Privileged Access Platform Updates & Release Notes

The following releases are now in Production:

Service accounts is GA

Okta Privileged Access secures SaaS service accounts allowing customers to monitor, manage, and secure access to service accounts in their SaaS apps. See Manage service accounts.

New System Log events for privileged access database integrations

Two new System Log events, pam.integration.create and pam.integration.delete, are now available for Okta Privileged Access database management. This enhancement allows admins to track when database integrations are created or deleted. See System Log.

The following releases are now in Preview:

On-demand password rotation for vaulted accounts (EA)

Admins can now grant users permission to perform on-demand password rotation for vaulted server accounts. This enhancement provides greater flexibility for managing account security and allows for immediate rotation of unrotated accounts.

The following releases are now in Production:

Expanded Active Directory account management

Okta Privileged Access now uses Active Directory (AD) as the source of truth for discovered AD accounts when the Keep as existing Okta user setting is disabled. This enhancement enables the discovery of AD accounts even if they aren't synced with Universal Directory, ensuring more comprehensive account management and faster discovery. Initial rotation for a large batch of new accounts may be slower if the AD accounts aren't in Universal Directory.

The following releases are now in Preview:

Service accounts is GA

Okta Privileged Access secures SaaS service accounts allowing customers to monitor, manage, and secure access to service accounts in their SaaS apps. See Manage service accounts.

The following releases are now in Production:

Improved Active Directory discovery pipeline

The Okta Privileged Access discovery pipeline for Active Directory accounts now resumes from the last successful stage if a timeout or error occurs. This improvement reduces processing time by preventing the need to restart the entire sequence.

The following releases are now in Production:

Workload identity for automation is now available in Okta Privileged Access

Workload identity for automation eliminates the need for hardcoded API keys or service account secrets. It does this by using a workload's native platform identity and a runtime OIDC token to securely authenticate automated workloads. This works with platforms like GitHub Actions, GitLab CI, Google Cloud Platform, and Azure Managed Identity. See Workloads.

Active Directory accounts available during rotation failures

If an Active Directory account password fails to rotate after an initial successful onboarding, the account status now remains Available. This enhancement ensures continued access to the account using the existing password while rotation issues are resolved.

The following releases are now in Preview:

Improved Active Directory discovery pipeline

The Okta Privileged Access discovery pipeline for Active Directory accounts now resumes from the last successful stage if a timeout or error occurs. This improvement reduces processing time by preventing the need to restart the entire sequence.

Expanded Active Directory account management

Okta Privileged Access now uses Active Directory (AD) as the source of truth for discovered AD accounts when the Keep as existing Okta user setting is disabled. This enhancement enables the discovery of AD accounts even if they aren't synced with Universal Directory, ensuring more comprehensive account management and faster discovery. Initial rotation for a large batch of new accounts may be a bit slower if the AD accounts aren't in Universal Directory.

The following releases are now in Preview:

Active Directory accounts available during rotation failures

If an Active Directory account password fails to rotate after an initial successful onboarding, the account status now remains Available. This enhancement ensures continued access to the account using the existing password while rotation issues are resolved.

Enhancements for SSH connectivity for Active Directory domains

Okta Privileged Access now supports SSH connectivity from the sft client to Active Directory domain-joined Linux servers.

The following releases are now in Preview:

New password management options for on-premises SaaS app accounts

Admins can now configure password rotation for managed on-premises app accounts that require a current password to rotate. This enhancement also allows authorized users to manually override stored passwords in Okta Privileged Access to resolve out-of-sync credentials. See Change rotation strategy for SaaS apps.

New System Log event for password rotation changes

A new System Log event has been added to track changes to the password rotation strategy for apps connected to Okta Privileged Access. You can use this event to track configuration changes that impact the management of credentials for connected app accounts.

The following releases are now in Production:

Longer account checkout durations

Security admins can now set the maximum checkout time for accounts to seven days. This update is available in both project settings and policy rule overrides. See Enable checkout.

Server Account reveal password configuration

Security admins can now set up security policies with reveal password privilege for server account rules. End users under that security policy can reveal the password when the server account is available or checked out by the end user. See Configure secret rule.

Preview

Server Account reveal password configuration

Security admins can now set up security policies with reveal password privilege for server account rules. End users under that security policy can reveal the password when the server account is available or checked out by the end user. See Configure secret rule.

Production

Predefined secret templates for Privileged Access

New secret templates in Okta Privileged Access allow users to quickly create common secret types, such as API keys and passwords, using predefined fields. This enhancement simplifies the secret creation process by eliminating the need to manually configure key-value pairs. See Create a secret.

The following releases are now in Preview:

Predefined secret templates for Privileged Access

New secret templates in Okta Privileged Access allow users to quickly create common secret types, such as API keys and passwords, using predefined fields. This enhancement simplifies the secret creation process by eliminating the need to manually configure key-value pairs. See Create a secret.

The following releases are now in Production:

Password rotation for SaaS app and Okta service accounts

Admins can now enable automatic password rotation for SaaS apps and Okta service accounts within their security policies. This feature allows for immediate rotation upon resource assignment or the flexibility to skip the initial rotation. See Security policy.

Automatic logging out for Okta Privileged Access sessions

Logging out of a Okta Privileged Access session now automatically ends the corresponding Okta session.