You've probably thought about it. Your clients run on Microsoft Entra ID, and it mostly works. You also know exactly where it doesn't: admin work repeated tenant by tenant, provisioning that covers fewer apps than your clients use, and a licensing step-up every time a client needs more. Okta does more. But moving clients sounds like a project full of unknowns, and the devil you know is at least a devil you know.
If you're still weighing why Okta is worth it, our guide Why Switch from Entra ID or Duo to Okta? makes the case. This post is about what comes next: the move itself.
Here's what it involves, the questions MSPs ask us most, and where your time goes once you're on the other side. Spoiler alert: for a typical Microsoft 365 client, the core integration takes under two hours, and it goes live in the middle of a business day.
What changes when you move from Entra ID to Okta?
The biggest misconception about this move is in the word "migration." Your clients don't leave Microsoft 365. They keep Outlook, Teams, SharePoint, and the Microsoft plans they already have. Users keep their mailboxes, files, and calendars.
What changes is who's in charge of identity. Okta becomes the identity provider, and Microsoft 365 is federated to it. When a user signs in to Outlook or Teams, Microsoft hands authentication to Okta, and Okta applies your sign-in and MFA policies. The same identity and the same policies can then extend to every other app the client uses.
Entra ID is the identity service built into Microsoft 365, so in practice, moving a client from Entra ID to Okta means integrating Microsoft 365 with Okta. Okta’s Universal Directory becomes the single source of truth for every identity, and Okta takes over sign-in, MFA, and access policies. Microsoft 365 keeps its own user accounts, as every app does, but Okta creates, updates, and removes them automatically, so you manage everyone in one place. That’s why the steps below are framed around Microsoft 365.
So this isn't a rip-and-replace. It's a new identity layer above the Microsoft stack your clients already rely on.
Do clients pay for both Entra ID and Okta?
No. This is the part of the math that surprises most MSPs.
Your clients aren't buying Entra ID. It comes inside the Microsoft 365 plan they already have for email, Office, and device management, usually Business Premium. They'd keep paying for that plan with or without Okta. So Okta isn't a duplicate bill. It's the identity system you run, day to day.
Going beyond the basics costs more on any platform. What differs is how you pay for it. When a client needs risk-based access, identity governance, or threat protection, Microsoft's path is a license step-up such as Entra ID P2 or Entra ID Governance, on an annual commitment, or about 20% more to stay month to month. Through ZeroTek, the only way for MSPs to buy Okta month to month, you add exactly the capabilities that client needs, billed on that month's user count. And in many environments, Okta retires something (and eliminates any associated costs) rather than adding to the pile: a separate MFA tool like Duo, on-premises AD servers, shared admin accounts.
Your clients don't buy identity licenses anyway. They buy security, new hires who are ready on day one, leavers who are locked out instantly, and quick answers when the insurer calls. That's what you deliver.
Which leaves the cost that never appears on an invoice: time. That's where the gap opens up.
How does an Entra ID to Okta migration work?
The technical work runs in five stages and takes under two hours of hands-on time. Go-live happens mid-workday, with no weekend or after-hours cutover.
Prepare the tenant. Tidy up the few things that would otherwise trip you up: confirm every user is correctly identified in Microsoft 365, move printers, scanners, and tools still using legacy authentication onto modern authentication, and set up a dedicated service account for the integration.
Connect and import. Connect Okta to Microsoft 365 and bring the client's users across. From here, Okta is where you manage them.
Automate. Turn on provisioning and group-based licensing. A user you create in Okta appears in Microsoft 365 with the right license, and a user you deactivate is blocked everywhere.
Activate users. Users activate their Okta accounts and set up Okta Verify, guided by a short communications plan.
Go live. Federate the client's domain with Okta during business hours. Active sessions stay active while the change rolls out across Microsoft's infrastructure.
That's it.
For a closer look at each stage, see our Okta–M365 Integration guide. ZeroTek partners can sign in for the full step-by-step procedures.
Real-world example: a client moved to Okta in one day
When NENS, now part of Harbor IT, had a client under active attack, they locked the environment down and moved it to Okta in a single day, with email restored the same day. That was three years ago, in the worst conditions imaginable. With today's field-tested baseline and streamlined setup, the same move is faster still.
How long does it take to move a client's apps to Okta?
The stand-up is fast and fixed. The rollout is yours to pace.
Microsoft 365 moves to Okta for every user at once, so everyone is activated before go-live. What you pace is everything after that. Once Microsoft 365 is live, you add the client's other apps to Okta one at a time, starting with the ones they use most. Okta's catalog makes this fast: more than 8,000 pre-built app integrations, using single sign-on where an app supports it and secure password vaulting where it doesn't, and more than 800 with automated provisioning, hundreds more than Duo or Microsoft offer, and most take 30–60 minutes to set up. Turn on automated provisioning for each app that supports it, and Okta handles more of your onboarding and offboarding with every app you add.
“Okta’s my first choice for IAM. The app integrations are so much easier than in other platforms, and the policy engine is really solid and logical.”
— Chris Cazel, Consultant, Dark Rhiino Security
There's no deadline and no big-bang moment. A client with three apps can be fully done in an afternoon. A client with forty can move over a few days or a couple of weeks, with every step delivering value as it lands.
Common questions about moving from Entra ID to Okta
Will users lose email access during go-live?
