Okta Release Notes

Features and Enhancements

Configure access to the resource catalog

Previously, the ability to view resource catalog entry points, such as the Request Access button in the End-User Dashboard, was available to all users in an org by default. Now, admins can configure this visibility to allow all members of an org to view the entry points, no users to view them, or restrict entry point visibility to a specific set of Okta groups. For the Unified requester experience, this configuration also controls the Resource Catalog links and search options from the Okta Access Request app, Slack, and Microsoft Teams. See Configure resource catalog entry point visibility.

Original source

2026.08.3: Update 3 started deployment on August 31

Manual MCP registration

Admins can now manually configure authorization server details and client credentials when registering MCP servers. This allows registration of internal or legacy MCP servers that don't support automated metadata discovery endpoints. See Add MCP servers.

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

• macOS (26.6.2)
• iOS (26.6.1, 18.7.10)
• Windows 10 builds (10.0.17763.9121, 10.0.19044.7663, 10.0.19045.7663)
• Windows 11 builds (10.0.22631.7517, 10.0.26100.9168, 10.0.26200.9168)

Authentication requirement for AI agent app

When an AI agent is bound to an app, the User access tab now displays the authentication requirement for the app. It also provides a link to the app's Sign On tab where you can configure an authentication policy.

Jamf Pro integration updates

The Application username format field in the Admin Console now appears by default. This allows admins to configure custom mappings for the SCIM userName attribute.

Original source

The following releases are now in Production:

Manual password configuration for resource credentials

You can now set passwords for Active Directory, SaaS, and Okta Universal Directory service accounts without triggering target system synchronization. This enhancement simplifies account migration and onboarding workflows while preserving continuous access to connected accounts.

The following releases are now in Preview:

Bulk password rotation for Active Directory accounts (EA)

Admins can now force password rotation for up to 100 Active Directory accounts simultaneously within a project. This enhancement streamlines daily administrative workflows by eliminating the need to rotate individual account passwords manually. See Bulk rotate Active Directory passwords.

Workload access control for secrets

Security admins can now extend least-privilege access controls to machine identities by assigning workload roles to secret policies. This allows workloads to perform operations on secrets while generating individual workload audit logs for tracking.

Original source

2026.08.2: Update 2 started deployment on August 25

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

• macOS 14.8.9
• macOS 15.7.9
• macOS 26.6.1

Radius Agent version 2.27

This version includes internal improvements and fixes.

JA4 TLS fingerprinting

Okta now captures JA4 TLS client fingerprints across Syslog event types (securityContext.tlsFingerprint.ja4 pr), instead of just a curated subset. This includes telephony events (for example, OTP/SMS delivery) along with sign-in, auth, and token events. This provides customers and Okta's security teams with fingerprint-level visibility to spot bot traffic, toll fraud, and other TLS-based attack patterns that IP/user-agent signals miss on their own.

This is not yet available for orgs on custom-hosted domains.

Enhanced import monitoring with real-time updates

You can now view real-time progress for imports from the Import Monitoring dashboard. This provides greater visibility into the current status of in-progress imports such as the number of data chunks currently being processed.

Copy email from-addresses to the default brand domain

You can now copy a custom email from-address to the default Okta domain when configuring brand email settings. Previously, this option was available only when copying between custom brands.

Original source

The following releases are now in Production:

Static JWKS support for JWT Workload Connectors

Admins operating in private or air-gapped environments can now configure a JWT Workload Connector using static JWKS content. This enables secretless workload authentication for high-security on-premises systems without requiring public key discovery endpoints. See Workloads.

API key authentication for Okta Privileged Access workload identities

Security admins can now create and manage API key connectors and issued secrets for workload identities. This allows legacy and non-OIDC workloads to authenticate securely to Okta Privileged Access. See Workloads.

Original source

Features and Enhancements

Access request admin action enhancements

Access request admins can now view and cancel requests, even if there are completed tasks associated with them.

Request Inbox updates in the Okta Access Requests app

Access request admins can now view all requests in the org from the Requests Inbox page.

Fixes

• The following endpoints weren't visible in the Rate limit report:
  • /governance/api/v1/my/campaigns/{campaignId}/reviews
  • /governance/api/v1/my/campaigns/{campaignId}/reviews/actions
  • /governance/api/v1/my/campaigns/{campaignId}/reviews/bulk-decisions
  • /governance/api/v1/my/campaigns/{campaignId}/reviews/bulk-decisions/jobs/{jobId}
    (OKTA-1211609)
• The issuer URL value appeared in the Audience field of an AI agent connection campaign review instead of the resource indicator value. (OKTA-1239834)

Original source

2026.08.1: Update 1 started deployment on August 17

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

• Android 14, 15, 16, 17 (2026-08-01)

New IP service categories for enhanced dynamic zones

Several new IP service categories are now supported as an individual VPN service category in enhanced dynamic zones. See Supported IP categories.

