Okta Office 365 Error Updating Properties for Directory Sync Objects
Last Updated:
Overview
When updating user profile attributes, Microsoft Office 365 provisioning fails with an HTTP 400 error. This occurs because the Microsoft Graph API restricts updates to non-license or role attributes for objects synced via Microsoft Entra Connect. Resolve this issue by changing the provisioning type in Okta to manage only licenses and roles.
The Azure Active Directory (AAD) audit log indicates the problematic update properties are lastName and displayName. The following provisioning error appears:
Automatic profile push of user <firstname> <lastname> to app Microsoft Office 365 failed: Could not push profile for Office 365 user received error: Received response with HTTP status code 400. httpStatusCode=400 errorCode=Request_BadRequest errorMessage="Unable to update the specified properties for on-premises mastered Directory Sync objects or objects currently undergoing migration." client-request-id=<client-request-id> request-id=<request-id> timestamp='Tue, 01 Nov 2022 15:52:08 GMT' method=PATCH url=https://graph.microsoft.com/v1.0/users/<immutable id>
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Microsoft Office 365 (O365)
- Provisioning
- Active Directory Synced With Azure Active Directory (AAD) via Microsoft Entra Connect
Cause
This issue occurs when the environment is configured to sync Active Directory with Azure Active Directory (AAD) using Microsoft Entra Connect, and Okta Microsoft Office 365 provisioning is enabled with any method other than Licenses/Roles Management Only. The Microsoft Graph API endpoint generates a 400 error because it restricts PATCH API updates for non-license or role attributes, such as firstName, lastName, and displayName, on Azure Active Directory user objects synced via Microsoft Entra Connect.
Solution
How is the Microsoft Office 365 provisioning type updated?
Update the Microsoft Office 365 application provisioning settings in the Okta Admin Console to only manage licenses and roles.
- Navigate to Applications > Applications > Microsoft Office 365.
- Select the Provisioning tab and choose To App.
- Select Edit.
- Change the provisioning type to Licenses/Roles Management Only.
- Select Save.
NOTE: For successful profile synchronization, the attribute mappings in Okta must exactly match the values synced from Active Directory to Microsoft Entra ID. Legacy accounts may often trigger errors if their first name, last name, primary email, or display name differs between the two systems. When Okta attempts to provision or update these mismatched users, it will generate an error. To resolve this, update the Microsoft 365 application assignments in Okta so that the attribute mappings align perfectly with the current values in Entra ID. Once aligned, retry the provisioning to resolve the errors.
