Update Office 365 to Support Application-Based Authentication for Okta Provisioning
Last Updated:
Overview
Okta continuously improves integrations to deliver the highest standards of security and reliability. In alignment with Microsoft's transition, Okta is proactively modernizing its Office 365 provisioning architecture. This involves upgrading the integration from the legacy service account model to a secure, advanced Application-Based Authentication (ABA) model.
Administrators can begin re-authenticating ahead of Microsoft's enforcement deadline of September 30, 2026 - after which provisioning will stop for tenants that have not re-authenticated.
Applies To
- Okta Identity Engine (OIE) and Okta Classic Engine
- Customers using the Office 365 or Office 365 GCC High app for Provisioning (user sync or universal sync) using either MSol or MS Graph.
- Only apps configured before this feature's release in the August monthly as the new architecture is by default.
What Prerequisites Are Required Before Updating Office 365 Provisioning?
An Office 365 application with provisioning enabled, an Okta App Administrator role, and a Microsoft Global Administrator credential with multifactor authentication (MFA) enabled are required before updating an Office 365 application to support Application-Based Authentication.
- An Office 365 application with provisioning currently enabled.
- An Okta App Administrator role in Okta to configure Office 365 provisioning.
- A Microsoft Global Administrator credential with MFA enabled to update the provisioning settings in Okta.
What Changes with Application-Based Authentication and Why Does It Matter?
Okta is modernizing the Office 365 integration by moving to a resilient Application-Based Authentication (ABA) framework. This update introduces two components that become visible in the Microsoft environment: the Application Registration, which serves as the configuration blueprint, and the Service Principal, which serves as the enterprise identity that executes the provisioning operations.
How Does an Administrator Update Office 365 to Support Application-Based Authentication?
During the authentication process, administrators grant consent to a set of permissions that includes 2 new permissions: Application.ReadWrite.All and AppRoleAssignment.ReadWrite.All, both of which are strictly used for provisioning as detailed in the Permissions Reference Documentation.
Update Office 365 applications with Provisioning enabled to support Application-based Authentication.
- In the Admin Console, navigate to Applications.
- Select the Office 365 application.
- Select the Provisioning tab, then choose Integration from the left-hand settings menu.
- Select Edit.
- Select Re-Authentication, then grant the permissions when prompted.
- Select Save.
NOTE: Administrators may encounter an error notification stating, "The client secret for the ADSync app is invalid or has been removed. Please re-authenticate to remediate the provisioning". This issue may be attributed to potential replication latencies on the Microsoft platform. To resolve this condition, initiate a re-push of the impacted application instance. To re-authenticate, Admins must select 'edit and save' operation within the provisioning setting of the respective application instance, or retry the push process from the Tasks page for the impacted application instances.
For Preview orgs: Administrators must re-authenticate after the July 8th release to enable the update.
For Production orgs: Administrators must re-authenticate after the August 11th release to enable the update.
