Okta Office 365 Error AADSTS50107 The Requested Federation Realm Object Does Not Exist

An AADSTS50107 error occurs when a user attempts to sign in to the Office 365 app using the WS-Federation (Automatic) process for federation with child domains due to a stale configuration from a previous platform update. Refreshing the child domain mappings in the Okta Admin Console resolves the error.

AADSTS50107: The requested federation realm object '<subdomain.domain.com>:exk123456789' does not exist

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Office 365
• Office 365 Federation with Child Domains
• Single Sign-On (SSO)
• WS-Federation (Automatic)

The issue occurs for Office365 WS-Federation (Automatic) configurations that include child domains, where the federation setup occurred before a recent platform update. The update implemented a fix, but the configuration requires a refresh to apply the changes. Refer to the Okta Classic Engine release notes (Production) for reference.

NOTE: This issue is specific to WS-Federation (Automatic) configurations that include child domains. WS-Federation (Manual) configurations do not experience this error, as manual federation supports only a single domain and does not involve child domain mappings.

How is the "AADSTS50107" error resolved?

Refresh the child domain mappings by navigating to the Office 365 application settings, accessing the verified domains, and saving the configuration without making changes.

1. In the Okta Admin Console, go to Applications > Applications > Office 365.
2. Select the Sign On tab.
3. Click Edit.
4. Ensure WS-Federation > Automatic is selected under Sign On Methods.
5. Click Manage verified domains.
6. Click Select domain without modifying any settings.
7. Click Save.

This triggers a refresh of the child domain mappings and resolves the error.
   

NOTE: The Manage verified domains option is only available for WS-Federation (Automatic). It is not present for manual federation configurations, as manual federation does not support multiple or child domains and is therefore not subject to this issue.