How does automatic deprovisioning occur in Okta?

Automatic deprovisioning in Okta primarily occurs through integration with Active Directory (AD), specifically when there are changes made to user profiles within AD. When a user is removed or their access is modified in AD, Okta can be configured to automatically deprovision that user from connected applications and systems. This integration allows for a seamless process where changes in the identity source (AD) drive the necessary updates in Okta, ensuring that users who are no longer authorized due to their profile changes are promptly removed from access to various applications.

This process eliminates the need for manual intervention, as the system is designed to respond automatically to changes. Additionally, it streamlines user management and enhances security by ensuring that removed or inactive users do not retain unnecessary access to company resources. In contrast, other options pose scenarios that do not facilitate the automatic nature of deprovisioning, such as requiring user requests or solely relying on user activity, which are not the default mechanisms for triggering deprovisioning in Okta.