u/PruneAdventurous8058

This post contains content not supported on old Reddit. Click here to view the full post

Hey everyone,

I’m working on a project to move our Okta environment away from using AD agents on domain controllers and instead use Entra as the source of truth. I’m trying to figure out the correct approach before making any changes and wanted to see how others have handled this.

Our current setup is Okta AD agents pulling users and groups from multiple AD domains/OUs (basically everything is being synced). Apps are assigned in Okta using AD groups and Entra is already in place and syncing users from AD.

What I’m trying to figure out:

1. What actually needs to be configured inside Okta when switching from AD agents to Entra as the source?
   • Best practice for provisioning (SCIM vs other methods?)
   • How to properly scope users (we’re planning to use a single Entra group)
2. What happens with the existing Okta AD agents?
   • Is it just a matter of disabling sync and removing them after validation
   • Anything people have run into when decommissioning?
3. User and group behavior during migration
   • Will users and groups automatically clean themselves up in Okta once they’re no longer coming from AD?
4. Applications in Okta
   • Do we need to worry about apps breaking when switching identity sources?
   • Any common issues with group-based assignments when moving from AD → Entra?
5. Documentation / real-world experiences
   • I’ve found some Microsoft documentation around migrating provisioning, but it doesn’t fully cover the Okta side
   • Has anyone done this exact transition (Okta AD agent → Entra-based sync)?
   • Any blogs, guides, or lessons learned would be helpful

Main concerns:

• Breaking app access due to missing groups
• Duplicate users if attributes don’t line up
• Hidden dependencies on AD auth via agents

If anyone has gone through this or has a recommended approach/order of operations, I’d really appreciate it.