No. Users are activated in Okta before the domain is federated, so everyone can sign in from the moment it goes live. Sessions they already have keep working, and because go-live happens mid-workday, you're on hand if anyone needs help—which is, based on our experience with our partners and the thousands of SMBs they support, vanishingly rare.
How do passwords and MFA enrollment work in Okta?
It's simpler than you'd expect, and more secure. ZeroTek's recommended Okta security baseline configuration, which ZeroConfig can roll out to a new client in minutes, sets up phishing-resistant MFA from day one. When users enroll, they create an Okta password, which must meet high complexity standards before Okta accepts it. But in most cases, that password never gets used again. Instead, users only sign in with fast, phishing-resistant methods that are easier for them and much harder for attackers.
What happens to Conditional Access policies after moving to Okta?
You don’t translate them one by one. Once Microsoft 365 is federated, Okta handles sign-in, and Okta’s policies take over the job Conditional Access was doing. ZeroTek’s recommended baseline covers most of it from day one, from phishing-resistant MFA to protection for admin accounts.
That baseline is also a foundation to build on. Okta’s policies follow a clear, logical structure: one layer decides how users sign in to Okta, another sets the requirements for each app, and rules in each layer can target groups, networks, devices, and risk. So a bespoke requirement, like finance staff reaching the banking app only from managed devices on the office network, becomes one readable rule instead of a set of overlapping Conditional Access policies.
“Microsoft’s Conditional Access—with security groups, specific exclusions, all across multiple overlapping policies in M365—can get confusing fast. It’s been so much easier to configure and manage access in Okta, even for more complex needs and edge cases. Okta’s global policy and federation approach has let us remove Conditional Access policies from M365 altogether. Okta logging actually tells a helpful story that our engineers can follow, so troubleshooting is quick.”
— Kristian Sanchez, Senior Security Consultant, NENS (now part of Harbor IT)
How do Entra-joined Windows devices work with Okta?
Okta has governing policies for Entra ID-joined Windows devices that enable seamless authentication once Microsoft 365 is federated with Okta. After go-live, users sign in to those devices with their Okta credentials, or with Windows Hello if they already use it.
What happens to printers, scanners, and MSP tools?
Accounts that still use legacy authentication are identified before go-live and either moved to modern authentication or kept off the federated domain. Nothing gets stranded.
Do clients need to change their Microsoft 365 licensing?
No. Clients keep the Microsoft 365 plans they already have.
Some may even save. If a client added Entra ID P2 or Entra ID Governance licenses for risk-based access or access reviews, Okta can take over those jobs, and the add-on can often be dropped at renewal.
Where does Okta save MSPs time?
The migration is a one-time job. The time savings come back every week, for every client.
A common security baseline for every client
With ZeroTek, each client’s Okta org is built on the same proven security baseline, so they're well protected from day one and rollout is fast because nothing is designed from scratch. Consistency pays off on the help desk too. Your technicians can count on the fundamentals being in place for every client, so troubleshooting starts with the problem, not with working out how this tenant was initially set up. Element Technologies, which manages more than 50 Okta orgs through ZeroTek, standardized its baseline this way and cut new-client setup from hours to minutes.
Automated onboarding and offboarding
Okta Lifecycle Management (LCM) automates provisioning and deprovisioning for more than 800 apps, including Microsoft 365. For most clients, that covers most or all of their stack. Create a user in Okta, and they appear in Microsoft 365 with the right license, with accounts ready in every other app that supports LCM. New hires are productive on day one. When Boston Tech Advisors moved a 500-user client to Okta through ZeroTek, onboarding went from days to minutes. Deactivate a user, and they lose single sign-on access to every app in Okta at once. Their Microsoft 365 sign-in is blocked immediately, their cached sessions in Outlook and mobile mail apps are revoked, and their accounts in every other app that supports LCM are removed automatically. There's no waiting for policy changes to replicate and no revoking sessions user by user. And ZeroTek puts every client in one console, so you never log in and out of tenants to get it done.
Audit and cyber insurance evidence in seconds
When a cyber insurance questionnaire or a compliance audit lands, everything you need to prove is in one place: who has access to what, how MFA is enforced, and what's changed. ZeroTek Audit records every admin action across every client, with optional links to your PSA tickets. Answers take seconds to find instead of an afternoon of digging through logs and consoles.
We won't put a dollar figure on any of this. You know what an hour of your team's time is worth.
How to add Okta capabilities as clients grow
Okta Pro through ZeroTek gives every client enterprise-class identity from day one. When a client's requirements go further, you extend it with add-ons like Okta Workflows, Identity Governance (OIG), and Identity Threat Protection (ITP), added to that client's org month to month and billed on each month's user count. There's no annual commitment, no premium for staying flexible, and no second migration.
Each add-on saves time while it raises security. Why Switch From Entra ID or Duo to Okta? takes a closer look at two of them.
Get help planning your first Entra ID to Okta migration
The devil you don't know is only a devil until you've seen it up close. ZeroTek's Okta-certified experts know both Okta and the MSP world, and they can help with any step, from a quick question to whole roll-outs. New partners also get hands-on, guided deployments as a free part of onboarding, so your team learns Okta fast. Book a call to walk through what moving one of your clients would look like.
“ZeroTek’s technical support consistently provides the best professional services and support I’ve experienced in my 30 years in IT. The team really took the time to understand my goals and then accelerated the process of reaching them.”
— Benjamin Katz, Founder and CTO, Boston Tech Advisors