Okta Identity Governance Updates & Release Notes

Features and Enhancements

Certify unmanaged accounts

Certify unmanaged accounts using access certification campaigns to help reduce drifts in access between Okta and the downstream app. See Certify unmanaged accounts.

You can also use imported app user attributes to further refine the campaign scope (managed or unmanaged resources) for resource campaigns, giving you more visibility and control. See Okta Expression Language examples.

Additionally, the Discover inactive users preconfigured campaign has been renamed to User activity review to avoid confusion.

This is an Early Access release.

Governance Analyzer recommendation update

The Governance Analyzer recommendation Revoke has been renamed to Review to clearly indicate the action that reviewers should take for a review item in a campaign.

New input type for questions in request type

While adding questions in a request type, you can now specify the input type as Date and Time for users. This gives you more control over when access to a resource begins or ends. See Question settings.

Fixes

• Some column headers on the Access Certifications campaign page in the Admin Console appeared truncated, and the option to resize the column was missing. (OKTA-1259416)
• Access Requests that assigned a user to a non-Entitlement Management enabled app reported success. However, they didn't assign the user if the user previously had a grant on the app and was later unassigned out-of-band, such as through the Admin Console. (OKTA-1295352)

Features and Enhancements

Configure access to the resource catalog is Generally Available in Production environments

Previously, the ability to view resource catalog entry points, such as the Request Access button in the End-User Dashboard, was available to all users in an org by default. Now, admins can configure this visibility to allow all members of an org to view the entry points, no users to view them, or restrict entry point visibility to a specific set of Okta groups. For the Unified requester experience, this configuration also controls the Resource Catalog links and search options from the Okta Access Request app, Slack, and Microsoft Teams. See Configure resource catalog entry point visibility.

Group self-ownership is Generally Available in Production environments

An Okta group can now be its own owner. This reduces friction in group maintenance by eliminating the need for membership approvals and reviews to be handled by separate entities (such as individual users or a different group), and instead allows admins to delegate membership approvals and reviews to current members of the group.

Resource collections is Generally Available in Preview environments

Resource collections let you combine apps, entitlements, Okta groups, and push groups into a single resource that you can directly assign to users based on their role. This simplifies access assignment for roles that require multiple types of resources. See Resource collections.

Resource collections support of groups, push groups, and non-Entitlement Management apps is Generally Available in Preview environments

Resource collections can now be further customized for specific roles by allowing groups, push groups, and non-Entitlement Management apps to be included in a collection. This provides admins the ability to assign a wider set of resources required for a specific role to a collection, improving control over resources and reducing management overhead. See Resource collections.

Convert users from custom to policy without access changes is Generally Available in Preview environments

Users can now be converted from custom entitlement and bundle assignments to policy while keeping their existing entitlements. See Manage user entitlements.

Account Reconciliation

Account Reconciliation enables governance teams to detect and govern unmanaged accounts that exist in the target system but weren't assigned by Okta. When enabled on a provisioning enabled app, this feature supports a new UI to detect, filter, and remediate accounts. The account reconciliation process helps Okta Identity Governance become the authoritative source for all accounts that exist in the target apps. See Identity reconciliation.

This is an Early Access release. See Enable self-service features.

Entitlement Reconciliation

Entitlement Reconciliation enables governance teams to detect and govern entitlement drifts between Okta and the target system. When enabled on a governance enabled app, this feature supports a new UI to detect, filter, and remediate entitlement drifts along with app-level entitlement rules to automatically revoke out-of-band entitlement changes. This entitlement reconciliation process helps Okta Identity Governance become the authoritative source for all entitlements assigned to users in the target apps. See Identity reconciliation.

This is an Early Access release. See Enable self-service features.

Account Reconciliation results report

Use this report to view accounts detected in external sources that were unmanaged in Okta, and all reconciliation actions taken on them either by admins or by the Okta system.

This is an Early Access release. See Enable self-service features.

Entitlement Reconciliation results report

Use this report to view entitlement drifts detected by Okta from external sources, and all reconciliation actions taken on them either by admins or by the Okta system.

This is an Early Access release. See Enable self-service features.

New System Log events

The System Log now logs the following events for staging Access Certification campaigns:

• certification.campaign.stage.start: Logged when the staging process starts for a campaign.
• certification.campaign.stage.end: Logged when the campaign staging process ends. The outcome.result field reports SUCCESS if the campaign snapshot is created successfully, or FAILURE if there were errors during the staging process.

