Okta offers a ready-made template, Microsoft IDP, for configuring Microsoft as an external social IDP. This template, however, uses a fixed schema for user attributes and cannot import or update custom attributes from Entra ID to Okta. To resolve this, administrators must configure a custom OpenID Connect (OIDC) IdP instead of using the pre-built template. Additionally, reference-type attributes like Manager require special consideration as Entra ID cannot emit them directly as a token claim

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Microsoft social login
• OIDC social login

The Microsoft IdP template uses a fixed schema and cannot import custom user attributes from Entra ID.

How does Okta import custom attributes from Entra ID?

Create a custom OpenID Connect Identity Provider, configure the necessary endpoints and claims in Entra ID, and map the attributes in Okta.

1. Create a custom OpenID Connect IdP instead of using the Microsoft Social IdP template. Please see the Enterprise identity provider for more details. If using a multi-tenant application, see NOTE in Solution footer.
2. Obtain the endpoints from the following address: https://login.microsoftonline.com/{Entra Tenant ID}/v2.0/.well-known/openid-configuration.
3. Leave the Userinfo endpoint field blank so Okta will read claims within the ID token instead.

4. Follow the instructions to set up Microsoft Social IdP as detailed Register an application in Microsoft Entra ID, and go to Applications > App registrations > {App} > and set acceptMappedClaims to "true".

5. Set up claims from Applications > Enterprise Applications > {App} > Single sign-on.

6. Configure attribute mappings on Okta to confirm that user attributes are getting updated upon social login.

Reference-type attributes fail to import due to Entra ID limitations.

The custom OpenID Connect IdP configuration assumes the source attribute is a scalar value (string, date, or boolean) that Entra emits directly in the ID token via a standard optional claim. Attributes like Manager in Entra ID and Microsoft Graph are reference and navigation properties (directoryObject type), not scalar values. Administrators cannot select these attributes via a standard $select, and Entra ID cannot emit them directly as a token claim or map them via a standard optional claim.

NOTE: If the Microsoft application is multi-tenant, administrators must use the preconfigured Microsoft IdP instead of the Custom OIDC IdP. The Custom OIDC IdP in Okta binds to one fixed Issuer for iss validation. Multi-tenant Entra applications mint tokens with a per-tenant issuer https://login.microsoftonline.com/{Entra Tenant ID}/v2.0), causing tokens from other tenants to fail validation against an IdP configured for a specific tenant's issuer.

Related References

• Map Attributes from an External OIDC Identity Provider into the Okta User Profile