TinaG.66602 (Customer) asked a question.
We are planning to switch to the ms-DS-ConsistencyGuid as sourceAnchor in our Azure AD connector, currently its set to objectGUID.
The only document I could find regarding this change is here: https://support.okta.com/help/s/article/How-to-change-the-ImmutableID-to-ms-consistency-guid-anchor-for-office365?language=en_US
This article must apply only if you are using a provisioning type other than Licenses and Roles Management Only because the Licenses and Roles Management Only does not support syncing the attribute ms-DS-ConsistencyGuid per https://help.okta.com/en-us/Content/Topics/Directory/Directory_AD_Field_Mappings.htm
If we are using Licenses and Roles Management Only are there any considerations we need to take into account?
Hi @TinaG.66602 (Customer) , Thank you for reaching out to the Okta Community!
Assuming that we're talking about a default, out-of-the-box O365 implementation with the "Licenses and Roles Management Only" Provisioning type enabled - the change to ms-DS-ConsistencyGuid would have no use or impact as the immutableID attribute is not leveraged.
Even if for some reason (maybe an older provisioning setting) the immutableID would show up on the attribute mappings setting side, it would be set to "Create Only" (only applies the attribute on User Creation) and the "Licenses and Roles Management Only" Provisioning type does not support User Creation.
That being said, I do not have knowledge of the possible intricacies of your particular environment. As such, I always recommend testing such implementations in a preview/demo environment whenever possible.
If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you.
Hope it helps!