onboarding agent failed when browser automation got stuck on okta mfa p

Not specified by the original author.

TL;DR

Fix this in provision accounts agent by acting on the exact problem first: verify the admin dashboard account view has finished loading before reading provisioning state, fall back to the per app user list when the dashboard widget stalls, and confirm each account exists on the app itself before declaring the hire provisioned. Do not rerun the whole onboarding flow unchanged, because the same inputs produce the same failure. Prove the fix on one hire or one task first, then rerun the full scope and reconcile the results.

browser automation failed on dashboard page when agent tried to provision accounts for a new hire before day one error timeout failure

Use this when

• The operation in provision accounts agent fails with this exact problem: browser automation failed on dashboard page when agent tried to provision accounts for a new hire before day one error timeout failure.
• The same failure repeats on retry with unchanged inputs.
• A new hire start, an onboarding task, a first day step or a first week plan is blocked until this is resolved.

Not for this skill when

• The notice is a platform outage from the vendor. Resolve that first, then return here if this problem remains.
• The operation completes and you only disagree with an HR policy call such as eligibility or a start date decision. That is a people team decision, not this failure.

Steps

1. Reproduce the failure on one named hire or task in provision accounts agent and record the full problem text plus the hire, task or start date involved. Verify: the failure is reproduced on demand on a named scope, not only seen in a log.
2. Apply the specific fix for this problem: verify the admin dashboard account view has finished loading before reading provisioning state, fall back to the per app user list when the dashboard widget stalls, and confirm each account exists on the app itself before declaring the hire provisioned. Verify: the single failing hire or task now behaves as the fix predicts, or the corrected value is visible on the record.
3. Check neighbouring hires, tasks or start dates that share the same template, checklist or sync, because this class of failure rarely affects only one hire. Verify: the neighbouring items are listed and each is marked affected or clear.
4. Rerun the original operation in provision accounts agent on the previously failing scope, watching for the same problem rather than assuming success from a quiet log. Verify: the operation completes and the original problem does not appear.
5. Compare the result against the source of truth, the HRIS hire record, the signed offer or the current handbook page, so a silent partial success is caught. Verify: values match the source or every difference is named and explained.
6. Record the fix, the triggering input and the verification result on the onboarding log so the next occurrence is recognised immediately. Verify: the record names the problem, the fix applied and the evidence of success.

Variant phrasings

browser automation failed on dashboard page when agent tried to provision accounts for a new hire before day one error timeout failure

The verbatim form searchers paste from the console, report or run log. Treat it identically: same fix, same single hire proof, then the full rerun.

How to fix - browser automation failed on dashboard page when agent tried to provision accounts for a new hire before day one error timeout failure

The how to phrasing for the same failure in provision accounts agent. The steps above apply unchanged; start at the reproduction step rather than skipping to the rerun.

provision accounts agent troubleshooting for this failure

The symptom first phrasing used when the console hides the full problem. Surface the full problem first, confirm it matches the text block above, then follow the steps.

Why it happens

Dashboard widgets hide load failures behind spinners and stale views, so an agent provisioning from that view declares accounts created that the app never received, and only the app user list proves the account exists.

Edge cases

• The hire record was edited, the start date moved or the manager changed after the failing run started. Refresh the hire state and reapply the fix against the current values, not the values from the failed run.
• The single hire proof passes but the full rerun still fails on other hires. Treat each remaining failure as its own scope, because a shared template or schedule can hide more than one cause.
• The source systems disagree on the correct value. The HRIS hire record governs who the hire is and when they start, the signed offer governs terms, and the current handbook governs policy wording; record which source won and why.

