Generally Available features

Improved MCP server registration experience

The Add an MCP Server UI has been updated to match the AI agent and Agent Gateway management experiences. These changes provide a consistent, streamlined workflow for admins when registering and configuring MCP servers.

Provisioning for Sumo Logic

The Sumo Logic Provisioning integration (by Actions) has been added to the OIN. This integration covers user create, update, deactivate/delete, and role assignment across Sumo Logic regional deployments. See Integrate Sumo Logic with Okta.

Provisioning for Cloudflare

Provisioning is now available for Cloudflare. See Integrate Cloudflare with Okta.

Removal of Cross App Access configuration using Managed Connection

The Managed connection tab located on the app instance's page in the Admin Console has been removed. Your existing configurations will stop working soon. Reconfigure your connections to avoid disruptions. See Configure AI agent-to-app with Cross App Access.

Early Access features

mTLS client authentication for OIDC apps

Mutual Transport Layer Security (mTLS) client authentication is now available for OIDC apps. Instead of a shared client secret, Okta issues access tokens that are cryptographically bound to that certificate, so a stolen token can't be used without it. This helps an org strengthen the security of their app and API connections, with no client secrets to store, share, or rotate. See Create OpenID Connect app integrations.

Authenticator enrollment sets

Authenticator enrollment sets let admins define groups of authenticators for end-user enrollment, instead of simply marking each one required, optional, or disabled. Admins can require a subset of the group (two of three, for example) or let end users choose which authenticator to enroll (Authenticator A or Authenticator B). This flexibility supports acceptable backup authenticators, gives end users more secure choices, and simplifies enrollment policy management. See Create an authenticator enrollment policy.

Device Visibility for macOS: Device Bound SSO sessions

The device details page for managed macOS devices now includes a Device Bound SSO (DBSSO) card. Admins can see the DBSSO session status for each OS-level user account on the device, alongside the Platform SSO and Okta FastPass enrollment status already shown for that account. This makes it easier for IT and security admins to verify that macOS users have an active, device-bound session without piecing together information from multiple screens. See View macOS device details.

Fixes

• Users couldn't sign-in through JIT provisioning flows that used IdP routing rules if they failed authentication at a third-party IdP and were redirected to Okta. (OKTA-1016779)
• When Okta sent email notifications for entitlement schema change interruptions, the email subject line displayed the app instance name twice. (OKTA-1253044)
• When an authentication policy used an authentication method chain that included Okta FastPass, the previously used authentication method wasn't retained. On subsequent sign-in attempts, users had to select an authentication method again instead of being prompted with their previously used method. (OKTA-1262367)
• Admins saw an Internal Server Error when they edited the embedded widget sign-in support in Settings > Account and selected Allow admins to configure the Interaction Code grant type. (OKTA-1269769)
• When admins selected a SAML app for AI Agent user access, the dropdown menu results contained some apps that were ineligible for agent delegation. (OKTA-1281415)
• When certain features registered a device, the device displayed its serial number instead of the assigned device name in the Display Name field. (OKTA-1283648)
• App admins couldn't delete app sign-in policies. (OKTA-1284157)
• Issues occurred when an admin created or updated a resource server that shared an issuer URL with an existing external authorization server. Configurations were overwritten, subject mappings cleared, and cross-resource side effects were introduced across unrelated integrations. (OKTA-1285509)
• Admins on some custom-domain orgs were unable to access the Admin Console due to a token validation mismatch. (OKTA-1289991)

Okta Integration Network

• Adweek (SWA) was updated.
• Bing Ads (SWA) was updated.
• Brava Security (SCIM) is now available. Learn more.
• CarFax (SWA) was updated.
• Crossbeam (SAML) is now available. Learn more.
• Dataloader.io (SWA) was updated.
• Guru (SAML) is now available. Learn more.
• Guru (SCIM) is available. Learn more.
• LeakData Shared Signals (API Service Integration) is now available. Learn more.
• Ollet (IDV) is now available. Learn more.
• Ready Room (OIDC) is now available. Learn more.

Original source

Version 2026.42.1. Deployed on October 14, 2026.

Generally Available features

Improved MCP server registration experience

The Add an MCP Server UI has been updated to match the AI agent and Agent Gateway management experiences. These changes provide a consistent, streamlined workflow for admins when registering and configuring MCP servers.

Provisioning for Sumo Logic

The Sumo Logic Provisioning integration (by Actions) has been added to the OIN. This integration covers user create, update, deactivate/delete, and role assignment across Sumo Logic regional deployments. See Integrate Sumo Logic with Okta.

Provisioning for Cloudfare

Provisioning is now available for Cloudfare. See Integrate Cloudfare with Okta.

Gemini Enterprise Agent Platform import integration

Admins can now import AI agents, including A2A agents, from the Gemini Enterprise Agent Platform into Okta. When enabling the import in Okta, admins can scope the integration to specific regional locations or a global location. The import retrieves key agent attributes, providing rich visibility into AI agent inventories. See Configure Gemini Enterprise Agent Platform for AI agent imports.

Early Access features

mTLS client authentication for OIDC apps

Mutual Transport Layer Security (mTLS) client authentication is now available for OIDC apps. Instead of a shared client secret, Okta issues access tokens that are cryptographically bound to that certificate, so a stolen token can't be used without it. This helps org strengthen the security of their app and API connections, with no client secrets to store, share, or rotate. See Create OpenID Connect app integrations.

Authenticator enrollment sets

Authenticator enrollment sets let admins define groups of authenticators for end-user enrollment, instead of simply marking each one required, optional, or disabled. Admins can require a subset of the group (two of three, for example) or let end users choose which authenticator to enroll (Authenticator A or Authenticator B). This flexibility supports acceptable backup authenticators, gives end users more secure choices, and simplifies enrollment policy management. See Create an authenticator enrollment policy.

Device Visibility for macOS: Device Bound SSO sessions

The device details page for managed macOS devices now includes a Device Bound SSO (DBSSO) card. Admins can see the DBSSO session status for each OS-level user account on the device, alongside the Platform SSO and Okta FastPass enrollment status already shown for that account. This makes it easier for IT and security admins to verify that macOS users have an active, device-bound session without piecing together information from multiple screens. See View macOS device details.

Fixes

• Users couldn't sign-in through JIT provisioning flows that used IdP routing rules if they failed authentication at a third-party IdP and were redirected to Okta. (OKTA-1016779)
• When Okta sent email notifications for entitlement schema change interruptions, the email subject line displayed the app instance name twice. (OKTA-1253044)
• When an authentication policy used an authentication method chain that included Okta FastPass, the previously used authentication method wasn't retained. On subsequent sign-in attempts, users had to select an authentication method again instead of being prompted with their previously used method. (OKTA-1262367)
• Admins saw an Internal Server Error when they edited the embedded widget sign-in support in Settings > Account and selected Allow admins to configure the Interaction Code grant type. (OKTA-1269769)
• When admins selected a SAML app for AI Agent user access, the dropdown menu results contained some apps that were ineligible for agent delegation. (OKTA-1281415)
• When certain features registered a device, the device displayed its serial number instead of the assigned device name in the Display Name field. (OKTA-1283648)
• App admins couldn't delete app sign-in policies. (OKTA-1284157)
• Issues occurred when an admin created or updated a resource server that shared an issuer URL with an existing external authorization server. Configurations were overwritten, subject mappings cleared, and cross-resource side effects were introduced across unrelated integrations. (OKTA-1285509)
• Admins on some custom-domain orgs were unable to access the Admin Console due to a token validation mismatch. (OKTA-1289991)

Okta Integration Network

• Adweek (SWA) was updated.
• Bing Ads (SWA) was updated.
• CarFax (SWA) was updated.
• Crossbeam (SAML) is now available. Learn more.
• Dataloader.io (SWA) was updated.
• Guru (SAML) is now available. Learn more.
• Guru (SCIM) is available. Learn more.
• LeakData Shared Signals (API Service Integration) is now available. Learn more.
• LinkedIn (SWA) was updated.
• Ollet (IDV) is now available. Learn more.
• Ready Room (OIDC) is now available. Learn more.

Original source

Generally Available features

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

• macOS 27.0.1
• macOS 26.7.1
• macOS 15.8.1
• iOS 27.0.1
• iOS 26.7.1

Sign-In Widget, version 7.50.0

For details about this release, see Sign-In Widget Release Notes. For more information about the widget, see Okta Sign-In Widget.

NFC authenticator available with Adaptive MFA

The NFC authenticator is now available to orgs with Adaptive MFA. Frontline workers can tap their NFC badge on a reader and enter a PIN to sign in to Okta-protected apps on shared Windows workstations. See Configure the NFC authenticator.

Security key PIN support for user verification

Users who initially enrolled a security key (such as a YubiKey) without a PIN, but later configured a PIN externally, can now authenticate successfully when a policy rule requires a device passcode or biometric verification.

