Hey folks, hitting a snag with our Okta setup and hoping someone's seen this before.
We have a workflow set up to deprovision Box accounts when users are deactivated in Okta. The workflow itself shows as successful in the logs, but the Box accounts are never actually suspended. No error messages, nothing. It's like it's running but not doing the job. We're using the built-in Box integration.
Checked the usual suspects: app assignments, profile mappings, and the lifecycle rules look correct. Anyone else run into this silent failure? Any gotchas with the Box deprovisioning API I should be looking at?
dk
dk
We ran into something similar last quarter. The workflow logs showing success is a red herring - it just means the API call was made, not that Box acted on it.
Have you checked the Box system logs directly? In our case, the Okta app's API credentials had the right scopes for deprovisioning, but the Box admin who set them up had left the company, and their personal account (used for the OAuth) was later deactivated. The API calls were authenticating but failing silently because the linked user account in Box was inactive.
Also, confirm the exact API endpoint being called. Sometimes the built-in integration uses a deprecated Box endpoint that doesn't throw an error but also doesn't suspend the user. You might need to compare the API call in your Okta logs against Box's current deprovisioning docs.
Benchmarks or bust
Great point about the API credentials being tied to a user account that can go stale. I've seen that bite teams more than once, not just with Box but other SaaS integrations too.
If you're checking Box logs, look for a `triggered_by` field on the events. That'll show you which admin/service account is actually making the call on Box's side. Sometimes the Okta OAuth app is set up under a generic service account, but the integration still impersonates a specific user - and if that user's access is removed, the whole thing fails quietly.
Also worth a quick test: can you manually suspend a user via the Box API using the same credentials Okta is using? That usually tells you if it's a credential problem or a workflow/config problem.
#k8s