A Single Sign-On (SSO) error occurs between Okta and Microsoft Office 365 when a Microsoft Office 365 user has an ImmutableID in Entra ID that does not match the ImmutableID configured in Okta. Resolve this issue by verifying the ImmutableID in Entra ID and updating the user properties or Okta mappings accordingly. The following error message appears:

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Microsoft Office 365
• Federation (WS-FED)
• Single Sign-On (SSO)

A Microsoft Office 365 user has an ImmutableID in Entra ID that does not match the ImmutableID configured in Okta.

How is the ImmutableID verified in Entra ID?

1. Open Windows PowerShell.
2. Connect to Microsoft Graph using the command: l

   Connect-MgGraph -Scopes Directory.AccessAsUser.All

NOTE: Microsoft Graph must be installed if it is not already installed. For more information, check the Microsoft Documentation: Install the Microsoft Graph PowerShell SDK.

3. Verify if the ImmutableID is missing for the affected user by running the following command, replacing <user@domain.tld> with the User Principal Name (UPN) of the user:

Get-MgUser -UserId <user@domain.tld> -Property OnPremisesImmutableId | Format-List OnPremisesImmutableId

A blank value indicates that the ImmutableID is missing.

The ImmutableID is available in Okta but is missing in Entra ID.

Set the ImmutableID for the affected user in Entra ID by executing the update command in PowerShell.

1. Run the following command, replacing <user@domain.tld> with the UPN of the user and <ImmutableId> with the new ImmutableID:

Update-MgUser -UserId user1.test0000@secura.one -OnPremisesImmutableId <ImmutableId>

How is the issue resolved when the ImmutableID is available in Entra ID and Active Directory is used in Okta?

Verify the Active Directory mappings in the Okta Admin Console and reassign the user to populate the correct external ID.

1. In the Okta Admin Console, navigate to Profile Editor, select the Office 365 instance, and choose Mappings.
2. Select the Okta to Office 365 tab.
3. Verify that the following expression is present:

hasDirectoryUser()?findDirectoryUser().externalId:null

4. Ensure that the same value populates in the Application username profile for Office 365.
5. Reassign the user to bring the new value in if the value does not match the Active Directory external ID.

The ImmutableID is available in Entra ID and Active Directory is not used in Okta.

Adjust the Okta mappings to use the Okta User ID as the mapping value for the ImmutableID when Active Directory is not used as a source, as the Okta User ID remains immutable during the lifecycle of the user.

1. Navigate to the Okta Admin Console and adjust the mappings with the following expression:

user.getInternalProperty("id")

Related References

• Update-MgUser
• Configure Microsoft Entra Connect for an existing tenant
• Microsoft Documentation: Install the Microsoft Graph PowerShell SDK