Okta returns a generic error message when an Active Directory (AD) sourced user with an expired password attempts to sign in. Administrators can customize this error message by injecting JavaScript into the Okta-hosted sign-in page or by adding a custom help link to the AD self-service password reset (SSPR) portal. The user receives the following error during the sign-in flow:

Password change is currently restricted by organization policy

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Active Directory (AD)
• Org2Org (O2O)
• Okta Sign-In Widget

Okta does not allow password changes for users with AD-sourced passwords. When an expired-password user reaches the sign-in flow, Okta returns error code E0000035, which displays a generic message. Administrators cannot edit the message text directly in the Admin Console.

How do administrators override the error message using the code editor?

Inject JavaScript into the Okta-hosted sign-in page to intercept the error and replace the generic message with specific guidance.

1. Navigate to the Sign-In Page code editor in the Admin Console.
2. Add the following JavaScript override to replace the E0000035 message with guidance to reset the password through AD or contact the IT Helpdesk.

NOTE: Test the configuration in a preview or sandbox organization first, and re-verify the functionality after Okta Sign-In Widget updates. This configuration works on the standard <subdomain>.okta.com URL and does not require a custom domain.

Add a custom help link to the sign-in page.

Configure the sign-in page customization options to point users directly to the AD SSPR portal without using the code editor.

1. Navigate to the sign-in page customization settings in the Admin Console.
2. Add a custom help link that redirects users to the AD SSPR portal.

Related References

• Okta Sign-In Widget (SIW) error message for password failure
• Customize your sign-in Page
• Login Attributes