See Event types.

Fixes

• Campaigns within seven days of a scheduled launch weren't visible in orgs that disabled the Stage certification campaigns before launching an Early Access (EA) feature. (OKTA-1245618)
• The certification.campaign.launch System Log event was triggered in error when the staging process for an Access Certification campaign started. (OKTA-1268484)
• When a permanent entitlement bundle was assigned to a user who had an existing app access window with an expiration date, the expiration date wasn't cleared. When the expiration date was reached, the user's base grant was revoked, which removed every bundle grant on that app, including the permanent one, and the user was deprovisioned from the downstream app. (OKTA-1290251)

Features and Enhancements

Access Requests decision justification

Okta Identity Governance now supports configurable justification controls for access request decisions, providing requesters more transparency into their approvals and denials. Admins can configure the approval sequence or request type settings to include the decision justification field for approval tasks, allowing approvers the option to provide a rationale for their decision. All submitted justification text is captured on the request ticket and made available to the requester, providing insight into access decisions.

Fixes

• Warnings and errors weren't propagated to Slack for campaigns in the STAGING_FAILED state. (OKTA-1272033)
• On rare occasions, the start date of a staged campaign was blank in Slack when staging started shortly after the campaign was eligible. (OKTA-1273337)

Features and Enhancements

Stage certification campaigns before launch

Staging a campaign lets you preview target users, resources, and reviewer assignments in advance to ensure accurate scope, fix configuration errors, and guarantee that requests reach the correct reviewers from day one. See Stage a campaign.

This is an Early Access release. See Enable self-service features.

Requester timeline view

Requesters can now view a detailed status timeline of their request's tasks directly from the Okta Access Request app. This enhanced visibility allows requesters to easily track the progress of their requests, see who has approved individual tasks, and identify remaining tasks, helping users stay informed throughout the approval process and reducing unnecessary status inquiries. The timeline is available for requests built with access request conditions.

Automatic tasks and questions reassignment after a manager change

To prevent access requests from being blocked during organizational changes, Okta Access Requests now automatically reassigns pending manager tasks and manager questions to an employee's new manager whenever a manager change occurs. This automated reassignment ensures that approvals proceed without manual IT intervention or delays, even if the previous manager's account has already been deactivated. This is available for requests built with both request conditions and request types.

Fixes

• Admins could set campaign inactivity periods to more than 90 days, which wasn't aligned with the System Log retention period. (OKTA-1254593)
• Missing HTTP content headers caused AD group assignments and revocations to fail intermittently. (OKTA-1266481)

Features and Enhancements

Configure access to the resource catalog is Generally Available in Preview environments

Previously, the ability to view resource catalog entry points, such as the Request Access button in the End-User Dashboard, was available to all users in an org by default. Now, admins can configure this visibility to allow all members of an org to view the entry points, no users to view them, or restrict entry point visibility to a specific set of Okta groups. For the Unified requester experience, this configuration also controls the Resource Catalog links and search options from the Okta Access Request app, Slack, and Microsoft Teams. See Configure resource catalog entry point visibility.

Certify AI agent resource connections is Generally Available in Production environments

You can review and certify AI agent resource connections using identity campaigns (formerly, user campaigns). This helps you maintain visibility and control as AI agents' access changes over time. See Create identity campaigns to certify resource connections.

Increased Access Request limits

The following Access Request limits have been increased:

• Users per task or question: 25 (previously 10)
• Entitlement bundles in an access level condition: 1,000 (previously 100)
• Groups in an access level condition: 1,000 (previously 500)
• Request type configuration lists per org: 250 (previously 100)
• Request types per org: 750 (previously 500)

Streamlined navigation for access requests

For orgs with the Unified Requester Experience enabled, requesters who select a request type tile on the End-User Dashboard now go directly to the request form, speeding up the access request process. Requesters don't need to click the Request access link on an intermediary page.

MCP server scopes in campaign reviews

When you certify managed connections, OAuth 2.0 scopes are now included in the campaign review for MCP server connections.

Group self-ownership

An Okta group can now be its own owner. This reduces friction in group maintenance by eliminating the need for membership approvals and reviews to be handled by separate entities (such as individual users or a different group), and instead allows admins to delegate membership approvals and reviews to current members of the group.

