Active Directory Agent Offline with 403 Forbidden Error in Okta
Last Updated:
Overview
The Active Directory (AD) Agent goes offline and displays a 403 (Forbidden) error in the agent logs when attempting to connect to Okta. The System Log records a Request from suspicious actor DENY entry for the same IP address as the AD Agent host server. When this occurs, an admin attempting to perform an import may see the error:
No connected Agents found to perform import.
Adding the AD Agent host server IP address to a Network zone and exempting that zone from Threat Insight resolves the issue.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Active Directory (AD) Agent
- ThreatInsight
- Network zones
Cause
ThreatInsight blocks the AD Agent IP address, causing Okta to deny connections from the agent and return a 403 (Forbidden) error.
Solution
Exempting the AD Agent IP Address from ThreatInsight
Add the AD Agent host server public IP address to a Network zone and exempt that zone from ThreatInsight to restore agent connectivity.
- Add the AD Agent host server IP address to a Network zone.
- Add the configured zone to the ThreatInsight exclusion list. Refer to Exclude IP zones from Okta ThreatInsight evaluation for detailed instructions.
