Terraform Provider for Okta Updates & Release Notes

7.0.0 (Aug 24, 2026)

BREAKING CHANGES

okta_email_template_settings: Migrated from Framework+SDKv3 to Terraform Plugin Framework + Okta SDK v6. The recipients attribute is now optional (previously required). brand_id and template_name now force resource replacement when changed.

okta_threat_insight_settings: Migrated from SDKv2 to Terraform Plugin Framework + Okta SDK v6. The network_excludes attribute has been renamed to exclude_zones. New computed attributes created and last_updated added.

okta_role_subscription: Migrated from SDKv2 to Terraform Plugin Framework + Okta SDK v6. The role_type attribute has been renamed to role_ref. The status attribute has been removed; use notification_type and manage subscription state directly.

okta_role_subscription (data source): role_type renamed to role_ref. notification_type moved from required input to computed output; pass the notification type as id instead. New computed attribute channels added.

okta_template_sms: Migrated from the legacy SDKv2 implementation to Terraform Plugin Framework (TPF) + Okta SDK v6. The translations attribute has changed from a set of objects ({language, template}) to a map(string). The type and template attributes are now optional (previously required). New computed attributes created and last_updated are available. Existing configurations must update the translations block accordingly.

okta_trusted_origin: Migrated from SDKv2 to Terraform Plugin Framework + Okta SDK v6. The scopes argument has changed type from a list of strings to a repeatable block: replace scopes = ["CORS", "REDIRECT"] with one scopes { type = "CORS" } block per scope. Each block also accepts the new optional allowed_okta_apps list, and at least one scopes block is required. The active boolean has been replaced by status (ACTIVE/INACTIVE); active = false becomes status = "INACTIVE". New computed attributes created, created_by, last_updated, and last_updated_by added. Existing configurations must update the scopes blocks and replace active accordingly.

okta_captcha: Migrated from SDKv2 to Terraform Plugin Framework + Okta SDK v6. The name, type, site_key, and secret_key attributes are now optional (previously required). type no longer forces resource replacement when changed; it is now updated in place.

okta_captcha_org_wide_settings: Deprecated in favour of the new okta_org_captcha resource, and will be removed in a future version. The replacement renames enabled_for (set of strings) to enabled_pages (list of strings); replace enabled_for = ["SIGN_IN"] with enabled_pages = ["SIGN_IN"] when moving to okta_org_captcha.

FEATURES

Added new resource okta_brands_templates_email_customization for managing email template customizations per brand #2891 by @pranav-okta

Added new data source okta_threat_insight_settings #2891 by @pranav-okta

Added new resource okta_user_subscription for managing notification subscriptions for individual users #2891 by @pranav-okta

Added new data source okta_user_subscription to read a user's notification subscription #2891 by @pranav-okta

Added new data source okta_role_subscription to read a role's notification subscription #2891 by @pranav-okta

Added new data source okta_trusted_origin to read a single trusted origin by id #2932 by @pranav-okta

Added new resource okta_org_captcha for managing org-wide CAPTCHA settings, replacing okta_captcha_org_wide_settings #2933 by @pranav-okta

Added new data source okta_captcha to read a CAPTCHA instance #2933 by @pranav-okta

Added new data source okta_org_captcha to read the org-wide CAPTCHA settings #2933 by @pranav-okta

ENHANCEMENTS

Migrated okta_template_sms to Terraform Plugin Framework + Okta SDK v6 #2891 by @pranav-okta

Migrated okta_email_template_settings to Terraform Plugin Framework + Okta SDK v6 #2891 by @pranav-okta

Migrated okta_threat_insight_settings to Terraform Plugin Framework + Okta SDK v6 #2891 by @pranav-okta

Adds new resources for oauthv1 clients #2886 by pranav-okta

Migrated okta_role_subscription to Terraform Plugin Framework + Okta SDK v6 #2891 by @pranav-okta

Migrated okta_trusted_origin to Terraform Plugin Framework + Okta SDK v6 #2932 by @pranav-okta

Migrated okta_captcha to Terraform Plugin Framework + Okta SDK v6 #2933 by @pranav-okta

6.15.0 (Aug 5, 2026)

BUG FIXES

• Updates documentation for okta_ap_signon_policy_rule resource to include office365_client_include #2916 by aditya-okta
• Updates documentation for oauthv1 client role resources #2917 by pranav-okta
• Normalize Workflow Permission Expansion for okta_admin_role_custom resources #2902 by dhiwakar-okta
• Normalize chains JSON keys during plan phase for okta_app_signon_policy_rules resource #2906 by aditya-okta
• Resolved breaking changes reported in v6.14.0 #2915, #2914 by pranav-okta

6.12.0 (June 10, 2026)

