We need to configure okta as IDP for azure ad applications. For example: When a user tries to access the enterprise application, they'll be challenged with a login page, which will be validated by OKTA. Post this authentication, the authorization will be handled by Azure and upon successful authorization, user will be shown a landing page of the application.

We have referred below links as reference for setup:

https://learn.microsoft.com/en-us/azure/active-directory/b2b/direct-federation https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-fed-saml-idp https://developer.okta.com/docs/guides/custom-url-domain/overview/

What we did so far?

1. Registered company "example.com" in okta. By default okta configures it as "example.okta.com"
2. Registered custom domain "id.example.com". Our okta instance is accessible using this domain
3. Created an enterprise SAML app (which also exist in Azure AD) in OKTA
4. Exported OKTA IDP metadata

Now, we are trying to import this IDP metadata as external identity provider in AAD. But it fails with below error, if we map example.com or id.example.com as domain name of federating idp. Because of these errors we’re unable to setup the custom domain of federated IDP(OKTA). Please assist us on the approach for the same.

Error Messages:

For domain as "id.example.com" Failed to add a SAML/WS-Fed identity provider.This direct federation policy does not pass one or more requirements. Go to aka.ms/b2b-direct-fed to learn more.

For domain as "example.okta.com" Failed to add a SAML/WS-Fed identity provider.This direct federation configuration is currently not supported. The authentication URL must match the domain for direct federation or be one of the allowed domains. Go to aka.ms/b2b-direct-fed to learn more.