Okta lifecycle states and provisioning behavior

this page explains how okta models account states and how charthop settings determine which state a person lands in use it as a reference when troubleshooting why an account was created in a different state than expected this applies to our okta 2 way sync, available for hris customers okta lifecycle states okta has its own state model, separate from charthop here's what each state means, whether the person can sign in, and how it appears in okta okta state what it means can the person sign in via sso? how it appears in okta staged account created, but activation was never started no email sent, no password set up no inactive provisioned activation started okta sent an activation link to the person waiting for them to finish setting up their password not yet active active fully set up, activation complete yes active inactive deactivated, e g , after a departure or before a rehire is reactivated no inactive note provisioned maps to active in charthop charthop treats "activation started" the same as "active " the distinction between provisioned and active lives in okta, not in charthop provisioning behavior by scenario the table below shows what okta state results from each combination of person type and app settings all scenarios are gated by the sync new hires before start date setting — nothing runs until a person crosses that threshold person type settings resulting okta state email sent? new hire create okta profiles for new hires = on send email and activate upon creation = on provisioned → becomes active once the person completes setup yes new hire create okta profiles for new hires = on send email and activate upon creation = off staged — account sits here until manually activated no new hire create okta profiles for new hires = off no account created — rehire (existing account is inactive) rehire re activate okta profiles for re hires = on send email and activate upon creation = on inactive → active (or provisioned if setup wasn't previously completed) yes — only if the person is assigned to okta known limitation for preboarding rehire re activate okta profiles for re hires = on send email and activate upon creation = off inactive → active, silently no rehire re activate okta profiles for re hires = off stays inactive no departure departure de activate okta profiles on departures = on active → inactive no timing gate every scenario above only runs once the person crosses the sync new hires before start date threshold if an account isn't being created when expected, confirm the person is within that window