Monthly

Find accounts with no login in 90 days

Once a month you get the users who haven't signed in for 90 days, ready for review.

Runs: Monthly
Apps: Okta
AI: Not needed
Access: read

Send this to your assistant

Create a ClickRuntime automation: on the first of every month, email me every active Okta user with no login in the last 90 days, with their email, department and last login date.

Paste it into your assistant. It tells you what it will send or change before it runs live.

Add to ChatGPT Add to Claude

First time? Adding ClickRuntime to your assistant takes about two minutes.

Why use it

Why teams use this automation

At a 300-person company, the Okta directory keeps growing. Contractors whose projects ended in spring, interns from last summer, and people who changed roles still have active accounts and live app assignments. Nobody notices until an auditor asks for evidence of access reviews, or until an old contractor login turns up in a breach report. Each dormant account is a credential that someone could use and nobody is watching.

On the first of each month, Okta is searched for users whose last login is more than 90 days ago, and the list is emailed to you with names, email addresses, status and the date of the last sign-in. You decide who to suspend, deactivate or keep, with real names in front of you instead of an export you had to remember to run.

It suits IT admins and security teams preparing for SOC 2 or ISO 27001 access reviews, and anyone paying per-seat licenses for tools behind Okta.

What you get out of it

Fewer forgotten logins to attack
Every active account that nobody uses is a login an attacker could guess or phish quietly. A monthly list of 90-day idle users keeps that attack surface from growing unnoticed.
Evidence ready for access reviews
Auditors want proof that dormant accounts are reviewed on a regular cycle. A dated monthly email, with decisions recorded against it, is simple evidence that the review actually took place.
Lower per-seat software bills
Many apps assigned through Okta charge per user. Finding people who have not signed in for three months shows seats you can reclaim before the next renewal invoice. Reclaiming unused licenses is often the quickest way to cut the bill.
Offboarding gaps get caught
When HR forgets to notify IT, a departed employee can remain active for months. Their absence from sign-in activity makes them appear in the list, where someone can finally act.
A steady routine instead of annual panic
A short list each month is a ten-minute job. Waiting a year turns the same task into a day of spreadsheet work and uncomfortable questions. Small, regular reviews are easier to finish and to keep doing.

How it works

What happens, step by step

Once a month, ClickRuntime searches Okta for users who haven't signed in for 90 days.
You get an email listing each one with their department and last login date, ready for review.
Nothing is changed in Okta. You decide who to deactivate.

Before it runs live

Connect Okta

What you get

RunsMonthly

Find accounts with no login in 90 daystoday, 9:00Succeeded

Email · 4 Okta users with no login in 90 dayscontractor1@northwind.example - Engineering - last login 2026-05-02

Build your own

Need it to work differently?

This template is a starting point. Copy the prompt and change it, or describe a different automation from scratch, with your own conditions, more apps or an AI step. Your assistant writes it, tests it and runs it on ClickRuntime.

Your own rules
Conditions, thresholds, filters and exceptions, written the way you'd explain them to a colleague.
Any number of apps
One automation can read from one app and update several others. Over 248 apps are ready, and anything with an API works too.
AI where it helps
Summaries, classification, extraction and drafts use ClickRuntime's built-in AI, with no extra key.
On a schedule or on each event
Runs as often as every 5 minutes, or the moment an app sends an event, and keeps track of what it already handled.

Changes you can ask for

Run it at a different time, more or less often, or only on weekdays
Add an AI step, for example to summarize, sort or draft a reply
Add another app, for example also send it to Slack
Combine it with other Okta steps into one automation

Under the hood

The code that runs this automation

This is the Python script that runs each time the automation starts. Your AI assistant writes it for you when you send the prompt, and you allow each step in your assistant. To change how the automation works, describe the change to your assistant and it updates the script for you. For every function it can use, see the script reference.

inactive_users_hygiene.pyexample

from datetime import datetime, timedelta, timezone
from clickruntime import on_trigger, credentials, http, notify

ORG = "northwind"

def okta(path, **params):
    resp = http.get(f"https://{ORG}.okta.com/api/v1/{path}", params=params,
                    headers={"Authorization": f"SSWS {credentials.secret('OKTA_API_TOKEN')}", "Accept": "application/json"})
    resp.raise_for_status()
    return resp.json()

@on_trigger
def run(event):
    cutoff = (datetime.now(timezone.utc) - timedelta(days=90)).strftime("%Y-%m-%dT%H:%M:%S.000Z")
    users = okta("users", search=f'status eq "ACTIVE" and lastLogin lt "{cutoff}"', limit=200)
    lines = [f"{u['profile']['email']} - {u['profile'].get('department') or 'no department'} - last login {u['lastLogin'][:10]}"
             for u in sorted(users, key=lambda u: u["lastLogin"])]
    notify.email_me(f"{len(lines)} Okta users with no login in 90 days", "\n".join(lines) or "None")
    return {"inactive": len(lines)}

FAQ

Common questions

How does Okta decide a user's last login?

Okta records a lastLogin timestamp on each user profile whenever they sign in to Okta. Someone who only uses an app through an existing session may still show an older date, and users who never signed in have no value at all.

Does it deactivate the accounts it finds?

No. The monthly email is a list for review only, and it does not suspend or deactivate anyone. Acting on the list stays a human decision, which avoids locking out someone on parental leave or a seasonal worker.

What Okta permission does the API token need?

A read-only administrator role is enough to search users and read their status. Giving the token the narrowest role that can list users is good practice, and the token itself is stored as a secret.

What permissions does it need?

read. Nothing else in your accounts is used.

Does it need AI?

No. It runs without AI, so it doesn't use your plan's AI allowance.

How many runs does it use?

One run each time it runs (monthly). Checks that find nothing to do and stop right away aren't counted.

Can I change how it works?

Yes. Describe the change to your AI assistant, for example a different schedule, channel or filter. It updates the automation, tests it and tells you what changed.

Daily