Provision users to Office 365

You can create, update, deprovision, and sync users in Office 365 from your Okta org. You can import users from different source directories into Okta and provision them in Office 365 using profile mappings.

Before you begin

• Complete Configure single sign-on for Office 365.

• Bring users into Okta: You can import users from a directory such as Active Directory (AD) or an app such as Salesforce. Currently, Okta doesn't support imports that take longer than two hours to complete. Contact Support if you have this type of import. You can also create users directly in Okta. See the following for more information:

  • Manage Active Directory users and groups
  • Import users
  • Add users manually

• Decide the type of provisioning, depending on your provisioning needs. See Provisioning options for Office 365.

• Ensure that you have a Global administrator account in Microsoft and an App administrator account in Okta tenant.

Start this procedure

To provision users in Office 365, you need to perform the following tasks in order:

1. Set up Okta → Office 365 provisioning

2. Map profile attributes Okta → Office 365

3. Test provisioning

Set up Okta to Office 365 provisioning

You can automate provisioning tasks by enabling API integration, obtaining admin consent for user import and provisioning, and configuring settings for user lifecycle stages.

Enable API integration

Office 365 requires your consent to authenticate against the Microsoft API. This allows Okta to enable provisioning in Office 365 apps.

1. Go to Office 365 > Provisioning > Integration > Configure API Integration.
2. Check Enable API Integration.

3. Click Authenticate with Microsoft Office 365 to provide consent. You're redirected to the Microsoft Azure login page.

4. Click Accept. Upon accepting the scopes in the Microsoft Azure portal, you're redirected back to Okta.

Select provisioning type and settings

The provisioning options depend on the provisioning type that you select. Profile Sync is selected by default.

1. Go to Office 365 > Provisioning > To App > Edit.

2. Select Office 365 Provisioning Type.

   You can change the provisioning type from Profile Sync to Licenses & Role Management Only, Universal, or User Sync. See Provisioning types for office 365.

   For Universal Sync only: Select Send full profile, contacts, and conference rooms from these AD instances if you want to sync Active Directory groups and resources.

   Note:

   A service account is created in Azure Active Directory with the username format svc_OKTA_sync_{appId}. This only applies to User Sync and Universal Sync provisioning types. Don't delete or modify this account. The service account shouldn't use MFA and must be excluded from all Microsoft Entra ID conditional access policies.

3. Optional. Enabling User Sync or Universal Sync provisioning without credentials can lead to an error about insufficient permissions. To fix it, follow these steps in PowerShell.

   1. Install v1.0 and beta Microsoft Graph PowerShell modules.

      Install-Module Microsoft.Graph -Force

      Install-Module Microsoft.Graph.Beta -AllowClobber -Force

   2. Connect with the Microsoft Hybrid Identity Administrator account.

      Connect-MgGraph -scopes "Organization.ReadWrite.All,Directory.ReadWrite.All"

   3. Verify the status of the DirSync type.

      Get-MgOrganization | Select OnPremisesSyncEnabled

   4. Store the tenant ID in a variable named organizationId.

      $organizationId = (Get-MgOrganization).Id

   5. Store the updated value for the DirSyncEnabled attribute.

      $params = @{onPremisesSyncEnabled = $true}

   6. Perform the update.

      Update-MgOrganization -OrganizationId $organizatnnnnionId -BodyParameter $params

   7. Verify the command.

      Get-MgOrganization | Select OnPremisesSyncEnabled

4. Enable Create Users to create or link a user in Microsoft Office 365 when you assign the app to a user in Okta.
   Note:

   This option isn't available if the provisioning type is set to Licenses & Role Management Only .

5. Enable Update User Attributes to update a user's attributes in Microsoft Office 365 when you assign the app to a user in Okta.
6. Manage provisioning scope for create and update actions.
7. Enable or disable other provisioning settings. See Get started with Office 365 provisioning and deprovisioning.
8. Click Save.
   Note:

   Verify your Provisioning scope before saving. Saving your settings triggers an immediate synchronization. Based on the scope selected, Okta pushes user attributes, licenses, and roles to Microsoft Entra ID for all users assigned to the app.

Manage provisioning scope for create and update actions

Select the level of user data that Okta manages in Microsoft Office 365:

• User Attributes, Licenses, and Roles: Select this option to manage attributes, licenses, and roles. This is the default option.
• User Attributes Only: Select this option to manage user attributes only.
  Note:

  The User Attributes Only option isn't available if Entitlement Management is enabled or if the provisioning type is set to Licenses & Role Management Only.

Map profile attributes Okta to Office 365

Depending on where your users are sourced from, the username format can vary. For users to successfully sign in to Office 365, their username for Office 365 must be in an email address format for the domain you're federating (username@yourfederated.domain).

Map username unchanged

If your users already have their username in an email address format for the domain you're federating (username@yourfederated.domain) format, you can map the email without reformatting.

1. Go to Office 365 Sign on > Edit.
2. In Credentials Details > Application username format, select Email.
3. Click Save.

Map custom username

If your users are sourced from different directories or apps, their username format may vary. You can use the Okta Expression Language to customize the username that is passed on to Office 365.

Map email address

If your users' email addresses don't reside in the domain you're federating, you can use the Okta Expression Language to customize the email address that's passed to Office 365.

Prerequisite

You should select User Sync or Universal Sync Provisioning type. See Provisioning options for Office 365.

Test provisioning

Ensure that you have correctly configured provisioning by assigning Office 365 to test users in Okta and verifying that they appear in your Microsoft tenant. Be sure that you've selected the Create Users option in Provisioning.

In Okta:

1. Open the Assignment tab of the Microsoft Office 365 app.
2. Click Assign.
3. Assign appropriate Office 365 licenses to test users.
4. Click Done.

In the Microsoft Admin center:

1. Open the list of Active Users.
2. Ensure that all test users appear in the list with appropriate licenses.

In Okta:

1. Log into Okta as a test user.
2. Ensure that all Office 365 apps appear on the user dashboard.

Next step

Assign Office 365 to users and groups