When creating Okta Evidence Based Controls integration in Mimecast, the following error appears after clicking on the Authorize button during the Activation:

Your integration has not been verified successfully. Please try again.
 

• Mimecast
• Provisioning

This error could happen because of:

• The Private Key entered is not in JSON format.
• The Application Settings Require Demonstrating Proof of Possession (DPoP) header in token requests is checked.
• Super Administrator is not assigned in Admin roles.

1. Log in to the Okta Administration Console.
2. In the Admin Console, navigate to Applications > Applications from the left-hand menu.
3. Click on the Create App Integration button.
4. Select the API Services option from the Create a new App integration page.
5. Provide an App integration name, and then click on the Save button.
6. Click on the Okta API Scopes tab and Grant the application the following permission scopes:
   • okta.groups.read
   • okta.groups.manage
   • okta.users.read
7. Click on the General tab and click Edit in the Client Credentials section.

8. For Client authentication, select the Public key / Private key and click the Add key button.

• In the new window, Add a public key and click Generate new key.

9. Copy the private key in JSON format and store it securely for future use. Click Done.
10. Edit in the General Settings section and uncheck the Require Demonstrating Proof of Possession in (DPoP) header in token requests.

11. Click on the Admin roles tab, click on Edit assignment, then click on Add assignment, assign the roles recommended by Mimecast, and Save Changes. When the precise roles are unclear, Okta advises reaching out to Mimecast to ascertain which resources are being accessed, in order to determine the minimum necessary role.

12. Return to the Mimecast Administration Console and provide the Client Id.

13. Provide the Private Key in JSON format copied in Step 10.

14. The Base URL should be set to the same baseURL used to log in to the Okta tenant, for example, https://myorg.okta.com. Make sure to remove the trailing forward slash at the end of the URL.

15. Click the Authorize button.

Related References

• Mimecast Okta Integration