Okta Error idx.error.code.no_matching_policy Occurs Due to Scope Mismatch on Authorization Server
Last Updated:
Overview
Okta generates an idx.error.code.no_matching_policy error during an OpenID Connect (OIDC) application login due to a scope mismatch between the application request and the Authorization Server Access Policy rule. Update the Access Policy rule to explicitly include all requested scopes to resolve this issue. When this error occurs, Okta displays the following message:
You are not allowed to access this app. To request access, contact an admin.
Applies To
- Okta Identity Engine (OIE)
- OpenID Connect (OIDC)
- Custom Authorization Server
- Access Policy
Cause
Okta requires that the Authorization Server Access Policy rule permits every scope the application requests. If the rule omits any requested scope, Okta rejects the login and surfaces the generic no_matching_policy error.
For example, if the application requests the following scopes:
requested_scopes = openid, profile, email, groups, address
Okta denies the request if the Access Policy rule only permits openid, profile, email, and groups because the rule excludes address.
NOTE: This error can mislead administrators because the System Log might show a successful Sign-On Policy evaluation. Okta blocks the request at the Authorization Server Access Policy layer, not the Sign-On Policy layer.
Solution
How is the scope mismatch resolved?
Update the Authorization Server Access Policy rule to explicitly include all scopes the application requests by navigating to the Authorization Servers menu in the Okta Admin Console.
- In the Okta Admin Console, go to Security and select API.
- Select the Authorization Servers tab.
- Select the Custom Authorization Server used by the OIDC application.
- Select the Access Policies tab.
- Locate the relevant Access Policy and open the applicable rule.
- Under The following scopes, add any missing scopes that the application requests.
- Save the rule.
If the issue persists after updating the scopes, verify that the Access Policy rule enables the Interaction Code grant type by reviewing Error idx.error.code.no_matching_policy.
Always audit the full list of scopes the application requests and ensure the Access Policy rule accounts for each one. Explicitly enumerate the scopes needed in the Access Policy rule rather than using broad settings to maintain least-privilege and avoid unintended scope grants. The Sign-On Policy and Access Policy evaluate independently. A successful Sign-On Policy evaluation does not guarantee a successful Access Policy evaluation.
