Okta Returns a 400 General Non Success Error When Configuring Entra ID as an Identity Provider

When configuring Microsoft Entra ID as an Identity Provider (IdP) in Okta, a 400 general non_success error occurs due to an incorrect IdP Issuer Uniform Resource Identifier (URI), an invalid certificate extension, or an incorrect Entity ID. Resolve this by appending a trailing slash to the IdP Issuer URI, converting the certificate to a .crt format, or updating the Entity ID in Entra ID. The following error message appears in the Okta System Log:

Unable to validate incoming SAML Assertion.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Microsoft Entra ID
• Identity Providers (IdP)

Two common scenarios trigger this error. The first scenario occurs when the IdP Issuer URI provided by Microsoft lacks a trailing slash ("/") or the certificate downloaded from the Entra ID portal has a default file extension of .cer instead of .crt. The Okta System Log displays the following error message indicating a Security Assertion Markup Language (SAML) issuer mismatch.

The Issuer in the SAML response did not match the Issuer configured for the Identity Provider.

The second scenario occurs when the Entity ID configured in Entra ID is incorrect. The Okta System Log displays the following error message indicating an invalid target condition.

The Identity Provider specified Conditions, but did not designate us as the target for these conditions. Found "{0}", expected "{1}".

How is the missing trailing slash in the Identity Provider Issuer URI resolved?

Append a trailing slash to the Identity Provider Issuer URI in the Okta Admin Console by following these steps.

1. Go to the Okta Admin Console and navigate to Security > Identity Providers.
2. Select the Edit button to update the IdP Issuer URI.
3. Add a "/" character at the end of the IdP Issuer URI if it is missing.
4. Select Save.

The SAML signing certificate must be reapplied to resolve the invalid extension.

Download the certificate from Entra ID, change the file extension, and upload the new version in Okta by following these steps.

1. Log in to the Entra ID portal and download the certificate from the SAML Signing Certificate area.
2. Change the extension of the certificate from .cer to .crt.
3. Go to the Okta Admin Console and navigate to Security > Identity Providers.
4. Select the Edit button for the Entra ID Identity Provider setting.
5. Remove the old certificate and upload the new version.
6. Select Save.

The Entity ID in Entra ID must be corrected to match the Okta Audience URI.

Copy the Audience URI from Okta and paste it into the Identifier field in the Entra ID Admin Center by following these steps.

1. Go to the Okta Admin Console and navigate to Security > Identity Providers.
2. Select the configured Identity Provider for Entra ID.
3. Select Actions > Configure Identity Provider.
4. Copy the Audience URI.

4. Log in to the Entra Admin Center and navigate to Applications > Enterprise Applications.

5. Select Single Sign-On.
6. Select Edit next to the Basic SAML Configuration header.
7. Paste the Audience URI into the Identifier (Entity ID) field.
8. Select Save.

If the issue persists, contact Okta Support and provide the relevant Okta System Log messages along with the troubleshooting steps already performed.