← All projects

IAM Engineer

Okta → Entra ID Workforce Migration

Consolidated two identity providers after a merger and migrated 120+ SSO apps with zero unplanned downtime.

  • Okta
  • Entra ID
  • SCIM
  • SAML/OIDC
  • PowerShell
  • Terraform

Sample case study — realistic but fictional. Replace with your own engagement and metrics.

Context

After acquiring a competitor, the combined company ran two identity providers in parallel: the acquirer on Okta, the acquired org on Entra ID. Employees who worked across both sides juggled two logins, and licensing two IdPs was an obvious cost. Leadership chose to standardize on Entra ID to align with the existing Microsoft 365 estate.

Problem

  • 120+ SSO integrations lived in Okta — SAML, OIDC, and a long tail of bookmark apps.
  • Provisioning was opaque. Several apps relied on Okta SCIM; turning Okta off without a replacement would strand accounts and break deprovisioning.
  • No room for a flag day. A single big-bang cutover risked locking thousands of users out of business-critical tools simultaneously.

Approach

  • Built an application inventory scored by protocol, provisioning method, and business criticality, then sequenced waves from low- to high-risk.
  • Stood up Entra ID enterprise apps alongside the live Okta ones and migrated SCIM provisioning app-by-app, so deprovisioning never lapsed.
  • Ran a per-wave cutover with verification and a documented rollback, instead of a single flag day.
  • Scripted repetitive app config and user assignment in PowerShell + Terraform to keep 120 migrations consistent and auditable.

Architecture

AfterUsersEntra IDSame apps, one IdPPer-wave cutovernoyesApp inventory + risk scoreMigrate waveLogin + SCIM verified?Roll back to OktaDisable Okta appBeforeUsersOkta120+ SaaS apps

Outcome

  • 120+ applications migrated across staged waves with zero unplanned downtime.
  • Okta decommissioned, removing a full IdP license tier from the budget.
  • Single sign-on for all staff behind one IdP, with provisioning and deprovisioning consolidated into Entra ID lifecycle workflows.
  • Each wave shipped with a rollback that was rehearsed but never needed in production.

Stack

  • Okta + Entra ID — source and target identity providers during the migration.
  • SCIM — automated user provisioning/deprovisioning, migrated per app.
  • SAML / OIDC — the federation protocols behind the SSO integrations.
  • PowerShell + Terraform — repeatable, reviewable app and assignment configuration.