Daily

Get a daily list of new and removed accounts

Each morning you see which Okta users were created and which were deactivated the day before.

Runs: Daily
Apps: Okta
AI: Not needed
Access: read

Send this to your assistant

Create a ClickRuntime automation: every morning at 8am, email me the Okta users created yesterday and the ones deactivated yesterday, with name, email and who did it.

Paste it into your assistant. It tells you what it will send or change before it runs live.

Add to ChatGPT Add to Claude

First time? Adding ClickRuntime to your assistant takes about two minutes.

Why use it

Why teams use this automation

A security analyst at a growing SaaS company gets asked the same question every few weeks: who joined and who left this month, and was access removed on time? Okta admins answer by scrolling the System Log or guessing from HR emails. A new hire provisioned with the wrong group goes unnoticed, and someone who left on Friday is still active on Wednesday because no one was looking.

Each day, the Okta System Log is queried for user.lifecycle.create and user.lifecycle.deactivate events from the previous 24 hours. The accounts created and deactivated are put into one email, with the user, the time and the admin or system that performed it, so you can see the day's joiners and leavers in a minute.

It fits IT teams, HR operations and compliance leads who must show joiner and leaver controls are working.

What you get out of it

Leavers lose access on the same day
If an employee departure appears in the log on Friday but not in your records, you see the mismatch Monday morning and not weeks later when someone remarks that the person still has access.
New accounts are checked at creation
A joiner who was created by mistake, or by an unexpected admin, stands out in a short daily list. You catch provisioning errors while the account is still unused. That is the cheapest moment to fix a mistake, before the account has any activity.
Proof of joiner-mover-leaver controls
Auditors ask for evidence that onboarding and offboarding follow policy. A saved daily digest shows each creation and deactivation with a timestamp and actor. That gives you a dated paper trail for each person without hunting through log pages.
Finance and HR get reliable counts
Headcount questions are answered from identity data. When a team lead asks how many people joined in the quarter, the digests add up to an answer. That makes workforce planning conversations quicker and less dependent on guesswork.
Odd admin behavior shows up
A flurry of accounts created at 2 am by one admin is hard to see inside raw log pages, but obvious in a one-page daily summary. That kind of pattern deserves a question, and the digest makes sure someone asks.

How it works

What happens, step by step

Every morning, ClickRuntime checks the Okta log for users created or deactivated the day before.
You get an email with two lists: new users with who created them, and deactivated users with who removed them.
If nothing changed that day, the list shows none, so you know the check still ran.

Before it runs live

Connect Okta

What you get

RunsDaily

Get a daily list of new and removed accountstoday, 9:00Succeeded

Email · Okta users created and deactivated on 2026-10-18Created (1): Sam Ortiz <sam@northwind.example> by Robin Hale Deactivated (0): none

Build your own

Need it to work differently?

This template is a starting point. Copy the prompt and change it, or describe a different automation from scratch, with your own conditions, more apps or an AI step. Your assistant writes it, tests it and runs it on ClickRuntime.

Your own rules
Conditions, thresholds, filters and exceptions, written the way you'd explain them to a colleague.
Any number of apps
One automation can read from one app and update several others. Over 248 apps are ready, and anything with an API works too.
AI where it helps
Summaries, classification, extraction and drafts use ClickRuntime's built-in AI, with no extra key.
On a schedule or on each event
Runs as often as every 5 minutes, or the moment an app sends an event, and keeps track of what it already handled.

Changes you can ask for

Run it at a different time, more or less often, or only on weekdays
Add an AI step, for example to summarize, sort or draft a reply
Add another app, for example also send it to Slack
Combine it with other Okta steps into one automation

Under the hood

The code that runs this automation

This is the Python script that runs each time the automation starts. Your AI assistant writes it for you when you send the prompt, and you allow each step in your assistant. To change how the automation works, describe the change to your assistant and it updates the script for you. For every function it can use, see the script reference.

new_deactivated_users_digest.pyexample

from datetime import date, timedelta
from clickruntime import on_trigger, credentials, http, notify

ORG = "northwind"

def okta(path, **params):
    resp = http.get(f"https://{ORG}.okta.com/api/v1/{path}", params=params,
                    headers={"Authorization": f"SSWS {credentials.secret('OKTA_API_TOKEN')}", "Accept": "application/json"})
    resp.raise_for_status()
    return resp.json()

@on_trigger
def run(event):
    y = date.today() - timedelta(days=1)
    sections = []
    for label, kind in [("Created", "user.lifecycle.create"), ("Deactivated", "user.lifecycle.deactivate")]:
        events = okta("logs", since=f"{y}T00:00:00Z", until=f"{date.today()}T00:00:00Z", filter=f'eventType eq "{kind}"')
        rows = [f"  {t.get('displayName')} <{t.get('alternateId')}> by {e['actor']['displayName']}"
                for e in events for t in e.get("target", []) if t.get("type") == "User"]
        sections.append(f"{label} ({len(rows)}):\n" + ("\n".join(rows) or "  none"))
    notify.email_me(f"Okta users created and deactivated on {y}", "\n\n".join(sections))
    return {"day": str(y)}

FAQ

Common questions

Are suspended users counted as deactivated?

Only deactivation events are included. Suspension, unsuspend and reactivation are separate System Log event types and do not appear unless you ask for them to be added to the digest. The actor named in the log is the person or process responsible.

Will it show who deactivated the account?

Yes. The System Log records an actor for each event, which may be a named admin, an API token or an automated process like a lifecycle sync from HR. That actor is listed beside each entry.

What if no one was created or deactivated that day?

The email can still arrive stating that there were no events, which confirms the check ran. If you would rather hear only when something happened, tell your AI assistant to skip empty days. A quiet day then costs you nothing to ignore.

What permissions does it need?

read. Nothing else in your accounts is used.

Does it need AI?

No. It runs without AI, so it doesn't use your plan's AI allowance.

How many runs does it use?

One run each time it runs (daily). Checks that find nothing to do and stop right away aren't counted.

Can I change how it works?

Yes. Describe the change to your AI assistant, for example a different schedule, channel or filter. It updates the automation, tests it and tells you what changed.

Monthly