Import AI agents from Snowflake

You can now import and manage AI agents built in Snowflake directly through Okta. See AI agent imports.

Passkey (FIDO2 WebAuthn) authenticator enabled by default

The Passkey (FIDO2 WebAuthn) authenticator is now available by default in all newly created orgs to ensure protection by a phishing-resistant authenticator from the start. As a possession and biometric or knowledge-based factor, Passkey (FIDO2 WebAuthn) meets the requirements for phishing resistance and user presence. See Configure the Passkey (FIDO2 WebAuthn) authenticator.

Import AI agents from Workato

You can now import and manage AI agents built in Workato directly through Okta. See AI agent imports.

Radius Agent version 2.28

This version changes the default client access behavior. Starting with this version, you must configure a client IP allowlist for new installations to accept RADIUS connections. See Okta RADIUS Server agent version history.

Provisioning for Fleet End User Enrollment

Provisioning is now available for the Fleet End User Enrollment integration. See Integrate Fleet End User Enrollment with Okta.

Provisioning for Pipedrive

Provisioning is now available for the Pipedrive integration. See Integrate Pipedrive with Okta.

App branding migration

Currently, when you upgrade to Identity Engine, that upgrade happens for your entire org, at a global level. You must prepare all of your customizations and integrations for every app before upgrading your tenant and reconfigure your upgraded org. If anything goes wrong, the whole upgrade must be rolled back.

The app branding migration feature allows eligible orgs to stage, preview, and deploy Identity Engine on an app-by-app basis while preserving their Classic Engine customizations and brands. Upgrade your most important and high-traffic apps first and with confidence, while leaving less critical apps for a later time. If anything goes wrong, only the affected apps need to be rolled back. See App branding migration.

Support for SharePoint Server Subscription Edition

Okta now supports SharePoint Server Subscription Edition for user authentication.

Passkey enrollment promotion prompt

You can now configure a passkey enrollment promotion nudge that prompts end users to enroll a passkey authenticator when they sign in. The nudge applies only when the passkey authenticator is optional, and users who skip it can still sign in with another authenticator. You can control how often the prompt reappears and how many times a user can skip it before Okta stops showing it. See Create an authenticator enrollment policy.

Email notifications for disrupted AD and LDAP agents

System email notifications now include options for Active Directory and LDAP agent disruption and recovery. Admins can enable notifications in the Admin Console to receive email alerts when an agent disrupts and recovers.

User identification policy

Admins can now manage rules in the user identification policy to control whether the Sign in with Okta FastPass button appears on an app-by-app basis, instead of relying on a single org-wide setting. This makes it easier to manage pilot groups during Okta FastPass rollouts and to tailor the sign-in experience for individual apps. See Add a rule to a user identification policy.

Zendesk app integration update

Okta's Zendesk app integration now uses OAuth 2.0 instead of Basic Authentication for provisioning. If you use Zendesk provisioning, re-authenticate your API connection in the Admin Console by April 29, 2027 to prevent provisioning failures. New Zendesk app instances require OAuth 2.0 beginning October 26, 2026. This change doesn't affect SSO. See Integrate Zendesk with Okta.

SAP SuccessFactors OAuth 2.0 with SAML Assertion

The SAP SuccessFactors app integration now supports OAuth 2.0 with SAML Assertion for enhanced API security. To ensure your provisioning and sync processes continue without interruption, you must migrate to this new authentication method before the SAP Basic Authentication deletion deadline on November 20, 2026. See Configure OAuth 2.0 with SAML for SAP SuccessFactors.

PowerShell scripts for Active Directory

Admins can now execute custom PowerShell scripts in on-premises Active Directory environments using the Active Directory agent to support custom lifecycle management functionalities. After configuration, admins can invoke scripts through Okta Workflows using the Okta public API. See Enable and configure PowerShell script in Active Directory and Invoke a remote script on the AD agent.

Telephony status callbacks for custom providers

Okta now records delivery status updates from custom telephony providers in the System Log. When admins configure a custom provider through the Admin Console, Okta logs system.sms.receive_status and system.voice.receive_status events. Admins can use these events to verify whether SMS messages and voice calls reach users and to troubleshoot provider credential issues. See Configure telephony providers.

Early Access features

OIN Community Integrations

New apps often launch before Okta has an integration for them, forcing admins to delay rollout or run the app without single sign-on and automated provisioning. Community Integrations close that gap. Okta builds the integration from the application's public APIs and publishes it to the Okta Integration Network at no additional cost. A new integration starts as Community Preview, available to install and test in preview orgs. Once a customer has run it in their own production org, it becomes Community Verified and can be installed in any org. You get a missing integration to test within days, not months, and decide when it's ready for production based on your own testing. See Community integrations.

New System Log events for staging Access Certification campaigns

The System Log now logs the following events for staging Access Certification campaigns:

• certification.campaign.stage.start: This event is logged when the staging process starts for a campaign.
• certification.campaign.stage.end: This event is logged when the campaign staging process ends. The outcome.result field reports SUCCESS if the campaign snapshot is created successfully, or FAILURE if there were errors during the staging process.

See Event Types.

Import AI agents from Cursor

You can now import and manage AI agents built in Cursor directly through Okta. See AI agent imports.

Self-service registration policy for ITP

Self-service sign-up is an easy path for fraud, because bad actors using disposable email addresses or specific networks can slip through undetected. With the new self-service registration policy on the User Profile Policies page, Identity Threat Protection (ITP) customers can create rules that automatically deny sign-up attempts from disposable and throwaway email domains or specific network zones, working alongside Bot Protection as part of Okta's growing set of Attack Protection capabilities. This gives admins another way to cut down on fake accounts and keep self-registration flows cleaner. See Self-service registration.

Incremental imports for Office 365 is EA in Preview

Admins can now schedule and run incremental imports for Microsoft Office 365 and Office 365 GCC High app integrations.

Fixes

• Users attempting to sign in through an embedded Sign-In Widget in Safari on macOS were prevented from completing authentication. (OKTA-1199687)
• Users on managed ChromeOS devices got an internal server error when they tried to enroll authenticators or reset their password from the Account Settings page. (OKTA-1199888)
• When user verification through Okta Verify failed at sign-in, the error message indicated that biometrics were required, even if the org's policy also allowed a device passcode. (OKTA-1250688)
• Developers using the Device Posture Checks OAuth scopes received an authorization error if their org had the base Device Posture Checks feature enabled without the related release flag. (OKTA-1265907)
• The certification.campaign.launch System Log was triggered in error when the staging process started for an Access Certification campaign. (OKTA-1268484)
• When an import resumed after an entitlement unassignment interruption, the import matrix incorrectly displayed the updated user count as 0 instead of reflecting the actual processed users. (OKTA-1272163)
• Some policy.rule.update events weren't displayed in the System Log. (OKTA-1273973)
• Some error messages on the Sign-In Widget weren't correctly translated to French. (OKTA-1277043)
• Admins who added a certificate authority for device management while the Single Certificate feature was enabled received a validation error. (OKTA-1287408)
• When an admin removed an entitlement locally, role or resource set updates failed to sync. (OKTA-1289782)

Okta Integration Network

• Aembit (OIDC) is now available. Learn more.
• Carta (SWA) was updated.
• Holistics (SAML) is now available. Learn more.
• Holistics (SCIM) is now available. Learn more.
• Mailzzy (OIDC) is now available. Learn more.
• Mailzzy (SAML) is now available. Learn more.
• Spacent (OIDC) is now available. Learn more.
• YakChat (OIDC) has a new redirect URI.
• Your360 AI Directory Lookup (API Service Integration) is now available. Learn more.

Documentation updates

Changes to Okta release version notation

Beginning in October, Okta release version notations are changing from year.month to year.week. For example, 2026.10.0 will become 2026.41.0, where 41 indicates the week of the year that the deployment occurs. More information is available in this knowledge base article.

Original source

Version 2026.41.0. Deployed on October 7, 2026.

Generally Available features

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

• macOS 27.0.1
• macOS 26.7.1
• macOS 15.8.1
• iOS 27.0.1
• iOS 26.7.1

NFC authenticator available with Adaptive MFA

The NFC authenticator is now available to orgs with Adaptive MFA. Frontline workers can tap their NFC badge on a reader and enter a PIN to sign in to Okta-protected apps on shared Windows workstations. See Configure the NFC authenticator.

Security key PIN support for user verification

Users who initially enrolled a security key (such as a YubiKey) without a PIN, but later configured a PIN externally, can now authenticate successfully when a policy rule requires a device passcode or biometric verification.

Workday incremental import enhancements

Workday incremental imports now support up to 45,000 changed workers in a single incremental import.

Import AI agents from Snowflake

You can now import and manage AI agents built in Snowflake directly through Okta. See AI agent imports.

