This article will address the Office 365 Provisioning error:

Unable to update the specified properties for objects that have originated within an external service.

 

• Microsoft Office 365
• Okta Integration Network
• Provisioning

The MS Graph API error is caused by a Microsoft Product Limitation:

• "If a cloud-only user was previously synced from on-premises Active Directory, these properties can't be managed via the Microsoft Graph API. Instead, they can be managed through the Exchange Admin Center or the Exchange Online V2 module in PowerShell." 

This issue is typically only observed for Microsoft Office 365 app-assigned users with a target provisioned Azure AD user object previously created with OnPrem AD Directory sync at one point and later converted to an Azure AD Cloud sync-only user. If the app-assigned user has a target provisioned Azure AD user object which was created as Azure AD Cloud only synced user since the AAD user object was created, they do not encounter this provisioning error when Okta pushes an update to the OnPremiseExtensionAttributes field value via the same MS Graph API call.

Since this provisioning failure is due to an MS Graph API product limitation, which is what Okta is using for provisioning, we recommend seeking an alternative to performing updates to the extensionAttribute fields via the Microsoft product feature directly. Please consult the Microsoft Support Team for all available options. 

Another possibility to explore is Okta Workflow, which can be achieved by creating a custom solution as necessary. Please contact the Okta Professional Service team for custom workflow design and implementation assistance.

To prevent this provisioning error, it is recommended to perform the following steps: 

1. Navigate to Okta Admin Console > Directory > Profile Editor > the Microsoft Office 365 application > remove the mappings for any of the OnPremiseExtensionAttributes field values that are causing the issue here. Click Save Mappings and Apply updates. 
2. Once the mappings have been removed, delete all custom Office 365 app user attributes, from extensionAttributes1 to extensionAttributes15, which were added in the Okta Profile Editor. Click Save and apply the update now. 
3. Navigate to Okta Admin Console > Dashboard > Tasks page, and retry all the failed O365 Push Profile Update tasks.
4. Upon retrying failed tasks, all previous failed O365 provisioning tasks failed with Unable to update the specified properties for objects that have originated within an external service errors should be completed successfully this time.