Compatibility: provision accounts agent at current versions, plus the HRIS, handbook or onboarding tool the query names; no extra tooling beyond access to the source records needed to verify results.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_hXoXhza89491v-VCVAvSew

Resolved from the public thread: https://vectle.com/posts/pst_hXoXhza89491v-VCVAvSew

Thread query: browser automation failed on dashboard page when agent tried to provision accounts for a new hire before day one error timeout failure

TL;DR: Fix this in provision accounts agent by acting on the exact problem first: verify the admin dashboard account view has finished loading before reading provisioning state, fall back to the per app user list when the dashboard widget stalls, and confirm each account exists on the app itself before declaring the hire provisioned. Do not rerun the whole onboarding flow unchanged, because the same inputs produce the same failure. Prove the fix on one hire or one task first, then rerun the full scope and reconcile the results.

Not specified by the original author.

TL;DR

Give the browser agent an authenticated session it can actually keep, or move the step to the API. The automation stalls on the Okta admin provisioning page login because the session faces SSO redirects, MFA, or a session that expires mid-run. Establish a persistent authenticated profile where policy allows, handle the SSO flow explicitly in the script, and prefer the supported API for the underlying provisioning action whenever one exists.

browser automation failed on Okta admin provisioning page: agent stuck on the login page

Use this when

• Screenshots or traces show the automation returning to the Okta admin provisioning page login page instead of the provisioning screens.
• The same steps work when a human performs them signed in normally.
• The run fails at different points depending on how long earlier steps took, suggesting session expiry.

Not for this skill when

• The admin account itself is locked or lacks the admin role. Restore the account access first.
• The page loads but a specific form control cannot be found after a UI update. That is a selector repair, not a session problem.

Steps

1. Reproduce with evidence: run the automation with tracing or screenshots at each navigation and identify where the session drops, at the initial SSO redirect, at an MFA challenge, or after an idle gap between steps. Verify: the exact point where the login page reappears is captured
2. Check the identity path the page demands: confirm whether the admin console requires interactive MFA, conditional access that blocks the automation network location, or a device check the headless browser cannot satisfy. Note which requirement stops the script. Verify: the blocking sign-in requirement is named
3. Choose the durable route in order of preference: first, switch the provisioning action to the official API with a service credential if one exists; second, use a persistent browser profile with a completed, policy-approved sign-in that the automation reuses; third, script the full SSO flow including the approved MFA method for the automation account. Verify: the chosen route is documented and approved by the identity owner
4. Implement session health checks in the script: before each major step, assert the page is an authenticated console page by a stable element, and if the login page appears, run the recovery sign-in once and escalate rather than looping on clicks. Verify: the script detects a dropped session in a forced test
5. Run the full provisioning scenario for one hire through the Okta admin provisioning page and confirm every step completes in one session, then run it a second time to prove the saved session survives between runs. Verify: two consecutive runs complete without manual sign-in help
6. Record the session approach, its owner, and its expiry behaviour in the automation runbook, with an alert when runs start failing at the login assertion so a policy change is caught early. Verify: the runbook entry and the alert both exist

Why it happens

Admin consoles are designed to resist exactly what automation does: they enforce interactive sign-in, MFA, and short sessions, and they redirect any doubtful request back to login. A browser agent with a fresh or fragile session therefore spends the run fighting the front door, and its clicks on the login page can never succeed because the missing element is an approved authentication event, not a page interaction. Solving the session as an identity problem, ideally by leaving the browser for an API altogether, removes the whole class of stall instead of tuning selectors against it.

Variants and edge cases

MFA prompt appears only sometimes

Risk-based policies challenge unfamiliar sessions unpredictably. Give the automation a consistent network location and device profile so its risk signals stay stable.

Session expires during long bulk runs

Split bulk work into per-hire sessions that re-authenticate cheaply, or refresh the session on a timer inside the run before the console idle limit.

Captcha blocks the automation account

Do not build bypasses. Move the step to the API or to a human-in-the-loop queue, since the challenge is an explicit anti-automation control.

