The following is a summary of questions and answers from the Okta Workflows community office hours on Thursday, June 17, 2025. I edit questions for clarity. Read past office hours’ questions and answers.

Questions

Our Security team wants to disable users who have not signed into Okta for over 90 days. How do we allow those users to re-enable their accounts through self-service?

One possible solution with self-service looks like this:

• If a user has not signed in for over 90 days, move the user into a group with no applications assigned.
  • This user stays active but will not run any applications.
  • Suspending the user doesn’t work since the user cannot sign into Okta.
• When a user attempts to sign in, run a flow to check if they are in the no-access group. If so, move them into a group with application access.

Okta Workflows resources

🚀 New to Okta Workflows? The Getting Started with Okta Workflows page has all the resources to help you get started.

📺 Like learning from videos? Watch Okta Workflows videos.

❓Have a question? Ask during community office hours, post on the community forum, or email me.

🙋🏻‍♀️ Want to learn from the community? Join the #okta-workflows channel on the MacAdmins Slack.

📖 Want to learn more about Okta and automation? Take the Okta Workflows training on Okta Learning.