Okta Classic Engine Updates & Release Notes

Version 2026.42.1. Deployed on October 19, 2026.

Generally Available features

Provisioning for Sumo Logic

The Sumo Logic Provisioning integration (by Actions) has been added to the OIN. This integration covers user create, update, deactivate/delete, and role assignment across Sumo Logic regional deployments. See Integrate Sumo Logic with Okta.

Provisioning for Cloudflare

Provisioning is now available for Cloudflare. See Integrate Cloudflare with Okta.

Early Access features

mTLS client authentication for OIDC apps

Mutual Transport Layer Security (mTLS) client authentication is now available for OIDC apps. Instead of a shared client secret, Okta issues access tokens that are cryptographically bound to that certificate, so a stolen token can't be used without it. This helps an org strengthen the security of their app and API connections, with no client secrets to store, share, or rotate. See Create OpenID Connect app integrations.

Fixes

• When Okta sent email notifications for entitlement schema change interruptions, the email subject line displayed the app instance name twice. (OKTA-1253044)
• Admins on some custom-domain orgs were unable to access the Admin Console due to a token validation mismatch. (OKTA-1289991)

Okta Integration Network

• Adweek (SWA) was updated.
• Bing Ads (SWA) was updated.
• Brava Security (SCIM) is now available. Learn more.
• CarFax (SWA) was updated.
• Crossbeam (SAML) is now available. Learn more.
• Dataloader.io (SWA) was updated.
• Guru (SAML) is now available. Learn more.
• Guru (SCIM) is available. Learn more.
• LeakData Shared Signals (API Service Integration) is now available. Learn more.
• Ollet (IDV) is now available. Learn more.
• Ready Room (OIDC) is now available. Learn more.

Version 2026.41.0. Deployed on October 12, 2026.

Generally Available features

Radius Agent version 2.28

This version changes the default client access behavior. Starting with this version, you must configure a client IP allowlist for new installations to accept RADIUS connections. See Okta RADIUS Server agent version history.

Provisioning for Fleet End User Enrollment

Provisioning is now available for the Fleet End User Enrollment integration. See Integrate Fleet End User Enrollment with Okta.

Provisioning for Pipedrive

Provisioning is now available for the Pipedrive integration. See Integrate Pipedrive with Okta.

App branding migration

Currently, when you upgrade to Identity Engine, that upgrade happens for your entire org, at a global level. You must prepare all of your customizations and integrations for every app before upgrading your tenant and reconfigure your upgraded org. If anything goes wrong, the whole upgrade must be rolled back.

The app branding migration feature allows eligible orgs to stage, preview, and deploy Identity Engine on an app-by-app basis while preserving their Classic Engine customizations and brands. Upgrade your most important and high-traffic apps first and with confidence, while leaving less critical apps for a later time. If anything goes wrong, only the affected apps need to be rolled back. See App branding migration.

Support for SharePoint Server Subscription Edition

Okta now supports SharePoint Server Subscription Edition for user authentication.

Email notifications for disrupted AD and LDAP agents

System email notifications now include options for Active Directory and LDAP agent disruption and recovery. Admins can enable notifications in the Admin Console to receive email alerts when an agent disrupts and recovers.

Zendesk app integration update

Okta's Zendesk app integration now uses OAuth 2.0 instead of Basic Authentication for provisioning. If you use Zendesk provisioning, re-authenticate your API connection in the Admin Console by April 29, 2027 to prevent provisioning failures. New Zendesk app instances require OAuth 2.0 beginning October 26, 2026. This change doesn't affect SSO. See Integrate Zendesk with Okta.

PowerShell scripts for Active Directory

Admins can now execute custom PowerShell scripts in on-premises Active Directory environments using the Active Directory agent to support custom lifecycle management functionalities. After configuration, admins can invoke scripts through Okta Workflows using the Okta public API. See Enable and configure PowerShell script in Active Directory and Invoke a remote script on the AD agent.