Import AI agents from Workato

You can now import and manage AI agents built in Workato directly through Okta. See AI agent imports.

Radius Agent version 2.28

This version changes the default client access behavior. Starting with this version, you must configure a client IP allowlist for new installations to accept RADIUS connections. See Okta RADIUS Server agent version history.

Entitlement support for disconnected apps

Disconnected apps are apps that aren't LCM integrated within Okta. This feature allows you to use CSV files to import users and entitlements into Okta from disconnected apps. This enables consistent governance and compliance across all apps, including those not fully integrated with Okta.

Provisioning for Fleet End User Enrollment

Provisioning is now available for the Fleet End User Enrollment integration. See Integrate Fleet End User Enrollment with Okta.

Provisioning for Pipedrive

Provisioning is now available for the Pipedrive integration. See Integrate Pipedrive with Okta.

Office 365 import updates

Office 365 imports now skip groups with 4-byte UTF-8 characters, such as emojis, instead of failing the entire job. Remaining groups import successfully, and Okta logs failed group details in syslog for troubleshooting.

Zendesk app integration update

Okta's Zendesk app integration now uses OAuth 2.0 instead of Basic Authentication for provisioning. If you use Zendesk provisioning, re-authenticate your API connection in the Admin Console by April 29, 2027 to prevent provisioning failures. New Zendesk app instances require OAuth 2.0 beginning October 26, 2026. This change doesn't affect SSO. See Integrate Zendesk with Okta.

Single Certificate Issuer

With Single Certificate Issuer, admins can configure one certificate authority and trust it for device registration, Okta Device Access, and management attestation, instead of setting up and maintaining a separate certificate authority or SCEP configuration for each purpose. This reduces the number of certificate authorities admins need to create, renew, and track, simplifying device management setup for organizations that use certificate-based device trust. See Single Certificate Issuer.

Telephony status callbacks for custom providers

Okta now records delivery status updates from custom telephony providers in the System Log. When admins configure a custom provider through the Admin Console, Okta logs system.sms.receive_status and system.voice.receive_status events. Admins can use these events to verify whether SMS messages and voice calls reach users and to troubleshoot provider credential issues. See Configure telephony providers.

App branding migration

Currently, when you upgrade to Identity Engine, that upgrade happens for your entire org, at a global level. You must prepare all of your customizations and integrations for every app before upgrading your tenant and reconfigure your upgraded org. If anything goes wrong, the whole upgrade must be rolled back.

The app branding migration feature allows eligible orgs to stage, preview, and deploy Identity Engine on an app-by-app basis while preserving their Classic Engine customizations and brands. Upgrade your most important and high-traffic apps first and with confidence, while leaving less critical apps for a later time. If anything goes wrong, only the affected apps need to be rolled back. See App branding migration.

Early Access features

OIN Community Integrations

New apps often launch before Okta has an integration for them, forcing admins to delay rollout or run the app without single sign-on and automated provisioning. Community Integrations close that gap. Okta builds the integration from the application's public APIs and publishes it to the Okta Integration Network at no additional cost. A new integration starts as Community Preview, available to install and test in preview orgs. Once a customer has run it in their own production org, it becomes Community Verified and can be installed in any org. You get a missing integration to test within days, not months, and decide when it's ready for production based on your own testing. See Community integrations.

New System Log events for staging Access Certification campaigns

The System Log now logs the following events for staging Access Certification campaigns:

• certification.campaign.stage.start: This event is logged when the staging process starts for a campaign.
• certification.campaign.stage.end: This event is logged when the campaign staging process ends. The outcome.result field reports SUCCESS if the campaign snapshot is created successfully, or FAILURE if there were errors during the staging process.

See Event Types.

Import AI agents from Cursor

You can now import and manage AI agents built in Cursor directly through Okta. See AI agent imports.

Self-service registration policy for ITP

Self-service sign-up is an easy path for fraud, because bad actors using disposable email addresses or specific networks can slip through undetected. With the new self-service registration policy on the User Profile Policies page, Identity Threat Protection (ITP) customers can create rules that automatically deny sign-up attempts from disposable and throwaway email domains or specific network zones, working alongside Bot Protection as part of Okta's growing set of Attack Protection capabilities. This gives admins another way to cut down on fake accounts and keep self-registration flows cleaner. See Self-service registration.

Authenticator enrollment sets

Authenticator enrollment sets let admins define groups of authenticators for end-user enrollment, instead of simply marking each one required, optional, or disabled. Admins can require a subset of the group (two of three, for example) or let end users choose which authenticator to enroll (Authenticator A or Authenticator B). This flexibility supports acceptable backup authenticators, gives end users more secure choices, and simplifies enrollment policy management. See Create an authenticator enrollment policy.

Incremental imports for Office 365 is EA in Preview

Admins can now schedule and run incremental imports for Microsoft Office 365 and Office 365 GCC High app integrations.

Fixes

• Users attempting to sign in through an embedded Sign-In Widget in Safari on macOS were prevented from completing authentication. (OKTA-1199687)
• Users on managed ChromeOS devices got an internal server error when they tried to enroll authenticators or reset their password from the Account Settings page. (OKTA-1199888)
• When user verification through Okta Verify failed at sign-in, the error message indicated that biometrics were required, even if the org's policy also allowed a device passcode. (OKTA-1250688)
• Developers using the Device Posture Checks OAuth scopes received an authorization error if their org had the base Device Posture Checks feature enabled without the related release flag. (OKTA-1265907)
• The certification.campaign.launch System Log was triggered in error when the staging process started for an Access Certification campaign. (OKTA-1268484)
• When an import resumed after an entitlement unassignment interruption, the import matrix incorrectly displayed the updated user count as 0 instead of reflecting the actual processed users. (OKTA-1272163)
• Some policy.rule.update events weren't displayed in the System Log. (OKTA-1273973)
• Some error messages on the Sign-In Widget weren't correctly translated to French. (OKTA-1277043)
• Admins who added a certificate authority for device management while the Single Certificate feature was enabled received a validation error. (OKTA-1287408)
• When an admin removed an entitlement locally, role or resource set updates failed to sync. (OKTA-1289782)

Okta Integration Network

• Aembit (OIDC) is now available. Learn more.
• Carta (SWA) was updated.
• Holistics (SAML) is now available. Learn more.
• Holistics (SCIM) is now available. Learn more.
• Mailzzy (OIDC) is now available. Learn more.
• Mailzzy (SAML) is now available. Learn more.
• Spacent (OIDC) is now available. Learn more.
• YakChat (OIDC) has a new redirect URI.
• Your360 AI Directory Lookup (API Service Integration) is now available. Learn more.

Documentation updates

Changes to Okta release version notation

Beginning in October, Okta release version notations are changing from year.month to year.week. For example, 2026.10.0 will become 2026.41.0, where 41 indicates the week of the year that the deployment occurs. More information is available in this knowledge base article.

Original source

Generally Available features

Unique MCP server names

When you register an MCP server, it must now have a unique display name.

Sign-In Widget, version 7.49.1

For details about this release, see Sign-In Widget Release Notes. For more information about the widget, see Okta Sign-In Widget.

Automatic phishing resistance for FastPass in authentication chains

When you include Okta FastPass in an authentication method chain, the
Phishing resistant
characteristic is now selected by default.

Access Requests decision justification

Okta Identity Governance now supports configurable justification controls for access request decisions, providing requesters more transparency into their approvals and denials. Admins can configure the approval sequence or request type settings to include the decision justification field for approval tasks, allowing approvers the option to provide a rationale for their decision. All submitted justification text is captured on the request ticket and made available to the requester, providing insight into access decisions. See Request type settings.

Provisioning for Kong AI

Provisioning is now available for the Kong AI integration. See Integrate Kong AI with Okta.

Editable resource URL for MCP servers

Admins can now edit the resource URL and re-trigger metadata discovery for an MCP server.

AI agent profile and attribute sourcing

You can now use profile sourcing to manage AI agent identities. Okta supports base, custom, and extendable attributes that you can define to create standardize tracking and visibility to your org's AI agents. See AI agent profile sourcing.

Passkey (FIDO2 WebAuthn) authenticator enabled by default

The Passkey (FIDO2 WebAuthn) authenticator is now available by default in all newly created orgs to ensure protection by a phishing-resistant authenticator from the start. As a possession and biometric or knowledge-based factor, Passkey (FIDO2 WebAuthn) meets the requirements for phishing resistance and user presence. See Configure the Passkey (FIDO2 WebAuthn) authenticator.

