Okta generates a provisioning error for Microsoft Office 365 when Directory Sync is disabled in Azure Active Directory. Enabling Directory Sync in Azure Active Directory using Microsoft Graph PowerShell resolves this issue. The following error appears on the Okta dashboard during the provisioning flow:

Could not create user <username>in Office 365, received error: Unable to provision user <username> to Office 365, because 'Directory Sync' value of Disabled in Azure Active Directory is unsupported. Please visit the Azure Active Directory portal and set 'Directory Sync' state to Activated and retry.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Integration Network (OIN)
• Microsoft Office 365 Provisioning
• Azure Active Directory (Azure AD)

The error occurs because Directory Sync is disabled in Azure Active Directory (Azure AD).

How is Directory Sync enabled in Azure Active Directory to resolve the provisioning error?

Run the following Microsoft Graph PowerShell commands to enable Directory Sync in Azure Active Directory and retry the failed provisioning tasks in Okta.

NOTE:

• Review the PowerShell command and the current Microsoft Office 365 integration configuration before running any commands. Review the Microsoft PowerShell documentation to understand the command functionality and proper usage.
• Administrators can enable Directory Sync in Azure AD, but it cannot be used in conjunction with Azure AD Connect, DirSync, or Azure AD Sync, while Okta uses User Sync or Universal Sync. Contact Microsoft Support for further troubleshooting if Microsoft reports an error.

1. Install the v1.0 and beta Microsoft Graph PowerShell modules.

   Install-Module Microsoft.Graph -Force
   Install-Module Microsoft.Graph.Beta -AllowClobber -Force

2. Connect with the Microsoft Hybrid Identity Administrator account.

   Connect-MgGraph -scopes "Organization.ReadWrite.All, Directory.ReadWrite.All"

3. Verify the status of the DirSync type.

   Get-MgOrganization | Select OnPremisesSyncEnabled

4. Store the tenant ID in a variable named organizationId.

   $organizationId = (Get-MgOrganization).Id

5. Store the true value for the DirSyncEnabled attribute.

   $params = @{onPremisesSyncEnabled = $true}

6. Perform the update.

   Update-MgOrganization -OrganizationId $organizationId -BodyParameter $params

7. Verify the command.

   Get-MgOrganization | Select OnPremisesSyncEnabled

8. Navigate to the Okta Admin Console and go to Dashboard > Tasks.
9. Retry the failed Microsoft Office 365 provisioning tasks.

Related References

• UNEXPECTED_ERROR while attempting to save Office 365 provisioning settings (MS Graph version)
• Provision users to Office 365