Early Access features

OIN Community Integrations

New apps often launch before Okta has an integration for them, forcing admins to delay rollout or run the app without single sign-on and automated provisioning. Community Integrations close that gap. Okta builds the integration from the application's public APIs and publishes it to the Okta Integration Network at no additional cost. A new integration starts as Community Preview, available to install and test in preview orgs. Once a customer has run it in their own production org, it becomes Community Verified and can be installed in any org. You get a missing integration to test within days, not months, and decide when it's ready for production based on your own testing. See Community integrations.

New System Log events for staging Access Certification campaigns

The System Log now logs the following events for staging Access Certification campaigns:

• certification.campaign.stage.start: This event is logged when the staging process starts for a campaign.
• certification.campaign.stage.end: This event is logged when the campaign staging process ends. The outcome.result field reports SUCCESS if the campaign snapshot is created successfully, or FAILURE if there were errors during the staging process.

See Event Types.

Incremental imports for Office 365 is EA in Preview

Admins can now schedule and run incremental imports for Microsoft Office 365 and Office 365 GCC High app integrations.

Fixes

• When an import resumed after an entitlement unassignment interruption, the import matrix incorrectly displayed the updated user count as 0 instead of reflecting the actual processed users. (OKTA-1272163)
• Some policy.rule.update events weren't displayed in the System Log. (OKTA-1273973)
• When an admin removed an entitlement locally, role or resource set updates failed to sync. (OKTA-1289782)
• When executing a Refresh App Groups action for the Snowflake OIN app, Okta stopped paginating results after retrieving the first 200 groups. (OKTA-1277539)

Okta Integration Network

• Aembit (OIDC) is now available. Learn more.
• Carta (SWA) was updated.
• Holistics (SAML) is now available. Learn more.
• Holistics (SCIM) is now available. Learn more.
• Mailzzy (OIDC) is now available. Learn more.
• Mailzzy (SAML) is now available. Learn more.
• Spacent (OIDC) is now available. Learn more.
• YakChat (OIDC) has a new redirect URI.
• Your360 AI Directory Lookup (API Service Integration) is now available. Learn more.

Documentation updates

Changes to Okta release version notation

Beginning in October, Okta release version notations are changing from year.month to year.week. For example, 2026.10.0 will become 2026.41.0, where 41 indicates the week of the year that the deployment occurs. More information is available in this knowledge base article.

Version: 2026.09.2

Deployed on October 5, 2026.

Generally Available features

Access Requests decision justification

Okta Identity Governance now supports configurable justification controls for access request decisions, providing requesters more transparency into their approvals and denials. Admins can configure the approval sequence or request type settings to include the decision justification field for approval tasks, allowing approvers the option to provide a rationale for their decision. All submitted justification text is captured on the request ticket and made available to the requester, providing insight into access decisions. See Request type settings.

Provisioning for Kong AI

Provisioning is now available for the Kong AI integration. See Integrate Kong AI with Okta.

AI agent profile and attribute sourcing

You can now use profile sourcing to manage AI agent identities. Okta supports base, custom, and extendable attributes that you can define to create standardize tracking and visibility to your org's AI agents. See AI agent profile sourcing.

Fixes

• When an import job reconciled existing active admin users, Okta incorrectly logged false ROLE_ASSIGNED_USER_ACTIVATION audit events. This issue created misleading records when no role changes occurred. (OKTA-1274235)
• The User Sources page loaded slowly if there was a large number of profile sources. (OKTA-1265698)
• When generating the Out-of-the-Box Admin Role Assignment report, the third-party admin status appeared inconsistently for users with multiple admin roles assigned through group memberships. (OKTA-1278183)
• Admins experienced page performance errors and unexpected MFA prompts due to access tokens expiring during tasks. (OKTA-1281712)