Fixes

• When accessing apps through a SAML IDP redirect, some device-bound SSO users experienced a continuous loop in Okta FastPass. (OKTA-1242455)
• For users not created through self-service registration, clicking
  Forgot Password
  on a
  Staged
  account sent an activation email and not a password reset email. This also changed the account status to
  Pending user action
  without logging a lifecycle event. (OKTA-1244542)
• In some orgs, the Sign-In Widget (third generation) displayed "Set up another" instead of "Set up" on the email enrollment prompt button. (OKTA-1245836)
• Users couldn't sign in with an NFC authenticator when Device-Bound Single Sign-On was enabled on their Windows devices. (OKTA-1274233)
• When an import job reconciled existing active admin users, Okta incorrectly logged false ROLE_ASSIGNED_USER_ACTIVATION audit events. This issue created misleading records when no role changes occurred. (OKTA-1274235)
• Enrolling the NFC authenticator failed with an error when the
  Sign-in with NFC
  option was disabled, both from the End-User Dashboard and through an enrollment policy that required the NFC authenticator. (OKTA-1275952)
• App-scoped identity provider (IdP) routing rules could route authentication requests to the wrong IdP, causing sign-in failures for users who should have been redirected to a different IdP or the default sign-in page. (OKTA-1176869)
• After Universal Logout revoked a user's session, clicking
  Sign In
  on the Session Revoked page redirected users to the Okta Dashboard instead of the app that they were trying to access. (OKTA-1182886)
• On the End-User Dashboard, the
  Set up
  button for the NFC authenticator incorrectly appeared for users on non-Windows devices. (OKTA-1255785)
• The
  User Sources
  page loaded slowly if there was a large number of profile sources. (OKTA-1265698)
• When the Flexible Okta Verify authenticator configuration was enabled, user verification recovery failed for Okta FastPass and Push. Users without an enrolled verification method weren't prompted to add one and users with an invalidated verification method weren't signed in even after completing recovery. (OKTA-1268512)
• In orgs with the early access feature "Support for re-authentication with an external IdP" enabled, users who tried to sign in to an app through an IdP saw an error message if they already had an active session on the upstream IdP. (OKTA-1276837)
• When generating the Out-of-the-Box Admin Role Assignment report, the third-party admin status appeared inconsistently for users with multiple admin roles assigned through group memberships. (OKTA-1278183)
• Admins experienced page performance errors and unexpected MFA prompts due to access tokens expiring during tasks. (OKTA-1281712)

Okta Integration Network

• Ansi Standards Connect (OIDC) is now available. Learn more.
• Antenna (API Service) is now available. Learn more.
• Availity (SWA) was updated.
• ClearVector (OIDC) is now available. Learn more.
• Corma (API Service) has a new logo and the following new scopes: okta.users.manage, okta.roles.read, okta.groups.manage.
• Cursor (SAML) is now available. Learn more.
• dbt Cloud (SAML) is now available. Learn more.
• DevArmor (OIDC) is now available. Learn more.
• Domo (OIDC) is now available. Learn more.
• Goldman Sachs Research (SWA) was updated.
• HelpJuice Lifecycle Management Connector by Redblock (SCIM) is now available. Learn more.
• Hexnode (API Service Integration) has a new integration guide. Learn more.
• Hgraph (SAML) is now available. Learn more.
• Honeycomb (SAML) is now available. Learn more.
• iCompaas - Compliance & Security Automation Platform (API Service) is now available. Learn more.
• Infomaniak (SAML) is now available. Learn more.
• Infomaniak (SCIM) is now available. Learn more.
• Kluster (OIDC) has a new redirect URI.
• Metano (OIDC) is now available. Learn more.
• Metano (SAML) is now available. Learn more.
• Metano (SCIM) is now available. Learn more.
• Metano (Universal Logout) is now available. Learn more.
• Metano has a new logo.
• Netskope User Enrollment (SCIM) now supports OIDC.
• PaperCut Hive and Pocket directory sync (API Service) is now available. Learn more.
• Pensero (SAML) is now available. Learn more.
• Pensero (SCIM) is now available. Learn more.
• PipeDrive (SWA) was updated.
• Progress Chef (OIDC) is now available. Learn more.
• Pulumi Cloud (SAML) is now available. Learn more.
• Pulumi Cloud is now available in the Okta Integration Network (OIN) with SCIM 2.0 provisioning support. Administrators can automate user onboarding, profile updates, and offboarding between Okta and Pulumi Cloud. Group push support enables role-based access by syncing Okta groups to Pulumi Cloud teams.
• Qualtrics XM (SWA) was updated.
• Skillcast (SCIM) was updated. Learn more.
• Tines (OIDC) is now available. Learn more.
• TrueFoundry (OIDC) is now available. Learn more.
• Visitly (SAML) has a new logo and description.
• Visitly (SCIM) has new SCIM features: Push New Users Without Password and Push Groups.
• Your360 (SAML) was updated with a new app name.

Original source

2026.09.1: Update 1 started deployment on September 28

CIMD for AI agents

You can now register AI agents with a CIMD so that they can identify themselves with a URL instead of a static client ID. See About Client ID Metadata Documents (CIMD).

UI update for MCP server scopes

Now when you add custom scopes to an MCP server, the list of scopes appears in a separate dialog. See Add an MCP server manually.

Automatic tasks and questions reassignment after a manager change

To prevent access requests from being blocked during organizational changes, Okta Access Requests now automatically reassigns pending manager tasks and manager questions to an employee's new manager whenever a manager change occurs. This automated reassignment ensures that approvals proceed without manual IT intervention or delays, even if the previous manager's account has already been deactivated. This is available for requests built with both request conditions and request types.

Requester timeline view

Requesters can now view a detailed status timeline of their request's tasks directly from the Okta Access Request app. This enhanced visibility allows requesters to easily track the progress of their requests, see who has approved individual tasks, and identify remaining tasks, helping users stay informed throughout the approval process and reducing unnecessary status inquiries. The timeline is available for requests built with access request conditions.

Original source

Version: 2026.09.0

Okta Integration Network MCP server registration

You can now add MCP servers from an Okta Integration Network catalog entry, without entering its connection details manually. See Add an MCP server from the OIN catalog. This feature is following a slow rollout with preview deployment throughout mid-September, followed by production.

Dynamic Client Registration support for MCP server registration

Admins can now select Dynamic Client Registration (DCR) when manually registering an MCP server. When you select this option, Okta automatically registers a client with the provider and populates the credentials. See Manually add MCP servers. This feature is following a slow rollout with preview deployment throughout mid-September, followed by production.

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

• Android 14, 15, 16, 17 (2026-08-01)

New IP service categories for enhanced dynamic zones

Several new IP service categories are now supported as an individual VPN service category in enhanced dynamic zones. See Supported IP categories.

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

• macOS 14.8.9
• macOS 15.7.9
• macOS 26.6.1

Okta On-Prem MFA agent version 1.8.7

This version includes security enhancements.

UI updates for AI agent client registration

On the AI agent > Client registration tab, the authentication methods are now displayed vertically and provide a Configure button. When you click Configure, you're directed to a configuration page for the authentication method.

Task count optimization

To improve performance in the Admin Console, the Tasks page now displays an approximate count of 999+ when a task contains more than 1,000 items.

Radius Agent version 2.27

This version includes internal improvements and fixes.

Copy email from-addresses to the default brand domain

You can now copy a custom email from-address to the default Okta domain when configuring brand email settings. Previously, this option was available only when copying between custom brands.

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

• macOS (26.6.2)
• iOS (26.6.1, 18.7.10)
• Windows 10 builds (10.0.17763.9121, 10.0.19044.7663, 10.0.19045.7663)
• Windows 11 builds (10.0.22631.7517, 10.0.26100.9168, 10.0.26200.9168)

Authentication requirement for AI agent app

When an AI agent is bound to an app, the User access tab now displays the authentication requirement for the app. It also provides a link to the app's Sign On tab where you can configure an authentication policy.

JAMF Pro integration updates

The Application username format field in the Admin Console now appears by default. This allows admins to configure custom mappings for the SCIM userName attribute.

Improved MCP server registration UI

MCP server registration has been updated with improved UI for scope handling and tool visibility.

Okta Provisioning Agent, version 3.3.1

Okta Provisioning Agent 3.3.1 is now available. This release updates the bundled JDK patch version and includes security enhancements. See Okta Provisioning Agent and SDK version history.

Provisioning for WordPress

Provisioning is now available for the WordPress integration. See Integrate WordPress with Okta.

Provisioning for Ivanti

Provisioning is now available for the Ivanti integration. See Integrate Ivanti with Okta.

Provisioning for Progress Chef

Provisioning is now available for the Progress Chef integration. See Integrate Progress Chef with Okta.

SAP Connector

The SAP integration has been migrated to use the SCIM 2.0 API, and the connector's internal HTTP helper has been updated to support this standard.

DBSSO device probing improvement

DBSSO now relies on the device-registered conditions that are configured in an app's sign-on policy instead of using org-wide probing methods.

Remote Desktop detection

Admins can now detect and control access from remote desktops using a new REMOTE_DESKTOP IP service category in Enhanced Dynamic Network Zones. Admins can include or exclude REMOTE_DESKTOP when configuring Enhanced Dynamic Network Zones, enabling more precise policies, for example, denying access through the global session policy or app sign-in policy for traffic originating from these networks. See Supported IP service categories.

