Okta Office 365 Provisioning Fails with an Invalid Usage Location Error
Last Updated:
Overview
When using Universal Sync for Microsoft Office 365 provisioning, Okta fails to push profile updates and generates an HTTP 400 error.
License assignment cannot be done for user with invalid usage location.
This occurs because the target Microsoft Azure Active Directory (Azure AD) user object lacks a valid usage location, causing the Microsoft Graph API license assignment request to fail. Resolve this by configuring a valid usage location for the user in Azure AD and retrying the failed task in the Okta Admin Console.
In general, when this error occurs for a few specific users, the Okta Admin can confirm on the Okta side whether the user's Office 365 app assignment has a valid Usage Location value set/mapped. However, when checked in the Azure AD Admin Console, it is noticed that the target provisioned Azure AD user's Usage Location was not being set (normally empty) based on Okta's app user assignment's Usage Location value.
- Universal Sync method is selected, but without any on-prem AD integration created in Okta.
- Okta's Office 365 app assignment has the correct Usage Location value, for example, "US" being set/mapped.
- The target Azure AD user does not already have a valid 'Usage Location' set in Azure AD.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Okta Integration Network (OIN)
- Microsoft Office 365 Provisioning
- Universal Sync
Cause
Microsoft fails to detect the target AAD user object has the required valid Usage Location field value during the Okta -> Office 365's push user profile update task while making the below API call:
POST https://graph.microsoft.com/v1.0/users/{AAD user id}/microsoft.graph.assignLicense As a result, the Microsoft Graph API request will fail with an HTTP 400 bad request error, with the error message "License assignment cannot be done for user with invalid usage location." usageLocation is a required property field that Microsoft uses for the license assignment validation check.
This is explained by the following Microsoft documentation:
Solution
How is the invalid usage location error resolved?
Resolve the invalid usage location error by accessing the Azure AD Admin Console, editing the user properties to set a valid usage locale, and then retrying the failed profile update synchronization task from the Tasks dashboard in the Okta Admin Console.
- Access the Azure AD Admin Console and locate the corresponding user object.
- Select Edit Properties, locate the Usage Locale field, and select a valid value.
- (Optional) Perform a bulk update of the usage location for Azure AD users by following the instructions in How to update Usage Location for users in Entra ID in Bulk, based on On-Premises Organizational Unit.
- Access the Okta Admin Console.
- Navigate to Dashboard > Tasks.
- Locate the previously failed profile update synchronization task.
- Select the task and choose Retry selected task. Okta successfully completes the push profile update to Microsoft Office 365.