Cross App Access support for AI agents and apps for all customers

Use XAA to secure access between custom SSO-agentic requesting apps and SSO resource apps. XAA enables customers to connect AI agents and apps to take action on behalf of a user, and removes the need for user consent at runtime. The XAA connection is managed by Okta admins, providing them with visibility and control over which actions an AI agent can take on behalf of a user across the supported OIDC and SAML SSO protocols.

• For the agentic requesting app configuration, see Add AI agents manually, and select your SSO agentic app in User access > App used for access configuration.
• For the XAA resource app configuration, see Configure resource server connectors. If you're configuring an OIN resource app, it must already have XAA enabled.
• To connect the AI agent to the resource app, see Connect AI agents to resources and select Application as the resource type, and then select your resource app.

For agentic requesting apps that use OIDC for SSO, Okta enables binding an AI agent with an OIDC SSO app so that they share the same credentials. If you want to remove this configuration in Okta, delete the AI agent and the corresponding OIDC app.

From this AI agent-app binding capability, admins can now configure direct user authentication for the AI agent. If you have an Okta for AI Agent org and have previously used the Delegation tab to configure AI agent access through delegation links, you need to reconfigure them with the User access tab. See the Migration from Okta for AI Agent delegation link guidance.

Original source

Version: 2026.08.0

Import AI agents from Workday

You can now import and manage AI agents built in the Workday Agent System of Record (ASOR) directly through Okta. See AI agent imports.

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

• Android 13, 14, 15, 16 security patch 2026-01-05

Claude supports SAML 2.0 SSO

The Claude app integration now supports SAML 2.0 SSO. Orgs that are subscribed to Okta for AI Agents can continue using the integration to import Claude Managed Agents into Okta. See Integrate Claude with Okta.

Provisioning for Barracuda

Provisioning is now available for the Barracuda WAF-as-a-Service app integration. See Integrate Barracuda WAF-as-a-Service with Okta.

Provisioning for Linear

Linear provisioning is now available. See Create Linear integration.

Provisioning for Appspace

Provisioning is now available for the Appspace app integration. When you provision the app, you can enable security features like Entitlement Management. See Integrate Appspace with Okta.

Agent-to-agent audience update

The agent-to-agent server resource url (audience parameter) can now be a free-form string.

Provisioning for Toggl

Provisioning is now available for the Toggl app integration. See Integrate Toggl with Okta.

Provisioning for Moodle

Provisioning is now available for the Moodle app integration. See Integrate Moodle with Okta.

Provisioning for HERE

Provisioning is now available for the HERE app integration. See Integrate HERE with Okta.

Editable issuer URL for AI agent resource connections

Now when you create a resource connection between an AI agent and an authorization server, you can modify the authorization server's issuer URL.

Skipped failed entries during AI agent import

Now when you import AI agents from a provider, Okta skips the failed entries and creates or updates the successful ones.

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

• Android 14, 15, 16, 17 (2026-07-01)
• Windows 10 builds (10.0.17763.9020, 10.0.19044.7548, 10.0.19045.7548)
• Windows 11 builds (10.0.22631.7376, 10.0.26100.8875, 10.0.26200.8875)

Import AI agents from Langsmith

You can now import and manage AI agents built in the Langsmith Deployments directly through Okta. See AI agent imports.

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

• macOS (26.6, 15.7.8, 14.8.8)
• iOS (26.6)

Improved smart card enrollment

Users can now enroll a smart card even if the login attribute doesn't match the value mapped from the card. Previously, enrollment failed during dynamic matching or Just-In-Time provisioning because the login attribute was treated as restricted from updates. See Add a Smart Card identity provider.

Okta Provisioning Agent, version 3.3.0

Okta Provisioning Agent 3.3.0 is now available. This release supports dynamic page size reduction during SCIM app imports, delta provisioning through PATCH requests, and automated entitlement removal during access certifications. Additionally, this version updates the bundled Amazon Corretto JRE to 17.0.19.10.1 and resolves a logging security issue. See Okta Provisioning Agent and SDK version history.

Okta Active Directory agent, version 3.23.0

This release of the Okta Active Directory agent updates the AD Agent Management Utility to guide administrators in granting minimum required permissions instead of prompting to add service accounts to the Domain Admins group. Additionally, the installer no longer halts during service account permission checks in misconfigured environments. This release also includes security enhancements and bug fixes. See Okta Active Directory agent version history.

New Research Release lifecycle

A new Research Release lifecycle is now available, marked with a Research Release banner in Okta admin documentation and visible in the Admin Console under Settings > Features. Research Release features are available exclusively to members of the Okta Research Partner Program for a fixed evaluation period, before a feature moves toward Early Access or General Availability. See Research Releases.