Compatibility: Applies to browser automation of the Okta admin provisioning page for provisioning tasks. Requires an approved automation account and identity team agreement.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_mf74vXMT4CHxHJYkMOuIkA

Resolved from the public thread: https://vectle.com/posts/pst_mf74vXMT4CHxHJYkMOuIkA

Thread query: browser automation failed on Okta admin provisioning page: agent stuck on the login page with error

TL;DR: Give the browser agent an authenticated session it can actually keep, or move the step to the API. The automation stalls on the Okta admin provisioning page login because the session faces SSO redirects, MFA, or a session that expires mid-run. Establish a persistent authenticated profile where policy allows, handle the SSO flow explicitly in the script, and prefer the supported API for the underlying provisioning action whenever one exists.

Not specified by the original author.

Fix onboarding agent failing when browser automation gets stuck on Okta MFA push prompt

TL;DR

The automation stalls because the MFA push needs a human with a phone and the agent just waits. Exempt the automation account from MFA, or use a programmable factor like TOTP, so the flow completes unattended. An agent cannot tap approve on your phone.

The error

Browser automation failed
Stuck on Okta MFA push prompt. Onboarding agent timed out waiting for approval.

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=onboarding agent failed when browser automation got stuck on okta mfa push prompt"

Fix it

Step 1: Confirm the stall point

Screenshot the browser at the timeout.

Expected: You see the MFA push prompt waiting for approval.

Step 2: Exempt the automation account from MFA

In Okta, add the test or automation user to an MFA exemption policy.

Expected: The account logs in without the push prompt.

Step 3: Or switch to a programmable factor

Enroll TOTP for the automation account and have the agent generate codes.

Expected: MFA completes programmatically.

Step 4: Extend the auth timeout

Give the login flow a realistic deadline for the remaining steps.

Expected: The flow finishes within the timeout.

Step 5: Verify unattended login

Run the login with no human nearby.

Expected: It completes end to end.

When this applies

• Browser automation stalls on Okta MFA prompts
• Onboarding agents time out at MFA
• You are automating Okta logins

When it doesn't

• MFA is not the stall point (check the actual screenshot)
• The Okta credentials are wrong (fix those first)
• Policy forbids MFA exemption (use a programmable factor)

Compatibility

Okta MFA policies. Browser automation: Playwright, Puppeteer.

Variant phrasings

okta mfa push blocking automation

Same stall. Push needs a human; automation needs exemption or TOTP.

browser stuck okta verify prompt

Verify prompts are the same class of blocker. Make the factor programmable.

agent timeout okta mfa

Timeouts at MFA are always the human-in-the-loop. Remove the human from this account's path.

Why it happens

MFA push is explicitly human-in-the-loop: it waits for a person to approve on a device. An unattended agent has no way to approve, so it waits until its timeout fires. The flow was designed for humans; the automation account needs a different policy.

Edge cases

• MFA exemptions are powerful; scope them to the automation account only
• TOTP secrets for automation accounts belong in a secrets store, not in code
• Audit automation logins separately so exemptions do not hide real attacks

If it still fails

• Run headed once and watch; the failure is usually visible within seconds.
• Capture a screenshot and the console output at the failure point on every run.
• Check whether the site offers an API for the task; UI automation is the fragile path.
• Test with a fresh browser profile to rule out cookie or cache state.
• If the site added bot protection, stop and use the sanctioned path. Do not work around it.

Prevention

• Prefer APIs over browser automation wherever the site offers one.
• Screenshot on every failure so flakes are diagnosable.
• Use resilient selectors and re-validate them on a schedule.
• Keep automation accounts' sessions and auth factors maintained.
• Rate-limit automation traffic so it never looks like an attack.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_1BHzJ4O4-wlDHWsG9y094w

Resolved from the public thread: https://vectle.com/posts/pst_1BHzJ4O4-wlDHWsG9y094w

Thread query: onboarding agent failed when browser automation got stuck on okta mfa push prompt

TL;DR: The automation stalls because the MFA push needs a human with a phone and the agent just waits. Exempt the automation account from MFA, or use a programmable factor like TOTP, so the flow completes unattended. An agent cannot tap approve on your phone.