Okta Release Notes

Version 2026.42.1. Deployed on October 19, 2026.

Generally Available features

Provisioning for Sumo Logic

The Sumo Logic Provisioning integration (by Actions) has been added to the OIN. This integration covers user create, update, deactivate/delete, and role assignment across Sumo Logic regional deployments. See Integrate Sumo Logic with Okta.

Provisioning for Cloudflare

Provisioning is now available for Cloudflare. See Integrate Cloudflare with Okta.

Early Access features

mTLS client authentication for OIDC apps

Mutual Transport Layer Security (mTLS) client authentication is now available for OIDC apps. Instead of a shared client secret, Okta issues access tokens that are cryptographically bound to that certificate, so a stolen token can't be used without it. This helps an org strengthen the security of their app and API connections, with no client secrets to store, share, or rotate. See Create OpenID Connect app integrations.

Fixes

• When Okta sent email notifications for entitlement schema change interruptions, the email subject line displayed the app instance name twice. (OKTA-1253044)
• Admins on some custom-domain orgs were unable to access the Admin Console due to a token validation mismatch. (OKTA-1289991)

Okta Integration Network

• Adweek (SWA) was updated.
• Bing Ads (SWA) was updated.
• Brava Security (SCIM) is now available. Learn more.
• CarFax (SWA) was updated.
• Crossbeam (SAML) is now available. Learn more.
• Dataloader.io (SWA) was updated.
• Guru (SAML) is now available. Learn more.
• Guru (SCIM) is available. Learn more.
• LeakData Shared Signals (API Service Integration) is now available. Learn more.
• Ollet (IDV) is now available. Learn more.
• Ready Room (OIDC) is now available. Learn more.

Generally Available features

Improved MCP server registration experience

The Add an MCP Server UI has been updated to match the AI agent and Agent Gateway management experiences. These changes provide a consistent, streamlined workflow for admins when registering and configuring MCP servers.

Provisioning for Sumo Logic

The Sumo Logic Provisioning integration (by Actions) has been added to the OIN. This integration covers user create, update, deactivate/delete, and role assignment across Sumo Logic regional deployments. See Integrate Sumo Logic with Okta.

Provisioning for Cloudflare

Provisioning is now available for Cloudflare. See Integrate Cloudflare with Okta.

Removal of Cross App Access configuration using Managed Connection

The Managed connection tab located on the app instance's page in the Admin Console has been removed. Your existing configurations will stop working soon. Reconfigure your connections to avoid disruptions. See Configure AI agent-to-app with Cross App Access.

Early Access features

mTLS client authentication for OIDC apps

Mutual Transport Layer Security (mTLS) client authentication is now available for OIDC apps. Instead of a shared client secret, Okta issues access tokens that are cryptographically bound to that certificate, so a stolen token can't be used without it. This helps an org strengthen the security of their app and API connections, with no client secrets to store, share, or rotate. See Create OpenID Connect app integrations.

Authenticator enrollment sets

Authenticator enrollment sets let admins define groups of authenticators for end-user enrollment, instead of simply marking each one required, optional, or disabled. Admins can require a subset of the group (two of three, for example) or let end users choose which authenticator to enroll (Authenticator A or Authenticator B). This flexibility supports acceptable backup authenticators, gives end users more secure choices, and simplifies enrollment policy management. See Create an authenticator enrollment policy.

Device Visibility for macOS: Device Bound SSO sessions

The device details page for managed macOS devices now includes a Device Bound SSO (DBSSO) card. Admins can see the DBSSO session status for each OS-level user account on the device, alongside the Platform SSO and Okta FastPass enrollment status already shown for that account. This makes it easier for IT and security admins to verify that macOS users have an active, device-bound session without piecing together information from multiple screens. See View macOS device details.

Fixes

• Users couldn't sign-in through JIT provisioning flows that used IdP routing rules if they failed authentication at a third-party IdP and were redirected to Okta. (OKTA-1016779)
• When Okta sent email notifications for entitlement schema change interruptions, the email subject line displayed the app instance name twice. (OKTA-1253044)
• When an authentication policy used an authentication method chain that included Okta FastPass, the previously used authentication method wasn't retained. On subsequent sign-in attempts, users had to select an authentication method again instead of being prompted with their previously used method. (OKTA-1262367)
• Admins saw an Internal Server Error when they edited the embedded widget sign-in support in Settings > Account and selected Allow admins to configure the Interaction Code grant type. (OKTA-1269769)
• When admins selected a SAML app for AI Agent user access, the dropdown menu results contained some apps that were ineligible for agent delegation. (OKTA-1281415)
• When certain features registered a device, the device displayed its serial number instead of the assigned device name in the Display Name field. (OKTA-1283648)
• App admins couldn't delete app sign-in policies. (OKTA-1284157)
• Issues occurred when an admin created or updated a resource server that shared an issuer URL with an existing external authorization server. Configurations were overwritten, subject mappings cleared, and cross-resource side effects were introduced across unrelated integrations. (OKTA-1285509)
• Admins on some custom-domain orgs were unable to access the Admin Console due to a token validation mismatch. (OKTA-1289991)

Okta Integration Network

• Adweek (SWA) was updated.
• Bing Ads (SWA) was updated.
• Brava Security (SCIM) is now available. Learn more.
• CarFax (SWA) was updated.
• Crossbeam (SAML) is now available. Learn more.
• Dataloader.io (SWA) was updated.
• Guru (SAML) is now available. Learn more.
• Guru (SCIM) is available. Learn more.
• LeakData Shared Signals (API Service Integration) is now available. Learn more.
• Ollet (IDV) is now available. Learn more.
• Ready Room (OIDC) is now available. Learn more.

Features and Enhancements

Certify unmanaged accounts

Certify unmanaged accounts using access certification campaigns to help reduce drifts in access between Okta and the downstream app. See Certify unmanaged accounts.

You can also use imported app user attributes to further refine the campaign scope (managed or unmanaged resources) for resource campaigns, giving you more visibility and control. See Okta Expression Language examples.

