Federating Microsoft Entra ID with Okta: Cross-Platform Identity Integration

Organizations using Microsoft Entra ID (formerly Azure AD) as their primary identity provider often need to provide users access to applications managed by Okta. This federation enables seamless single sign-on from Entra ID to Okta-managed applications using SAML 2.0.

Prerequisites

• Microsoft Azure tenant with Entra ID P1 license or higher
• Okta organization with administrative access
• Global Administrator permissions in Entra ID
• Super Admin permissions in Okta

Architecture Overview

Identity Provider: Microsoft Entra ID (manages users and authentication)
Service Provider: Okta (provides applications and services)
Flow: User → Entra ID (authenticate) → Okta (federate) → Applications

Step 1: Create Enterprise Application in Entra ID

Navigate to Enterprise Applications

1. Log into Azure Portal (portal.azure.com)
2. Navigate to Microsoft Entra ID
3. Select Enterprise applications from the left menu
4. Click New application

Create Custom Application

1. Select Create your own application
2. Configure application settings:
   • Name: Okta Federation (or descriptive name)
   • Integration type: Select “Integrate any other application you don’t find in the gallery”
3. Click Create

Configure Single Sign-On

1. After creation, navigate to Single sign-on in the application menu
2. Select SAML as the authentication method

Generate SAML Certificate

In Section 3 (SAML Signing Certificate):

1. Click Edit pencil icon
2. Click New Certificate
3. Set expiration (default 3 years is acceptable)
4. Click Save
5. Download certificate in Base64 format
6. Save certificate file securely

Collect Identity Provider Details

From Section 4 (Set up [Application Name]):

• Copy Login URL
• Copy Microsoft Entra Identifier

Keep these values accessible for Okta configuration.

Step 2: Configure SAML Identity Provider in Okta

Create New Identity Provider

1. Log into Okta Admin Console
2. Navigate to Security > Identity Providers
3. Click Add Identity Provider
4. Select SAML 2.0 IdP

Basic Configuration

Identity Provider Settings:

• Name: Entra ID Federation
• IdP Username: idpuser.subjectNameId
• Filter: Leave blank
• Match against: Okta username

Account Link and Provisioning Settings

Account Link Policy:

• ✓ Automatic (recommended for seamless experience)

Provisioning Policy:

• ✓ Auto-Link users
• ✓ Create users if one does not exist (JIT)
• ✓ Update attributes for existing users

Group Assignment:

• Assign to Groups: Create or select group for federated users
• This enables targeted policies for Entra ID users

SAML Protocol Configuration

Certificate:

• X.509 Certificate: Upload Base64 certificate from Entra ID

Endpoints:

• IdP Issuer URI: Microsoft Entra Identifier (from Step 1)
• IdP Single Sign-On URL: Login URL (from Step 1)
• IdP Single Log-Out URL: Leave blank (optional)

Click Add Identity Provider to create the configuration.

Collect Service Provider Details

After creation, copy the following from the IdP details page:

• Assertion Consumer Service URL
• Audience URI

Step 3: Complete Entra ID Application Configuration

Configure Basic SAML Settings

Return to Entra ID Enterprise Application > Single sign-on

In Section 1 (Basic SAML Configuration):

1. Click Edit
2. Enter values from Okta IdP:
   • Identifier (Entity ID): Audience URI from Okta
   • Reply URL (Assertion Consumer Service URL): ACS URL from Okta
3. Click Save

Configure User Attributes & Claims

In Section 2 (User Attributes & Claims):

Default claims are provided, but note the namespaces for Okta mapping:

• Email: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
• Given Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
• Surname: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
• Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Step 4: Configure Attribute Mapping in Okta

Access Profile Editor

1. In Okta Admin Console, navigate to Directory > Profile Editor
2. Find your Entra ID Identity Provider profile
3. Click Mappings > Configure User mappings

Reset Existing Mappings

Clear Current Mappings:

