When trying to use the Microsoft Global Admin account on the Microsoft Okta app to fetch and select the domain or to allow Advanced API Access, Microsoft throws an error.
Invalid credentials
The Okta System Log shows an error message similar to the following:
Could not validate your Office 365 credentials, received error: 400 AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '0000000'
- Okta Integration Network (OIN)
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Microsoft 365 / Office 365 (M365 / O365)
This error is thrown by Microsoft because it is waiting for a Multi-Factor Authentication (MFA) for that Global Admin account. Since Okta cannot provide MFA for the above API calls, Microsoft throws an error.
Disable the Microsoft MFA for the Office 365 Global Admin account used for WS-Federation.