Okta Integration Network

• Ansi Standards Connect (OIDC) is now available. Learn more.
• Antenna (API Service) is now available. Learn more.
• Availity (SWA) was updated.
• ClearVector (OIDC) is now available. Learn more.
• Corma (API Service) has a new logo and the following new scopes: okta.users.manage, okta.roles.read, okta.groups.manage.
• Cursor (SAML) is now available. Learn more.
• dbt Cloud (SAML) is now available. Learn more.
• DevArmor (OIDC) is now available. Learn more.
• Domo (OIDC) is now available. Learn more.
• Goldman Sachs Research (SWA) was updated.
• HelpJuice Lifecycle Management Connector by Redblock (SCIM) is now available. Learn more.
• Hexnode (API Service Integration) has a new integration guide. Learn more.
• Hgraph (SAML) is now available. Learn more.
• Honeycomb (SAML) is now available. Learn more.
• iCompaas - Compliance & Security Automation Platform (API Service) is now available. Learn more.
• Infomaniak (SAML) is now available. Learn more.
• Infomaniak (SCIM) is now available. Learn more.
• Kluster (OIDC) has a new redirect URI.
• Metano (OIDC) is now available. Learn more.
• Metano (SAML) is now available. Learn more.
• Metano (SCIM) is now available. Learn more.
• Metano (Universal Logout) is now available. Learn more.
• Metano has a new logo.
• Netskope User Enrollment (SCIM) now supports OIDC.
• PaperCut Hive and Pocket directory sync (API Service) is now available. Learn more.
• Pensero (SAML) is now available. Learn more.
• Pensero (SCIM) is now available. Learn more.
• PipeDrive (SWA) was updated.
• Progress Chef (OIDC) is now available. Learn more.
• Pulumi Cloud (SAML) is now available. Learn more.
• Pulumi Cloud is now available in the Okta Integration Network (OIN) with SCIM 2.0 provisioning support. Administrators can automate user onboarding, profile updates, and offboarding between Okta and Pulumi Cloud. Group push support enables role-based access by syncing Okta groups to Pulumi Cloud teams.
• Qualtrics XM (SWA) was updated.
• Skillcast (SCIM) was updated. Learn more.
• Tines (OIDC) is now available. Learn more.
• TrueFoundry (OIDC) is now available. Learn more.
• Visitly (SAML) has a new logo and description.
• Visitly (SCIM) has new SCIM features: Push New Users Without Password and Push Groups.
• Your360 (SAML) was updated with a new app name.

2026.09.2: Update 2 started deployment on October 5

Access Requests decision justification

Okta Identity Governance now supports configurable justification controls for access request decisions, providing requesters more transparency into their approvals and denials. Admins can configure the approval sequence or request type settings to include the decision justification field for approval tasks, allowing approvers the option to provide a rationale for their decision. All submitted justification text is captured on the request ticket and made available to the requester, providing insight into access decisions. See Request type settings.

Provisioning for Kong AI

Provisioning is now available for the Kong AI integration. See Integrate Kong AI with Okta.

2026.09.1: Update 1 started deployment on September 28

Automatic tasks and questions reassignment after a manager change

To prevent access requests from being blocked during organizational changes, Okta Access Requests now automatically reassigns pending manager tasks and manager questions to an employee's new manager whenever a manager change occurs. This automated reassignment ensures that approvals proceed without manual IT intervention or delays, even if the previous manager's account has already been deactivated. This is available for requests built with both request conditions and request types.

Requester timeline view

Requesters can now view a detailed status timeline of their request's tasks directly from the Okta Access Request app. This enhanced visibility allows requesters to easily track the progress of their requests, see who has approved individual tasks, and identify remaining tasks, helping users stay informed throughout the approval process and reducing unnecessary status inquiries. The timeline is available for requests built with access request conditions.

Version: 2026.09.0

Several new IP service categories are now supported as an individual VPN service category in enhanced dynamic zones. See Supported IP categories.

Okta On-Prem MFA agent version 1.8.7

This version includes security enhancements.

Radius Agent version 2.27

This version includes internal improvements and fixes.

JA4 TLS fingerprinting

Okta now captures JA4 TLS client fingerprints across Syslog event types (securityContext.tlsFingerprint.ja4 pr), instead of just a curated subset. This includes telephony events (for example, OTP/SMS delivery) along with sign-in, auth, and token events. This provides customers and Okta's security teams with fingerprint-level visibility to spot bot traffic, toll fraud, and other TLS-based attack patterns that IP/user-agent signals miss on their own.

This is not yet available for orgs on custom-hosted domains.

