Okta Identity Governance Updates & Release Notes

Features and Enhancements

Self-review for Okta admin roles is Generally Available in Production environments

Allow or block campaign reviewers from approving or revoking their own access to Okta admin roles. While Okta prevents self-reviews in campaigns that govern Okta admin roles by default, this feature gives you the option to allow self-reviews. See Create campaigns to review admin roles.

Customize Justification Requirements is Generally Available in Production environments

Configure Justification Settings when you create or edit a campaign to get more granular control over when campaign reviewers must enter a justification for access decisions, including making it mandatory only for revoke decisions and optional for approve decisions. This helps you better align the reviewer experience with your org's specific compliance needs. See Create resource campaigns or Create identity campaign.

Okta Workflows actions for request types is Generally Available in Preview environments

Use the Run a workflow action step in a request type to allow requests managed by request types to trigger a delegated flow automatically. The requestID of the request is passed to the delegated flow using the Okta Workflows Caller input field. This feature lets you use your existing Workflows connectors and flows in Access Requests to automate requests. See Create request type.

Certify service accounts is Generally Available in Preview environments

You can now create resource campaigns to review and certify access for both SaaS application and Okta service accounts. This feature extends your governance strategy to non-human identities, helping you maintain visibility and control over critical service account access. See Certify service accounts.

Certify AI agent resource connections

After you enable the Resource Access Certifications for AI Agents feature, you can review and certify AI agent resource connections using identity campaigns (formerly, user campaigns). This helps you maintain visibility and control as AI agents' access changes over time. See Create identity campaigns to certify resource connections.

This is an Early Access release. See Enable self-service features.

Removal of search filters from the Inbox page

The Requester type and Follower options have been removed from Filters on the Inbox page of the Okta Access Requests web app to improve performance.

UI updates to Okta Access Requests web app

The All requests page in the Okta Access Requests web app now shows 999+ if there are 1,000 or more requests instead of showing the exact count. This change helps reduce the time taken to list the requests on the page.

Features and Enhancements

Cancel action steps in requests managed by request types

If an action step is stuck in a request managed by a request type, request assignees can cancel the action step to better manage the request.

Reassign steps to multiple users

You can now reassign steps within an approval sequence or request type to 10 users. This applies to tasks, questions, actions, and approvals.

Fixes

• Sometimes approval tasks in access requests for Okta admin roles weren't assigned to groups and remained unassigned, causing delays in request resolution. (OKTA-1198387)

Features and Enhancements

Smart Review for campaign reviewers is Generally Available in Production environments

Smart Review creates a step-by-step workflow for campaign reviewers that groups items by user or resource. This approach helps reduce reviewer fatigue, enables more informed access decisions, and helps reviewers efficiently tackle high-volume campaigns. See Smart review.

Assignment methods for access certification campaigns is Generally Available in Production environments

The Assignment methods setting gives access certification campaign reviewers context on how a user was assigned access to a resource. It provides visibility into assignment methods for all resources, including all methods used to grant entitlements. This feature helps reviewers make informed, accurate decisions about a user's access. See Customizable reviewer context.

With this feature, the following Admin Console changes are also applicable:

• The existing Assignment type field has been renamed to Assignment methods.
• The existing Application assignment type field has been renamed to Application assignment methods.
• Resource-specific assignment method fields, such as Assigned via policy, Collection assignment type, Entitlement assignment type, and Group assignment type are no longer available. The information appears in the Assignment methods field.

The assignment method value Custom has been renamed to Individual. See Assignment methods.

Active Campaign Summary report is Generally Available in Production environments

Use this report to view the high-level configurations and status of your active access certification campaigns. This overview helps you easily track overall campaign progress at a glance. See Active Campaign Summary report.

Active Campaign Details report is Generally Available in Production environments

Use this report to view in-depth information about your active access certification campaigns. This detailed view helps you monitor granular progress, identify reviewers who haven't completed their tasks, and improve overall completion rates. See Active Campaign Details report.

Governance Analyzer is Generally Available in Preview environments

Governance Analyzer provides access certification campaign reviewers with insights and recommendations to make more informed decisions when approving or revoking user access. See Governance analyzer.

Self-review for Okta admin roles is Generally Available in Preview environments

Allow or block campaign reviewers from approving or revoking their own access to Okta admin roles. While Okta prevents self-reviews in campaigns that govern Okta admin roles by default, this feature gives you the option to allow self-reviews. See Create campaigns to review admin roles.

Customize Justification Requirements is Generally Available in Preview environments

Configure Justification Settings when you create or edit a campaign to get more granular control over when campaign reviewers must enter a justification for access decisions, including making it mandatory only for revoke decisions and optional for approve decisions. This helps you better align the reviewer experience with your org's specific compliance needs. See Create resource campaigns or Create user campaign.

This feature is Generally Available in Preview environments, but it's an Early Access release for Production environments.

Improved request details layout

The request details page now features an optimized layout for small screens to improve readability.

