Microsoft Office 365 Login Loop Occurs After Resetting Okta Password
Last Updated:
Overview
A persistent login loop occurs when accessing Microsoft Office 365 after an Okta password reset because Okta passes a future-dated timestamp to Entra ID. Administrators can resolve this by revoking the user sign-in session via PowerShell to refresh the timestamp attribute. Users experience a continuous login loop when attempting to access the Microsoft Office 365 tenant after a password reset, which persists even after clearing browser session cookies and switching devices.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Microsoft Office 365 (O365)
- Universal Directory
- Federation
Cause
This issue occurs when Okta passes the LastPasswordChangeTimestamp to Entra ID (formerly Azure Active Directory). Microsoft Office 365 processes certain dates incorrectly, resulting in a future date that propagates to the sign-in sessions valid from date attribute. When an affected user attempts to log in, Entra ID denies the assertion based on the timestamp and validity of the assertion. The assertion remains valid for only 10 minutes from the time of creation, making the future-dated attribute invalid.
Solution
How does an administrator resolve the Microsoft Office 365 login loop?
Refresh the signInSessionsValidFromDateTime attribute to the current date and allow the user to log in by executing a specific command in PowerShell.
- Open PowerShell.
- Execute the following command:
Revoke-MgUserSignInSession -UserId <String>