Enhanced import monitoring with real-time updates

You can now view real-time progress for imports from the Import Monitoring dashboard. This provides greater visibility into the current status of in-progress imports such as the number of data chunks currently being processed.

Copy email from-addresses to the default brand domain

You can now copy a custom email from-address to the default Okta domain when configuring brand email settings. Previously, this option was available only when copying between custom brands.

JAMF Pro integration updates

TheApplication username format field in the Admin Console now appears by default. This allows admins to configure custom mappings for the SCIMuserNameattribute.

Provisioning for WordPress

Provisioning is now available for the WordPress integration. See Integrate WordPress with Okta.

Provisioning for Ivanti

Provisioning is now available for the Ivanti integration. See Integrate Ivanti with Okta.

Provisioning for Progress Chef

Provisioning is now available for the Progress Chef integration. See Integrate Progress Chef with Okta.

SAP Connector

TheSAPintegration has been migrated to use the SCIM 2.0 API, and the connector's internal HTTP helper has been updated to support this standard.

Remote Desktop detection

Admins can now detect and control access from remote desktops using a newREMOTE_DESKTOPIP service category in Enhanced Dynamic Network Zones. Admins can include or excludeREMOTE_DESKTOPwhen configuring Enhanced Dynamic Network Zones, enabling more precise policies, for example, denying access through the global session policy or app sign-in policy for traffic originating from these networks. See Supported IP service categories.

Email notifications for disrupted AD and LDAP agents

System email notifications now include options for Active Directory and LDAP agent disruption and recovery. Admins can enable notifications in the Admin Console to receive email alerts when an agent disrupts and recovers.

Provisioning for Vercel

Provisioning is now available for the Vercel integration. See Integrate Vercel with Okta.

Increased Access Request limit

The following Access Request limits have been increased:

• Users per task or question: 25 (previously 10)
• Entitlement bundles in an access level condition: 1,000 (previously 100)
• Groups in an access level condition: 1,000 (previously 500)
• Request type configuration lists per org: 250 (previously 100)
• Request types per org: 750 (previously 500)

Malware Proxy Detection

Admins can now detect and control access from known malware proxy networks using a newMALWARE_PROXIESIP service category in Enhanced Dynamic Network Zones. This category is powered by Okta's CyberDefense, covering proxy services associated with malware and botnet activity (including 911 S5, NSOCKS, iProxy, BHProxies, and others). Admins can include or excludeMALWARE_PROXIESwhen configuring Enhanced Dynamic Network Zones, enabling more precise policies, for example, denying access through the global session policy or app sign-in policy for traffic originating from these proxy networks. See Supported IP service categories.

Okta Integration Wizard

Use the Okta Integration Wizard (OIW) to create and deploy custom app integrations in your Okta org. You can configure SSO, SCIM provisioning, Entitlement Management, Universal Logout, API service integration, and custom API Integration Actions capabilities for the app integration. You can use the app integration as a template to create multiple app instances in your org without reconfiguring each app instance. This helps you manage your custom integrations more efficiently and avoid workarounds for SCIM and custom Workflows connectors. See Okta Integration Wizard.

Okta Provisioning Agent, version 3.3.1

Okta Provisioning Agent 3.3.1 is now available. This release updates the bundled JDK patch version and includes security enhancements. See Okta Provisioning Agent and SDK version history.

Task count optimization

To improve performance in the Admin Console, theTaskspage now displays an approximate count of999+when a task contains more than 1,000 items.

Provisioning for Sophos Cloud

Provisioning is now available for the Sophos Cloud integration. See Integrate Sophos Cloud with Okta.

Radius Agent version 2.27

This version includes internal improvements and fixes.

JA4 TLS fingerprinting

Okta now captures JA4 TLS client fingerprints across Syslog event types (securityContext.tlsFingerprint.ja4 pr), instead of just a curated subset. This includes telephony events (for example, OTP/SMS delivery) along with sign-in, auth, and token events. This provides customers and Okta's security teams with fingerprint-level visibility to spot bot traffic, toll fraud, and other TLS-based attack patterns that IP/user-agent signals miss on their own.

