OPA Provisioning "Access Denied" Error Due to Missing Oauth Approve Permissions

When trying to configure Okta Privileged Access Provisioning > Configure API Integration > Enable API Integration > Authenticate with Okta Privileged Access, it results in the following error: 

Access Denied.  One or more of the following capabilities is required to access this page: oauth_permissions.approve"

• Okta Privileged Access (OPA)

• The Okta user through which the provisioning configuration was attempted was not the Owner of the Okta Privileged Access App.
• The issue can also happen when a group of users is assigned initially before enabling provisioning. OPA will then add one user from the group as the owner, and the rest will not be provisioned. As per the instructions, only one user needs to be assigned to the application before enabling provisioning.

When OPA is set up for the first time, the user logged in should be the only user assigned to the app. This user will become the owner of the OPA Team by default and is the only user who can then set up provisioning. After the provisioning integration has been completed by the original owner, any user or group can be assigned to the app and become an OPA Admin. 

NOTE: It is Best Practice to use an Okta service account to log in and perform the first-time OPA integration so that the owner is not tied to any individual identity.

To address the error, do the following:

• Remove any additional groups or users that were assigned to the OPA after the 1st default user.
• Log in as the original default user when the OPA application was first created.
• Retry the provisioning steps as outlined in the link below.

For more information, refer to Set up Okta Privileged Access.