Okta introduced an OAuth-based consent flow leveraging the Microsoft Graph framework to enable provisioning in Microsoft Office 365 applications. This change eliminates the need for administrator credentials to set up provisioning and aligns with the Microsoft plan to enforce Multi-Factor Authentication (MFA) on administrators. Update the Microsoft Office 365 application in Okta to support Microsoft Graph and ensure provisioning integrations remain unaffected by enforcing MFA on administrators.

NOTE: This article only applies to environments with provisioning enabled in the Microsoft Office 365 application.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Microsoft Office 365 (M365 / O365)
• Microsoft Graph
• Multi-Factor Authentication (MFA)
• Provisioning

What are the important dates for the Microsoft Multi-Factor Authentication enforcement?

Review the following timeline detailing the Microsoft Multi-Factor Authentication (MFA) enforcement phases and the deadline for updating the Okta integration.

• As of December 31, 2024: Okta requires all environments to consent and leverage the upgraded integrations. If no action is taken, the provisioning integration for Microsoft Office 365 with Okta might be affected.
• Phase 1: Starting Oct 2024, enforcement for MFA at sign-in for only the Azure portal rolled out gradually to all tenants. This phase did not impact other Azure clients, such as Azure CLI, Azure PowerShell, and IaC tools.
• Phase 2: Starting in Oct 2025, enforcement for MFA at sign-in for Azure Command Line Interface (CLI), Azure PowerShell, and Infrastructure as Code (IaC) tools gradually rolled out to all tenants.

Review the prerequisites required to update Microsoft Office 365 applications.

Ensure the following requirements are met before proceeding with the update:

• A Microsoft Office 365 application with provisioning enabled
• An Application Administrator role in Okta to migrate the Microsoft Office 365 provisioning applications
• A Microsoft Global administrator credential with MFA enabled to update the provisioning in Okta

How is the Microsoft Office 365 application updated to support Microsoft Graph?

Update the Microsoft Office 365 application by navigating to the application in the Okta Admin Console, accessing the provisioning integration settings, and authenticating with Microsoft Office 365.

1. In the Okta Admin Console, go to Applications > Applications.
2. Select the Microsoft Office 365 application with provisioning enabled.
3. Select the Provisioning tab and select the Integration menu.
   
   The following image displays the Integration menu within the Provisioning tab of the Microsoft Office 365 application.

4. Click Edit.
5. If the Authenticate with Microsoft Office 365 button is visible, click it to provide consent and click Save.
   If the Reauthenticate with Microsoft Office 365 button is visible, click Save.

NOTE: For any issues related to migration, contact Okta Support.

Related References

• Update Okta Office 365 App Instance with Manual Federation to Support Microsoft Graph
• Update Office 365 Single Sign-on Applications with Automatic Configuration to Support Microsoft Graph
• Frequently Asked Questions about Mandatory MFA Requirements for Microsoft Applications