Passkey enrollment promotion prompt

You can now configure a passkey enrollment promotion nudge that prompts end users to enroll a passkey authenticator when they sign in. The nudge applies only when the passkey authenticator is optional, and users who skip it can still sign in with another authenticator. You can control how often the prompt reappears and how many times a user can skip it before Okta stops showing it. See Create an authenticator enrollment policy.

Email notifications for disrupted AD and LDAP agents

System email notifications now include options for Active Directory and LDAP agent disruption and recovery. Admins can enable notifications in the Admin Console to receive email alerts when an agent disrupts and recovers.

Provisioning for Vercel

Provisioning is now available for the Vercel integration. See Integrate Vercel with Okta.

Increased Access Request limit

The following Access Request limits have been increased:

• Users per task or question: 25 (previously 10)
• Entitlement bundles in an access level condition: 1,000 (previously 100)
• Groups in an access level condition: 1,000 (previously 500)
• Request type configuration lists per org: 250 (previously 100)
• Request types per org: 750 (previously 500)

Tool discovery for MCP servers

When you register an MCP server, you can now test your credentials and discover its available tools. This ensures your connections are fully verified and lets you view the MCP server's capabilities. See Add MCP servers.

Platform SSO password integration with Device-Bound SSO

The Platform SSO password authentication method now integrates with Device-Bound SSO. When a user signs in at the macOS sign-in window, Okta verifies the password factor and creates a device-bound session. Users can then access Okta-protected apps in their browser without additional password prompts. See Platform SSO for macOS and Configure device configuration profiles for PSSO using a generic MDM.

Secure Enclave key support for Platform SSO

Platform SSO now supports a Secure Enclave key-based authentication method that integrates with Device-Bound SSO. When a user authenticates at the macOS sign-in window with their password, the authentication unlocks a hardware-bound cryptographic key stored in the Secure Enclave. Okta uses the key to create a device-bound session that satisfies any authentication policy that requires Okta FastPass with user verification, without repeated MFA prompts. See Platform SSO for macOS and Configure device configuration profiles for Secure Enclave using a generic MDM.

Device-Bound Single Sign-On

Device-Bound Single Sign-On initiates a hardware-protected session for seamless access to apps after users sign in to Okta-joined macOS and Windows devices. This feature provides session replay protection and a streamlined authentication experience. See Device-Bound Single Sign-On.

PowerShell scripts for Active Directory

Admins can now execute custom PowerShell scripts in on-premises Active Directory environments using the Active Directory agent to support custom lifecycle management functionalities. After configuration, admins can invoke scripts through Okta Workflows using the Okta public API. See Enable and configure PowerShell script in Active Directory and Invoke a remote script on the AD agent.

Provisioning for Sophos Cloud

Provisioning is now available for the Sophos Cloud integration. See Integrate Sophos Cloud with Okta.

Original source

Version: 2026.09.0

Device assurance OS version update

The following OS versions are now supported in device assurance policies: Android 14, 15, 16, 17 (2026-08-01)

New IP service categories for enhanced dynamic zones

Several new IP service categories are now supported as an individual VPN service category in enhanced dynamic zones. See Supported IP categories.

Cross App Access support for AI agents and apps for all customers

Use XAA to secure access between custom SSO-agentic requesting apps and SSO resource apps. XAA enables customers to connect AI agents and apps to take action on behalf of a user, and removes the need for user consent at runtime. The XAA connection is managed by Okta admins, providing them with visibility and control over which actions an AI agent can take on behalf of a user across the supported OIDC and SAML SSO protocols.

• For the agentic requesting app configuration, see Add AI agents manually, and select your SSO agentic app in User access > App used for access configuration.
• For the XAA resource app configuration, see Configure resource server connectors. If you're configuring an OIN resource app, it must already have XAA enabled.
• To connect the AI agent to the resource app, see Connect AI agents to resources and select Application as the resource type, and then select your resource app.

For agentic requesting apps that use OIDC for SSO, Okta enables binding an AI agent with an OIDC SSO app so that they share the same credentials. If you want to remove this configuration in Okta, delete the AI agent and the corresponding OIDC app.

From this AI agent-app binding capability, admins can now configure direct user authentication for the AI agent. If you have an Okta for AI Agent org and have previously used the Delegation tab to configure AI agent access through delegation links, you need to reconfigure them with the User access tab. See the Migration from Okta for AI Agent delegation link guidance.

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

• macOS 14.8.9
• macOS 15.7.9
• macOS 26.6.1

Unified identity for AI agents

Admins can now use an external identifier to ensure their org's registered AI agents are unique. They can also configure creation and matching criteria for imported AI agents, and preview imported AI agents before they're registered. See Enable AI agent imports for an app.

Okta On-Prem MFA agent version 1.8.7

This version includes security enhancements.

UI updates for AI agent client registration

On the AI agent > Client registration tab, the authentication methods are now displayed vertically and provide a Configure button. When you click Configure, you're directed to a configuration page for the authentication method.

Radius Agent version 2.27

This version includes internal improvements and fixes.

JA4 TLS fingerprinting

Okta now captures JA4 TLS client fingerprints across Syslog event types (securityContext.tlsFingerprint.ja4 pr), instead of just a curated subset. This includes telephony events (for example, OTP/SMS delivery) along with sign-in, auth, and token events. This provides customers and Okta's security teams with fingerprint-level visibility to spot bot traffic, toll fraud, and other TLS-based attack patterns that IP/user-agent signals miss on their own.

This is not yet available for orgs on custom-hosted domains.

Enhanced import monitoring with real-time updates

You can now view real-time progress for imports from the Import Monitoring dashboard. This provides greater visibility into the current status of in-progress imports such as the number of data chunks currently being processed.

Copy email from-addresses to the default brand domain

You can now copy a custom email from-address to the default Okta domain when configuring brand email settings. Previously, this option was available only when copying between custom brands.

Manual MCP registration

Admins can now manually configure authorization server details and client credentials when registering MCP servers. This allows registration of internal or legacy MCP servers that don't support automated metadata discovery endpoints. See Add MCP servers.

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

• macOS (26.6.2)
• iOS (26.6.1, 18.7.10)
• Windows 10 builds (10.0.17763.9121, 10.0.19044.7663, 10.0.19045.7663)
• Windows 11 builds (10.0.22631.7517, 10.0.26100.9168, 10.0.26200.9168)

Authentication requirement for AI agent app

When an AI agent is bound to an app, the User access tab now displays the authentication requirement for the app. It also provides a link to the app's Sign On tab where you can configure an authentication policy.

JAMF Pro integration updates

The Application username format field in the Admin Console now appears by default. This allows admins to configure custom mappings for the SCIM userName attribute.

Improved MCP server registration UI

MCP server registration has been updated with improved UI for scope handling and tool visibility.

Provisioning for WordPress

Provisioning is now available for the WordPress integration. See Integrate WordPress with Okta.

Provisioning for Ivanti

Provisioning is now available for the Ivanti integration. See Integrate Ivanti with Okta.

Provisioning for Progress Chef

Provisioning is now available for the Progress Chef integration. See Integrate Progress Chef with Okta.

SAP Connector

The SAP integration has been migrated to use the SCIM 2.0 API, and the connector's internal HTTP helper has been updated to support this standard.

Dynamic Client Registration support for MCP server registration

Admins can now select Dynamic Client Registration (DCR) when manually registering an MCP server. When you select this option, Okta automatically registers a client with the provider and populates the credentials. See Manually add MCP servers. This feature is following a slow rollout with preview deployment throughout mid-September, followed by production.

Okta Integration Network MCP server

You can now add MCP servers from an Okta Integration Network catalog entry, without entering its connection details manually. See Add an MCP server from the OIN catalog. This feature is following a slow rollout with preview deployment throughout mid-September, followed by production.

DBSSO device probing improvement

DBSSO now relies on the device-registered conditions that are configured in an app's sign-on policy instead of using org-wide probing methods.

Remote Desktop detection

Admins can now detect and control access from remote desktops using a new REMOTE_DESKTOP IP service category in Enhanced Dynamic Network Zones. Admins can include or exclude REMOTE_DESKTOP when configuring Enhanced Dynamic Network Zones, enabling more precise policies, for example, denying access through the global session policy or app sign-in policy for traffic originating from these networks. See Supported IP service categories.

Email notifications for disrupted AD and LDAP agents

System email notifications now include options for Active Directory and LDAP agent disruption and recovery. Admins can enable notifications in the Admin Console to receive email alerts when an agent disrupts and recovers.

Provisioning for Vercel

Provisioning is now available for the Vercel integration. See Integrate Vercel with Okta.

