v2f9s (v2f9s) asked a question.
Hi everyone,
We’re currently using Okta Classic with Entra ID configured as cloud-only. Our domain is federated with Okta via WS-Fed.
We’re encountering an issue when attempting to create accounts directly in Entra ID using the federated domain. The error message indicates a missing source anchor.
We’ve found a workaround: creating accounts in Okta using the federated domain and then pushing them to Entra ID via the Office 365 app API integration. However, our goal is to source accounts directly from Entra ID.
Question 1:
Is it possible to use Universal Directory Sync in Okta to source accounts from Entra ID? If so, could you please provide a detailed guide or best practices?
Question 2:
What are the potential benefits of switching from WS-Fed to secure web auth?
Any insights or suggestions would be greatly appreciated.
Hello @v2f9s (v2f9s) , thank you for contacting Okta Community.
You could look into setting up Entra ID as an identity provider:
Make Azure Active Directory an Identity Provider - this article also covers JIT (Just-In-Time) settings which allow user profile updates upon logging into Okta
If you do decide to go through with the above, then it will no longer be leveraging WS-Federation. It will be using SAML instead.
As for the second question, there are no benefits to switching from WS-Fed to SWA.
Regards.
--
Help others in the community by liking or hitting Select as Best if this response helped you.
Thank you for your response. This doesn't solve the problem in my case, however. The company still wants Okta to handle authentication. How can I have accounts created in Entra ID directly and then synced to Okta?
I am currently able to create the account in Okta, which syncs to Entra. I then add the proper group memberships in Entra ID (that handle licensing), Okta will discover those new groups based on an import job. Lots of syncing going on when it should just be one sync from Entra ID.
@v2f9s (v2f9s) You can use either Okta or Entra for provisioning. The typical flow is unidirectional.
The Universal Directory route could be used, but it is not recommended. If account information differs, users could be deactivated.
If your company has a paid account, they can use it to open a support ticket here. It could be helpful to discuss the implementation with one of our engineers and receive personalized assistance.
Regards.
—
Help others in the community by liking or hitting Select as Best if this response helped you.
My current configuration is now Entra ID only (no longer syncing from on-prem AD to Entra ID). All accounts are now "cloud only" in Entra ID.
When I try to create directly in Entra ID, it doesn't let me pick the domain that's federated with Okta. It complains about missing a source anchor. Maybe it's a problem with the way entra id connect sync was configured and not an Okta issue. I have a ticket open with Microsoft on this.