Improved system log events for IdP routing

System log events for IdP routing now include the target information from the IdP Discovery rule that matched, when available.

New minimum character length for AI agent names

AI agent names now must contain a minimum of three characters.

Request subscriptions data export

To export information about users subscribed to access requests, select the Request subscriptions option in the Export Data window. The Requests option no longer includes subscriber data. See Export data from Access Requests.

New target for user.risk.detect events

Identity Threat Protection now populates affected factors in the user.risk.detect event's target for entity critical actions for high-threat IPs.

Malware Proxy Detection

Admins can now detect and control access from known malware proxy networks using a new MALWARE_PROXIES IP service category in Enhanced Dynamic Network Zones. This category is powered by Okta's CyberDefense, covering proxy services associated with malware and botnet activity (including 911 S5, NSOCKS, iProxy, BHProxies, and others). Admins can include or exclude MALWARE_PROXIES when configuring Enhanced Dynamic Network Zones, enabling more precise policies, for example, denying access through the global session policy or app sign-in policy for traffic originating from these proxy networks. See Supported IP service categories.

SAP SuccessFactors OAuth 2.0 with SAML Assertion

The SAP SuccessFactors app integration now supports OAuth 2.0 with SAML Assertion for enhanced API security. To ensure your provisioning and sync processes continue without interruption, you must migrate to this new authentication method before the SAP Basic Authentication deletion deadline on November 20, 2026. See Configure OAuth 2.0 with SAML for SAP SuccessFactors.

Okta Integration Wizard

Use the Okta Integration Wizard (OIW) to create and deploy custom app integrations in your Okta org. You can configure SSO, SCIM provisioning, Entitlement Management, Universal Logout, and custom API Integration Actions capabilities for the app integration. You can use the app integration as a template to create multiple app instances in your org without reconfiguring each app instance. This helps you manage your custom integrations more efficiently and avoid workarounds for SCIM and custom Workflows connectors. See Okta Integration Wizard.

Updated passkey enrollment screen

The passkey enrollment screen in the Sign-In Widget now includes updated copy and an informational image to help users understand what a passkey is before they enroll.

WebAuthn enrollment failure events in the System Log

The System Log now logs failed WebAuthn (FIDO2) enrollment attempts, using the user.mfa.factor.activate event and debug data such as AAGUID, isBackupEligible, and matched authenticator groups. Previously, only successful enrollments were logged. You can use this to identify which authenticator models don't enroll.

MCP Servers and Resource Servers moved to Applications and Resources

In the Admin Console, the MCP Servers and Resource Servers pages have moved from the Directory menu to the Applications and Resources menu.

Applications menu renamed to Applications and Resources

In the Admin Console, the Applications menu is now called Applications and Resources.

Direct End-User Settings access

Users may now access their Settings page through a direct URL in addition to the End-User Dashboard. This feature provides convenience and security for users, gives admins greater flexibility when working with End-User Dashboard access control scenarios, and includes accessibility and UX improvements. See End-User Settings.

Original source

Version: 2026.08.0

Import AI agents from Workday

You can now import and manage AI agents built in the Workday Agent System of Record (ASOR) directly through Okta. See AI agent imports.

Provisioning for Barracuda

Provisioning is now available for the Barracuda WAF-as-a-Service app integration. See Integrate Barracuda WAF-as-a-Service with Okta.

Provisioning for Linear

Linear provisioning is now available. See Create Linear integration.

Provisioning for Appspace

Provisioning is now available for the Appspace app integration. When you provision the app, you can enable security features like Entitlement Management. See Integrate Appspace with Okta.

Provisioning for SafetyCulture

Provisioning is now available for the SafteyCulture app integration. See Integrate Safetyculture with Okta.

Provisioning for Toggl

Provisioning is now available for the Toggl app integration. See Integrate Toggl with Okta.

Provisioning for Moodle

Provisioning is now available for the Moodle app integration. See Integrate Moodle with Okta.

Provisioning for Elastic Search

Provisioning is now available for the Elastic Search app integration. See Integrate Elastic Search with Okta.

Provisioning for QualtricsXM

Provisioning is now available for the QualtricsXM app integration. See Integrate Qualtrics XM with Okta.

Provisioning for HERE

Provisioning is now available for the HERE app integration. See Integrate HERE with Okta.

Okta Provisioning Agent, version 3.3.0

Okta Provisioning Agent 3.3.0 is now available. This release supports dynamic page size reduction during SCIM app imports, delta provisioning through PATCH requests, and automated entitlement removal during access certifications. Additionally, this version updates the bundled Amazon Corretto JRE to 17.0.19.10.1 and resolves a logging security issue. See Okta Provisioning Agent and SDK version history.