Fixes

• Admins could set campaign inactivity periods to more than 90 days, which wasn't aligned with the System Log retention period. (OKTA-1254593)
• Missing HTTP content headers caused AD group assignments and revocations to fail intermittently. (OKTA-1266481)

Features and Enhancements

Configure access to the resource catalog

Previously, the ability to view resource catalog entry points, such as the Request Access button in the End-User Dashboard, was available to all users in an org by default. Now, admins can configure this visibility to allow all members of an org to view the entry points, no users to view them, or restrict entry point visibility to a specific set of Okta groups. For the Unified requester experience, this configuration also controls the Resource Catalog links and search options from the Okta Access Request app, Slack, and Microsoft Teams. See Configure resource catalog entry point visibility.

Features and Enhancements

Access request admin action enhancements

Access request admins can now view and cancel requests, even if there are completed tasks associated with them.

Request Inbox updates in the Okta Access Requests app

Access request admins can now view all requests in the org from the Requests Inbox page.

Fixes

• The following endpoints weren't visible in the Rate limit report:
  • /governance/api/v1/my/campaigns/{campaignId}/reviews
  • /governance/api/v1/my/campaigns/{campaignId}/reviews/actions
  • /governance/api/v1/my/campaigns/{campaignId}/reviews/bulk-decisions
  • /governance/api/v1/my/campaigns/{campaignId}/reviews/bulk-decisions/jobs/{jobId}
    (OKTA-1211609)
• The issuer URL value appeared in the Audience field of an AI agent connection campaign review instead of the resource indicator value. (OKTA-1239834)

Features and Enhancements

Certify AI agent resource connections is Generally Available in Preview environments

you can review and certify AI agent resource connections using identity campaigns (formerly, user campaigns). This helps you maintain visibility and control as AI agents' access changes over time. See Create identity campaigns to certify resource connections.

Governance Analyzer is Generally Available in Production environments

Governance Analyzer provides access certification campaign reviewers with insights and recommendations to make more informed decisions when approving or revoking user access. See Governance analyzer.

Certify service accounts is Generally Available in Production environments

You can now create resource campaigns to review and certify access for both SaaS application and Okta service accounts. This feature extends your governance strategy to non-human identities, helping you maintain visibility and control over critical service account access. See Certify service accounts.

Okta Workflows actions for request types is Generally Available in Production environments

Use the Run a workflow action step in a request type to allow requests managed by request types to trigger a delegated flow automatically. The requestID of the request is passed to the delegated flow using the Okta Workflows Caller input field. This feature lets you use your existing Workflows connectors and flows in Access Requests to automate requests. See Create request type.

Request subscriptions data export

To export information about users subscribed to access requests, select the Request subscriptions option in the Export Data window. The Requests option no longer includes subscriber data. See Export data from Access Requests.

Increased maximum for unique groups in the requester scope

You can now specify a maximum of 500 unique groups when you define the requester scope for all conditions in an org. See Access request condition limits.

Fixes

• When the AI agent connection type was API_SERVER, the connection's configured scopes weren't available in an Identity campaign's review item table. (OKTA-1235938)

Features and Enhancements

Resource collections now support groups, push groups, and non-Entitlement Management apps

Resource collections can now be further customized for specific roles by allowing groups, push groups, and non-Entitlement Management apps to be included in a collection. This provides admins the ability to assign a wider set of resources required for a specific role to a collection, improving control over resources and reducing management overhead. See Resource collections.

This is an Early Access release. See Enable self-service features.

New filter in Active campaign details and Past campaign details reports

Use the Resource name filter in Active campaign details and Past campaign details reports to filter for all resources, including AI agents.

Fixes

• The Resource column was unavailable in the table of review items for active identity campaigns when the identity scope was users or groups. (OKTA-1226108)
• Users could make changes to Access Request integrations without the appropriate permissions. (OKTA-1218777)

Features and Enhancements

Self-review for Okta admin roles is Generally Available in Production environments

Allow or block campaign reviewers from approving or revoking their own access to Okta admin roles. While Okta prevents self-reviews in campaigns that govern Okta admin roles by default, this feature gives you the option to allow self-reviews. See Create campaigns to review admin roles.

Customize Justification Requirements is Generally Available in Production environments

Configure Justification Settings when you create or edit a campaign to get more granular control over when campaign reviewers must enter a justification for access decisions, including making it mandatory only for revoke decisions and optional for approve decisions. This helps you better align the reviewer experience with your org's specific compliance needs. See Create resource campaigns or Create identity campaign.