Additionally, the Discover inactive users preconfigured campaign has been renamed to User activity review to avoid confusion.

This is an Early Access release.

Governance Analyzer recommendation update

The Governance Analyzer recommendation Revoke has been renamed to Review to clearly indicate the action that reviewers should take for a review item in a campaign.

New input type for questions in request type

While adding questions in a request type, you can now specify the input type as Date and Time for users. This gives you more control over when access to a resource begins or ends. See Question settings.

Fixes

• Some column headers on the Access Certifications campaign page in the Admin Console appeared truncated, and the option to resize the column was missing. (OKTA-1259416)
• Access Requests that assigned a user to a non-Entitlement Management enabled app reported success. However, they didn't assign the user if the user previously had a grant on the app and was later unassigned out-of-band, such as through the Admin Console. (OKTA-1295352)

Version 2026.42.1. Deployed on October 14, 2026.

Generally Available features

Improved MCP server registration experience

The Add an MCP Server UI has been updated to match the AI agent and Agent Gateway management experiences. These changes provide a consistent, streamlined workflow for admins when registering and configuring MCP servers.

Provisioning for Sumo Logic

The Sumo Logic Provisioning integration (by Actions) has been added to the OIN. This integration covers user create, update, deactivate/delete, and role assignment across Sumo Logic regional deployments. See Integrate Sumo Logic with Okta.

Provisioning for Cloudfare

Provisioning is now available for Cloudfare. See Integrate Cloudfare with Okta.

Gemini Enterprise Agent Platform import integration

Admins can now import AI agents, including A2A agents, from the Gemini Enterprise Agent Platform into Okta. When enabling the import in Okta, admins can scope the integration to specific regional locations or a global location. The import retrieves key agent attributes, providing rich visibility into AI agent inventories. See Configure Gemini Enterprise Agent Platform for AI agent imports.

Early Access features

mTLS client authentication for OIDC apps

Mutual Transport Layer Security (mTLS) client authentication is now available for OIDC apps. Instead of a shared client secret, Okta issues access tokens that are cryptographically bound to that certificate, so a stolen token can't be used without it. This helps org strengthen the security of their app and API connections, with no client secrets to store, share, or rotate. See Create OpenID Connect app integrations.

Authenticator enrollment sets

Authenticator enrollment sets let admins define groups of authenticators for end-user enrollment, instead of simply marking each one required, optional, or disabled. Admins can require a subset of the group (two of three, for example) or let end users choose which authenticator to enroll (Authenticator A or Authenticator B). This flexibility supports acceptable backup authenticators, gives end users more secure choices, and simplifies enrollment policy management. See Create an authenticator enrollment policy.

Device Visibility for macOS: Device Bound SSO sessions

The device details page for managed macOS devices now includes a Device Bound SSO (DBSSO) card. Admins can see the DBSSO session status for each OS-level user account on the device, alongside the Platform SSO and Okta FastPass enrollment status already shown for that account. This makes it easier for IT and security admins to verify that macOS users have an active, device-bound session without piecing together information from multiple screens. See View macOS device details.

Fixes

• Users couldn't sign-in through JIT provisioning flows that used IdP routing rules if they failed authentication at a third-party IdP and were redirected to Okta. (OKTA-1016779)
• When Okta sent email notifications for entitlement schema change interruptions, the email subject line displayed the app instance name twice. (OKTA-1253044)
• When an authentication policy used an authentication method chain that included Okta FastPass, the previously used authentication method wasn't retained. On subsequent sign-in attempts, users had to select an authentication method again instead of being prompted with their previously used method. (OKTA-1262367)
• Admins saw an Internal Server Error when they edited the embedded widget sign-in support in Settings > Account and selected Allow admins to configure the Interaction Code grant type. (OKTA-1269769)
• When admins selected a SAML app for AI Agent user access, the dropdown menu results contained some apps that were ineligible for agent delegation. (OKTA-1281415)
• When certain features registered a device, the device displayed its serial number instead of the assigned device name in the Display Name field. (OKTA-1283648)
• App admins couldn't delete app sign-in policies. (OKTA-1284157)
• Issues occurred when an admin created or updated a resource server that shared an issuer URL with an existing external authorization server. Configurations were overwritten, subject mappings cleared, and cross-resource side effects were introduced across unrelated integrations. (OKTA-1285509)
• Admins on some custom-domain orgs were unable to access the Admin Console due to a token validation mismatch. (OKTA-1289991)

Okta Integration Network

• Adweek (SWA) was updated.
• Bing Ads (SWA) was updated.
• CarFax (SWA) was updated.
• Crossbeam (SAML) is now available. Learn more.
• Dataloader.io (SWA) was updated.
• Guru (SAML) is now available. Learn more.
• Guru (SCIM) is available. Learn more.
• LeakData Shared Signals (API Service Integration) is now available. Learn more.
• LinkedIn (SWA) was updated.
• Ollet (IDV) is now available. Learn more.
• Ready Room (OIDC) is now available. Learn more.

Version 2026.41.0. Deployed on October 12, 2026.

Generally Available features

Radius Agent version 2.28

This version changes the default client access behavior. Starting with this version, you must configure a client IP allowlist for new installations to accept RADIUS connections. See Okta RADIUS Server agent version history.

Provisioning for Fleet End User Enrollment

Provisioning is now available for the Fleet End User Enrollment integration. See Integrate Fleet End User Enrollment with Okta.

Provisioning for Pipedrive

Provisioning is now available for the Pipedrive integration. See Integrate Pipedrive with Okta.

App branding migration

Currently, when you upgrade to Identity Engine, that upgrade happens for your entire org, at a global level. You must prepare all of your customizations and integrations for every app before upgrading your tenant and reconfigure your upgraded org. If anything goes wrong, the whole upgrade must be rolled back.

The app branding migration feature allows eligible orgs to stage, preview, and deploy Identity Engine on an app-by-app basis while preserving their Classic Engine customizations and brands. Upgrade your most important and high-traffic apps first and with confidence, while leaving less critical apps for a later time. If anything goes wrong, only the affected apps need to be rolled back. See App branding migration.

