Okta connector limitations

Important

This feature is in Beta. To use it, a workspace admin must turn on Lakeflow Connect for Okta from the Previews page. See Manage Azure Databricks previews.

The managed Okta connector in Lakeflow Connect keeps deleted records in incremental tables until a full refresh, ingests only the previous 365 days of changes on the first sync by default, and refreshes group membership data only when a group's membership changes.

General software as a service (SaaS) connector limitations

The limitations in this section apply to all SaaS connectors in Lakeflow Connect.

• When you run a scheduled pipeline, alerts don't trigger immediately. Instead, they trigger when the next update runs.
• When a source table is deleted, the destination table is not automatically deleted. You must delete the destination table manually. This behavior is not consistent with Spark Declarative Pipelines on Lakeflow behavior.
• During source maintenance periods, Databricks might not be able to access your data.
• If a source table name conflicts with an existing destination table name, the pipeline update fails.
• Multi-destination pipeline support is API-only.
• You can optionally rename a table that you ingest. If you rename a table in your pipeline, it becomes an API-only pipeline, and you can no longer edit the pipeline in the UI.
• If you select a column after a pipeline has already started, the connector does not automatically backfill data for the new column. To ingest historical data, manually run a full refresh on the table.
• Databricks can't ingest two or more tables with the same name in the same pipeline, even if they come from different source schemas.
• The source system assumes that the cursor columns are monotonically increasing.
• The connector ingests raw data without transformations. Use downstream Spark Declarative Pipelines on Lakeflow pipelines for transformations.

Connector-specific limitations

The limitations in this section apply to the Okta connector.

• Okta doesn't report deletions, so deleted records remain in the users, groups, devices, group_members, and group_push_mappings tables until you run a full refresh. Full-refresh tables drop deleted records on the next sync.
• By default, the first sync of each incremental table ingests only records changed in the previous 365 days. To ingest records that haven't changed recently, set start_datetime. See Connector options.
• The group_members table rereads a group's members only when that group's membership changes, so member profile values in it can be out of date. For current user profile and status values, use the users table.
• Okta doesn't treat membership, app assignment, group push mapping, or admin role changes as group changes, so the group statistics in the _embedded column of the groups table can be out of date. To update them, run a full refresh.
• The policies and policy_rules tables contain only the policy types that your Okta organization has enabled. The connector skips policy types that require a feature your organization doesn't have.
• The user_factors table contains only the enrolled factors that are required or optional in the highest-priority authenticator enrollment policy for each user. To see every enrollment, use the user_authenticator_enrollments table.
• The connector doesn't ingest Okta System Log events. Use the Okta System Logs connector instead.