When should Universal Sync be selected in Okta provisioning?

Universal Sync should be selected in Okta provisioning for Active Directory-mastered users because it allows for bi-directional synchronization between Okta and the Active Directory environment. This means that changes made in Active Directory, such as user attributes or statuses, can seamlessly sync back to Okta, ensuring that user information remains consistent across both systems. This feature is particularly advantageous for organizations that rely heavily on Active Directory as their primary identity provider, as it helps maintain accurate and up-to-date user records in Okta.

Selecting Universal Sync also ensures that Active Directory's hierarchical structure and relationships are respected during the provisioning process, which is essential for maintaining organizational policies and access controls. Overall, this option facilitates a more integrated and efficient identity management strategy for organizations using Active Directory as their authoritative source for user data.