Support for SharePoint Server Subscription Edition

Okta now supports SharePoint Server Subscription Edition for user authentication.

Email notifications for disrupted AD and LDAP agents

System email notifications now include options for Active Directory and LDAP agent disruption and recovery. Admins can enable notifications in the Admin Console to receive email alerts when an agent disrupts and recovers.

Zendesk app integration update

Okta's Zendesk app integration now uses OAuth 2.0 instead of Basic Authentication for provisioning. If you use Zendesk provisioning, re-authenticate your API connection in the Admin Console by April 29, 2027 to prevent provisioning failures. New Zendesk app instances require OAuth 2.0 beginning October 26, 2026. This change doesn't affect SSO. See Integrate Zendesk with Okta.

PowerShell scripts for Active Directory

Admins can now execute custom PowerShell scripts in on-premises Active Directory environments using the Active Directory agent to support custom lifecycle management functionalities. After configuration, admins can invoke scripts through Okta Workflows using the Okta public API. See Enable and configure PowerShell script in Active Directory and Invoke a remote script on the AD agent.

Early Access features

OIN Community Integrations

New apps often launch before Okta has an integration for them, forcing admins to delay rollout or run the app without single sign-on and automated provisioning. Community Integrations close that gap. Okta builds the integration from the application's public APIs and publishes it to the Okta Integration Network at no additional cost. A new integration starts as Community Preview, available to install and test in preview orgs. Once a customer has run it in their own production org, it becomes Community Verified and can be installed in any org. You get a missing integration to test within days, not months, and decide when it's ready for production based on your own testing. See Community integrations.

New System Log events for staging Access Certification campaigns

The System Log now logs the following events for staging Access Certification campaigns:

• certification.campaign.stage.start: This event is logged when the staging process starts for a campaign.
• certification.campaign.stage.end: This event is logged when the campaign staging process ends. The outcome.result field reports SUCCESS if the campaign snapshot is created successfully, or FAILURE if there were errors during the staging process.

See Event Types.

Incremental imports for Office 365 is EA in Preview

Admins can now schedule and run incremental imports for Microsoft Office 365 and Office 365 GCC High app integrations.

Fixes

• When an import resumed after an entitlement unassignment interruption, the import matrix incorrectly displayed the updated user count as 0 instead of reflecting the actual processed users. (OKTA-1272163)
• Some policy.rule.update events weren't displayed in the System Log. (OKTA-1273973)
• When an admin removed an entitlement locally, role or resource set updates failed to sync. (OKTA-1289782)
• When executing a Refresh App Groups action for the Snowflake OIN app, Okta stopped paginating results after retrieving the first 200 groups. (OKTA-1277539)

Okta Integration Network

• Aembit (OIDC) is now available. Learn more.
• Carta (SWA) was updated.
• Holistics (SAML) is now available. Learn more.
• Holistics (SCIM) is now available. Learn more.
• Mailzzy (OIDC) is now available. Learn more.
• Mailzzy (SAML) is now available. Learn more.
• Spacent (OIDC) is now available. Learn more.
• YakChat (OIDC) has a new redirect URI.
• Your360 AI Directory Lookup (API Service Integration) is now available. Learn more.

Documentation updates

Changes to Okta release version notation

Beginning in October, Okta release version notations are changing from year.month to year.week. For example, 2026.10.0 will become 2026.41.0, where 41 indicates the week of the year that the deployment occurs. More information is available in this knowledge base article.

Generally Available features

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

• macOS 27.0.1
• macOS 26.7.1
• macOS 15.8.1
• iOS 27.0.1
• iOS 26.7.1

Sign-In Widget, version 7.50.0

For details about this release, see Sign-In Widget Release Notes. For more information about the widget, see Okta Sign-In Widget.

NFC authenticator available with Adaptive MFA

The NFC authenticator is now available to orgs with Adaptive MFA. Frontline workers can tap their NFC badge on a reader and enter a PIN to sign in to Okta-protected apps on shared Windows workstations. See Configure the NFC authenticator.

Security key PIN support for user verification

Users who initially enrolled a security key (such as a YubiKey) without a PIN, but later configured a PIN externally, can now authenticate successfully when a policy rule requires a device passcode or biometric verification.

Import AI agents from Snowflake

You can now import and manage AI agents built in Snowflake directly through Okta. See AI agent imports.

Passkey (FIDO2 WebAuthn) authenticator enabled by default

The Passkey (FIDO2 WebAuthn) authenticator is now available by default in all newly created orgs to ensure protection by a phishing-resistant authenticator from the start. As a possession and biometric or knowledge-based factor, Passkey (FIDO2 WebAuthn) meets the requirements for phishing resistance and user presence. See Configure the Passkey (FIDO2 WebAuthn) authenticator.

Import AI agents from Workato

You can now import and manage AI agents built in Workato directly through Okta. See AI agent imports.

Radius Agent version 2.28

This version changes the default client access behavior. Starting with this version, you must configure a client IP allowlist for new installations to accept RADIUS connections. See Okta RADIUS Server agent version history.

Provisioning for Fleet End User Enrollment

Provisioning is now available for the Fleet End User Enrollment integration. See Integrate Fleet End User Enrollment with Okta.

Provisioning for Pipedrive

Provisioning is now available for the Pipedrive integration. See Integrate Pipedrive with Okta.

App branding migration

Currently, when you upgrade to Identity Engine, that upgrade happens for your entire org, at a global level. You must prepare all of your customizations and integrations for every app before upgrading your tenant and reconfigure your upgraded org. If anything goes wrong, the whole upgrade must be rolled back.

The app branding migration feature allows eligible orgs to stage, preview, and deploy Identity Engine on an app-by-app basis while preserving their Classic Engine customizations and brands. Upgrade your most important and high-traffic apps first and with confidence, while leaving less critical apps for a later time. If anything goes wrong, only the affected apps need to be rolled back. See App branding migration.