FEATURES

Added new data source okta_signon_policy_rule to read sign-on policy rules #2846 by aditya-okta

Added new data source okta_auth_server_policy_rule to read authorization server policy rules #2848 by aditya-okta

Added new data source okta_assignees_users to list users assignable to a resource #2851 by aditya-okta

Added backchannel_custom_authenticator_id attribute to okta_app_oauth for Client Initiated Backchannel Authentication (CIBA) support #2855 by dhiwakar-okta

Added keep_me_signed_in support to okta_app_signon_policy_rules resource #2858 by dhiwakar-okta

BUG FIXES

Fixed nil pointer dereference in okta_idp_saml, okta_idp_social, and okta_idp_oidc when accountLink.filter.groups is null #2843 by aditya-okta

Fixed documentation for okta_request_setting_resource #2844 by aditya-okta

Fixed okta_authenticator validation error when updating WebAuthn authenticators #2763 by trosborn

Fixed groups_included field being ignored in okta_policy_password resource #2856 by dhiwakar-okta

Fixed documentation for okta_request_setting_organization #2852 by aditya-okta

Deferred 429 retries to SDK for DPoP requests, improving handling of rate-limited DPoP-bound traffic #2841 by dhiwakar-okta

Fixed okta_app_signon_policy_rules to work in organizations without Risk Scoring #2858 by dhiwakar-okta

6.11.0 (May 26, 2026)

FEATURES

• Added diff suppression to okta_network_zone #2308 by exitcode0
• Added setup-terraform step to fix expired hc-install GPG key #2803 by aditya-okta
• Changed identity_provider in okta_policy_rule_sign_on to be of TypeSet #2802 by emanor-okta
• Added authenticator methods and webauth custom aaguids #2772 by pranav-okta
• Added terraform import support for okta_profile_mapping #2809 by dhiwakar-okta
• Added AD support as destination for okta_push_group #2712 by Dogers
• Added support for breached password protection settings in okta_policy_password #2813 by dhiwakar-okta
• Added computed timestamp fields to okta_user#2817 by dhiwakar-okta
• Added support for Option to stay signed in to okta_app_signon_policy_rule #2818 by dhiwakar-okta
• Added identity_source resources, data sources, tests, and docs #2811 by aditya-okta

BUG FIXES

• Fixed priority mismatch for okta_resource_condition #2786 by yoclaire
• Fixed importing users when importing okta_group_memberships #2810 by dhiwakar-okta
• Fixed normalization chains JSON key order to prevent inconsistent result after apply #2816 by tanasegabriel
• Fixed priority modification for okta_policy_password_default #2829 by aditya-okta

6.10.0 (April 27, 2026)

ENHANCEMENTS

Added self_service_password_requirements support to okta_policy_rule_password resource #2752 by dhiwakar-okta

Bug Fixes

Fixed status = "INACTIVE" not being applied on rules in okta_app_signon_policy_rules resource #2798 by aditya-okta
Fixed 409 conflict error when updating okta_request_condition resource #2784 by aditya-okta
Fixed resource_id change now correctly triggers resource replacement in okta_request_condition #2782 by aditya-okta
Fixed LINUX os_type and OTHER os_expression inconsistency in okta_app_signon_policy_rules resource #2779 by aditya-okta

6.8.0 (April 7, 2026)

FEATURES

New resource and data source okta_entity_risk_policy and okta_entity_risk_policy_rule #2749 by pranav-okta

New resource and data source okta_session_violation_policy and okta_session_violation_policy_rule #2759 by pranav-okta

New resource okta_group_owners #2459 by exitcode0

New data source okta_auth_server_default (org auth server) #2339 by exitcode0

ENHANCEMENTS

Support for updating resource okta_campaign #2760 by aditya-okta

Support for chains argument in resource okta_app_signon_policy_rules #2758 by aditya-okta

Support for network attribute in okta_app_oauth #2754 by pranav-okta

Support for app_settings_json attribute in okta_app_swa #2755 by dhiwakar-okta

Bug Fixes

Fixes bug when using dynamic rule blocks in resource okta_app_signon_policy_rules #2753 by aditya-okta

6.7.0 (March 27, 2026)

FEATURES

New Resource and data source okta_user_risk for UserRisk API #2724 by pranav-okta

Resource and data source okta_post_auth_session_policy, okta_post_auth_session_policy_rule #2746 by pranav-okta

ENHANCEMENTS

Support for preconfigured_app attribute in okta_app_oauth #2721 by dhiwakar-okta

Update fallback templates for tfplugindocs v0.17+ #2744 by exitcode0

Bug Fixes

Add validate authenticators to list the authenticator #2718 by pranav-okta

okta_event_hook_verification not re-verifying after update #2723 by dhiwakar-okta