This is not yet available for orgs on custom-hosted domains.

Enhanced import monitoring with real-time updates

You can now view real-time progress for imports from the Import Monitoring dashboard. This provides greater visibility into the current status of in-progress imports such as the number of data chunks currently being processed.

Copy email from-addresses to the default brand domain

You can now copy a custom email from-address to the default Okta domain when configuring brand email settings. Previously, this option was available only when copying between custom brands.

Version: 2026.08.0

February 2026

Generally Available

Import AI agents from Workday

You can now import and manage AI agents built in the Workday Agent System of Record (ASOR) directly through Okta. See AI agent imports.

Provisioning for Barracuda

Provisioning is now available for the Barracuda WAF-as-a-Service app integration. See Integrate Barracuda WAF-as-a-Service with Okta.

Provisioning for Linear

Linear provisioning is now available. See Create Linear integration.

Provisioning for Appspace

Provisioning is now available for the Appspace app integration. When you provision the app, you can enable security features like Entitlement Management. See Integrate Appspace with Okta.

Provisioning for SafetyCulture

Provisioning is now available for the SafteyCulture app integration. See Integrate Safetyculture with Okta.

Provisioning for Toggl

Provisioning is now available for the Toggl app integration. See Integrate Toggl with Okta.

Provisioning for Moodle

Provisioning is now available for the Moodle app integration. See Integrate Moodle with Okta.

Provisioning for Elastic Search

Provisioning is now available for the Elastic Search app integration. See Integrate Elastic Search with Okta.

Provisioning for QualtricsXM

Provisioning is now available for the QualtricsXM app integration. See Integrate Qualtrics XM with Okta.

Provisioning for HERE

Provisioning is now available for the HERE app integration. See Integrate HERE with Okta.

Okta Provisioning Agent, version 3.3.0

Okta Provisioning Agent 3.3.0 is now available. This release supports dynamic page size reduction during SCIM app imports, delta provisioning through PATCH requests, and automated entitlement removal during access certifications. Additionally, this version updates the bundled Amazon Corretto JRE to 17.0.19.10.1 and resolves a logging security issue. See Okta Provisioning Agent and SDK version history.

Okta Active Directory agent, version 3.23.0

This release of the Okta Active Directory agent updates the AD Agent Management Utility to guide administrators in granting minimum required permissions instead of prompting to add service accounts to the Domain Admins group. Additionally, the installer no longer halts during service account permission checks in misconfigured environments. This release also includes security enhancements and bug fixes. See Okta Active Directory agent version history.

New Research Release lifecycle

A new Research Release lifecycle, marked with a Research Release banner, is now available for Okta admin documentation. Research Release features are available exclusively to members of the Okta Research Partner Program for a fixed evaluation period, before a feature moves toward Early Access or General Availability. See Research Releases.

New Proxy service for enhanced dynamic zones

PROXYLINE_PROXY is now supported as an individual Proxy service category in enhanced dynamic zones. See Supported IP categories.

Request subscriptions data export

To export information about users subscribed to access requests, select the Request subscriptions option in the Export Data window. The Requests option no longer includes subscriber data. See Export data from Access Requests.

New System Log events for Office 365 app-based provisioning

The System Log now logs the following events for app-based authentication for Office 365 provisioning:

• app.office365.provisioning_app.create: This event is logged when Okta creates a dedicated Microsoft Entra ID app that's registered and used for Office 365 provisioning.
• app.office365.provisioning_app_credential.rotate: This event is logged when Okta rotates the client secret of the registered Microsoft Entra ID app that's used for Office 365 provisioning. The Outcome field in this event's data indicates whether the client secret rotation was successful or not.

Application-based authentication for Office 365 provisioning

Okta now creates a dedicated app in your Microsoft Entra ID tenant instead of a service account for User Sync and Universal Sync provisioning. This app supports app-based authentication and helps improve your org's security. If you have existing User Sync or Universal Sync configurations, you must reauthenticate and consent to two new permissions by September 30, 2026. See Provide Microsoft admin consent for Okta.

