Organizations consolidating on Microsoft Entra ID from Okta face a common problem: which apps exist, who actually uses them, and what order should they migrate in? OktaToEntra is a PowerShell module built to answer that - it discovers apps from Okta (SAML, OIDC, SWA, and more), pulls usage history to separate active apps from dead ones, creates the corresponding App Registrations and Service Principals in Entra ID, and replicates user/group assignments across. It deliberately stops short of configuring SSO itself - that step stays manual, with the tool generating config packs to make it easier.
The module tracks each app through a migration lifecycle (discovered, ready, stub created, in progress, validated, complete), stores its data locally in SQLite, and keeps credentials in the SecretStore vault rather than in plaintext. It ships both an interactive console menu and a full set of scriptable cmdlets for CI-style usage.
What started as this PowerShell tool has since grown into a web app, meant to be self-hosted. That web app’s source is on a private repository for now; open-sourcing it is planned but not yet scheduled. The plan is to build out a dedicated blog page for it later with more detail and screenshots.
Read more about the motivation and design behind the original PowerShell module in the companion write-up on the IAM blog: OktaToEntra: A PowerShell companion Tool.