29% of the exam — the second-largest domain.
4 sub-topics · this deck covers sub-topic 2 of 4
↑ Module 2 OverviewEvery Okta user account moves through a defined set of states — this bullet is really asking whether you know that state machine cold.
Staged — the account exists but activation hasn't started. Provisioned — the account exists but the user "hasn't provided verification by clicking through the activation email" yet. Active — fully activated, normal access.
Recovery — triggered when an admin initiates a password reset. Password Expired — the user must update credentials before accessing apps. Locked out — the account is blocked after too many failed login attempts.
Suspended — "the user can't access apps, the Admin Console, or the Okta End-User Dashboard," but profile updates remain possible. Reversible.
Deprovisioned — an admin deactivates the account: all app assignments are removed and the password is permanently deleted. This is the real deprovisioning step, not suspension.
Watch for scenario questions built around this exact distinction:
→ "An employee is on leave and shouldn't log in, but their profile still needs occasional updates." = Suspended, not Deprovisioned.
→ "An employee has left the company for good." = Deprovisioned — password permanently deleted, all app assignments removed.
Sources: help.okta.com — usgp-end-user-states.htm
Next: Sub 3 →