What happens when a user is unassigned from an application in Okta?

When a user is unassigned from an application in Okta, the correct understanding is that the user's downstream account associated with that application is deactivated. This deactivation happens because unassigning a user effectively removes their access credentials and permissions to that application. As a result, the user can no longer log in or access any features or data associated with that application.

This process is particularly important for maintaining security and ensuring that only actively assigned users have access to applications. Any configurations tied to the user are also removed, reinforcing the principle of least privilege.

The other options do not accurately reflect the outcome of unassigning a user from an application. For example, retaining access or automatic reassignment contradicts the unassignment action, and notifying the user by email is not a standard function of the unassignment process in Okta. Thus, the deactivation of the user's downstream account is the primary consequence of unassignment in this context.