Hello! This request is in response to a constraint with the Okta connector - it’s quite mission critical as the current connector does not effectively allow us to account for user lifecycle. Problem statement The users stream hits the default ‘list users’ endpoint for Okta users the first run unfiltered. This endpoint only returns users not in a

"*DEPROVISIONED"*

status when not filtered. This corrupts the output, as de-provisioned users aren’t returned, and you will always overstate your active users in the dataset. The

"DEPROVISIONED"

status users need to be returned within the stream in order for a complete user picture out of okta. This heavily devalues the use of this connector for seeing a full user lifecycle. Proposed solution The

"DEPROVISIONED"

status users can be returned through a filtered call - I’m not sure the best way this can be resolved, but I believe if the stream can be filtered initially - it would return all de-provisioned users along with it. A couple ideas - not sure which one makes most sense: • The users stream makes a secondary call setting the filter to

status eq "DEPROVISIONED"

• An initial “Sync data from date” parameter is passed, facilitating an initial filter of:

lastUpdated gt "yyyy-MM-dd'T'HH:mm:ss.SSSZ"

(this may be most accessible to the existing stream) • A secondary users stream, called

deprovisioned_users

is copied from the initial with a fixed filter of

status eq "DEPROVISIONED"

Thank you for your consideration, Again this is extremely important to having us able to effectively account for user lifecycle out of the Okta tenant.

hi zach, thanks for the great suggestions. Would you mind creating this in an issue for tracking? Just copy pasting everything you have here is great.

I imagine to implement this we would do what you mentioned, making a secondary call to set the filter to deprovisioned

at the moment we are focused on reliability enhancements to existing connectors so the fastest way to get this done is via a PR contribution