1. For all attributes except login, click the blue dropdown arrow
2. Select Do not map to clear existing mappings

Delete and Recreate Custom Attributes

Delete existing custom attributes and recreate:

Email Attribute:

• Variable Name: email
• External Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
• Attribute Type: string

First Name Attribute:

• Variable Name: firstName
• External Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
• Attribute Type: string

Last Name Attribute:

• Variable Name: lastName
• External Name: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
• Attribute Type: string

Add Required Entra ID Claims

Based on authentication logs analysis, create additional custom attributes:

Tenant ID:

• Variable Name: tenantId
• External Name: http://schemas.microsoft.com/identity/claims/tenantid

Identity Provider:

• Variable Name: identityProvider
• External Name: http://schemas.microsoft.com/identity/claims/identityprovider

Object Identifier:

• Variable Name: objectIdentifier
• External Name: http://schemas.microsoft.com/identity/claims/objectidentifier

Authentication Methods:

• Variable Name: authMethods
• External Name: http://schemas.microsoft.com/claims/authnmethodsreferences

Configure Profile Mappings

1. Navigate to Profile Editor > [IdP Profile] > Mappings
2. Map the following attributes:
   • firstName → user.firstName
   • lastName → user.lastName
   • email → user.email
   • displayName → user.displayName

Step 5: Assign Users and Test Federation

Assign Users in Entra ID

1. In Entra ID Enterprise Application, navigate to Users and groups
2. Click Add user/group
3. Select target users or groups for Okta access
4. Assign appropriate roles if needed

Test Authentication Flow

Initial User Experience:

1. User navigates to myapps.microsoft.com
2. Authenticates with Entra ID credentials
3. Clicks Okta Org tile
4. First-time users may need to:
   • Complete additional authentication challenges
   • Set up Okta profile information
5. Successfully lands on Okta dashboard with assigned applications

Verification Steps

Administrative Verification:

1. Check Okta System Log for successful SAML assertions
2. Verify user creation in Directory > People
3. Confirm group assignment for federated users
4. Test application access from Okta dashboard

Troubleshooting Common Issues

SAML Response Errors

“General Nonsuccess” Error:

• Review attribute mappings in Okta Profile Editor
• Verify all required claims are mapped correctly
• Check Okta System Log for detailed error messages

“Unable to JIT” Error:

• Confirm user email format matches Okta username requirements
• Verify email attribute mapping is correct
• Check for conflicting existing users in Okta

Authentication Failures

Certificate Issues:

• Verify certificate is in Base64 format
• Check certificate expiration date
• Ensure certificate upload completed successfully

Endpoint Configuration:

• Confirm Issuer URI matches Microsoft Entra Identifier exactly
• Verify Sign-On URL is correct from Entra ID
• Check for trailing slashes or extra characters

User Provisioning Problems

Missing Attributes:

• Review Entra ID claims configuration
• Verify namespace URLs match exactly
• Check attribute case sensitivity

Group Assignment Issues:

• Confirm federated user group exists in Okta
• Verify group policies are configured correctly
• Check application assignments for federated user groups

Security Considerations

Certificate Management

• Monitor certificate expiration dates
• Implement certificate rotation procedures
• Use strong certificate key lengths (2048-bit minimum)

User Access Controls

• Implement conditional access policies in Entra ID
• Configure appropriate Okta policies for federated users
• Regular access reviews for cross-platform users

Monitoring and Auditing

• Enable comprehensive logging in both platforms
• Monitor for unusual authentication patterns
• Implement automated alerting for failed federations

Advanced Configuration Options

Conditional Access Integration

• Configure Entra ID conditional access for Okta access
• Implement device-based access controls
• Set up location-based restrictions

Multi-Factor Authentication

• Configure MFA requirements in Entra ID
• Set up Okta MFA policies for federated users
• Implement step-up authentication scenarios

This federation enables seamless user experience while maintaining security boundaries between Microsoft and Okta identity platforms, providing centralized access management across hybrid identity infrastructures.

Federating Microsoft Entra ID with Okta: Cross-Platform Identity Integration