you can use a challenge stream which should be defined at your auth-service rule in 'custom' tab.

However what is the type of authentication that you are using?

We use SAML authentication, when we get user metadata and the role associated is not in list of accepted roles from our application then we assign unauthenticated access group to the user. Then in IAC screen we see a message "There has been an issue; please consult your system administrator". We want to customize the message but couldn't find which rule to change.  

I think we cannot use the challenge stream here, as we authenticate the user.