← Course Home
Okta Certified Administrator · Part I

User Lifecycle Management

29% of the exam — the second-largest domain.

User Lifecycle Management

Module 2: Provisioning

4 sub-topics · this deck covers sub-topic 2 of 4

↑ Module 2 Overview

The Exam Bullet

"Demonstrate knowledge of the typical flow of user registration/onboarding, updates, and deprovisioning"

Every Okta user account moves through a defined set of states — this bullet is really asking whether you know that state machine cold.

Registration & Onboarding

Staged → Provisioned → Active

Staged — the account exists but activation hasn't started. Provisioned — the account exists but the user "hasn't provided verification by clicking through the activation email" yet. Active — fully activated, normal access.

Account Management States

Recovery · Password Expired · Locked out

Recovery — triggered when an admin initiates a password reset. Password Expired — the user must update credentials before accessing apps. Locked out — the account is blocked after too many failed login attempts.

Suspension vs. Deprovisioning — Don't Confuse These

Suspended — "the user can't access apps, the Admin Console, or the Okta End-User Dashboard," but profile updates remain possible. Reversible.

Deprovisioned — an admin deactivates the account: all app assignments are removed and the password is permanently deleted. This is the real deprovisioning step, not suspension.

The Exam Angle

Watch for scenario questions built around this exact distinction:

→ "An employee is on leave and shouldn't log in, but their profile still needs occasional updates." = Suspended, not Deprovisioned.

→ "An employee has left the company for good." = Deprovisioned — password permanently deleted, all app assignments removed.

One Line To Remember

8 states: Staged → Provisioned → Active (onboarding); Recovery, Password Expired, Locked out (management); Suspended (no access, profile still editable, reversible) vs. Deprovisioned (password permanently deleted, all app assignments removed — the real offboarding step).

Sources: help.okta.com — usgp-end-user-states.htm