entirely).
Entitlement safeguard limitations
- Entitlement safeguard supports a maximum of 3,000 entitlements per user.
- The first import after enabling an entitlement safeguard or schema block automatically runs as a full import to establish the baseline and doesn't trigger a safeguard limit, even if an incremental import was scheduled.
- The Prevent changes to the entitlement schema setting allows additions to the schema, but blocks modifications and deletions.
Priority of import safeguards
When both the app-level and org-level import safeguards are set, the user import stops whenever the first limit is reached. If the limits are the same, the app-level safeguard takes priority.
The Prevent changes to the entitlement schema setting acts as a hard block; if a schema change is detected, the import pauses before any user-level thresholds are calculated.