Support for SharePoint Server Subscription Edition

Okta now supports SharePoint Server Subscription Edition for user authentication.

Passkey enrollment promotion prompt

You can now configure a passkey enrollment promotion nudge that prompts end users to enroll a passkey authenticator when they sign in. The nudge applies only when the passkey authenticator is optional, and users who skip it can still sign in with another authenticator. You can control how often the prompt reappears and how many times a user can skip it before Okta stops showing it. See Create an authenticator enrollment policy.

Email notifications for disrupted AD and LDAP agents

System email notifications now include options for Active Directory and LDAP agent disruption and recovery. Admins can enable notifications in the Admin Console to receive email alerts when an agent disrupts and recovers.

User identification policy

Admins can now manage rules in the user identification policy to control whether the Sign in with Okta FastPass button appears on an app-by-app basis, instead of relying on a single org-wide setting. This makes it easier to manage pilot groups during Okta FastPass rollouts and to tailor the sign-in experience for individual apps. See Add a rule to a user identification policy.

Zendesk app integration update

Okta's Zendesk app integration now uses OAuth 2.0 instead of Basic Authentication for provisioning. If you use Zendesk provisioning, re-authenticate your API connection in the Admin Console by April 29, 2027 to prevent provisioning failures. New Zendesk app instances require OAuth 2.0 beginning October 26, 2026. This change doesn't affect SSO. See Integrate Zendesk with Okta.

SAP SuccessFactors OAuth 2.0 with SAML Assertion

The SAP SuccessFactors app integration now supports OAuth 2.0 with SAML Assertion for enhanced API security. To ensure your provisioning and sync processes continue without interruption, you must migrate to this new authentication method before the SAP Basic Authentication deletion deadline on November 20, 2026. See Configure OAuth 2.0 with SAML for SAP SuccessFactors.

PowerShell scripts for Active Directory

Admins can now execute custom PowerShell scripts in on-premises Active Directory environments using the Active Directory agent to support custom lifecycle management functionalities. After configuration, admins can invoke scripts through Okta Workflows using the Okta public API. See Enable and configure PowerShell script in Active Directory and Invoke a remote script on the AD agent.

Telephony status callbacks for custom providers

Okta now records delivery status updates from custom telephony providers in the System Log. When admins configure a custom provider through the Admin Console, Okta logs system.sms.receive_status and system.voice.receive_status events. Admins can use these events to verify whether SMS messages and voice calls reach users and to troubleshoot provider credential issues. See Configure telephony providers.

Early Access features

OIN Community Integrations

New apps often launch before Okta has an integration for them, forcing admins to delay rollout or run the app without single sign-on and automated provisioning. Community Integrations close that gap. Okta builds the integration from the application's public APIs and publishes it to the Okta Integration Network at no additional cost. A new integration starts as Community Preview, available to install and test in preview orgs. Once a customer has run it in their own production org, it becomes Community Verified and can be installed in any org. You get a missing integration to test within days, not months, and decide when it's ready for production based on your own testing. See Community integrations.

New System Log events for staging Access Certification campaigns

The System Log now logs the following events for staging Access Certification campaigns:

• certification.campaign.stage.start: This event is logged when the staging process starts for a campaign.
• certification.campaign.stage.end: This event is logged when the campaign staging process ends. The outcome.result field reports SUCCESS if the campaign snapshot is created successfully, or FAILURE if there were errors during the staging process.

See Event Types.

Import AI agents from Cursor

You can now import and manage AI agents built in Cursor directly through Okta. See AI agent imports.

Self-service registration policy for ITP

Self-service sign-up is an easy path for fraud, because bad actors using disposable email addresses or specific networks can slip through undetected. With the new self-service registration policy on the User Profile Policies page, Identity Threat Protection (ITP) customers can create rules that automatically deny sign-up attempts from disposable and throwaway email domains or specific network zones, working alongside Bot Protection as part of Okta's growing set of Attack Protection capabilities. This gives admins another way to cut down on fake accounts and keep self-registration flows cleaner. See Self-service registration.

Incremental imports for Office 365 is EA in Preview

Admins can now schedule and run incremental imports for Microsoft Office 365 and Office 365 GCC High app integrations.

Fixes

• Users attempting to sign in through an embedded Sign-In Widget in Safari on macOS were prevented from completing authentication. (OKTA-1199687)
• Users on managed ChromeOS devices got an internal server error when they tried to enroll authenticators or reset their password from the Account Settings page. (OKTA-1199888)
• When user verification through Okta Verify failed at sign-in, the error message indicated that biometrics were required, even if the org's policy also allowed a device passcode. (OKTA-1250688)
• Developers using the Device Posture Checks OAuth scopes received an authorization error if their org had the base Device Posture Checks feature enabled without the related release flag. (OKTA-1265907)
• The certification.campaign.launch System Log was triggered in error when the staging process started for an Access Certification campaign. (OKTA-1268484)
• When an import resumed after an entitlement unassignment interruption, the import matrix incorrectly displayed the updated user count as 0 instead of reflecting the actual processed users. (OKTA-1272163)
• Some policy.rule.update events weren't displayed in the System Log. (OKTA-1273973)
• Some error messages on the Sign-In Widget weren't correctly translated to French. (OKTA-1277043)
• Admins who added a certificate authority for device management while the Single Certificate feature was enabled received a validation error. (OKTA-1287408)
• When an admin removed an entitlement locally, role or resource set updates failed to sync. (OKTA-1289782)

Okta Integration Network

• Aembit (OIDC) is now available. Learn more.
• Carta (SWA) was updated.
• Holistics (SAML) is now available. Learn more.
• Holistics (SCIM) is now available. Learn more.
• Mailzzy (OIDC) is now available. Learn more.
• Mailzzy (SAML) is now available. Learn more.
• Spacent (OIDC) is now available. Learn more.
• YakChat (OIDC) has a new redirect URI.
• Your360 AI Directory Lookup (API Service Integration) is now available. Learn more.