Update group rule assignments

Admins can now update the groups assigned to a group rule without deleting and recreating the rule. This streamlines the management of group memberships and rule conditions. See Edit group rules.

Import unlicensed users from Azure Active Directory to Okta

You can now import users from Microsoft Azure Active Directory (AAD) who don't have an assigned Office 365 license. This allows admins to centralize their workforce lifecycle within Okta and eliminates the need to manage unlicensed accounts across both platforms. See Import users to Office 365 using Microsoft Graph API.

On-demand rotation of Office 365 SSO signing certificates

Office 365 app integrations that use WS-Federation for authentication now support the use of app-level certificates. Switching from org-level certificates to app-level certificates improves your security outcomes by eliminating a single point of failure if a shared org-level certificate expires. UI updates enable IT admins to easily monitor certificate status, generate certificates on demand, and perform certificate rotations without disrupting operations. See Configure Single Sign-On for Office 365.

Version: 2026.08.0

Provisioning for Barracuda

Provisioning is now available for the Barracuda WAF-as-a-Service app integration. See Integrate Barracuda WAF-as-a-Service with Okta.

Provisioning for Linear

Linear provisioning is now available. See Create Linear integration.

Provisioning for Appspace

Provisioning is now available for the Appspace app integration. When you provision the app, you can enable security features like Entitlement Management. See Integrate Appspace with Okta.

Provisioning for SafetyCulture

Provisioning is now available for the SafteyCulture app integration. See Integrate Safetyculture with Okta.

Provisioning for Toggl

Provisioning is now available for the Toggl app integration. See Integrate Toggl with Okta.

Provisioning for Moodle

Provisioning is now available for the Moodle app integration. See Integrate Moodle with Okta.

Provisioning for Elastic Search

Provisioning is now available for the Elastic Search app integration. See Integrate Elastic Search with Okta.

Provisioning for QualtricsXM

Provisioning is now available for the QualtricsXM app integration. See Integrate Qualtrics XM with Okta.

Provisioning for HERE

Provisioning is now available for the HERE app integration. See Integrate HERE with Okta.

Okta Provisioning Agent, version 3.3.0

Okta Provisioning Agent 3.3.0 is now available. This release supports dynamic page size reduction during SCIM app imports, delta provisioning through PATCH requests, and automated entitlement removal during access certifications. Additionally, this version updates the bundled Amazon Corretto JRE to 17.0.19.10.1 and resolves a logging security issue. See Okta Provisioning Agent and SDK version history.

Okta Active Directory agent, version 3.23.0

This release of the Okta Active Directory agent updates the AD Agent Management Utility to guide administrators in granting minimum required permissions instead of prompting to add service accounts to the Domain Admins group. Additionally, the installer no longer halts during service account permission checks in misconfigured environments. This release also includes security enhancements and bug fixes. See Okta Active Directory agent version history.

Request subscriptions data export

To export information about users subscribed to access requests, select the Request subscriptions option in the Export Data window. The Requests option no longer includes subscriber data. See Export data from Access Requests.

Fixes

• When an admin modified a LinkedObject attribute value on a user profile, Okta failed to push the updated value to downstream provisioning-enabled apps. (OKTA-311345)
• When admins configured the app setting When a user is deactivated in the app to Do nothing alongside a Post-Termination Interval, user imports from SuccessFactors failed to unassign terminated users. (OKTA-1115401)
• When users clicked the privacy policy link in the Sign-in Widget, they were redirected to the sign-in page instead of the privacy policy page. (OKTA-1201388)
• Some admins saw 500 errors when they tried to delete authorization servers in bulk. (OKTA-1208896)
• In some orgs, when admins created an OIDC web app, the client credentials grant type didn't appear, even though the correct feature flags were enabled. (OKTA-1221984)
• The Okta password health report timed out for orgs with large user directories and returned incomplete data. Reports for large orgs are now limited to a maximum of 500,000 users to ensure reliable performance. (OKTA-1151306)
• The Identity Governance pages had several spelling and punctuation errors. (OKTA-1163458)
• When admins ran an individual realm assignment job, the evaluation process stopped after encountering a single user evaluation failure. (OKTA-1193971)
• On the Welcome and Create Account activation pages on mobile devices, the brand logo was misaligned. (OKTA-1203670)
• In the Admin Console, when admins configured protected actions, the UI displayed both Reset factors for super admins and Reset authenticators for super admins simultaneously. (OKTA-1205255)
• When admins enabled user provisioning features in SCIM 1.0 using On-Premises Provisioning, the schema discovery flow broke. (OKTA-1210290)
• Admins could create a custom token claim named ver for an OpenID Connect app, even though ver is a reserved claim in the ID token. (OKTA-1222755)
• Some proxies and VPNs weren't supported as IP service categories in enhanced dynamic zones. (OKTA-1223345)

