Provisioning Migration: Okta to Entra ID¶

# Step 1: Identify the Entra Enterprise Application
$app = Get-MgServicePrincipal -Filter "displayName eq 'Salesforce'"

# Step 2: Enable provisioning
$provisioningConfig = @{
    provisioningMode = "automatic"
}
# Note: Provisioning configuration is typically done via the Entra admin center
# The Graph API for provisioning is under the /servicePrincipals/{id}/synchronization namespace

# Step 3: Configure provisioning credentials
# Navigate to Entra admin center > Enterprise Applications > {app} > Provisioning
# Enter SCIM endpoint URL and authentication token from the target application
# These are the same credentials used in Okta provisioning configuration

# Step 4: Configure attribute mapping (see section 3)

# Step 5: Test provisioning
# Entra admin center > Provisioning > Provision on demand
# Select a test user and verify provisioning succeeds

# Step 6: Start provisioning
# Set provisioning mode from "manual" to "automatic"
# Initial cycle runs; subsequent incremental cycles run every 40 minutes

# Configure Workday inbound provisioning
# This is configured via the Entra admin center:
# Enterprise Applications > Workday to Azure AD User Provisioning

# Key configuration steps:
# 1. Provide Workday API credentials (ISU account)
# 2. Map Workday worker attributes to Entra user attributes
# 3. Configure matching rules (Worker ID -> employeeId)
# 4. Set scoping filters (active workers, specific supervisory orgs)
# 5. Test with provision-on-demand
# 6. Enable automatic provisioning

# Configure SuccessFactors inbound provisioning
# Enterprise Applications > SAP SuccessFactors to Azure AD User Provisioning

# Similar configuration pattern to Workday:
# 1. Provide SuccessFactors API credentials
# 2. Map Employee Central attributes to Entra user attributes
# 3. Configure matching rules
# 4. Set scoping filters
# 5. Test and enable

# Step 1: Create Entra security groups matching Okta groups
$groups = @(
    @{ DisplayName = "Salesforce-Users"; Description = "Users provisioned to Salesforce" },
    @{ DisplayName = "ServiceNow-Users"; Description = "Users provisioned to ServiceNow" },
    @{ DisplayName = "Slack-Users"; Description = "Users provisioned to Slack" }
)

foreach ($group in $groups) {
    New-MgGroup -DisplayName $group.DisplayName `
                -Description $group.Description `
                -MailEnabled:$false `
                -MailNickname ($group.DisplayName -replace "[^a-zA-Z0-9]", "") `
                -SecurityEnabled:$true
}

# Step 2: Assign groups to enterprise applications
$salesforceApp = Get-MgServicePrincipal -Filter "displayName eq 'Salesforce'"
$salesforceGroup = Get-MgGroup -Filter "displayName eq 'Salesforce-Users'"

New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $salesforceApp.Id -Body @{
    principalId = $salesforceGroup.Id
    resourceId = $salesforceApp.Id
    appRoleId = "00000000-0000-0000-0000-000000000000"  # Default access role
}

# Step 3: Configure provisioning scope to "Sync assigned users and groups"
# This ensures only members of the assigned group are provisioned

# Create dynamic group equivalent to Okta group rule
# Okta rule: user.department == "Engineering" AND user.status == "ACTIVE"

New-MgGroup -DisplayName "Engineering-Dynamic" `
            -Description "All active Engineering department users" `
            -MailEnabled:$false `
            -MailNickname "EngineeringDynamic" `
            -SecurityEnabled:$true `
            -GroupTypes @("DynamicMembership") `
            -MembershipRule "(user.department -eq `"Engineering`") and (user.accountEnabled -eq true)" `
            -MembershipRuleProcessingState "On"

# Configure deprovisioning behavior
# In Entra admin center > Enterprise Applications > {app} > Provisioning > Settings

# Options for "When a user falls out of scope":
# 1. "Disable" - Sends SCIM PATCH to set active=false (recommended)
# 2. "Delete" - Sends SCIM DELETE to remove the user (use with caution)

# Accidental deletion prevention
# Entra provisioning includes a deletion threshold (default: 500)
# If more than threshold users would be deleted in a cycle, provisioning pauses
# This prevents mass deletion from misconfigured scoping filters