Increased maximum for groups in access levels

You can now specify a maximum of 500 unique groups when you define the Access level for an access request condition. Consequently, the maximum number of options available to requesters for an app is 50,000. See Access request condition limits.

Improved task assignment logic for group owners

When a group has a mix of individual users and groups defined as its group owner, Okta now assigns access request tasks to both the individual users and the members of the owner group.

Features and Enhancements

Governance Analyzer

Governance Analyzer provides access certification campaign reviewers with insights and recommendations to make more informed decisions when approving or revoking user access. See Governance analyzer.

This is an Early Access release. See Enable self-service features.

Self-review for Okta admin roles

Allow or block campaign reviewers from approving or revoking their own access to Okta admin roles. While Okta prevents self-reviews in campaigns that govern Okta admin roles by default, this feature gives you the option to allow self-reviews. See Create campaigns to review admin roles.

This is an Early Access release. See Enable self-service features.

Smart Review for campaign reviewers is Generally Available in Preview environments

Smart Review creates a step-by-step workflow for campaign reviewers that groups items by user or resource. This approach helps reduce reviewer fatigue, enables more informed access decisions, and helps reviewers efficiently tackle high-volume campaigns. See Smart review.

Assignment methods for access certification campaigns is Generally Available in Preview environments

The Assignment methods setting gives access certification campaign reviewers context on how a user was assigned access to a resource. It provides visibility into assignment methods for all resources, including all methods used to grant entitlements. This feature helps reviewers make informed, accurate decisions about a user's access. See Customizable reviewer context.

With this feature, the following Admin Console changes are also applicable:

• The existing Assignment type field has been renamed to Assignment methods.
• The existing Application assignment type field has been renamed to Application assignment methods.
• Resource-specific assignment method fields, such as Assigned via policy, Collection assignment type, Entitlement assignment type, and Group assignment type are no longer available. The information appears in the Assignment methods field.

The assignment method value Custom has been renamed to Individual. See Assignment methods.

Active Campaign Summary report is Generally Available in Preview environments

Use this report to view the high-level configurations and status of your active access certification campaigns. This overview helps you easily track overall campaign progress at a glance. See Active Campaign Summary report.

Active Campaign Details report is Generally Available in Preview environments

Use this report to view in-depth information about your active access certification campaigns. This detailed view helps you monitor granular progress, identify reviewers who haven't completed their tasks, and improve overall completion rates. See Active Campaign Details report.

Add access request condition descriptions

You can now add descriptions to access request conditions for apps, collections, and Okta admin role bundles. These descriptions appear alongside the condition's name on the Access Requests tab, making it easier for you to understand the specific purpose of each condition. See Create access request conditions.

Admin Console updates for Past Campaign Details and Past Campaign Summary reports

The following column headers have been renamed in the Past Campaign Details and Past Campaign Summary reports:

• Campaign started is now called Campaign start date.
• Campaign ended is now called Campaign end date.

Admin Console updates for access certification campaigns

• The Select applications dropdown menu on the campaign wizard's Resources page for AI agent resource types has been updated for clarity.
• The Managed connections checkbox on the Contextual Information page and the Managed connections field on the Review details panel have been renamed to Resource connections.

Fixes

• Apps that didn't have any entitlements weren't listed as a review item in user campaigns. (OKTA-1120669)
• Manual remediation was required when reviewers revoked a user's access to Active Directory-source groups in a campaign. (OKTA-1167090)

Features and Enhancements

Additive entitlements

Admins can now assign individual entitlements to users using an API. They can remove these entitlements by API or through the Admin Console.

Increase to the maximum access duration limit

When you create or edit access request conditions, you can now set the Access duration field to a maximum of 365 days or 52 weeks.

Warning notification when access ends

Requesters now receive a notification one day and and one hour before their access ends. Okta sends these notifications only for the access that was requested using requests managed by conditions. See Access request notifications.

Certify resource collections - User campaigns

Run access certification user campaigns to certify user access to resource collections. Running user campaigns that include collections helps you reduce the volume of review items for reviewers and accelerate campaign completion. Using the Contextual Information settings, you can also provide reviewers with the necessary context to help them make informed and more accurate decisions. See Create user campaigns.

This is an Early Access release. See Enable self-service features.

Assignment methods for access certification campaigns

The Assignment methods setting gives access certification campaign reviewers context on how a user was assigned access to a resource. It provides visibility into assignment methods for all resources, including all methods used to grant entitlements. This feature helps reviewers to make informed, accurate decisions about a user's access. See Customizable reviewer context.

When you enable this feature, the following UI changes are applicable:

• The existing Assignment type field has been renamed to Assignment methods.
• The existing Application assignment type field has been renamed to Application assignment methods.
• Resource-specific assignment method fields, such as Assigned via policy, Collection assignment type, Entitlement assignment type, and Group assignment type are no longer available. The information is displayed in the Assignment methods field.