Okta Integration Network

• Airbyte Lifecycle Management Connector by Redblock (SCIM) was updated with a new app name and description.
• Cisco User Management Connector (SAML) is now available. Learn more.
• Clarion by Cantina (API Service) has the okta.groups.manage scope.
• DeleteMe (SCIM) has updated endpoints. Learn more.
• Emergent (SAML) is now available. Learn more.
• GreyMatter Transit (API Service) is now available. Learn more.
• Spark HR (OIDC) is now available. Learn more.
• Spark HR (SCIM) is now available. Learn more.
• SpotDraft (SCIM) was updated. Learn more.

Generally Available

Fixes

• In Profile Editor, when an admin clicked the info icon next to the Licenses attribute for the Google app, the Attribute members list became editable instead of read-only. (OKTA-182607)
• In the Secure Partner Access Admin Portal, profile attributes from external IdPs incorrectly appeared as editable fields. (OKTA-1124860)
• When an admin permanently deleted a deactivated user, downstream apps provisioned using SCIM didn't receive a deprovisioning request if the user inherited the app assignment through an Okta-managed group. (OKTA-1186388)
• When an on-premises provisioning operation failed, the resulting error message displayed an inaccurate error code. (OKTA-1199729)
• When admins attempted to reassign a user to a custom app that used on-premises provisioning, the reactivation request failed. (OKTA-1210786)
• In some orgs, when admins created an OIDC web app, the client credentials grant type didn't appear, even though the correct feature flags were enabled. (OKTA-1221984)
• The Okta password health report timed out for orgs with large user directories and returned incomplete data. Reports for large orgs are now limited to a maximum of 500,000 users to ensure reliable performance. (OKTA-1151306)
• The Identity Governance pages had several spelling and punctuation errors. (OKTA-1163458)
• When admins ran an individual realm assignment job, the evaluation process stopped after encountering a single user evaluation failure. (OKTA-1193971)
• On the Welcome and Create Account activation pages on mobile devices, the brand logo was misaligned. (OKTA-1203670)
• In the Admin Console, when admins configured protected actions, the UI displayed both Reset factors for super admins and Reset authenticators for super admins simultaneously. (OKTA-1205255)
• When admins enabled user provisioning features in SCIM 1.0 using On-Premises Provisioning, the schema discovery flow broke. (OKTA-1210290)
• Admins could create a custom token claim named ver for an OpenID Connect app, even though ver is a reserved claim in the ID token. (OKTA-1222755)
• Some proxies and VPNs weren't supported as IP service categories in enhanced dynamic zones. (OKTA-1223345)

Okta Integration Network

• Airbyte by Redblock (SCIM) is now available. Learn more.
• Bitwarden (OIDC) is now available. Learn more.
• Bitwarden (SAML) is now available. Learn more.
• Cribl Cloud (SAML) is now available. Learn more.
• KnowledgeOwl Author Provisioning (SCIM) is now available. Learn more.
• Levenza (SAML) has a new app name, description, icon, and integration guide.
• Lolipop! Static IP Access (SCIM) is now available. Learn more.
• Rapid7 InsightAppSec (SAML) has a new app name.
• SafetyCulture (SAML) is now available. Learn more.
• SparkToro (OIDC) is now available. Learn more.
• SparkToro (SCIM) is now available. Learn more.
• Toggl (SAML) is now available. Learn more.