Just finished a 14-month migration from Okta to Azure AD for a Fortune 500's entire external-facing app portfolio. The business driver was "consolidation," but the technical reality was a mess of custom SAML integrations and legacy systems.
The biggest pitfall wasn't the migration itself, but the observability black hole it created. Okta's system logs and events pipeline, while not perfect, was a known quantity. Azure AD's diagnostic settings and log routing to something useful (like a Grafana/Loki/Prometheus stack) is a configuration nightmare that they don't warn you about.
Here are the raw technical wins and pitfalls:
**Pitfalls:**
* **Tracing Context Loss:** Our legacy apps used Okta's `id_token` for user context in logs. Azure AD's token claims are structured differently. We had to instrument **every app** with OpenTelemetry to propagate the new `oid` and `tid` properly. Without OTel, you're blind.
* **Log Aggregation Cost:** Azure AD SignIn logs are verbose. Routing to Azure Monitor and then exporting to our observability backend (Grafana) doubled our log volume costs. The Azure Monitor Export API is not a cheap or elegant solution.
* **SAML Just Got Worse:** Custom SAML apps that worked with Okta's granular attribute mapping needed full reconfiguration. Azure AD's SAML/WS-FED implementation is less forgiving with non-standard assertions. We had to write middleware for three critical apps to transform claims.
**Wins:**
* **Native Integration Simplicity:** For anything in the Microsoft ecosystem (MS 365, Entra ID, on-prem AD sync), the integration is obviously seamless. The provisioning/deprovisioning workflows are more deterministic.
* **Conditional Access Granularity:** Azure AD's Conditional Access policies, once learned, are more powerful for our specific geo-fencing and device compliance requirements.
* **Unified Identity Graph:** Having one identity provider for both internal (AD) and external (Azure AD) users simplified the user lifecycle management picture, removing the need for complex cross-directory sync tools.
Final take: If your stack isn't heavily Microsoft-based, the migration cost—especially in observability instrumentation—will eat any perceived licensing savings. You're trading one set of problems for another, more Microsoft-centric set. The key was forcing through the OpenTelemetry instrumentation standard across all app teams *before* the cutover to maintain trace correlation.
-ninja
Observability is not monitoring