Increased Access Request limit

The following Access Request limits have been increased:

• Users per task or question: 25 (previously 10)
• Entitlement bundles in an access level condition: 1,000 (previously 100)
• Groups in an access level condition: 1,000 (previously 500)
• Request type configuration lists per org: 250 (previously 100)
• Request types per org: 750 (previously 500)

Malware Proxy Detection

Admins can now detect and control access from known malware proxy networks using a new MALWARE_PROXIES IP service category in Enhanced Dynamic Network Zones. This category is powered by Okta's CyberDefense, covering proxy services associated with malware and botnet activity (including 911 S5, NSOCKS, iProxy, BHProxies, and others). Admins can include or exclude MALWARE_PROXIES when configuring Enhanced Dynamic Network Zones, enabling more precise policies, for example, denying access through the global session policy or app sign-in policy for traffic originating from these proxy networks. See Supported IP service categories.

Okta Integration Wizard

Use the Okta Integration Wizard (OIW) to create and deploy custom app integrations in your Okta org. You can configure SSO, SCIM provisioning, Entitlement Management, Universal Logout, API service integration, and custom API Integration Actions capabilities for the app integration. You can use the app integration as a template to create multiple app instances in your org without reconfiguring each app instance. This helps you manage your custom integrations more efficiently and avoid workarounds for SCIM and custom Workflows connectors. See Okta Integration Wizard.

WebAuthn enrollment failure events in the System Log

The System Log now logs failed WebAuthn (FIDO2) enrollment attempts, using the user.mfa.factor.activate event and debug data such as AAGUID, isBackupEligible, and matched authenticator groups. Previously, only successful enrollments were logged. You can use this to identify which authenticator models don't enroll.

Tool discovery for MCP servers

When you register an MCP server, you can now test your credentials and discover its available tools. This ensures your connections are fully verified and lets you view the MCP server's capabilities. See Add MCP servers.

Okta Provisioning Agent, version 3.3.1

Okta Provisioning Agent 3.3.1 is now available. This release updates the bundled JDK patch version and includes security enhancements. See Okta Provisioning Agent and SDK version history.

Task count optimization

To improve performance in the Admin Console, the Tasks page now displays an approximate count of 999+ when a task contains more than 1,000 items.

Provisioning for Sophos Cloud

Provisioning is now available for the Sophos Cloud integration. See Integrate Sophos Cloud with Okta.

Original source

2026.08.3: Update 3 started deployment on August 31

Manual MCP registration

Admins can now manually configure authorization server details and client credentials when registering MCP servers. This allows registration of internal or legacy MCP servers that don't support automated metadata discovery endpoints. See Add MCP servers.

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

• macOS (26.6.2)
• iOS (26.6.1, 18.7.10)
• Windows 10 builds (10.0.17763.9121, 10.0.19044.7663, 10.0.19045.7663)
• Windows 11 builds (10.0.22631.7517, 10.0.26100.9168, 10.0.26200.9168)

Authentication requirement for AI agent app

When an AI agent is bound to an app, the User access tab now displays the authentication requirement for the app. It also provides a link to the app's Sign On tab where you can configure an authentication policy.

Jamf Pro integration updates

The Application username format field in the Admin Console now appears by default. This allows admins to configure custom mappings for the SCIM userName attribute.

Original source

2026.08.2: Update 2 started deployment on August 25

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

• macOS 14.8.9
• macOS 15.7.9
• macOS 26.6.1

Radius Agent version 2.27

This version includes internal improvements and fixes.

JA4 TLS fingerprinting

Okta now captures JA4 TLS client fingerprints across Syslog event types (securityContext.tlsFingerprint.ja4 pr), instead of just a curated subset. This includes telephony events (for example, OTP/SMS delivery) along with sign-in, auth, and token events. This provides customers and Okta's security teams with fingerprint-level visibility to spot bot traffic, toll fraud, and other TLS-based attack patterns that IP/user-agent signals miss on their own.

This is not yet available for orgs on custom-hosted domains.

Enhanced import monitoring with real-time updates

You can now view real-time progress for imports from the Import Monitoring dashboard. This provides greater visibility into the current status of in-progress imports such as the number of data chunks currently being processed.

Copy email from-addresses to the default brand domain

You can now copy a custom email from-address to the default Okta domain when configuring brand email settings. Previously, this option was available only when copying between custom brands.

Original source

2026.08.1: Update 1 started deployment on August 17

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

• Android 14, 15, 16, 17 (2026-08-01)

New IP service categories for enhanced dynamic zones

Several new IP service categories are now supported as an individual VPN service category in enhanced dynamic zones. See Supported IP categories.

Cross App Access support for AI agents and apps for all customers

Use XAA to secure access between custom SSO-agentic requesting apps and SSO resource apps. XAA enables customers to connect AI agents and apps to take action on behalf of a user, and removes the need for user consent at runtime. The XAA connection is managed by Okta admins, providing them with visibility and control over which actions an AI agent can take on behalf of a user across the supported OIDC and SAML SSO protocols.

• For the agentic requesting app configuration, see Add AI agents manually, and select your SSO agentic app in User access > App used for access configuration.
• For the XAA resource app configuration, see Configure resource server connectors. If you're configuring an OIN resource app, it must already have XAA enabled.
• To connect the AI agent to the resource app, see Connect AI agents to resources and select Application as the resource type, and then select your resource app.

For agentic requesting apps that use OIDC for SSO, Okta enables binding an AI agent with an OIDC SSO app so that they share the same credentials. If you want to remove this configuration in Okta, delete the AI agent and the corresponding OIDC app.

From this AI agent-app binding capability, admins can now configure direct user authentication for the AI agent. If you have an Okta for AI Agent org and have previously used the Delegation tab to configure AI agent access through delegation links, you need to reconfigure them with the User access tab. See the Migration from Okta for AI Agent delegation link guidance.

Original source

Version: 2026.08.0

Import AI agents from Workday

You can now import and manage AI agents built in the Workday Agent System of Record (ASOR) directly through Okta. See AI agent imports.

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

• Android 13, 14, 15, 16 security patch 2026-01-05

Claude supports SAML 2.0 SSO

The Claude app integration now supports SAML 2.0 SSO. Orgs that are subscribed to Okta for AI Agents can continue using the integration to import Claude Managed Agents into Okta. See Integrate Claude with Okta.

Provisioning for Barracuda

Provisioning is now available for the Barracuda WAF-as-a-Service app integration. See Integrate Barracuda WAF-as-a-Service with Okta.

Provisioning for Linear

Linear provisioning is now available. See Create Linear integration.

Provisioning for Appspace

Provisioning is now available for the Appspace app integration. When you provision the app, you can enable security features like Entitlement Management. See Integrate Appspace with Okta.

Agent-to-agent audience update

The agent-to-agent server resource url (audience parameter) can now be a free-form string.

Provisioning for Toggl

Provisioning is now available for the Toggl app integration. See Integrate Toggl with Okta.

Provisioning for Moodle

Provisioning is now available for the Moodle app integration. See Integrate Moodle with Okta.

Provisioning for HERE

Provisioning is now available for the HERE app integration. See Integrate HERE with Okta.

Editable issuer URL for AI agent resource connections

Now when you create a resource connection between an AI agent and an authorization server, you can modify the authorization server's issuer URL.

Skipped failed entries during AI agent import

Now when you import AI agents from a provider, Okta skips the failed entries and creates or updates the successful ones.

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

• Android 14, 15, 16, 17 (2026-07-01)
• Windows 10 builds (10.0.17763.9020, 10.0.19044.7548, 10.0.19045.7548)
• Windows 11 builds (10.0.22631.7376, 10.0.26100.8875, 10.0.26200.8875)

Import AI agents from Langsmith

You can now import and manage AI agents built in the Langsmith Deployments directly through Okta. See AI agent imports.

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

• macOS (26.6, 15.7.8, 14.8.8)
• iOS (26.6)

Improved smart card enrollment

Users can now enroll a smart card even if the login attribute doesn't match the value mapped from the card. Previously, enrollment failed during dynamic matching or Just-In-Time provisioning because the login attribute was treated as restricted from updates. See Add a Smart Card identity provider.

Okta Provisioning Agent, version 3.3.0

Okta Provisioning Agent 3.3.0 is now available. This release supports dynamic page size reduction during SCIM app imports, delta provisioning through PATCH requests, and automated entitlement removal during access certifications. Additionally, this version updates the bundled Amazon Corretto JRE to 17.0.19.10.1 and resolves a logging security issue. See Okta Provisioning Agent and SDK version history.

Okta Active Directory agent, version 3.23.0

This release of the Okta Active Directory agent updates the AD Agent Management Utility to guide administrators in granting minimum required permissions instead of prompting to add service accounts to the Domain Admins group. Additionally, the installer no longer halts during service account permission checks in misconfigured environments. This release also includes security enhancements and bug fixes. See Okta Active Directory agent version history.

