Windows Hello PIN or Convenience PIN setup, Error 403

Loading

Skip to Navigation Skip to Main Content

Search

Search

Select Language

0D5KZ00000vePyO0AUOkta Identity EngineAuthenticationAnswered2025-06-30T19:19:35.000Z2025-06-10T09:08:13.000Z2025-06-30T19:19:35.000Z

ChristopherR.08896 (Customer) asked a question.

June 10, 2025 at 9:08 AM

Windows Hello PIN or Convenience PIN setup, Error 403

Hi everybody,

maybe someone can chime in if anybody got the same error.

Starting about 3 weeks ago, on a new onboarding session with New Hires, Okta / Windows started to throw errors when Windows wants to setup the Windows Hello PIN (Convenience PIN). Just before settings the PIN, Windows asks for another login which redirects to Okta. After logging in successfully, the wizard shows a error window saying "No connection possible" with HTTP 403 and *domain*.okta.com at the end.

Interestingly enough, we have 1 mac user who get´s the same error when trying to log in into Outlook on his device. Web login into the Okta portal and Microsoft 365 is working fine, it is only the Office application that is having a problem.

We did not change anything in our config the last few weeks and this setup worked for just about a year without issues.

For both instances, the sign in logs for the user or the application on Okta is not showing any errors and everything seems to be working fine.

We are using WS-FED to our M365 tenant with a pretty standard setup and user provisioning.

We have a ticket open, the first suggestions did not yield any positive results.

Thanks and regards,

Christopher

Top Rated Answers

Mihai N. (Okta, Inc.)
a year ago
Hi @ChristopherR.08896 (Customer) , Thank you for reaching out to the Okta Community!

If you are not aware of any configuration change in the respective time-frame, the only thing that comes to mind is a possible "false positive" flag by Okta ThreatInsight.
You can check the Okta System logs for events around the failed attempts. The events will not be listed under the user specific events as they are checked before user validation, so check
In the Admin Console, go to Security>General.
Under Okta ThreatInsight settings, click System Log. The search field is pre-populated with the query eventType eq "security.threat.detected". You can customize this query to find other types of events.
Configure the date range.
Click the magnifying glass icon beside the Search field.

Cross-reference any events listed there with date/time and IPs for your network/VPNs.

Beyond that, if you already have a Support ticket open, then I recommend continuing the discussion with the assigned Technical Support Engineers. They'll be able to access additional tools and resources to help you get to the bottom of it.

If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you.

Hope my answer helps!

--
Help others in the community by liking or hitting Select as Best if this response helped you.
Collect them all. Learn a new skill and earn a new Okta Learning badge.
Expand Post
Selected as Best

All Answers

Mihai N. (Okta, Inc.)
a year ago
Hi @ChristopherR.08896 (Customer) , Thank you for reaching out to the Okta Community!

If you are not aware of any configuration change in the respective time-frame, the only thing that comes to mind is a possible "false positive" flag by Okta ThreatInsight.
You can check the Okta System logs for events around the failed attempts. The events will not be listed under the user specific events as they are checked before user validation, so check
In the Admin Console, go to Security>General.
Under Okta ThreatInsight settings, click System Log. The search field is pre-populated with the query eventType eq "security.threat.detected". You can customize this query to find other types of events.
Configure the date range.
Click the magnifying glass icon beside the Search field.

Cross-reference any events listed there with date/time and IPs for your network/VPNs.

Beyond that, if you already have a Support ticket open, then I recommend continuing the discussion with the assigned Technical Support Engineers. They'll be able to access additional tools and resources to help you get to the bottom of it.

If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you.

Hope my answer helps!

--
Help others in the community by liking or hitting Select as Best if this response helped you.
Collect them all. Learn a new skill and earn a new Okta Learning badge.
Expand Post
Selected as Best

This question is closed.

Recommended content

Forum

Electron crash with -1073741819 error (Windows Access Violation)

Forum

We get a 403 error when we set the session cookie and include a redirectURL back to our application.

Forum

can okta pass windows authentication to a cloud based web app that is not in the same domain

Forum

Bypass Okta widgets or redirects and pass user credentials to Okta API to Authenticate

Loading

Windows Hello PIN or Convenience PIN setup, Error 403