Attempting to access the Govern Okta admin roles Governance tab by navigating to Security > Administrators > Governance in the Okta Admin Console fails with the following error message:

We've encountered a technical error. Please try again after some time.
 

• Okta Admin Console
• Govern for admin roles
• Okta Access Requests Admin app

Okta Identity Engine

1. Ensure the user has been assigned to the Okta Access Requests Admin app. In the Okta Admin Console:
   1. Navigate to Applications > Applications > Okta Access Requests Admin > Assignments tab.
   2. Make sure the user has an Individual or Group assignment to the app.
2. Review the authentication policy on the Okta Access Requests Admin app. In the Okta Admin Console:
   1. Navigate to Applications > Applications > Okta Access Requests Admin app > Sign On tab.
   2. Click on the View policy details link to navigate to the currently selected user authentication policy.
   3. Review the policy rules to determine which rule is applicable to the affected user and if access is being denied based on the rule.
3. The Access Testing Tool can also be used to determine if access is being denied by policy.  In the Okta Admin Console:
   1. Navigate to Reports > Access Testing Tool
   2. In the Application drop-down list, enter "Okta Access Requests Admin".
   3. In the Username drop-down list, enter the Okta username.
   4. Enter any other optional values that could be applicable based on the policy rules.
   5. Click the Run test button and review the results.
4. If access is being denied by policy, modify the policy to allow access if possible or create and apply a new policy that allows access.

Okta Classic Engine

1. Ensure the user has been assigned to the Okta Access Requests Admin app. In the Okta Admin Console:
   1. Navigate to Applications > Applications > Okta Access Requests Admin > Assignments tab.
   2. Make sure the user has an Individual or Group assignment to the app.
2. Review the Sign On Policy for the Okta Access Requests Admin app. In the Okta Admin Console:
   1. Navigate to Applications > Applications > Okta Access Requests Admin app > Sign On tab.
   2. Review the policy rules to determine which rule is applicable to the affected user and if access is being denied based on the rule.
3. If access is being denied by one of the rules, modify the rule to allow access if possible, or create and enable a new rule that allows access.

For both Okta Identity Engine and Okta Classic, it may also be helpful to search the system logs for access_denied errors using a query similar to the following:

outcome.result eq "FAILURE" and outcome.reason eq "access_denied" and actor.displayName eq "Okta Access Requests Admin"

Related References 

• Okta Identity Engine - Authentication polices
• Okta Classic - Sign-on polices