Configure the optional Just-In-Time (JIT) setting for the Microsoft Entra ID Identity Provider (IdP) to establish a full synchronization of groups from Entra ID to Okta. When properly configured, Okta automatically assigns users to groups imported from Entra ID. This configuration requires an active JIT setup for the Entra ID IdP.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Microsoft Entra ID
• Identity Provider (IdP)

How is the full group synchronization configured for the Entra ID Identity Provider in Okta?

Configure the full group synchronization by updating the Identity Provider settings in the Okta Admin Console and defining the group filter values.

NOTE: The full synchronization of groups removes users from groups in Okta that are not in the inbound Security Assertion Markup Language (SAML) assertion. Another technique to achieve a similar result is to use the Add User to Missing Groups option.

1. Navigate to Security > Identity Providers in the Okta Admin Console.
2. Click the Configure dropdown menu for the Entra ID IdP entry and select Configure Identity Provider.

3. Scroll to the JIT Settings section and locate the Group Assignments dropdown menu.
4. Select Full sync of groups to reveal the SAML Attribute Name and Group Filter fields.

NOTE: Groups entered in the Group Filter field must already exist in Okta, or the synchronization fails.

5. Enter the group claim for the SAML Attribute Name.

6. Create Okta groups named after the Entra ID Group ID of the groups that require synchronization to Okta.

   • To find the Entra ID Group ID, follow the instructions mentioned in the Identify the Group ID of the Groups in Microsoft Entra ID chapter below.

7. Enter the Group Filter values based on the Group ID of the groups synced from Entra ID.
   NOTE: The most common claim name for Entra ID groups is http://schemas.microsoft.com/ws/2008/06/identity/claims/groups.

8. Click Update Identity Provider to initiate the full synchronization.

Test the Full Group Synchronization Configuration

Verify the full group synchronization by signing in to Office 365 with a user assigned to the filtered groups and checking the user profile in Okta.

1. Sign in to Office 365 with a user who belongs to one of the groups included in the Group Filter field.

2. Navigate to Apps > All Apps on the Office 365 Dashboard and select the Okta application.
3. Locate the user in Okta to verify that the profile is sourced from the Identity Provider and the user is assigned to the synchronized groups.

NOTE: The group names must match the Group ID, which can cause confusion as Group IDs are not human-readable. Create a Group Rule to populate human-readable group names based on membership in the Group ID groups. Since the full synchronization of groups removes users from groups in Okta that are absent from the inbound SAML assertion, another technique, such as the Add User to Missing Groups option, is required.

How is the SAML attribute name located in Microsoft Entra ID?

Locate the SAML attribute name by accessing the enterprise application settings in the Microsoft Entra ID admin console and adding a group claim.

1. Sign in to the Microsoft Entra ID admin console and navigate to Applications > Enterprise Applications.
2. Select the Okta application.
    

3. Click Single sign-on.

4. Click Edit next to the Attributes and Claims section.

5. Click + Add a group claim on the Attributes & Claims page.

6. Select the Security groups radio button and ensure the Source attribute is set to Group ID.

7. Click Save.
8. Copy the Claim name value of the newly created group claim.

Identify the Group ID of the Groups in Microsoft Entra ID

Identify the group ID required for the group filter by viewing the object ID of the groups in the Microsoft Entra ID admin console.

1. Navigate to Entra ID > Groups > All groups in the Microsoft Entra ID admin console.
2. Locate the Entra ID Group ID in the Object ID column on the All groups page.

Related References

• Create a Group Rule
• Make Microsoft Entra ID an Identity Provider
• Create the Okta enterprise app in Microsoft Entra ID
• "Unknown Profile Attribute" Error when Integrating Entra ID as IdP