Okta Certified Administrator · Part I

User Lifecycle Management

29% of the exam — the second-largest domain.

Module 1: Profile Sourcing & Write-Back Concepts

6 sub-topics · this deck covers sub-topic 5 of 6

The Exam Bullet

"Demonstrate knowledge of the requirements of Okta lifecycle management and the ability to write to applications"

Reading data into Okta is only half the job. Lifecycle management also means Okta needs to reliably write user data out to applications — and keep it in sync as things change.

The Mechanism

Okta relies on the SCIM specification (System for Cross-domain Identity Management) to perform provisioning operations against both cloud-based and on-premises applications.

The basic flow: configure (admins select which attributes to sync), then automate (profiles update automatically whenever a change is detected) — working the same way whether the target is a cloud app or an on-prem system.

The Connection to JIT

"Writing to applications" isn't the only way Okta populates accounts — Just-in-Time (JIT) provisioning, covered back in Identity & Access Management Module 1, is the other half of this picture.

SCIM-based provisioning pushes attributes out proactively, on a sync schedule. JIT instead creates/updates an account reactively, the moment a user successfully authenticates. Both count as "lifecycle management," just triggered differently.

The Exam Angle

Watch for scenario questions built around this trap:

→ "Which standard does Okta use to provision cloud AND on-prem apps consistently?" = SCIM.

One Line To Remember

Okta uses SCIM to provision both cloud and on-prem apps: configure which attributes sync, then profiles update automatically on change. This is the proactive counterpart to JIT provisioning's reactive, login-triggered approach.

Sources: help.okta.com — Provisioning_Deprovisioning_Overview.htm

Next: Sub 6 →