Documentation updates

Changes to Okta release version notation

Beginning in October, Okta release version notations are changing from year.month to year.week. For example, 2026.10.0 will become 2026.41.0, where 41 indicates the week of the year that the deployment occurs. More information is available in this knowledge base article.

Features and Enhancements

Configure access to the resource catalog is Generally Available in Production environments

Previously, the ability to view resource catalog entry points, such as the Request Access button in the End-User Dashboard, was available to all users in an org by default. Now, admins can configure this visibility to allow all members of an org to view the entry points, no users to view them, or restrict entry point visibility to a specific set of Okta groups. For the Unified requester experience, this configuration also controls the Resource Catalog links and search options from the Okta Access Request app, Slack, and Microsoft Teams. See Configure resource catalog entry point visibility.

Group self-ownership is Generally Available in Production environments

An Okta group can now be its own owner. This reduces friction in group maintenance by eliminating the need for membership approvals and reviews to be handled by separate entities (such as individual users or a different group), and instead allows admins to delegate membership approvals and reviews to current members of the group.

Resource collections is Generally Available in Preview environments

Resource collections let you combine apps, entitlements, Okta groups, and push groups into a single resource that you can directly assign to users based on their role. This simplifies access assignment for roles that require multiple types of resources. See Resource collections.

Resource collections support of groups, push groups, and non-Entitlement Management apps is Generally Available in Preview environments

Resource collections can now be further customized for specific roles by allowing groups, push groups, and non-Entitlement Management apps to be included in a collection. This provides admins the ability to assign a wider set of resources required for a specific role to a collection, improving control over resources and reducing management overhead. See Resource collections.

Convert users from custom to policy without access changes is Generally Available in Preview environments

Users can now be converted from custom entitlement and bundle assignments to policy while keeping their existing entitlements. See Manage user entitlements.

Account Reconciliation

Account Reconciliation enables governance teams to detect and govern unmanaged accounts that exist in the target system but weren't assigned by Okta. When enabled on a provisioning enabled app, this feature supports a new UI to detect, filter, and remediate accounts. The account reconciliation process helps Okta Identity Governance become the authoritative source for all accounts that exist in the target apps. See Identity reconciliation.

This is an Early Access release. See Enable self-service features.

Entitlement Reconciliation

Entitlement Reconciliation enables governance teams to detect and govern entitlement drifts between Okta and the target system. When enabled on a governance enabled app, this feature supports a new UI to detect, filter, and remediate entitlement drifts along with app-level entitlement rules to automatically revoke out-of-band entitlement changes. This entitlement reconciliation process helps Okta Identity Governance become the authoritative source for all entitlements assigned to users in the target apps. See Identity reconciliation.

This is an Early Access release. See Enable self-service features.

Account Reconciliation results report

Use this report to view accounts detected in external sources that were unmanaged in Okta, and all reconciliation actions taken on them either by admins or by the Okta system.

This is an Early Access release. See Enable self-service features.

Entitlement Reconciliation results report

Use this report to view entitlement drifts detected by Okta from external sources, and all reconciliation actions taken on them either by admins or by the Okta system.

This is an Early Access release. See Enable self-service features.

New System Log events

The System Log now logs the following events for staging Access Certification campaigns:

• certification.campaign.stage.start: Logged when the staging process starts for a campaign.
• certification.campaign.stage.end: Logged when the campaign staging process ends. The outcome.result field reports SUCCESS if the campaign snapshot is created successfully, or FAILURE if there were errors during the staging process.

See Event types.

Fixes

• Campaigns within seven days of a scheduled launch weren't visible in orgs that disabled the Stage certification campaigns before launching an Early Access (EA) feature. (OKTA-1245618)
• The certification.campaign.launch System Log event was triggered in error when the staging process for an Access Certification campaign started. (OKTA-1268484)
• When a permanent entitlement bundle was assigned to a user who had an existing app access window with an expiration date, the expiration date wasn't cleared. When the expiration date was reached, the user's base grant was revoked, which removed every bundle grant on that app, including the permanent one, and the user was deprovisioned from the downstream app. (OKTA-1290251)

Version 2026.41.0. Deployed on October 7, 2026.

Generally Available features

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

• macOS 27.0.1
• macOS 26.7.1
• macOS 15.8.1
• iOS 27.0.1
• iOS 26.7.1

NFC authenticator available with Adaptive MFA

The NFC authenticator is now available to orgs with Adaptive MFA. Frontline workers can tap their NFC badge on a reader and enter a PIN to sign in to Okta-protected apps on shared Windows workstations. See Configure the NFC authenticator.

Security key PIN support for user verification

Users who initially enrolled a security key (such as a YubiKey) without a PIN, but later configured a PIN externally, can now authenticate successfully when a policy rule requires a device passcode or biometric verification.

Workday incremental import enhancements

Workday incremental imports now support up to 45,000 changed workers in a single incremental import.

Import AI agents from Snowflake

You can now import and manage AI agents built in Snowflake directly through Okta. See AI agent imports.

Import AI agents from Workato

You can now import and manage AI agents built in Workato directly through Okta. See AI agent imports.

Radius Agent version 2.28

This version changes the default client access behavior. Starting with this version, you must configure a client IP allowlist for new installations to accept RADIUS connections. See Okta RADIUS Server agent version history.

Entitlement support for disconnected apps

Disconnected apps are apps that aren't LCM integrated within Okta. This feature allows you to use CSV files to import users and entitlements into Okta from disconnected apps. This enables consistent governance and compliance across all apps, including those not fully integrated with Okta.

Provisioning for Fleet End User Enrollment

Provisioning is now available for the Fleet End User Enrollment integration. See Integrate Fleet End User Enrollment with Okta.

Provisioning for Pipedrive

Provisioning is now available for the Pipedrive integration. See Integrate Pipedrive with Okta.

Office 365 import updates

Office 365 imports now skip groups with 4-byte UTF-8 characters, such as emojis, instead of failing the entire job. Remaining groups import successfully, and Okta logs failed group details in syslog for troubleshooting.

