Do all three directories still agree?

Okta owns the account. Entra ID and Google Cloud Identity receive it. Twice a day this reads all three and checks, account by account, whether they actually say the same thing.

Last run 22 minutes ago · Mon, 02 Nov 2026 06:17:00 GMT · took 0.7s

The rules and what each finding means · Their tests

2 disagreements to resolve

11accounts seenacross all three directories

9in agreementno open findings

2to resolveexcludes accepted exceptions

5acceptedbreak-glass and service accounts

Account by account

Disagreements first. The Okta column shows the status Okta holds and the downstream state that status implies, which is not the same thing — Okta's status tracks the password credential, not whether the person can sign in.

One row per account found in any directory.
Person	Okta	Entra ID	Google	Result
person-185da2	DEPROVISIONEDimplies disabled	disabledanchored	enabled/Okta Users	critical
criticalOkta expects this account to be disabled, but Google still has it enabled.access_not_revoked runbook §9
person-de68af	PASSWORD_EXPIREDimplies enabled	enabledanchored	enabled/Okta Users	medium
mediumMapped attribute "title" differs between Okta and Entra ID.attribute_drift runbook §4
person-05c84f	no Okta identity	enabledno anchor	absent	accepted
person-14ee83	no Okta identity	absent	enabled/Service Accounts	accepted
person-3759e6	ACTIVEimplies enabled	enabledanchored	enabled/Okta Users	agrees
person-40f834	no Okta identity	enabledno anchor	absent	accepted
person-58afa2	no Okta identity	absent	enabled/Service Accounts	accepted
person-793f42	ACTIVEimplies enabled	enabledanchored	enabled/Okta Users	agrees
person-9d7862	no Okta identity	absent	enabled/Breakglass	accepted
person-c2f820	ACTIVEimplies enabled	enabledanchored	enabled/Okta Users	agrees
person-d4ba71	ACTIVEimplies enabled	absent	absent	agrees

Disagreements over time

Each disagreement from first sighting to the complete run that no longer found it. Times are when a run saw it. Runs are twelve hours apart, so a problem may have started up to twelve hours before it was first seen, and been fixed up to twelve hours before it shows as resolved.

Who	What	First seen	Last seen	Lasted	Status
person-de68af	Mapped attribute "title" differs between Okta and Entra ID. attribute_drift	13 Oct, 17:39 UTC	2 Nov, 06:17 UTC	20 days so far	open
person-185da2	Okta expects this account to be disabled, but Google still has it enabled. access_not_revoked	14 Oct, 06:17 UTC	2 Nov, 06:17 UTC	19 days so far	open
person-185da2	An Entra ID account exists with no Okta identity and no recorded exception. orphan	13 Oct, 17:12 UTC	13 Oct, 18:17 UTC	13 hours	resolved 14 Oct, 06:17 UTC
person-185da2	Account sits in the OU that carries the SSO profile but has no Okta identity, so it would be redirected to an identity provider that has never heard of it. unmanaged_in_scope	13 Oct, 17:12 UTC	13 Oct, 18:17 UTC	13 hours	resolved 14 Oct, 06:17 UTC
person-de68af	An Entra ID account exists with no Okta identity and no recorded exception. orphan	13 Oct, 17:36 UTC	13 Oct, 17:37 UTC	under an hour	resolved 13 Oct, 17:39 UTC
person-de68af	Account sits in the OU that carries the SSO profile but has no Okta identity, so it would be redirected to an identity provider that has never heard of it. unmanaged_in_scope	13 Oct, 17:36 UTC	13 Oct, 17:37 UTC	under an hour	resolved 13 Oct, 17:39 UTC

Every run, including the ones that published nothing

The last 44 attempts: 44 complete, 0 failed. A complete run read all three directories. A failed run couldn't read at least one of them, so it changed nothing on this page and closed no findings.

2 Nov, 06:17 UTC complete, 2 to resolve 0.7s
1 Nov, 18:17 UTC complete, 2 to resolve 0.7s
1 Nov, 06:17 UTC complete, 2 to resolve 0.7s
31 Oct, 18:17 UTC complete, 2 to resolve 0.7s
31 Oct, 06:17 UTC complete, 2 to resolve 0.6s
30 Oct, 18:17 UTC complete, 2 to resolve 0.8s
30 Oct, 06:17 UTC complete, 2 to resolve 0.7s
29 Oct, 18:17 UTC complete, 2 to resolve 0.7s
29 Oct, 06:17 UTC complete, 2 to resolve 0.7s
28 Oct, 18:17 UTC complete, 2 to resolve 0.7s
28 Oct, 06:17 UTC complete, 2 to resolve 0.7s
27 Oct, 18:17 UTC complete, 2 to resolve 0.7s

How to read this

pseudonyms: People are stable fake labels, the same ones the operations dashboard uses, so one person can be followed across both pages. Addresses, directory object ids and attribute values are never published.
accepted: Break-glass and the provisioning connector's own service account are meant to exist with no Okta identity. They're recorded as exceptions rather than reported as faults, because a check that cries wolf gets ignored.
anchored: Entra matches a federated sign-in on an immutable anchor Okta writes. An account without one looks healthy in the portal and cannot be signed into.
clean: The most recent complete run found nothing to resolve. It is not a claim about any time after that run. If a later attempt failed, the note under "Last run" says so, and the run list below shows it.
if a read fails: Nothing is published. A partial read would make every account look like it had vanished from a directory, so the run stops and this page keeps the previous result and its timestamp.