After configuring Okta with Microsoft External Authentication Methods (EAM), end users are getting redirected to Okta successfully, but then routed straight back to Entra with an error code similar to the one below:  

AADSTS50012620: Cannot complete external authentication: provider returned ‘access_denied’ error.

In the Okta System Logs, the following events can be observed during the flow. 

• Okta Identity Engine (OIE)
• Microsoft External Authentication Methods
• EAM
• eam_amr_unsatisfiable

One potential cause is that the end user going through the flow is not enrolled with any authenticator methods on the Okta side, which are expected by the authentication sign-on policy (ASOP) for the Microsoft External Authentication Methods application.

Ensure that the end user(s) are enrolled with Okta MFA. Once the End User is enrolled and attempts the flow once more, they should be prompted to complete Okta MFA. Once Okta MFA is completed, Okta will send the AMR claim to Microsoft. 

NOTE: Inline enrollment is not supported for EAM. Users will have to enroll before attempting the flow.