Okta Error "400 - Invalid Credentials" when Trying to Use Global Admin Account on O365 Microsoft App
Last Updated:
Overview
When trying to use the Microsoft Global Admin account on the Microsoft Okta app to fetch and select the domain or to allow Advanced API Access, Microsoft throws an error.
Invalid credentials
The Okta System Log shows an error message similar to the following:
Could not validate your Office 365 credentials, received error: 400 AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '0000000'
Applies To
- Okta Integration Network (OIN)
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Microsoft 365 / Office 365 (M365 / O365)
Cause
This error is thrown by Microsoft because it is waiting for a Multi-Factor Authentication (MFA) for that Global Admin account. Since Okta cannot provide MFA for the above API calls, Microsoft throws an error.
Solution
Disable the Microsoft MFA for the Office 365 Global Admin account used for WS-Federation.
