Just-In-Time (JIT) provisioning fails during external Identity Provider (IdP) authentication because required profile attributes are missing or improperly mapped. Resolve this issue by populating the missing attributes on the external IdP and ensuring proper attribute mapping in Okta. When this issue occurs, Okta records the following errors in the System Log:

Authenticate user via IDP FAILURE: Unable To JIT
Create okta user FAILURE:
Authenticate user via IDP FAILURE: Unknown Profile Attribute

• Okta Identity Engine (OIE)
• Okta Classic Engine
• External Identity Provider (IdP)
• Just-In-Time (JIT) Provisioning

The external IdP lacks required user profile attributes, or Okta lacks proper attribute mapping for the inbound IdP application user profile.

How is the Just-In-Time provisioning failure resolved?

Populate the missing attributes on the external IdP.

Configure the proper attribute mappings within Okta to resolve the provisioning failure.

1. Populate the missing attributes on the user profile within the external IdP.
2. Replace any placeholder values (such as "placeholder_firstname") with the actual values from the external IdP.
3. Verify that the values exist on the inbound IdP application user profile in the Okta organization where the JIT provisioning fails.
4. Ensure that Okta maps these attributes properly.

Related References

• Map Microsoft Entra ID attributes to Okta attributes