Hello OKTA Pros - 

So I am new to OKTA and have been tasked with enabling SAML. Wondering if anyone on here has experienced the following error with AWS configured:

Your MFA credentials were incorrect. Please check your device and try again.

Request ID: 0123d7fc-e2a5-46fa-a523-dee3e94811ea

Time: Mon, 30 Aug 2021 20:48:31 GMT

I am Changing between AWS SSO and Okta as the external identity provider (IdP).

The section I am not clear on is when do I turn on the idp, since there is a new section where you can create idp users and groups located at https://docs.aws.amazon.com/singlesignon/latest/userguide/manage-your-identity-source-idp.html

According to OKTA - The SAML protocol does not provide a way to query the IdP to learn about users and groups. Therefore, you must make AWS SSO aware of those users and groups by provisioning them into AWS SSO.

Do we need to know how to use the roles under AWS IAM instead of the OKTA SSO section?

Or am I missing something all together?

Thanks GANG in advance!

-RoDevia