Okta Manager Attribute Is Not Synced to Office 365
Last Updated:
Overview
The Manager attribute fails to synchronize from Okta to Microsoft Office 365 because the attribute maps to an email value instead of a directory object. Update the Office 365 attribute mapping in the Profile Editor to use the Active Directory manager distinguished name to resolve this issue. The Manager attribute synchronizes correctly from the on-premises Active Directory (AD) to Okta, and the Okta user profiles display the correct Manager using the following expressions.
user.managerId => getManagerUser("active_directory").email
user.manager => String.substringAfter(String.substringBefore(appuser.managerDn, ",OU"), "CN=")
The Office 365 application Profile Editor displays the Manager attribute mapping that synchronizes data from Okta to Office 365.
However, the Manager attribute from Okta does not synchronize to Office 365.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Microsoft Office 365 Application
- Active Directory (AD)
- ManagerID
Cause
The Office 365 Manager attribute is a directoryObject attribute, which requires updates from another directoryObject type of attribute. The user.managerId attribute maps to getManagerUser("active_directory").email for AD integration mapping. This mapping retrieves the manager email value, which is not a directoryObject type. The Manager attribute requires AD integration and must source from the on-premises AD profile of the user, as the Supported user profile attributes for Office 365 provisioning documentation details.
Solution
How is the Office 365 Manager attribute mapping updated?
Update the Office 365 default mapping for the Manager attribute in the Profile Editor to check for an Active Directory assignment and return the manager distinguished name.
- Go to Directory > Profile Editor, search for the Office365 application, and select Mappings.
- Select the Okta User to Microsoft Office365 tab, search for the Manager attribute, and enter the following mapping.
hasDirectoryUser()?findDirectoryUser().managerDn:null => Manager
- Select Save Mappings and Apply updates now.
- Confirm the correct value for the Manager attribute on a user profile in the Office 365 Azure portal.
NOTE: If multiple Active Directory (AD) instances connect to Okta and the preceding steps do not resolve the issue, an additional Okta feature may require activation. This feature ensures that Okta links the active Office 365 application user immutable ID correctly to the corresponding Azure/Entra user ID. Open a support case with the Okta Support team for assistance.
