Locked out of admin console - only Super Admin account cannot sign in (403 / "Unable to sign in")

Hi @JaeseongK.61311 (Customer)​ , Thank you for reaching out to the Okta Community! 

Okta generates a 403 error when an administrator attempts to access the admin console. This occurs when a configuration change locks out the sole Super Admin account in a test or evaluation organization. Resolve this issue by utilizing self-service recovery, contacting Okta Support for paid accounts, or creating a new test environment.

Access Forbidden

Unable to sign in. Contact support for assistance.

Applies To

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Administrator Access
• Free Trial and Developer Accounts

Cause

A configuration change, such as modifying an integration or authentication policy, inadvertently applies to the sole Super Admin account and prevents authentication to the admin console.

Solution

What are the recovery options for a locked-out Super Admin?

Review the available recovery paths based on the Okta account type to regain access or establish a new testing environment.

• Free Trial, Developer, or Integrator Accounts: These accounts fall outside the scope of Okta Support. Recovery requires self-service options, provided the administrator previously configured appropriate policies and backup accounts. If no backup account exists, sign up for a new account using a different email address at Okta Developer Signup.
• Independent Software Vendors (ISVs): ISVs with published applications in the Okta Integration Network can send an email to developers@okta.com with the subject: ISV - <issue description>.
• Paid Production or Developer Accounts: Open a support case via the Okta Help Center or call the support line detailed in Okta Administrator Is Locked Out and Cannot Sign In. Calling support requires a Customer Support Account ID. Alternatively, contact the assigned Okta Account Executive or Customer Success Manager to engage the Support team.
• Sales Inquiries: Contact Okta Sales to discuss acquiring Okta Support services.

How can administrators prevent admin account lockouts?

Implement the following best practices to ensure continuous access to the Okta admin console.

• Configure test users and groups for evaluating enrollment and authentication policies.
• Ensure experimental policies do not apply to primary admin accounts.
• Maintain a secondary Super Admin account as a backup for recovery purposes.

Summary

Review the available recovery paths for a locked-out Super Admin account based on the Okta subscription type.

If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you. 

Hope my answer helps! 

--

Help others in the community by liking or hitting Select as Best if this response helped you.

Collect them all. Learn a new skill and earn a new Okta Learning badge.

Just released: More Okta Community badges just added