# Create a Joiner workflow (equivalent to Okta's onboarding automation)
$joinerWorkflow = @{
    displayName = "New Employee Onboarding"
    description = "Automated onboarding for new employees"
    isEnabled = $true
    isSchedulingEnabled = $true
    executionConditions = @{
        "@odata.type" = "#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions"
        scope = @{
            "@odata.type" = "#microsoft.graph.identityGovernance.ruleBasedSubjectSet"
            rule = "department eq 'Engineering'"
        }
        trigger = @{
            "@odata.type" = "#microsoft.graph.identityGovernance.timeBasedAttributeTrigger"
            timeBasedAttribute = "employeeHireDate"
            offsetInDays = 0  # On hire date
        }
    }
    tasks = @(
        @{
            displayName = "Generate TAP"
            taskDefinitionId = "1b555e50-7f65-41d5-b514-5894a026d10d"
            isEnabled = $true
            arguments = @(
                @{ name = "tapLifetimeMinutes"; value = "480" }
                @{ name = "tapIsUsableOnce"; value = "true" }
            )
        },
        @{
            displayName = "Add to Engineering group"
            taskDefinitionId = "22085229-5809-45e8-97fd-270d28d66910"
            isEnabled = $true
            arguments = @(
                @{ name = "groupID"; value = "engineering-group-id" }
            )
        },
        @{
            displayName = "Enable user account"
            taskDefinitionId = "6fc52c9d-398b-4305-9763-15f42c1676fc"
            isEnabled = $true
        },
        @{
            displayName = "Send welcome email"
            taskDefinitionId = "70b29d51-b59a-4773-9280-8841dfd3f2ea"
            isEnabled = $true
        }
    )
}

New-MgIdentityGovernanceLifecycleWorkflow -BodyParameter $joinerWorkflow

# Create a Leaver workflow (equivalent to Okta's offboarding automation)
$leaverWorkflow = @{
    displayName = "Employee Offboarding"
    description = "Automated offboarding when employees leave"
    isEnabled = $true
    isSchedulingEnabled = $true
    executionConditions = @{
        "@odata.type" = "#microsoft.graph.identityGovernance.triggerAndScopeBasedConditions"
        scope = @{
            "@odata.type" = "#microsoft.graph.identityGovernance.ruleBasedSubjectSet"
            rule = "department ne null"
        }
        trigger = @{
            "@odata.type" = "#microsoft.graph.identityGovernance.timeBasedAttributeTrigger"
            timeBasedAttribute = "employeeLeaveDateTime"
            offsetInDays = 0  # On leave date
        }
    }
    tasks = @(
        @{
            displayName = "Disable user account"
            taskDefinitionId = "1dfdfcc7-52fa-4c2e-bf3a-e3919cc12950"
            isEnabled = $true
        },
        @{
            displayName = "Remove from all groups"
            taskDefinitionId = "b3a31406-2a15-4c9a-b25b-a658fa5f07fc"
            isEnabled = $true
        },
        @{
            displayName = "Revoke all sign-in sessions"
            taskDefinitionId = "8a0b7d16-3e0f-4e82-b6d0-c5bfb41e5b6b"
            isEnabled = $true
        },
        @{
            displayName = "Remove access to all applications"
            taskDefinitionId = "4a0b64f2-c7ec-46ba-b117-18f262946c50"
            isEnabled = $true
        }
    )
}

New-MgIdentityGovernanceLifecycleWorkflow -BodyParameter $leaverWorkflow

# Check provisioning status for an application
$sp = Get-MgServicePrincipal -Filter "displayName eq 'Salesforce'"
$provStatus = Get-MgServicePrincipalSynchronizationJob -ServicePrincipalId $sp.Id

$provStatus | ForEach-Object {
    Write-Host "Job ID: $($_.Id)"
    Write-Host "Status: $($_.Status.Code)"
    Write-Host "Last execution: $($_.Status.LastExecution.ActivityIdentifier)"
    Write-Host "Last successful: $($_.Status.LastSuccessfulExecution.TimeBegan)"
    Write-Host "Quarantine status: $($_.Status.QuarantineStatus.CurrentBegan)"
}

# View provisioning logs
$provLogs = Get-MgAuditLogProvisioning -Filter "servicePrincipal/id eq '$($sp.Id)'" -Top 50

$provLogs | ForEach-Object {
    Write-Host "$($_.ActivityDateTime): $($_.Action) - $($_.ProvisioningStatusInfo.Status) - $($_.TargetIdentity.DisplayName)"
}