When provisioning users from Okta to Active Directory (AD), mapping the logonHours attribute to a custom Okta string attribute causes the application assignment to fail. The failure occurs because AD expects a byte array for this attribute, meaning Okta provisioning does not support it. Remove the attribute from the profile mapping and manage it directly in AD. The application assignment fails with the following error:

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Active Directory (AD)
• Provisioning
• Attribute Mapping

The AD logonHours attribute is a special attribute type that requires a byte array as its value, expecting 21 octets of data. Okta attribute mapping sends the value as a string, which does not match the format AD expects, causing the write operation to fail. As a result, Okta does not support writing to the logonHours attribute.

How is the Active Directory provisioning failure resolved?

Remove the logonHours attribute and the corresponding custom Okta attribute from the profile mapping to allow provisioning to complete successfully.

1. Unmap logonHours in the Okta to AD profile mapping.
2. Manage the logonHours attribute directly in AD.