Avatar of Garry Shape
Garry Shape
Flag for United States of America asked on

O365 - federated domain users who aren’t in On Prem AD

I’m seeing a small but strange issue in an environment that has Okta, on prem AD, Azure AD and O365.  

There are users in Azure/O365 with usernames using the federated domain.com, however I do not see them in on prem AD. They are classified as “in-cloud”.
So how come if I try and create another user in Azure or O365, I cannot specify the same domain.com in its username since I get an error that the domain is federated?
Microsoft 365Active DirectoryAzure

Avatar of undefined
Last Comment
Garry Shape

8/22/2022 - Mon
ASKER CERTIFIED SOLUTION
Mahesh

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
GET A PERSONALIZED SOLUTION
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.
Garry Shape

ASKER
I tried that but what happens is I get this error:
Set-MsolUserPrincipalName : You must provide a required property: Parameter name: FederatedUser.SourceAnchor

This indicates the user would need to be in Okta -- but the other users who are "in-cloud" and have the domain.com upn are not in Okta not AD.

That's why I'm wondering if maybe they were setup at a different time perhaps before the Domain was federated.  

Is there a way to see when the Domain was federated ?
SOLUTION
Mahesh

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
GET A PERSONALIZED SOLUTION
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.
Garry Shape

ASKER
Yes I tried setting it to federated one but got:

Set-MsolUserPrincipalName : You must provide a required property: Parameter name: FederatedUser.SourceAnchor.    
Okta appears to have the users in its People database but doesn't provision to O365.  There are some federated domain users who don't appear in Okta and neither in  AD.
Mahesh

it seems that users with federated domain showing as cloud only are created previously before you set O365 integration with OKTA (i.e federation)

are those users having active mailboxes?

If those are not in use, you can ignore them
OR
if you can create them in AD and sync to o365 with OKTA
All of life is about relationships, and EE has made a viirtual community a real community. It lifts everyone's boat
William Peck
Garry Shape

ASKER
Thanks yeah they were created before it was federated I learned.