New Research Release lifecycle

A new Research Release lifecycle is now available, marked with a Research Release banner in Okta admin documentation and visible in the Admin Console under Settings > Features. Research Release features are available exclusively to members of the Okta Research Partner Program for a fixed evaluation period, before a feature moves toward Early Access or General Availability. See Research Releases.

Improved system log events for IdP routing

System log events for IdP routing now include the target information from the IdP Discovery rule that matched, when available.

New minimum character length for AI agent names

AI agent names now must contain a minimum of three characters.

Request subscriptions data export

To export information about users subscribed to access requests, select the Request subscriptions option in the Export Data window. The Requests option no longer includes subscriber data. See Export data from Access Requests.

New target for user.risk.detect events

Identity Threat Protection now populates affected factors in the user.risk.detect event's target for entity critical actions for high-threat IPs.

Malware Proxy Detection

Admins can now detect and control access from known malware proxy networks using a new MALWARE_PROXIES IP service category in Enhanced Dynamic Network Zones. This category is powered by Okta's CyberDefense, covering proxy services associated with malware and botnet activity (including 911 S5, NSOCKS, iProxy, BHProxies, and others). Admins can include or exclude MALWARE_PROXIES when configuring Enhanced Dynamic Network Zones, enabling more precise policies, for example, denying access through the global session policy or app sign-in policy for traffic originating from these proxy networks. See Supported IP service categories.

SAP SuccessFactors OAuth 2.0 with SAML Assertion

The SAP SuccessFactors app integration now supports OAuth 2.0 with SAML Assertion for enhanced API security. To ensure your provisioning and sync processes continue without interruption, you must migrate to this new authentication method before the SAP Basic Authentication deletion deadline on November 20, 2026. See Configure OAuth 2.0 with SAML for SAP SuccessFactors.

Okta Integration Wizard

Use the Okta Integration Wizard (OIW) to create and deploy custom app integrations in your Okta org. You can configure SSO, SCIM provisioning, Entitlement Management, Universal Logout, and custom API Integration Actions capabilities for the app integration. You can use the app integration as a template to create multiple app instances in your org without reconfiguring each app instance. This helps you manage your custom integrations more efficiently and avoid workarounds for SCIM and custom Workflows connectors. See Okta Integration Wizard.

Updated passkey enrollment screen

The passkey enrollment screen in the Sign-In Widget now includes updated copy and an informational image to help users understand what a passkey is before they enroll.

WebAuthn enrollment failure events in the System Log

The System Log now logs failed WebAuthn (FIDO2) enrollment attempts, using the user.mfa.factor.activate event and debug data such as AAGUID, isBackupEligible, and matched authenticator groups. Previously, only successful enrollments were logged. You can use this to identify which authenticator models don't enroll.

MCP Servers and Resource Servers moved to Applications and Resources

In the Admin Console, the MCP Servers and Resource Servers pages have moved from the Directory menu to the Applications and Resources menu.

Applications menu renamed to Applications and Resources

In the Admin Console, the Applications menu is now called Applications and Resources.

Direct End-User Settings access

Users may now access their Settings page through a direct URL in addition to the End-User Dashboard. This feature provides convenience and security for users, gives admins greater flexibility when working with End-User Dashboard access control scenarios, and includes accessibility and UX improvements. See End-User Settings.

Original source

Version: 2026.08.0

Import AI agents from Microsoft Office 365

You can now import and manage AI agents built in Microsoft Copilot Studio and Microsoft AI Foundry directly through Okta. See AI agent imports.

Import AI agents from Workday

You can now import and manage AI agents built in the Workday Agent System of Record (ASOR) directly through Okta. See AI agent imports.

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

• Android 13, 14, 15, 16 security patch 2026-01-05

Anthropic (Claude) SAML SSO integration

A new SAML 2.0 SSO integration for Anthropic (Claude) is now available on the Okta Integration Network, with the existing Anthropic AI Agent integration bundled in.

Claude supports SAML 2.0 SSO

The Claude app integration now supports SAML 2.0 SSO. Orgs that are subscribed to Okta for AI Agents can continue using the integration to import Claude Managed Agents into Okta. See Integrate Claude with Okta.

Provisioning for Barracuda

Provisioning is now available for the Barracuda WAF-as-a-Service app integration. See Integrate Barracuda WAF-as-a-Service with Okta.

Provisioning for Linear

Linear provisioning is now available. See Create Linear integration.

Provisioning for Appspace

Provisioning is now available for the Appspace app integration. When you provision the app, you can enable security features like Entitlement Management. See Integrate Appspace with Okta.

Sign-In Widget, version 7.47.1

For details about this release, see Sign-In Widget Release Notes. For more information about the widget, see Okta Sign-In Widget.

Agent-to-agent audience update

The agent-to-agent server resource url (audience parameter) can now be a free-form string.

Cross app access for AI agents and apps

Cross app access now secures connections between custom SAML requesting apps and OIDC/SAML resource apps. This feature allows admins to securely connect AI agents and apps to take action on behalf of users, bypassing the need for user consent. Admins retain full visibility and granular control over every action an AI agent can execute for a user. See Configure resource server connectors.

Provisioning for SafetyCulture

Provisioning is now available for the SafteyCulture app integration. See Integrate Safetyculture with Okta.

Provisioning for Toggl

Provisioning is now available for the Toggl app integration. See Integrate Toggl with Okta.

Provisioning for Moodle

Provisioning is now available for the Moodle app integration. See Integrate Moodle with Okta.

Agent-to-agent connections

Agent-to-agent server connections allow admins to connect AI agents to other AI agents. Admins can manage scopes to restrict access to the appropriate AI agent tasks, and allow service apps to call AI agents without user context. Using tokens and the System Log, admins can view all the users, AI agents, and apps that call an AI agent. See Agent-to-agent connections.

Provisioning for Elastic Search

Provisioning is now available for the Elastic Search app integration. See Integrate Elastic Search with Okta.

Provisioning for QualtricsXM

Provisioning is now available for the QualtricsXM app integration. See Integrate Qualtrics XM with Okta.

Provisioning for HERE

Provisioning is now available for the HERE app integration. See Integrate HERE with Okta.

Editable issuer URL for AI agent resource connections

Now when you create a resource connection between an AI agent and an authorization server, you can modify the authorization server's issuer URL.

Skipped failed entries during AI agent import

Now when you import AI agents from a provider, Okta skips the failed entries and creates or updates the successful ones.

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

• Android 14, 15, 16, 17 (2026-07-01)
• Windows 10 builds (10.0.17763.9020, 10.0.19044.7548, 10.0.19045.7548)
• Windows 11 builds (10.0.22631.7376, 10.0.26100.8875, 10.0.26200.8875)

Import AI agents from Langsmith

You can now import and manage AI agents built in the Langsmith Deployments directly through Okta. See AI agent imports.

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

• macOS (26.6, 15.7.8, 14.8.8)
• iOS (26.6)

Sign-In Widget, versions 7.48.1 and 7.48.0

For details about these releases, see Sign-In Widget Release Notes. For more information about the widget, see Okta Sign-In Widget.

Improved smart card enrollment

Users can now enroll a smart card even if the login attribute doesn't match the value mapped from the card. Previously, enrollment failed during dynamic matching or Just-In-Time provisioning because the login attribute was treated as restricted from updates. See Add a Smart Card identity provider.

Okta Provisioning Agent, version 3.3.0

Okta Provisioning Agent 3.3.0 is now available. This release supports dynamic page size reduction during SCIM app imports, delta provisioning through PATCH requests, and automated entitlement removal during access certifications. Additionally, this version updates the bundled Amazon Corretto JRE to 17.0.19.10.1 and resolves a logging security issue. See Okta Provisioning Agent and SDK version history.

Okta Active Directory agent, version 3.23.0

This release of the Okta Active Directory agent updates the AD Agent Management Utility to guide administrators in granting minimum required permissions instead of prompting to add service accounts to the Domain Admins group. Additionally, the installer no longer halts during service account permission checks in misconfigured environments. This release also includes security enhancements and bug fixes. See Okta Active Directory agent version history.

New Research Release lifecycle

A new Research Release lifecycle, marked with a Research Release banner, is now available for Okta admin documentation. Research Release features are available exclusively to members of the Okta Research Partner Program for a fixed evaluation period, before a feature moves toward Early Access or General Availability. See Research Releases.

Improved system log events for IdP routing

System log events for IdP routing now include the target information from the IdP Discovery rule that matched, when available.

New minimum character length for AI agent names

AI agent names now must contain a minimum of three characters.

New Proxy service for enhanced dynamic zones

PROXYLINE_PROXY is now supported as an individual Proxy service category in enhanced dynamic zones. See Supported IP categories.

Request subscriptions data export

To export information about users subscribed to access requests, select the Request subscriptions option in the Export Data window. The Requests option no longer includes subscriber data. See Export data from Access Requests.

