When attempting to sign in to Okta, the following error is received:

You do not have permission to perform the requested action.

• Org-level login
• Single Sign-On (SSO)
• ThreatInsight

If ThreatInsight is enabled with the Log and enforce security based on threat level setting selected under Security > General > Okta ThreatInsight settings in the Admin Console, the user's IP address is likely to have been flagged as suspicious and blocked.

To validate blocked login attempts, Administrators can:

1. Navigate to the Okta System Log under Reports > System Log.
2. Search for any recent login activity associated with the impacted user.
3. When associated events indicating an "Evaluation of sign-on policy DENY" are observed, the event should be expanded and the associated Sign-on Policy investigated to ascertain why the policy is denying the login attempt. If this is not the case, proceeding to the subsequent steps is advised.
4. Note the client IP addresses associated with the recent login activity and any consistent login failures. Tip: If there is a lot of user activity, it will be easier to download the System Logs to a CSV and filter by the IP Address(es) from there.
5. Create a new System Log search using the following query for each IP address: 

actor.id eq "InsertIpAddressHere" and eventType eq "security.threat.detected" and outcome.result eq "DENY"

If there are any Suspicious Activity events returned, this is an indication that Okta has temporarily blocked at least one of the IP Addresses.

Related References

• Okta ThreatInsight 
• Users Blocked by ThreatInsight and How to Exempt them via IP