UNEXPECTED_ERROR while Attempting to Save Okta Office 365 Application Provisioning Settings

An unexpected error occurs when saving Office 365 provisioning settings in Okta because a Microsoft Office API change prevents Okta from automatically enabling Directory Sync. Resolve this issue by manually enabling Directory Sync using PowerShell commands.

After authenticating with an Office 365 admin account, attempting to save the Office 365 provisioning settings with User Sync or Universal Sync selected as the Office 365 provisioning option results in the following error:

UNEXPECTED_ERROR

When selecting License Sync or Profile Sync, the provisioning settings save successfully. In the System Log, the following events appear with the eventType eq

"app.office365.api.error.set.company.dirsync.failure" search query:

Unable to enable Office 365 directory sync for the company, received error: com.microsoftonline.provisioning.IProvisioningWebServiceSetCompanyDirSyncEnabledAccessDeniedExceptionFaultFaultMessage: Current user does not have permissions to the make this call.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Office 365
• Provisioning
• User Sync
• Universal Sync

Due to a change with the Microsoft Office APIs, Okta cannot automatically enable Directory Sync (DirSync) when enabling User Sync or Universal Sync and saving the Office 365 provisioning settings.

What steps manually enable Directory Sync?

Enable Directory Sync manually by executing the provided PowerShell commands, verifying the configuration, and saving the Office 365 provisioning settings in the Okta Admin Console.

1. Execute the following PowerShell commands to enable Directory Sync:

# Install v1.0 and beta Microsoft Graph PowerShell modules

Install-Module Microsoft.Graph -Force 

Install-Module Microsoft.Graph.Beta -AllowClobber -Force

# Connect With Hybrid Identity Administrator Account

Connect-MgGraph -scopes "Organization.ReadWrite.All,Directory.ReadWrite.All"

# Verify the current status of the DirSync Type

Get-MgOrganization | Select OnPremisesSyncEnabled

# Store the Tenant ID in a variable named organizationId

$organizationId = (Get-MgOrganization).Id

# Store the False value for the DirSyncEnabled Attribute

$params = @{

onPremisesSyncEnabled = $true

}

# Perform the update

Update-MgOrganization -OrganizationId $organizationId -BodyParameter $params

# Check that the command worked

Get-MgOrganization | Select OnPremisesSyncEnabled

2. Save the Office 365 provisioning settings in the Okta Admin Console.
3. Verify that the settings save successfully.

NOTE: Before running any PowerShell command, carefully review the command and the current Office 365 integration configuration. Review Microsoft's PowerShell documentation to understand the command functionality and proper usage.

What steps resolve a package source resolution error during module installation?

If the Install-Module Microsoft.Graph - Force command fails with a package source resolution error, enable TLS 1.2 by executing the provided command.

WARNING: Unable to resolve package source 'https://www.powershellgallery.com/api/v2/'

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12