Provisioning uses the System for Cross-domain Identity Management (SCIM) protocol to synchronize user account information between the user store and the external applications. The SCIM connector uses basic authentication to authorize the connection between the external application and Okta and will inherit the permissions of that account. 

If, on the application side, the administrator account is required to use Multi-Factor Authentication (MFA) in order to access the application, the API authentication will fail with the following error:

Could not verify the administrator credentials; please confirm that these are set correctly

• Okta Integration Network (OIN)
• Provisioning
• API Authentication
• Multi-Factor Authentication (MFA)
• System for Cross-domain Identity Management (SCIM)

The Administrator Account used to set up the provisioning flow in Okta must be excluded from the MFA policy on the application side. The SCIM connector cannot use MFA, only basic authentication.