Handling Immutable ID Issues in Okta for Microsoft 365 Assignments
Last Updated:
Overview
Users with Microsoft 365 assignments experience login failures via the Okta dashboard due to missing immutable IDs. This issue occurs when the immutable ID mapping fails to find a value from an Active Directory (AD) instance and defaults to a null value after profile changes. Updating the immutable ID mapping expression to use the Okta User Profile ID resolves the issue.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Microsoft 365
- Single Sign-On (SSO)
Cause
The absence of immutable IDs occurs when the immutable ID mapping fails to find a value from an AD instance and defaults to a null value. This loss of immutable IDs in Okta after profile changes leads to login failures for users with Microsoft 365 assignments.
Solution
How does updating the mapping expression resolve the missing immutable ID issue?
Okta uses the following out-of-the-box expression for the immutable ID during Microsoft 365 integration.
hasDirectoryUser()?findDirectoryUser().externalId:null
This expression sets the value to null if Okta finds no value from a directory integration. However, Okta substitutes the user's App ID as the immutable ID when assigning a new user to the application.
Instead of relying on this default behavior, update the expression to use the Okta User Profile ID. Update the immutable ID mapping expression to ensure Okta sets the immutable ID to a static value that never changes if Okta retrieves no value from a directory integration.
hasDirectoryUser()?findDirectoryUser().externalId:user.getInternalProperty("id")
Review the following considerations regarding user assignments and updates when using the new expression for the immutable ID mapping.
- Okta does not update the immutable ID to the Okta User Profile ID for users already assigned to the application, as Okta only applies the immutable ID during user creation and cannot update it later.
- If an existing user loses and regains assignment to the application, the immutable ID might change in Okta, leading to the observed login issue. In such cases, update the immutable ID on the Microsoft side using PowerShell.
Related References
