Identity Provider Routing rule fails to activate or deactivate

Hello @EddieM.66666 (Customer)​ Thank you for posting on our Community page!

I know there is a set limit to the amount of routing rules you can have, but that is around 200 or 250 so having 40+ should not be the issue.

500 error is a relatively general error and it does not say much, have you tried in an Incognito window? Maybe a cache issue could be the cause of the error.

If the cache is not the issue, I would recommend to check the System log and see if that shows something:

Go to Reports > System Log, Look for the "Update Policy" event. Even if the UI shows a 500, the System Log often captures the actual reason (e.g., ValidationError: Duplicate rule priority).

If this is not captured by the system log as well, the I would recommend to Open a case with Support for additional investigation.

Thank you for reaching out to our Community and have a great day!

--

Help others in the community by liking or hitting Select as Best if this response helped you.

Hi Paul,

Yeah, that 500 code was not very helpful.

I have tried managing these routing rules across 7 different browsers on Windows and MacOS. 14 when you count using incognito mode.

The System Log is not recording any details when I try to (De)Activate a routing rule. I see changes, but nothing related to (de)activate failures.

Is there any insight you can provide regarding routing rule priority? I am using one of two different criteria for routing rules: domain list on login, and user attribute matches a regex. I read in the docs that this (de)activate failure could be related to a priority conflict, but did not find anything specific to what the priority of routing rules needed to be.

Updating this response for ease of access and reference:

A 500 Internal Server Error occurs when activating or deactivating Identity Provider (IdP) routing rules in Okta. This issue typically indicates a backend processing error. The error occurs when the configuration reaches the maximum limit of 100 routing rules, references orphaned dependencies, or encounters a bug in the Admin Console. Resolve the issue by testing the API directly, verifying rule limits and dependencies, and capturing the request ID for Okta Support.

Applies To

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Identity Providers (IdP)
• Routing Rules

Cause

A 500 Internal Server Error indicates that Okta cannot process the request. This error occurs when the configuration reaches the hard limit of 100 IdP routing rules, references deleted dependencies such as network zones or user groups, or encounters a bug in the Admin Console.

Solution

What steps resolve a 500 Internal Server Error when modifying routing rules?

Verify the API functionality, check the routing rule limits, inspect for orphaned dependencies, and capture the request ID to resolve the routing rule error.

• Isolate the UI from the API: Right-click the failing request in the browser network tab and copy it as a cURL command. Execute the state change directly against the Okta API. If the API call succeeds and returns a 200 OK, the issue is a bug in the Admin Console. If the call returns a 500 error, the backend cannot process the request.
• Check Okta limits: Okta enforces a hard limit of 100 IdP routing rules. Check the total rule count, including both active and inactive rules, to ensure the configuration does not exceed the limit.
• Look for orphaned dependencies: Verify that the routing rule does not reference a deleted or modified network zone, user group, or application.
• Capture the Request ID: Look at the Response Headers for the failing request in the network tab. Locate the x-request-id, trace-id, or req-id field. Provide this exact string to Okta Support to retrieve the specific backend crash log.