Okta Workflows actions for request types is Generally Available in Preview environments

Use the Run a workflow action step in a request type to allow requests managed by request types to trigger a delegated flow automatically. The requestID of the request is passed to the delegated flow using the Okta Workflows Caller input field. This feature lets you use your existing Workflows connectors and flows in Access Requests to automate requests. See Create request type.

Certify service accounts is Generally Available in Preview environments

You can now create resource campaigns to review and certify access for both SaaS application and Okta service accounts. This feature extends your governance strategy to non-human identities, helping you maintain visibility and control over critical service account access. See Certify service accounts.

Certify AI agent resource connections

After you enable the Resource Access Certifications for AI Agents feature, you can review and certify AI agent resource connections using identity campaigns (formerly, user campaigns). This helps you maintain visibility and control as AI agents' access changes over time. See Create identity campaigns to certify resource connections.

This is an Early Access release. See Enable self-service features.

Removal of search filters from the Inbox page

The Requester type and Follower options have been removed from Filters on the Inbox page of the Okta Access Requests web app to improve performance.

UI updates to Okta Access Requests web app

The All requests page in the Okta Access Requests web app now shows 999+ if there are 1,000 or more requests instead of showing the exact count. This change helps reduce the time taken to list the requests on the page.

Features and Enhancements

Cancel action steps in requests managed by request types

If an action step is stuck in a request managed by a request type, request assignees can cancel the action step to better manage the request.

Reassign steps to multiple users

You can now reassign steps within an approval sequence or request type to 10 users. This applies to tasks, questions, actions, and approvals.

Fixes

• Sometimes approval tasks in access requests for Okta admin roles weren't assigned to groups and remained unassigned, causing delays in request resolution. (OKTA-1198387)

Features and Enhancements

Smart Review for campaign reviewers is Generally Available in Production environments

Smart Review creates a step-by-step workflow for campaign reviewers that groups items by user or resource. This approach helps reduce reviewer fatigue, enables more informed access decisions, and helps reviewers efficiently tackle high-volume campaigns. See Smart review.

Assignment methods for access certification campaigns is Generally Available in Production environments

The Assignment methods setting gives access certification campaign reviewers context on how a user was assigned access to a resource. It provides visibility into assignment methods for all resources, including all methods used to grant entitlements. This feature helps reviewers make informed, accurate decisions about a user's access. See Customizable reviewer context.

With this feature, the following Admin Console changes are also applicable:

• The existing Assignment type field has been renamed to Assignment methods.
• The existing Application assignment type field has been renamed to Application assignment methods.
• Resource-specific assignment method fields, such as Assigned via policy, Collection assignment type, Entitlement assignment type, and Group assignment type are no longer available. The information appears in the Assignment methods field.

The assignment method value Custom has been renamed to Individual. See Assignment methods.

Active Campaign Summary report is Generally Available in Production environments

Use this report to view the high-level configurations and status of your active access certification campaigns. This overview helps you easily track overall campaign progress at a glance. See Active Campaign Summary report.

Active Campaign Details report is Generally Available in Production environments

Use this report to view in-depth information about your active access certification campaigns. This detailed view helps you monitor granular progress, identify reviewers who haven't completed their tasks, and improve overall completion rates. See Active Campaign Details report.

Governance Analyzer is Generally Available in Preview environments

Governance Analyzer provides access certification campaign reviewers with insights and recommendations to make more informed decisions when approving or revoking user access. See Governance analyzer.

Self-review for Okta admin roles is Generally Available in Preview environments

Allow or block campaign reviewers from approving or revoking their own access to Okta admin roles. While Okta prevents self-reviews in campaigns that govern Okta admin roles by default, this feature gives you the option to allow self-reviews. See Create campaigns to review admin roles.

Customize Justification Requirements is Generally Available in Preview environments

Configure Justification Settings when you create or edit a campaign to get more granular control over when campaign reviewers must enter a justification for access decisions, including making it mandatory only for revoke decisions and optional for approve decisions. This helps you better align the reviewer experience with your org's specific compliance needs. See Create resource campaigns or Create user campaign.

This feature is Generally Available in Preview environments, but it's an Early Access release for Production environments.

Improved request details layout

The request details page now features an optimized layout for small screens to improve readability.

Increased maximum for groups in access levels

You can now specify a maximum of 500 unique groups when you define the Access level for an access request condition. Consequently, the maximum number of options available to requesters for an app is 50,000. See Access request condition limits.

Improved task assignment logic for group owners

When a group has a mix of individual users and groups defined as its group owner, Okta now assigns access request tasks to both the individual users and the members of the owner group.