uqswq (uqswq) asked a question.
Hello,
As of today we are federating our Office 365 environment with Okta, and we have been using a regular "Profile Sync" for the Okta to App provisionning.
Today we wanted to make it further and start using our on-prem AD (which sources Okta) to manage distribution groups.
But indeed we need to enable the universal sync.
Will I be able to change this on the go ? Will there be repercussions for the users already synced ?
Important thing to mention as well; most of our office users, used to be "standalone". What I mean is, that we had Office running alone before using Okta, meaning that all of these users, where synced FROM office to match their Okta (AD) counterpart.
Will you think it's possible for me to make these changes ?
Hi @uqswq (uqswq) , Thank you for reaching out to the Okta Community!
The typical user data flow would be AD → Okta → O365, so I would recommend reviewing the O365 Provisioning guide for a few of the extra mentions for Universal Sync as well as the ones mentioned under Provisioning Types doc.
The most important in my opinion being: "Once you select User Sync or Universal Sync, you can’t change your selection back to Profile Sync, unless your org has the Microsoft Graph API feature enabled. "
Going over the Attribute list won't hurt either.
I would also recommend scheduling the enablement for off-hours to be able to mitigate any potential down-time caused by unforeseen circumstances.
If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you.
Hope my answer helps!
--------------------------------
Community members help others by clicking Like or Select as Best on responses. Try it today.