An error occurs when attempting to change the Microsoft Office 365 sign-on method to Secure Web Authentication (SWA) because Okta attempts to access the federation object using expired or removed Global Admin credentials. Resolve this issue by granting Okta the necessary Microsoft Graph API permissions to manage federation or by using the Microsoft Graph module via PowerShell for manual federation.

The following error occurs when attempting to change the sign-on method to SWA in the Microsoft Office 365 application:

Please review the form to correct the following error(s):Could not remove the domain federation with Office 365; please retry removing the federation for this domain after a few hours.

• Okta Classic Engine
• Okta Identity Engine (OIE)
• Microsoft Office 365
• WS-Federation (WS-Fed)
• Secure Web Authentication (SWA)

The error occurs because Okta attempts to access the federation object in Microsoft using the stored credentials of the Global Admin account. The process fails if the password expires or the account no longer exists.

How is the error resolved for automatic federation?

If the Microsoft Office 365 application uses Automatic Federation in Okta, grant Okta the necessary Microsoft Graph API permissions to manage federation from the Okta Admin Console.

Navigate to the Office 365 sign-on settings in the Okta Admin Console and start the federation setup to grant Okta the necessary Microsoft Graph API permissions.

1. Navigate to Applications > Office 365 > Sign On in the Okta Admin Console.
2. Select Start federation setup under the Office 365 Domains section to grant Okta the necessary Microsoft Graph API permissions to manage federation.
3. Locate the Office 365 Domains section and select the option to start the federation setup.

How is the error resolved for manual federation using PowerShell?

If the application uses Manual Federation, Okta cannot modify the federation settings in Microsoft.

Install the Microsoft Graph module on a Windows device, run the PowerShell commands to remove the domain federation configuration, and deactivate and delete the Office 365 application in Okta.

1. Install the Microsoft Graph module on a Windows device using the Microsoft Graph Installation Guide.
2. Run the following PowerShell commands, replacing <DomainName> in both places with the federated domain name.

   1. Connect-MgGraph -Scopes Directory.AccessAsUser.All

   2. Remove-MgDomainFederationConfiguration -DomainId <DomainName> -InternalDomainFederationId (Get-MgDomainFederationConfiguration -DomainId <DomainName> | Select -Property Id).id

       3. Deactivate and delete the Office 365 application in Okta once Microsoft users no longer redirect to Okta for authentication.

Related References

• • How to Use PowerShell to Disable Manual Federation Between Okta and Microsoft Office 365
  • Microsoft Graph Installation Guide