Okta 404 Error Occurs During SP-Initiated SSO After Decommissioning an Application

When a Service Provider (SP) application retains outdated domain-based routing or Identity Provider (IdP) Single Sign-On (SSO) configurations, Okta generates a 404 error during SP-initiated SSO. Modifying or removing the SSO routing configuration directly within the SP administration portal resolves this issue. End users attempting to log in via the SP application using a corporate email domain experience a redirection to an Okta URL that displays the following error:

404 - Page Not Found / App Not Found

When logging in with a non-federated email address, the application prompts for a standard password without redirecting to Okta. Administrators deactivate, delete, or reconfigure the application integration in Okta, but legacy login attempts still route to the old Okta SSO endpoint.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• SSO / Security Assertion Markup Language (SAML) 2.0 / WS-Fed / OpenID Connect (OIDC)
• SP-initiated SSO
• Decommissioned, Deleted, or Updated Application Integrations

The SP application maintains domain-based routing or IdP SSO configurations on the administrative side. When users enter an email address with the federated corporate domain, the SP automatically redirects the authentication request to the configured IdP endpoint. If administrators do not update or remove this routing rule or SSO configuration on the SP side after modifying or decommissioning the application in Okta, the SP continues sending requests to a stale or non-existent Okta endpoint. This action triggers an Okta 404 error.

How is the Okta 404 error resolved during SP-initiated SSO?

Access the administration portal for the specific SP application and update or remove the outdated domain-based routing or IdP SSO configuration settings to reflect the current integration status.

1. Navigate to the administration portal for the specific SP application.
2. Modify or remove the SSO routing configuration.