Okta OIDC Connection with Entra ID Fails with Claims Sharing Enabled
Last Updated:
Overview
Authentication failures occur when an Okta environment uses Microsoft Entra ID as an OpenID Connect (OIDC) Identity Provider (IdP) with the Claims Sharing feature enabled. A mismatch in the issuer value from Microsoft Entra ID in the access token causes the Okta security validation of the access token to fail, interrupting the authentication flow and preventing users from signing in. Resolve this by updating the IdP in Okta to use the v1.0 endpoints:
- Authorize URL:
https://login.microsoftonline.com/<tenant-id>/oauth2/authorize - Token URL:
https://login.microsoftonline.com/<tenant-id>/oauth2/token - Issuer URL:
https://sts.windows.net/<tenant-id>/ - JWKS Endpoint:
https://login.microsoftonline.com/<tenant-id>/discovery/keys - Userinfo Endpoint:
https://login.microsoftonline.com/<tenant-id>/openid/userinfo
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- OpenID Connect (OIDC) Identity Providers (IdP)
- Microsoft Entra ID Integration
- Claims Sharing
Cause
A mismatch in the issuer value from Microsoft Entra ID in the access token causes this issue. By default, Okta validates the ID Token from an external OIDC IdP to create a user session. When the Entra ID IdP configuration includes the Claims Sharing feature, Okta must also validate the Access Token, which contains the Authentication Methods Reference (AMR) claims. The Microsoft Entra ID v2.0 endpoints return an Access Token with an iss (issuer) claim that does not match the issuer URL published in the Entra ID OIDC .well-known configuration endpoint. This discrepancy causes the Okta security validation of the access token to fail, interrupting the authentication flow and preventing the user from signing in.
Solution
How is the Entra ID OIDC connection failure resolved?
Update the Microsoft Entra ID provider settings in the Okta Admin Console to use the v1.0 endpoints, which include the necessary AMR claims in the ID Token and prevent Okta from evaluating the invalid access token.
- In the Okta Admin Console, navigate to Security > Identity Providers.
- Select the configured Microsoft Entra ID provider.
- Click Edit for the General settings.
- Enter the following v1.0 endpoint URLs for the Entra ID tenant, replacing
<tenant-id>with the specific Microsoft Entra ID Tenant ID:
- Authorize URL:
https://login.microsoftonline.com/<tenant-id>/oauth2/authorize - Token URL:
https://login.microsoftonline.com/<tenant-id>/oauth2/token - Issuer URL:
https://sts.windows.net/<tenant-id>/ - JWKS Endpoint:
https://login.microsoftonline.com/<tenant-id>/discovery/keys - Userinfo Endpoint:
https://login.microsoftonline.com/<tenant-id>/openid/userinfo
- Click Update Identity Provider.
NOTE: In the Entra ID Manifest, set acceptMappedClaims : true according to the Microsoft Documentation. Setting api:requestedAccessTokenVersion : 2 may also be necessary.