The assignment method value Custom has been renamed to Individual. See Assignment methods.

This is an Early Access release. See Enable self-service features.

Smart Review for campaign reviewers

Smart Review creates a step-by-step workflow for campaign reviewers that groups items by user or resource. This approach helps reduce reviewer fatigue, enables more informed access decisions, and helps reviewers efficiently tackle high-volume campaigns. See Smart review.

This is an Early Access release. See Enable self-service features.

Improvements access request experience for Slack

If you've enabled the Unified Requester Experience feature, you can now configure whether users can submit and approve requests in Slack without being redirected to the End-user Dashboard. This applies to access requests that are managed by request types and to conditions. Additionally, when Approve and deny requests is toggled on, users can approve Okta admin role bundle access requests from Slack. See Enable Slack notifications.

Slack integration for Access Certifications and Access_Requests is Generally Available in Production environments

The Identity Governance - Slack notifications feature allows you to send Access Certification campaign notifications to reviewers and admins using Slack. You can send notifications for new campaigns, reminders for campaigns closing soon, reassigned review items, and more. Slack notifications for campaigns help reduce the need for additional manual follow ups for campaign owners. They also help increase the completion rate of reviews before the campaign's end date.

Once enabled, super admins and admins with the Manage governance settings permission can integrate Slack with Okta from the Settings Integrations tab and configure Access Certifications and Access Requests notifications. See Integrations.

Restrict delegates is Generally Available in Production environments

Restrict who users can select as a delegate to ensure that tasks are assigned only to authorized individuals. Configure settings to limit delegate selection to a user's direct manager, their colleagues (peers with the same manager), or allow them to select anyone in the org. This helps you strengthen org security, improves compliance, and gives you more control over task delegation. See Enable end users to assign delegates.

Slack integration for Identity Governance is Generally Available in Production environments

Okta for Government Moderate and Government High customers who use commercial Slack instances can now integrate Slack with their org to streamline access management in Access Requests and Access Certifications. Users can now submit and approve requests in Slack as well as receive Slack notifications for access requests and certification campaigns. Feature availability varies depending on whether the Unified requester experience feature is enabled. See Okta Identity Governance Limitations for Public Sector Service and Integrate Slack.

Fixes

Reviewers were redirected to the End-User Dashboard instead of the Okta Access Certification reviews or Okta Security Access Reviews app when they clicked View Assigned Reviews from a notification or accessed the review using a link. (OKTA-1100001)

Features and enhancements

Additive entitlements

Admins can now assign individual entitlements to users using an API. They can remove these entitlements by API or through the Admin Console.

Resource owners now supports collection owners

You can now assign owners to collections. This feature allows you to automatically route access request steps and access certification campaign reviews to the correct stakeholder. This improves the efficiency and accuracy of your governance processes. It also helps ensure that the right stakeholder is always involved in access decisions without requiring manual updates to your configurations.

• Access Requests: When configuring approval sequences in access request conditions, you can now assign approvals, tasks, or questions directly to resource owners. See Configure an approval sequence.
• Access Certifications: When creating certification campaigns, you can now select the Resource Owner as the designated reviewer. See Certification campaign reviews.

See Resource owners.

Improved search experience for request types

While configuring request types, you can search for and select users to assign a step to even if they aren't assigned to the Okta Access Requests app. Okta automatically assigns the Okta Access requests app to the user if the user isn't assigned to the app. This improves productivity and helps you save time.

Slack integration for Access Certifications and Access Requests is Generally Available in Preview environments

The Identity Governance - Slack notifications feature allows you to send Access Certification campaign notifications to reviewers and admins using Slack. You can send notifications for new campaigns, reminders for campaigns closing soon, reassigned review items, and more. Slack notifications for campaigns help reduce the need for additional manual follow ups for campaign owners. They also help increase the completion rate of reviews before the campaign's end date.

After you enable the feature, super admins and admins with the Manage governance settings permission can integrate Slack with Okta from the Settings Integrations tab and configure Access Certifications and Access Requests notifications. See Integrations.

Restrict delegates is Generally Available in Preview environments

Restrict who users can select as a delegate to ensure that tasks are assigned only to authorized individuals. Configure settings to limit delegate selection to a user's direct manager, their colleagues (peers with the same manager), or allow them to select anyone in the org. This helps you strengthen org security, improves compliance, and gives you more control over task delegation. See Enable end users to assign delegates.

This feature is Generally Available in Preview environments, but it's an Early Access release for Production environments.

Fixes

• You couldn't search and select users with Provisioned, Active, Recovery, Password Expired, or Locked out status when assigning a step in an approval sequence and in request types. (OKTA-944822)
• In the Okta Access Requests app, the date displayed in an access request's details was in the UTC time zone instead of the user's local time zone. (OKTA-1095934)
• Admins with the Manage SOD risk rules and the View applications or Manage applications permissions couldn't view or interact with the Separation of duties rules tab for an app. (OKTA-1117973)