Map Azure Active Directory attributes to Okta attributes

To use Azure Active Directory (AD) for user authentication, you need to map Azure AD user attributes to Okta attributes.

Before you begin

  • Complete Make Azure Active Directory an Identity Provider.

  • Decide which claims you want to map to these required attributes in Okta: login, email, firstName, and lastName.

    Caution

    • If you're using a UPN for both the login and email attributes, you must map it to both attributes.
    • Creating a new user through Just-In-Time (JIT) provisioning may fail if any of the required attributes are empty or incorrectly mapped.

Start this procedure

This procedure involves the following tasks:

  1. Disable attribute mappings from Azure AD to Okta

  2. Add custom Azure AD attributes in Okta

  3. Map Azure AD attributes to Okta

Disable attribute mappings from Azure AD to Okta

  1. In the Admin Console, go to DirectoryProfile Editor.
  2. In the Search field, enter AAD or the name you assigned to Azure Active Directory when you added it as an identity provider (IdP).
  3. Click Profile next to the directory.
  4. In the Profile Editor, configure the user mappings:
    1. Click Mappings and select Configure User mappings.
    2. Select the AAD Application Name to Okta User tab.
    3. In the second dropdown menu for each attribute, select Do not map for all of the attributes except the login attribute.
    4. Click Save Mappings and Apply updates now.
  5. Repeat step 4 for any additional custom user mappings that exist for your org.

Add custom Azure AD attributes in Okta

  1. Under FILTERS in the Profile Editor for your Azure AD IdP, select Custom.
  2. Delete these attributes: First Name, Last Name, and Email.
    Note

    You delete these attributes because their Variable Name and External Name fields aren't editable. In the next step, you'll add custom attributes, where you can edit these fields.

  3. Click the Add Attribute button. The Add Attribute window opens.
  4. To create the Email attribute, complete these fields:

    Field Value
    Display name Email or any other name you want to assign to this email.
    Variable name email

    This name is used to refer to this attribute in profile mappings and expressions.

    External name The claim you want to map to this attribute. For example, http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

  5. Click Save and Add Another to save this attribute and add another.
  6. Repeat steps 4–5 to add these attributes: First Name, Last Name, and UPN (optional). Use the following values:

    For First Name:

    Field Value
    Display name First Name or any other name you want to assign to the first name.
    Variable name firstName

    This name is used to refer to this attribute in profile mappings and expressions.

    External name The claim you want to map to this attribute. For example, http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname

    For Last Name:

    Field Value
    Display name Last Name or any other name you want to assign.
    Variable name lastName

    This name is used to refer to this attribute in profile mappings and expressions.

    External name The claim you want to map to this attribute. For example, http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname

    For UPN (optional):

    Field Value
    Display name UPN or any other name you want to assign to the UPN.
    Variable name upn

    This name is used to refer to this attribute in profile mappings and expressions.

    External name The claim you want to map to this attribute. For example, http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier

Map Azure AD attributes to Okta

  1. Click Mappings and select Configure User mappings.
  2. Select the AAD Application Name to Okta User tab.
  3. Map the custom Azure AD attributes you created to the Okta User Profile as shown in the following table:

    Azure AD attributeOkta attribute

    email or upn or subjectNameId

    Choose the correct attribute depending on what the user uses while authenticating into Okta.

    login

    email or upn or subjectNameId

    Choose the correct attribute depending on what the user's primary email is or will be.

    email

    firstNamefirstName
    lastNamelastName

    upn

    Optional.

    name identifier

    Image.

  4. Click Save Mappings and Apply updates now.

Next steps

Test the Azure Active Directory integration