browser automation failed on Okta admin provisioning page: agent stuck on the login page with error

TL;DR

Give the browser agent an authenticated session it can actually keep, or move the step to the API. The automation stalls on the Okta admin provisioning page login because the session faces SSO redirects, MFA, or a session that expires mid-run. Establish a persistent authenticated profile where policy allows, handle the SSO flow explicitly in the script, and prefer the supported API for the underlying provisioning action whenever one exists.

browser automation failed on Okta admin provisioning page: agent stuck on the login page

Use this when

• Screenshots or traces show the automation returning to the Okta admin provisioning page login page instead of the provisioning screens.
• The same steps work when a human performs them signed in normally.
• The run fails at different points depending on how long earlier steps took, suggesting session expiry.

Not for this skill when

• The admin account itself is locked or lacks the admin role. Restore the account access first.
• The page loads but a specific form control cannot be found after a UI update. That is a selector repair, not a session problem.

Steps

1. Reproduce with evidence: run the automation with tracing or screenshots at each navigation and identify where the session drops, at the initial SSO redirect, at an MFA challenge, or after an idle gap between steps. Verify: the exact point where the login page reappears is captured
2. Check the identity path the page demands: confirm whether the admin console requires interactive MFA, conditional access that blocks the automation network location, or a device check the headless browser cannot satisfy. Note which requirement stops the script. Verify: the blocking sign-in requirement is named
3. Choose the durable route in order of preference: first, switch the provisioning action to the official API with a service credential if one exists; second, use a persistent browser profile with a completed, policy-approved sign-in that the automation reuses; third, script the full SSO flow including the approved MFA method for the automation account. Verify: the chosen route is documented and approved by the identity owner
4. Implement session health checks in the script: before each major step, assert the page is an authenticated console page by a stable element, and if the login page appears, run the recovery sign-in once and escalate rather than looping on clicks. Verify: the script detects a dropped session in a forced test
5. Run the full provisioning scenario for one hire through the Okta admin provisioning page and confirm every step completes in one session, then run it a second time to prove the saved session survives between runs. Verify: two consecutive runs complete without manual sign-in help
6. Record the session approach, its owner, and its expiry behaviour in the automation runbook, with an alert when runs start failing at the login assertion so a policy change is caught early. Verify: the runbook entry and the alert both exist

Why it happens

Admin consoles are designed to resist exactly what automation does: they enforce interactive sign-in, MFA, and short sessions, and they redirect any doubtful request back to login. A browser agent with a fresh or fragile session therefore spends the run fighting the front door, and its clicks on the login page can never succeed because the missing element is an approved authentication event, not a page interaction. Solving the session as an identity problem, ideally by leaving the browser for an API altogether, removes the whole class of stall instead of tuning selectors against it.

Variants and edge cases

MFA prompt appears only sometimes

Risk-based policies challenge unfamiliar sessions unpredictably. Give the automation a consistent network location and device profile so its risk signals stay stable.

Session expires during long bulk runs

Split bulk work into per-hire sessions that re-authenticate cheaply, or refresh the session on a timer inside the run before the console idle limit.

Captcha blocks the automation account

Do not build bypasses. Move the step to the API or to a human-in-the-loop queue, since the challenge is an explicit anti-automation control.

Compatibility: Applies to browser automation of the Okta admin provisioning page for provisioning tasks. Requires an approved automation account and identity team agreement.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_mf74vXMT4CHxHJYkMOuIkA