An Okta admin is unable to log into the Admin console and is getting the error:
403 Access Forbidden - You don't have permission to access this page.
- Okta Classic Engine
- Admin Console
- Multi-factor Authentication (MFA)
In some cases, an Admin may receive a 403 error when attempting to log in to the Admin console due to the Authentication Policy for the Okta Admin Dashboard application, which requires an MFA factor that the Admin is not yet enrolled in or has had their enrollment removed, or the user does not meet other conditions of the policy.
Depending on the configuration, the user may still be able to log in to the end user dashboard even if they receive a 403 for the Admin dashboard specifically.
- Log in to the end-user dashboard.
- Navigate to Settings > Edit Profile.
- Enter the password and scroll down to the Extra Verification section.
- Under Extra Verification, make sure the user is enrolled in all necessary MFA factors to meet the requirements of the Admin Dashboard application sign-on policy.
To verify the MFA enrollment policy settings, use the following steps:
- With a different Admin, log in to the Admin Console and navigate to Security.
- Select Authenticators > Enrollment tab.
- This tab displays all MFA enrollment policies. Make sure that the one applying to the Admin group is active and that the authentication method that is needed is either set to Optional or Required. This will allow the user to enroll in the eligible authenticators during the next login attempt.
If the user is enrolled in all the MFA factors and still does not have access, contact another tenant admin to verify what the authentication policy requires.
To verify the Authentication policy settings, use the following steps:
- With a different Admin, log in to the Admin Console and navigate to Security.
- Navigate to the authentication policy and view the rule to verify what is required.
- Make sure the user meets all the conditions for the rule.
- For example, make sure Device management selection is not preventing user access.
NOTE: If all of the above steps do not resolve the issue, open an Okta Support ticket to investigate further.