Okta Active Directory agent, version 3.23.0

This release of the Okta Active Directory agent updates the AD Agent Management Utility to guide administrators in granting minimum required permissions instead of prompting to add service accounts to the Domain Admins group. Additionally, the installer no longer halts during service account permission checks in misconfigured environments. This release also includes security enhancements and bug fixes. See Okta Active Directory agent version history.

New Research Release lifecycle

A new Research Release lifecycle, marked with a Research Release banner, is now available for Okta admin documentation. Research Release features are available exclusively to members of the Okta Research Partner Program for a fixed evaluation period, before a feature moves toward Early Access or General Availability. See Research Releases.

New Proxy service for enhanced dynamic zones

PROXYLINE_PROXY is now supported as an individual Proxy service category in enhanced dynamic zones. See Supported IP categories.

Request subscriptions data export

To export information about users subscribed to access requests, select the Request subscriptions option in the Export Data window. The Requests option no longer includes subscriber data. See Export data from Access Requests.

New System Log events for Office 365 app-based provisioning

The System Log now logs the following events for app-based authentication for Office 365 provisioning:

• app.office365.provisioning_app.create: This event is logged when Okta creates a dedicated Microsoft Entra ID app that's registered and used for Office 365 provisioning.
• app.office365.provisioning_app_credential.rotate: This event is logged when Okta rotates the client secret of the registered Microsoft Entra ID app that's used for Office 365 provisioning. The Outcome field in this event's data indicates whether the client secret rotation was successful or not.

Application-based authentication for Office 365 provisioning

Okta now creates a dedicated app in your Microsoft Entra ID tenant instead of a service account for User Sync and Universal Sync provisioning. This app supports app-based authentication and helps improve your org's security. If you have existing User Sync or Universal Sync configurations, you must reauthenticate and consent to two new permissions by September 30, 2026. See Provide Microsoft admin consent for Okta.

Update group rule assignments

Admins can now update the groups assigned to a group rule without deleting and recreating the rule. This streamlines the management of group memberships and rule conditions. See Edit group rules.

Import unlicensed users from Azure Active Directory to Okta

You can now import users from Microsoft Azure Active Directory (AAD) who don't have an assigned Office 365 license. This allows admins to centralize their workforce lifecycle within Okta and eliminates the need to manage unlicensed accounts across both platforms. See Import users to Office 365 using Microsoft Graph API.

On-demand rotation of Office 365 SSO signing certificates

Office 365 app integrations that use WS-Federation for authentication now support the use of app-level certificates. Switching from org-level certificates to app-level certificates improves your security outcomes by eliminating a single point of failure if a shared org-level certificate expires. UI updates enable IT admins to easily monitor certificate status, generate certificates on demand, and perform certificate rotations without disrupting operations. See Configure Single Sign-On for Office 365.

Original source

Version: 2026.08.0

Provisioning for Barracuda

Provisioning is now available for the Barracuda WAF-as-a-Service app integration. See Integrate Barracuda WAF-as-a-Service with Okta.

Provisioning for Linear

Linear provisioning is now available. See Create Linear integration.

Provisioning for Appspace

Provisioning is now available for the Appspace app integration. When you provision the app, you can enable security features like Entitlement Management. See Integrate Appspace with Okta.

Provisioning for SafetyCulture

Provisioning is now available for the SafteyCulture app integration. See Integrate Safetyculture with Okta.

Provisioning for Toggl

Provisioning is now available for the Toggl app integration. See Integrate Toggl with Okta.

Provisioning for Moodle

Provisioning is now available for the Moodle app integration. See Integrate Moodle with Okta.

Provisioning for Elastic Search

Provisioning is now available for the Elastic Search app integration. See Integrate Elastic Search with Okta.

Provisioning for QualtricsXM

Provisioning is now available for the QualtricsXM app integration. See Integrate Qualtrics XM with Okta.

Provisioning for HERE

Provisioning is now available for the HERE app integration. See Integrate HERE with Okta.

Okta Provisioning Agent, version 3.3.0

Okta Provisioning Agent 3.3.0 is now available. This release supports dynamic page size reduction during SCIM app imports, delta provisioning through PATCH requests, and automated entitlement removal during access certifications. Additionally, this version updates the bundled Amazon Corretto JRE to 17.0.19.10.1 and resolves a logging security issue. See Okta Provisioning Agent and SDK version history.

Okta Active Directory agent, version 3.23.0

This release of the Okta Active Directory agent updates the AD Agent Management Utility to guide administrators in granting minimum required permissions instead of prompting to add service accounts to the Domain Admins group. Additionally, the installer no longer halts during service account permission checks in misconfigured environments. This release also includes security enhancements and bug fixes. See Okta Active Directory agent version history.

Request subscriptions data export

To export information about users subscribed to access requests, select the Request subscriptions option in the Export Data window. The Requests option no longer includes subscriber data. See Export data from Access Requests.

Original source