Zendesk app integration update

Okta's Zendesk app integration now uses OAuth 2.0 instead of Basic Authentication for provisioning. If you use Zendesk provisioning, re-authenticate your API connection in the Admin Console by April 29, 2027 to prevent provisioning failures. New Zendesk app instances require OAuth 2.0 beginning October 26, 2026. This change doesn't affect SSO. See Integrate Zendesk with Okta.

Single Certificate Issuer

With Single Certificate Issuer, admins can configure one certificate authority and trust it for device registration, Okta Device Access, and management attestation, instead of setting up and maintaining a separate certificate authority or SCEP configuration for each purpose. This reduces the number of certificate authorities admins need to create, renew, and track, simplifying device management setup for organizations that use certificate-based device trust. See Single Certificate Issuer.

Telephony status callbacks for custom providers

Okta now records delivery status updates from custom telephony providers in the System Log. When admins configure a custom provider through the Admin Console, Okta logs system.sms.receive_status and system.voice.receive_status events. Admins can use these events to verify whether SMS messages and voice calls reach users and to troubleshoot provider credential issues. See Configure telephony providers.

App branding migration

Currently, when you upgrade to Identity Engine, that upgrade happens for your entire org, at a global level. You must prepare all of your customizations and integrations for every app before upgrading your tenant and reconfigure your upgraded org. If anything goes wrong, the whole upgrade must be rolled back.

The app branding migration feature allows eligible orgs to stage, preview, and deploy Identity Engine on an app-by-app basis while preserving their Classic Engine customizations and brands. Upgrade your most important and high-traffic apps first and with confidence, while leaving less critical apps for a later time. If anything goes wrong, only the affected apps need to be rolled back. See App branding migration.

Early Access features

OIN Community Integrations

New apps often launch before Okta has an integration for them, forcing admins to delay rollout or run the app without single sign-on and automated provisioning. Community Integrations close that gap. Okta builds the integration from the application's public APIs and publishes it to the Okta Integration Network at no additional cost. A new integration starts as Community Preview, available to install and test in preview orgs. Once a customer has run it in their own production org, it becomes Community Verified and can be installed in any org. You get a missing integration to test within days, not months, and decide when it's ready for production based on your own testing. See Community integrations.

New System Log events for staging Access Certification campaigns

The System Log now logs the following events for staging Access Certification campaigns:

• certification.campaign.stage.start: This event is logged when the staging process starts for a campaign.
• certification.campaign.stage.end: This event is logged when the campaign staging process ends. The outcome.result field reports SUCCESS if the campaign snapshot is created successfully, or FAILURE if there were errors during the staging process.

See Event Types.

Import AI agents from Cursor

You can now import and manage AI agents built in Cursor directly through Okta. See AI agent imports.

Self-service registration policy for ITP

Self-service sign-up is an easy path for fraud, because bad actors using disposable email addresses or specific networks can slip through undetected. With the new self-service registration policy on the User Profile Policies page, Identity Threat Protection (ITP) customers can create rules that automatically deny sign-up attempts from disposable and throwaway email domains or specific network zones, working alongside Bot Protection as part of Okta's growing set of Attack Protection capabilities. This gives admins another way to cut down on fake accounts and keep self-registration flows cleaner. See Self-service registration.

Authenticator enrollment sets

Authenticator enrollment sets let admins define groups of authenticators for end-user enrollment, instead of simply marking each one required, optional, or disabled. Admins can require a subset of the group (two of three, for example) or let end users choose which authenticator to enroll (Authenticator A or Authenticator B). This flexibility supports acceptable backup authenticators, gives end users more secure choices, and simplifies enrollment policy management. See Create an authenticator enrollment policy.

Incremental imports for Office 365 is EA in Preview

Admins can now schedule and run incremental imports for Microsoft Office 365 and Office 365 GCC High app integrations.

Fixes

• Users attempting to sign in through an embedded Sign-In Widget in Safari on macOS were prevented from completing authentication. (OKTA-1199687)
• Users on managed ChromeOS devices got an internal server error when they tried to enroll authenticators or reset their password from the Account Settings page. (OKTA-1199888)
• When user verification through Okta Verify failed at sign-in, the error message indicated that biometrics were required, even if the org's policy also allowed a device passcode. (OKTA-1250688)
• Developers using the Device Posture Checks OAuth scopes received an authorization error if their org had the base Device Posture Checks feature enabled without the related release flag. (OKTA-1265907)
• The certification.campaign.launch System Log was triggered in error when the staging process started for an Access Certification campaign. (OKTA-1268484)
• When an import resumed after an entitlement unassignment interruption, the import matrix incorrectly displayed the updated user count as 0 instead of reflecting the actual processed users. (OKTA-1272163)
• Some policy.rule.update events weren't displayed in the System Log. (OKTA-1273973)
• Some error messages on the Sign-In Widget weren't correctly translated to French. (OKTA-1277043)
• Admins who added a certificate authority for device management while the Single Certificate feature was enabled received a validation error. (OKTA-1287408)
• When an admin removed an entitlement locally, role or resource set updates failed to sync. (OKTA-1289782)

Okta Integration Network

• Aembit (OIDC) is now available. Learn more.
• Carta (SWA) was updated.
• Holistics (SAML) is now available. Learn more.
• Holistics (SCIM) is now available. Learn more.
• Mailzzy (OIDC) is now available. Learn more.
• Mailzzy (SAML) is now available. Learn more.
• Spacent (OIDC) is now available. Learn more.
• YakChat (OIDC) has a new redirect URI.
• Your360 AI Directory Lookup (API Service Integration) is now available. Learn more.

Documentation updates

Changes to Okta release version notation

Beginning in October, Okta release version notations are changing from year.month to year.week. For example, 2026.10.0 will become 2026.41.0, where 41 indicates the week of the year that the deployment occurs. More information is available in this knowledge base article.

Version: 2026.09.2

Deployed on October 5, 2026.

