Which is a / are best-practice(s) in a SAML 2.0 situation?
Solution: To not use SAML 2.0 and Provisioning via the same App instance in Okta, but integrate the same SP custom domain via two different app instances in Okta, one for SSO, via SAML 2.0 in this case, and one for provisioning on users

Can you map the Okta user ID as an Office 365 Immutable ID?
Solution: Done via mappings, by pushing from Okta to Office 365: user.getInternalProperty("id")

With Okta you federate the 'Office 365 tenant name' (which is the default Microsoft domain you have) or the 'Office 365 domain'?
Solution: You federate with Okta only the 'Office 365 tenant name'

When does Okta bring LDAP roles into Okta?
Solution: During both LDAP import and JIT

Once brought into Okta, LDAP roles are represented as:
Solution: Groups