New target for user.risk.detect events

Identity Threat Protection now populates affected factors in the user.risk.detect event's target for entity critical actions for high-threat IPs.

New System Log events for Office 365 app-based provisioning

The System Log now logs the following events for app-based authentication for Office 365 provisioning:

• app.office365.provisioning_app.create: This event is logged when Okta creates a dedicated Microsoft Entra ID app that's registered and used for Office 365 provisioning.
• app.office365.provisioning_app_credential.rotate: This event is logged when Okta rotates the client secret of the registered Microsoft Entra ID app that's used for Office 365 provisioning. The Outcome field in this event's data indicates whether the client secret rotation was successful or not.

Advanced posture checks for device assurance

Advanced posture checks let admins configure specific device security conditions beyond what standard device assurance policies support. Using osquery, you can write custom SQL queries to assess device state on macOS and Windows devices, configure checks for unmanaged devices, and integrate with endpoint detection and response (EDR) tools. See Configure advanced posture checks for device assurance.

Strong cipher enforcement for X.509 client certificate authentication

Okta now enforces strong cryptographic ciphers for X.509 client certificates used in mTLS authentication. Client certificates signed with weak ciphers, such as RSA-1024, are no longer accepted for new orgs. If you use X.509 certificate-based authentication, ensure that your client certificates meet FIPS 140-2 cipher requirements.

Updated passkey enrollment screen

The passkey enrollment screen in the Sign-In Widget now includes updated copy and an informational image to help users understand what a passkey is before they enroll.

Customizable emails for Passkeys (FIDO2 WebAuthn) authenticator

The email that users receive when the admin configures a Passkeys (FIDO2 WebAuthn) authenticator is now available as a customizable template in Customizations Brands Emails. Admins can modify the subject line, email body, and dynamic variables such as the PIN, first name, and org name, and can add content in multiple languages.

Email auto-enrollment and recovery management

Admins can control the automatic enrollment of email as an authenticator and configure email-based password recovery, unlock, and change where email isn't an authenticator. See Make email an optional authenticator.

Application-based authentication for Office 365 provisioning

Okta now creates a dedicated app in your Microsoft Entra ID tenant instead of a service account for User Sync and Universal Sync provisioning. This app supports app-based authentication and helps improve your org's security. If you have existing User Sync or Universal Sync configurations, you must reauthenticate and consent to two new permissions by September 30, 2026. See Provide Microsoft admin consent for Okta.

MCP Servers and Resource Servers moved to Applications and Resources

In the Admin Console, the MCP Servers and Resource Servers pages have moved from the Directory menu to the Applications and Resources menu.

Applications menu renamed to Applications and Resources

In the Admin Console, the Applications menu is now called Applications and Resources.

Enhanced Breached Credentials Protection

This feature provides a premium breached credentials detection feed for Okta Customer Identity (OCI) customers with Identity Threat Protection which identifies more compromised credentials sooner. See Breached credentials protection.

Update group rule assignments

Admins can now update the groups assigned to a group rule without deleting and recreating the rule. This streamlines the management of group memberships and rule conditions. See Edit group rules.

Import unlicensed users from Azure Active Directory to Okta

You can now import users from Microsoft Azure Active Directory (AAD) who don't have an assigned Office 365 license. This allows admins to centralize their workforce lifecycle within Okta and eliminates the need to manage unlicensed accounts across both platforms. See Import users to Office 365 using Microsoft Graph API.

Identity verification with vendor-submitted integrations

Identity verification (IDV) vendors can now submit integrations through the Okta Integration Network. You can configure and apply these integrations to your authentication policies to verify user identities.

On-demand rotation of Office 365 SSO signing certificates

Office 365 app integrations that use WS-Federation for authentication now support the use of app-level certificates. Switching from org-level certificates to app-level certificates improves your security outcomes by eliminating a single point of failure if a shared org-level certificate expires. UI updates enable IT admins to easily monitor certificate status, generate certificates on demand, and perform certificate rotations without disrupting operations. See Configure Single Sign-On for Office 365.

Original source

Generally Available

Editable issuer URL for AI agent resource connections

Now when you create a resource connection between an AI agent and an authorization server, you can modify the authorization server's issuer URL.

Skipped failed entries during AI agent import

Now when you import AI agents from a provider, Okta skips the failed entries and creates or updates the successful ones.

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

• Android 14, 15, 16, 17 (2026-07-01)
• Windows 10 builds (10.0.17763.9020, 10.0.19044.7548, 10.0.19045.7548)
• Windows 11 builds (10.0.22631.7376, 10.0.26100.8875, 10.0.26200.8875)

Early Access

Removal of Cross App Access configuration using Managed Connection

The removal of the ability to configure cross app access from the Managed connection tab located on the app's profile page is scheduled for an upcoming release. When it's removed, your existing configurations will stop working. Reconfigure your connections from the Resource Server tab to avoid disruptions. See Connect AI agents to resources.

Fixes

• When admins reassigned Google Workspace licenses to users, the process occasionally failed and returned a task error in Okta. (OKTA-1074226)
• When admins configured the app setting When a user is deactivated in the app to Do nothing alongside a Post-Termination Interval, user imports from SuccessFactors failed to unassign terminated users. (OKTA-1115401)
• In My Settings, the accessible label for the org logo link didn't match the visible label text. (OKTA-1164496)
• Users who originally enrolled a YubiKey without a PIN, but later set a PIN externally, received an error when an authentication policy rule required a device passcode or biometric verification. (OKTA-1187996)
• When users clicked the privacy policy link in the Sign-in Widget, they were redirected to the sign-in page instead of the privacy policy page. (OKTA-1201388)
• The System Log incorrectly logged VPN Notification Settings updated as the reason when the Display icon to users setting was enabled or disabled for a custom OIDC app. (OKTA-1203429)
• In some orgs, users couldn't authenticate through their IdP, even though Trust claims from this identity provider was enabled and the IdP had already satisfied the authentication policy's phishing-resistant requirement. (OKTA-1204547)
• Some admins saw 500 errors when they tried to delete authorization servers in bulk. (OKTA-1208896)
• Some admins saw 500 errors when they tried to delete authorization servers in bulk. (OKTA-1208896)
• In some orgs, when admins created an OIDC web app, the client credentials grant type didn't appear, even though the correct feature flags were enabled. (OKTA-1221984)
• Session context change events in the System Log showed blank display names when a rate limit was exceeded. (OKTA-1226680)
• The Okta password health report timed out for orgs with large user directories and returned incomplete data. Reports for large orgs are now limited to a maximum of 500,000 users to ensure reliable performance. (OKTA-1151306)
• The Identity Governance pages had several spelling and punctuation errors. (OKTA-1163458)
• When admins ran an individual realm assignment job, the evaluation process stopped after encountering a single user evaluation failure. (OKTA-1193971)
• In the Admin Console, when admins configured protected actions, the UI displayed both Reset factors for super admins and Reset authenticators for super admins simultaneously. (OKTA-1205255)
• When admins enabled user provisioning features in SCIM 1.0 using On-Premises Provisioning, the schema discovery flow broke. (OKTA-1210290)
• Deleted AI agent providers still appeared on the AI agent providers screen and in the AI agent provider filter on the AI agents screen. (OKTA-1211699)
• Admins could create a custom token claim named ver for an OpenID Connect app, even though ver is a reserved claim in the ID token. (OKTA-1222755)
• In orgs with both Identity Threat Protection and Policy Change Management enabled, admins saw an error message when they tried to roll back a policy branch. (OKTA-1227194)
• In orgs that use an external IdP as an authentication factor, claims from those IdPs weren't shared with downstream apps. (OKTA-1231193)

Okta Integration Network

• Airbyte Lifecycle Management Connector by Redblock (SCIM) was updated with a new app name and description.
• Cisco User Management Connector (SAML) is now available. Learn more.
• Clarion by Cantina (API Service) has the okta.groups.manage scope.
• DeleteMe (SCIM) has updated endpoints. Learn more.
• Emergent (SAML) is now available. Learn more.
• GreyMatter Transit (API Service) is now available. Learn more.
• Spark HR (OIDC) is now available. Learn more.
• Spark HR (SCIM) is now available. Learn more.
• SpotDraft (SCIM) was updated. Learn more.

Original source

Editable issuer URL for AI agent resource connections

Now when you create a resource connection between an AI agent and an authorization server, you can modify the authorization server's issuer URL.

Skipped failed entries during AI agent import

Now when you import AI agents from a provider, Okta skips the failed entries and creates or updates the successful ones.

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

• Android 14, 15, 16, 17 (2026-07-01)
• Windows 10 builds (10.0.17763.9020, 10.0.19044.7548, 10.0.19045.7548)
• Windows 11 builds (10.0.22631.7376, 10.0.26100.8875, 10.0.26200.8875)

Original source