Generally Available features

Access Requests decision justification

Okta Identity Governance now supports configurable justification controls for access request decisions, providing requesters more transparency into their approvals and denials. Admins can configure the approval sequence or request type settings to include the decision justification field for approval tasks, allowing approvers the option to provide a rationale for their decision. All submitted justification text is captured on the request ticket and made available to the requester, providing insight into access decisions. See Request type settings.

Provisioning for Kong AI

Provisioning is now available for the Kong AI integration. See Integrate Kong AI with Okta.

AI agent profile and attribute sourcing

You can now use profile sourcing to manage AI agent identities. Okta supports base, custom, and extendable attributes that you can define to create standardize tracking and visibility to your org's AI agents. See AI agent profile sourcing.

Fixes

• When an import job reconciled existing active admin users, Okta incorrectly logged false ROLE_ASSIGNED_USER_ACTIVATION audit events. This issue created misleading records when no role changes occurred. (OKTA-1274235)
• The User Sources page loaded slowly if there was a large number of profile sources. (OKTA-1265698)
• When generating the Out-of-the-Box Admin Role Assignment report, the third-party admin status appeared inconsistently for users with multiple admin roles assigned through group memberships. (OKTA-1278183)
• Admins experienced page performance errors and unexpected MFA prompts due to access tokens expiring during tasks. (OKTA-1281712)

Okta Integration Network

• Ansi Standards Connect (OIDC) is now available. Learn more.
• Antenna (API Service) is now available. Learn more.
• Availity (SWA) was updated.
• ClearVector (OIDC) is now available. Learn more.
• Corma (API Service) has a new logo and the following new scopes: okta.users.manage, okta.roles.read, okta.groups.manage.
• Cursor (SAML) is now available. Learn more.
• dbt Cloud (SAML) is now available. Learn more.
• DevArmor (OIDC) is now available. Learn more.
• Domo (OIDC) is now available. Learn more.
• Goldman Sachs Research (SWA) was updated.
• HelpJuice Lifecycle Management Connector by Redblock (SCIM) is now available. Learn more.
• Hexnode (API Service Integration) has a new integration guide. Learn more.
• Hgraph (SAML) is now available. Learn more.
• Honeycomb (SAML) is now available. Learn more.
• iCompaas - Compliance & Security Automation Platform (API Service) is now available. Learn more.
• Infomaniak (SAML) is now available. Learn more.
• Infomaniak (SCIM) is now available. Learn more.
• Kluster (OIDC) has a new redirect URI.
• Metano (OIDC) is now available. Learn more.
• Metano (SAML) is now available. Learn more.
• Metano (SCIM) is now available. Learn more.
• Metano (Universal Logout) is now available. Learn more.
• Metano has a new logo.
• Netskope User Enrollment (SCIM) now supports OIDC.
• PaperCut Hive and Pocket directory sync (API Service) is now available. Learn more.
• Pensero (SAML) is now available. Learn more.
• Pensero (SCIM) is now available. Learn more.
• PipeDrive (SWA) was updated.
• Progress Chef (OIDC) is now available. Learn more.
• Pulumi Cloud (SAML) is now available. Learn more.
• Pulumi Cloud is now available in the Okta Integration Network (OIN) with SCIM 2.0 provisioning support. Administrators can automate user onboarding, profile updates, and offboarding between Okta and Pulumi Cloud. Group push support enables role-based access by syncing Okta groups to Pulumi Cloud teams.
• Qualtrics XM (SWA) was updated.
• Skillcast (SCIM) was updated. Learn more.
• Tines (OIDC) is now available. Learn more.
• TrueFoundry (OIDC) is now available. Learn more.
• Visitly (SAML) has a new logo and description.
• Visitly (SCIM) has new SCIM features: Push New Users Without Password and Push Groups.
• Your360 (SAML) was updated with a new app name.

Generally Available features

Unique MCP server names

When you register an MCP server, it must now have a unique display name.

Sign-In Widget, version 7.49.1

For details about this release, see Sign-In Widget Release Notes. For more information about the widget, see Okta Sign-In Widget.

Automatic phishing resistance for FastPass in authentication chains

When you include Okta FastPass in an authentication method chain, the
Phishing resistant
characteristic is now selected by default.

Access Requests decision justification

Okta Identity Governance now supports configurable justification controls for access request decisions, providing requesters more transparency into their approvals and denials. Admins can configure the approval sequence or request type settings to include the decision justification field for approval tasks, allowing approvers the option to provide a rationale for their decision. All submitted justification text is captured on the request ticket and made available to the requester, providing insight into access decisions. See Request type settings.

Provisioning for Kong AI

Provisioning is now available for the Kong AI integration. See Integrate Kong AI with Okta.

Editable resource URL for MCP servers

Admins can now edit the resource URL and re-trigger metadata discovery for an MCP server.

AI agent profile and attribute sourcing

You can now use profile sourcing to manage AI agent identities. Okta supports base, custom, and extendable attributes that you can define to create standardize tracking and visibility to your org's AI agents. See AI agent profile sourcing.

Passkey (FIDO2 WebAuthn) authenticator enabled by default

The Passkey (FIDO2 WebAuthn) authenticator is now available by default in all newly created orgs to ensure protection by a phishing-resistant authenticator from the start. As a possession and biometric or knowledge-based factor, Passkey (FIDO2 WebAuthn) meets the requirements for phishing resistance and user presence. See Configure the Passkey (FIDO2 WebAuthn) authenticator.

