I found an answer on an AT&T forum. This worked for me. I am pasting below.
Hello!
Here’s an update on the issue and a solution that works (until AT&T fixed the underlying root-cause). After spending several weeks talking with DirecTV Now and AT&T U-verse TV technical support, there is an issue that occurs whenever you attempt to authenticate into the Apple TV or iOS TV Provider settings using an email address that is in the domain @att.net or @sbcglobal.net. The error: ‘you are not authorized to access this web-site’ occurs for ALL customers of DirecTV, DirecTV Now, and even AT&T U-verse TV whose AT&T User ID (formerly Access ID) is in AT&T owned domains such as @att.net or @sbcglobal.net. The issue seems to be that those domains are internal to the AT&T network and don’t have permissions to the TV Provider authentication page (somewhere within cprodmasx.att.com).
The solution is to change your AT&T User ID (formerly called the Access ID) to a domain other than AT&T, meaning external to AT&T (such as gmail or hotmail, or yahoo) or basically any e-mail address other than att.net or sbcglobal.net. For example, I changed my AT&T User ID to my old yahoo address but you could also change it a gmail account or hotmail, etc.
Note: If you merged your AT&T accounts and services under one profile and have an AT&T Wireless number bundled with your other services, you can use your primary AT&T wireless number to authenticate AT&T as your TV Provider.
To change your AT&T User ID, follow these instructions:
- Login to att.com
- In the upper-right menu area, click your account name and select Profile from the drop-down menu.
- When the Profile page loads, click on the section that says ‘Sign-in info’.
- In the User ID section, click the link to Change your User ID.
By the way, even AT&T recommends you don’t use an AT&T email address for your User ID. They even post a suggestion at the top of the page that reads: “Want to change your ID? Keep in mind – It's best to enter an email address that isn't an AT&T email.” That suggestion seems more like a warning to me… and it should be heeded, as if you use an AT&T email address, it definitely causes this TV Provider authentication issue.
Note: This is safe to do. Changing your AT&T User ID does not change your billing e-mail address or your Member ID. If you have an AT&T email address such as @att.net or @sbcglobal.net, this will not affect those. Your ATT.NET Member ID will remain your @att.net email address. And, you can still login to your att.com account to manage your bundled services, bill, etc. using either your User ID or your Member ID (or your phone number). An easy way to think about this is that your AT&T User ID (formerly Access ID) is just an identifier for your profile that manages all your bundled AT&T services under one profile, but your Member ID is specific to your ATT.NET or SBCGLOBAL.NET email service. Apple has the same concept, they call it your Apple ID, and it is normally an external e-mail address like your gmail or hotmail account (although Apple recently allowed your Apple ID to be an iCloud.com email address, but I digress...).
Now that you’ve changed your AT&T User ID to something NOT at AT&T email address, let’s use your new User ID to authenticate into Apple TV or iOS’s TV Provider Single Sign-On. Before we start, keep in mind, this error never occurred when trying to login directly to the DirectTV Now App. The error only occurred when trying to authenticate AT&T as your TV Provider within iOS Settings on an iPad, iPhone, or Apple TV.
