QUESTION

We use Panther's native Okta integration to populate the Okta.Users enrichment (lookup) table, but users with a DEPROVISIONED status in Okta never show up in it even though they're returned when we query the Okta API directly. Why is this happening, and can it be fixed?

ANSWER

This is expected behavior with Panther's default Okta user profile configuration, and it can be resolved.

Why it happens: When Panther pulls Okta user profiles into the Okta.Users enrichment table, it uses Okta's List Users API. By default, an unfiltered call to that endpoint excludes users with a DEPROVISIONED status — this is Okta's own default behavior, not a Panther parsing issue. Okta only returns deprovisioned users when the request includes an explicit search or filter parameter for that status. See Okta's List Users API documentation for details.

The fix: As of Panther version 1.129.62, there's an opt-in setting that includes DEPROVISIONED users in the Okta.Users enrichment pull. Because this changes what data is returned (and may affect existing detections or lookups that assume only active/non-deprovisioned users are present), it's enabled per account rather than turned on for everyone automatically.

If you'd like deprovisioned users included in your Okta.Users enrichment table, reach out to your Panther support or account team and ask to have this enabled for your instance. Once enabled:

• The next scheduled Okta profile sync will begin including users regardless of status.

• No changes are needed on your end to the Okta integration itself — the status field on each record (already part of the Okta.Users schema) will reflect DEPROVISIONED alongside other statuses like ACTIVE or SUSPENDED.

Scope: This only affects the Okta.Users profile enrichment pull. It does not change how Okta.SystemLog events are ingested.