Fixes

• When accessing apps through a SAML IDP redirect, some device-bound SSO users experienced a continuous loop in Okta FastPass. (OKTA-1242455)
• For users not created through self-service registration, clicking
  Forgot Password
  on a
  Staged
  account sent an activation email and not a password reset email. This also changed the account status to
  Pending user action
  without logging a lifecycle event. (OKTA-1244542)
• In some orgs, the Sign-In Widget (third generation) displayed "Set up another" instead of "Set up" on the email enrollment prompt button. (OKTA-1245836)
• Users couldn't sign in with an NFC authenticator when Device-Bound Single Sign-On was enabled on their Windows devices. (OKTA-1274233)
• When an import job reconciled existing active admin users, Okta incorrectly logged false ROLE_ASSIGNED_USER_ACTIVATION audit events. This issue created misleading records when no role changes occurred. (OKTA-1274235)
• Enrolling the NFC authenticator failed with an error when the
  Sign-in with NFC
  option was disabled, both from the End-User Dashboard and through an enrollment policy that required the NFC authenticator. (OKTA-1275952)
• App-scoped identity provider (IdP) routing rules could route authentication requests to the wrong IdP, causing sign-in failures for users who should have been redirected to a different IdP or the default sign-in page. (OKTA-1176869)
• After Universal Logout revoked a user's session, clicking
  Sign In
  on the Session Revoked page redirected users to the Okta Dashboard instead of the app that they were trying to access. (OKTA-1182886)
• On the End-User Dashboard, the
  Set up
  button for the NFC authenticator incorrectly appeared for users on non-Windows devices. (OKTA-1255785)
• The
  User Sources
  page loaded slowly if there was a large number of profile sources. (OKTA-1265698)
• When the Flexible Okta Verify authenticator configuration was enabled, user verification recovery failed for Okta FastPass and Push. Users without an enrolled verification method weren't prompted to add one and users with an invalidated verification method weren't signed in even after completing recovery. (OKTA-1268512)
• In orgs with the early access feature "Support for re-authentication with an external IdP" enabled, users who tried to sign in to an app through an IdP saw an error message if they already had an active session on the upstream IdP. (OKTA-1276837)
• When generating the Out-of-the-Box Admin Role Assignment report, the third-party admin status appeared inconsistently for users with multiple admin roles assigned through group memberships. (OKTA-1278183)
• Admins experienced page performance errors and unexpected MFA prompts due to access tokens expiring during tasks. (OKTA-1281712)

Okta Integration Network

• Ansi Standards Connect (OIDC) is now available. Learn more.
• Antenna (API Service) is now available. Learn more.
• Availity (SWA) was updated.
• ClearVector (OIDC) is now available. Learn more.
• Corma (API Service) has a new logo and the following new scopes: okta.users.manage, okta.roles.read, okta.groups.manage.
• Cursor (SAML) is now available. Learn more.
• dbt Cloud (SAML) is now available. Learn more.
• DevArmor (OIDC) is now available. Learn more.
• Domo (OIDC) is now available. Learn more.
• Goldman Sachs Research (SWA) was updated.
• HelpJuice Lifecycle Management Connector by Redblock (SCIM) is now available. Learn more.
• Hexnode (API Service Integration) has a new integration guide. Learn more.
• Hgraph (SAML) is now available. Learn more.
• Honeycomb (SAML) is now available. Learn more.
• iCompaas - Compliance & Security Automation Platform (API Service) is now available. Learn more.
• Infomaniak (SAML) is now available. Learn more.
• Infomaniak (SCIM) is now available. Learn more.
• Kluster (OIDC) has a new redirect URI.
• Metano (OIDC) is now available. Learn more.
• Metano (SAML) is now available. Learn more.
• Metano (SCIM) is now available. Learn more.
• Metano (Universal Logout) is now available. Learn more.
• Metano has a new logo.
• Netskope User Enrollment (SCIM) now supports OIDC.
• PaperCut Hive and Pocket directory sync (API Service) is now available. Learn more.
• Pensero (SAML) is now available. Learn more.
• Pensero (SCIM) is now available. Learn more.
• PipeDrive (SWA) was updated.
• Progress Chef (OIDC) is now available. Learn more.
• Pulumi Cloud (SAML) is now available. Learn more.
• Pulumi Cloud is now available in the Okta Integration Network (OIN) with SCIM 2.0 provisioning support. Administrators can automate user onboarding, profile updates, and offboarding between Okta and Pulumi Cloud. Group push support enables role-based access by syncing Okta groups to Pulumi Cloud teams.
• Qualtrics XM (SWA) was updated.
• Skillcast (SCIM) was updated. Learn more.
• Tines (OIDC) is now available. Learn more.
• TrueFoundry (OIDC) is now available. Learn more.
• Visitly (SAML) has a new logo and description.
• Visitly (SCIM) has new SCIM features: Push New Users Without Password and Push Groups.
• Your360 (SAML) was updated with a new app name.

2026.09.2: Update 2 started deployment on October 5

Access Requests decision justification

Okta Identity Governance now supports configurable justification controls for access request decisions, providing requesters more transparency into their approvals and denials. Admins can configure the approval sequence or request type settings to include the decision justification field for approval tasks, allowing approvers the option to provide a rationale for their decision. All submitted justification text is captured on the request ticket and made available to the requester, providing insight into access decisions. See Request type settings.

Provisioning for Kong AI

Provisioning is now available for the Kong AI integration. See Integrate Kong AI with Okta.

Features and Enhancements

Access Requests decision justification

Okta Identity Governance now supports configurable justification controls for access request decisions, providing requesters more transparency into their approvals and denials. Admins can configure the approval sequence or request type settings to include the decision justification field for approval tasks, allowing approvers the option to provide a rationale for their decision. All submitted justification text is captured on the request ticket and made available to the requester, providing insight into access decisions.

Fixes

• Warnings and errors weren't propagated to Slack for campaigns in the STAGING_FAILED state. (OKTA-1272033)
• On rare occasions, the start date of a staged campaign was blank in Slack when staging started shortly after the campaign was eligible. (OKTA-1273337)

Register AI Agents with CIMD

Today, onboarding AI agents usually requires that admins manually exchange public keys with agent operators and handle key rotations, a process that creates "key fatigue," encourages shared credentials, and stalls deployments. Registering AI Agents with CIMD (Client ID Metadata Document) is a new feature of Okta for AI Agents that hands AI agent credential management back to the developers who build them. Admins register a URL, developers control authentication at that endpoint, and Okta authenticates agents at runtime without storing credentials.