Privileged Access Platform Updates & Release Notes

The following releases are now in Production:

Manual password configuration for resource credentials

You can now set passwords for Active Directory, SaaS, and Okta Universal Directory service accounts without triggering target system synchronization. This enhancement simplifies account migration and onboarding workflows while preserving continuous access to connected accounts.

The following releases are now in Preview:

Bulk password rotation for Active Directory accounts (EA)

Admins can now force password rotation for up to 100 Active Directory accounts simultaneously within a project. This enhancement streamlines daily administrative workflows by eliminating the need to rotate individual account passwords manually. See Bulk rotate Active Directory passwords.

Workload access control for secrets

Security admins can now extend least-privilege access controls to machine identities by assigning workload roles to secret policies. This allows workloads to perform operations on secrets while generating individual workload audit logs for tracking.

The following releases are now in Production:

Static JWKS support for JWT Workload Connectors

Admins operating in private or air-gapped environments can now configure a JWT Workload Connector using static JWKS content. This enables secretless workload authentication for high-security on-premises systems without requiring public key discovery endpoints. See Workloads.

API key authentication for Okta Privileged Access workload identities

Security admins can now create and manage API key connectors and issued secrets for workload identities. This allows legacy and non-OIDC workloads to authenticate securely to Okta Privileged Access. See Workloads.

Credential version history

Okta Privileged Access users can now reveal credential version history for secrets, Active Directory accounts, SaaS app accounts, and Okta Universal Directory accounts. See the Okta Privileged Access user guide.

New System Log events

New System Log events, pam.identity_key.create, and pam.identity_key.rotate, are now available for Okta Privileged Access. These events allow admins to audit when per-team identity keys are created and rotated. See the Event Types.

The following releases are now in Preview:

Okta Privileged Access automated app provisioning

Okta Privileged Access is now automatically provisioned in your org when your subscription becomes active. You no longer need to manually add the app from the OIN catalog or configure SCIM provisioning. See Set up Okta Privileged Access.

Credential version history

Okta Privileged Access users can now reveal credential version history for secrets, Active Directory accounts, SaaS app accounts, and Okta Universal Directory accounts. See the Okta Privileged Access user guide.

The following releases are now in Production:

Service accounts is GA

Okta Privileged Access secures SaaS service accounts allowing customers to monitor, manage, and secure access to service accounts in their SaaS apps. See Manage service accounts.

New System Log events for privileged access database integrations

Two new System Log events, pam.integration.create and pam.integration.delete, are now available for Okta Privileged Access database management. This enhancement allows admins to track when database integrations are created or deleted. See System Log.

The following releases are now in Preview:

On-demand password rotation for vaulted accounts (EA)

Admins can now grant users permission to perform on-demand password rotation for vaulted server accounts. This enhancement provides greater flexibility for managing account security and allows for immediate rotation of unrotated accounts.

The following releases are now in Production:

Expanded Active Directory account management

Okta Privileged Access now uses Active Directory (AD) as the source of truth for discovered AD accounts when the Keep as existing Okta user setting is disabled. This enhancement enables the discovery of AD accounts even if they aren't synced with Universal Directory, ensuring more comprehensive account management and faster discovery. Initial rotation for a large batch of new accounts may be slower if the AD accounts aren't in Universal Directory.