Okta → Entra ID

Migrate SSO applications from Okta to Entra ID in hours, not months.

TenantFlex reads every SAML and OIDC application in your Okta org, maps its claims to Entra ID's own form, and recreates it in the Microsoft Entra ID tenant with an execution log and a hand-off bundle for each owner. The Okta side is read-only throughout.

Request a demo

Microsoft Entra IDOktaPingOneadditional IdPs on request

Okta → Entra ID · in production

What moves

Saml 2.0 and oidc applications, recreated as SAML enterprise applications and OIDC app registrations.

SAML

Entity ID, reply and sign-on URLs, NameID format and the attribute statements. A new signing certificate is generated on the Entra ID side; the application owner installs it at cutover.

OIDC and OAuth

Redirect URIs, grant types, scopes and API permissions. Client secrets are generated on the Entra ID side and handed to the owner once, never copied.

Reported, not moved

User and group assignments, conditional access or sign-on policies, and SCIM provisioning are read and shown in discovery so the owner can recreate them deliberately. SCIM migration is on the roadmap.

How it works

Discover, review, migrate.

Discover

Connect an identity provider tenant in read-only. TenantFlex inventories its SAML and OAuth/OIDC applications, service principals, credentials and their expiry. You see what is really there, not what the CMDB says.

Review

Approve what is in scope, set naming and credential handling, and get suggestions for complex claims transformations. Nothing migrates until it is approved.

Migrate and hand off

Each application is recreated in the target tenant, read back and compared with the source, then handed to its owner for cutover. If one fails, the job rolls back what it created.

Okta to Entra ID, step by step

Connect the Okta org as the source and the Entra ID tenant as the destination. The Okta connection only needs okta.apps.read; the Entra connection needs Application.ReadWrite.All so it can create applications and their claims configuration.

Run discovery on the Okta org to list every SAML application with its sign-on configuration, attribute statements and assignments, and to band each one as straightforward, needs review or manual work. Pre-approve the applications in scope, create a migration job with a naming template, and run it. TenantFlex creates each application in Entra ID as an enterprise application with SAML single sign-on configured from the Okta settings (identifier, reply URL and NameID) and a claims policy built from the Okta attribute statements. Every stage is written to an execution log, including any setting Entra ID refuses, such as an identifier on a domain the tenant has not verified.

The application owner then points the service provider at the Entra ID federation metadata (login URL, identifier and signing certificate) at a time that suits them.

Claims

Okta writes `${user.email}`. Entra ID expects `user.mail`.

Each provider's claims are translated to one shared vocabulary, the central TenantFlex profile vocabulary, and written back in the destination's own format. Claims that map to a standard user attribute migrate automatically. Claims that use transformations, expressions or attributes the destination does not have are reported as complex in discovery, so they are reviewed before anything moves. Custom claims can be mapped to destination claims for a whole job or for a single application.

At cutover

TenantFlex provides a handover bundle per migrated application. For a SAML application: the identity provider login URL, the identity provider identifier and the signing certificate, all of which are in the destination's federation metadata. For an OIDC application: the client ID, the client secret and the issuer URL. Until the owner makes the change, users keep signing in through the source tenant, so each application can be cut over on its own schedule, aligned with your change management processes and maintenance windows.

How long it takes

Recreating an application in the destination takes minutes. Most of the elapsed time in a tenant migration is cutover coordination with application owners, so a plan is usually built back from a date: discovery about three months ahead, a pilot wave, then the remaining waves as scheduled jobs.

Same provider on both sides?

Yes. The destination can be any connected tenant, including one at the same provider: Entra ID to Entra ID after an acquisition, or Okta org to Okta org when two business units consolidate. The naming template keeps the migrated applications distinguishable from the originals.

Permissions for this pair

Read-only on Okta. Write only on Entra ID.

Okta · source

Read applicationsokta.apps.read

Lists applications with their sign-on mode, SAML and OIDC configuration, assignments and signing certificates. The API client also needs an administrator role that can read applications.

Optionalokta.appGrants.read
Only so an OAuth application's API permissions are read rather than reported as unknown.
Never needed on the source
No write permission is asked for on the org you are leaving.

Microsoft Entra ID · destination

Create applicationsApplication.ReadWrite.All

Creates the applications and their claims configuration.

Read back after each write
Every setting is read back from Entra ID and compared with the source. A failed application is rolled back.

The full list, including the optional scopes for discovery features, is in the permissions reference.

Permissions reference →How it works

Other pairsEntra ID → Okta Entra ID → PingOne Okta → Entra ID Okta → PingOne PingOne → Entra ID PingOne → Okta

Pricing

Pay for the applications you move, or hand the whole thing to us.

Licensed per application in scope. Discovery tells you the number before you commit.

Two ways to engage.Take the platform, or take the platform and the people.

Licensed per application

You license the platform by the applications in scope, not by user count or tenant size. Discovery tells you that number before you commit. SaaS or deployed in your own environment, the same release either way.

Self-service

White-glove migration

We run it with you: scoping, the claim and policy decisions that need a human, a cutover plan per application, and the hand-off to each application owner. You get the platform and the practitioners who have done these migrations by hand.

With consultancy

Standby and the privileged access review are priced separately.

Pricing →

Get started

Bring your Okta to Entra ID migration to TenantFlex.

Tell us roughly how many applications are in the org and what is driving the move. We will walk you through a live migration, read-only on Okta throughout.

[email protected] · www.tenantflex.com