Okta Classic Engine release notes (2020)

December 2020

2020.12.0: Monthly Production release began deployment on December 9

* Features may not be available in all Okta Product SKUs.

Content

Generally Available Features

New Features

Admin Privilege events can be used as Event Hooks

Admin Privilege events are now available for use as Event Hooks. See Event Types for a list of events that can be used with event hooks.

Application Access Request Workflow Event Hooks

Application Access Request Workflow events are now available for use as an external Event Hook. Admins can use Application Access Request Workflow events to designate approvers for app access requests. See Event Types for a list of Events that can be used with Event Hooks.

The map view is again available in the System Log

The System Log map view, which was temporarily removed, is again available.

System Log events

  • The system.custom_error.update event indicates that the Custom Error page has been updated.

  • The system.custom_signin.update event indicates that the Custom Sign-In page has been updated.

  • The system.custom_url_domain.initiate event indicates that the Custom URL Domain setup has been initiated.

  • The system.custom_url_domain.cert_upload event indicates that a Custom URL Domain HTTPS certificate has been uploaded.

  • The system.custom_url_domain.verify event indicates that the Custom URL Domain has been verified in the DNS.

Recommendation text added to SSO IWA Agents section of the Downloads page

On the Okta Admin Console Downloads page, text has been added to the SSO IWA Agents section recommending that Agentless Desktop Single Sign-on (ADSSO) should be used to implement Desktop Single Sign-on (DSSO). This text has been added to highlight that ADSSO has a simplified configuration process and requires less maintenance. See Configure agentless Desktop Single Sign-on

Additional PIV IDP user profile mapping values

In Okta user profiles, three new attributes are available:

  • idpuser.subjectAltNameUuid
  • idpuser.subjectKeyIdentifier
  • idpuser.sha1PublicKeyHash

These attributes are available to newly created Personal Identity Verification (PIV) identity providers and to identity providers that were marked inactive and then reactivated.

Okta SSO IWA Web App agent, version 1.13.2

This release of the Okta SSO IWA Web App agent includes security enhancements and internal fixes. See Okta SSO IWA Web App version history.

Jira Authenticator, version 3.1.5

This release contains bug fixes and logging improvements. See Okta Jira Authenticator Version History.

Confluence Authenticator, version 3.1.5

This release contains bug fixes and logging improvements. See Okta Confluence Authenticator version history.

State tokens in the Agentless DSSO authentication flow

An authentication state token has been added to the Agentless DSSO workflow to allow orgs to relay information such as fromUri. This change lets orgs shorten URLs and avoid HTTP 414 URI Too Long status code errors. See Configure agentless Desktop Single Sign-on.

SAML account linking

Admins can now enable or disable automatic account linking between SAML identity providers and Okta. They can also restrict the linking based on whether the end user is a member of any of the specified groups. See Identity Providers.

Generally Available Enhancements

Inclusive language updates

As part of the Okta inclusive language initiative, the following is changed:

Usability enhancements for OIDC app wizard

The OIDC app integration wizard interface has been updated with usability improvements and clarified help text. See Create OIDC app integrations.

Sign-in Widget and accessibility improvements

Main landmarks and skip links have been added to the Sign-in Widget. Accessibility improvements for OAuth and Admin Consent pages include focus on input fields and Don’t Allow buttons. See Configure a custom Okta-hosted sign-in page.

Contact your administrator link removed

The Client/Device certificate error page no longer contains an email link to contact your administrator.

BambooHR integration enhancement

The following org properties have been added to the BambooHR application integration:

  • Timezone aware pre-hires: This enables users' Lifecycle Management based on their Timezone/Location. If it is disabled, Okta manages users' lifecycles according to UTC timezone.

  • Preferred timezone: This option allows admins to set the main location timezone the same as in the BambooHR instance (BambooHR Settings > General Settings > Timezone). This is available only when the Timezone aware pre-hires option is enabled.

See Configure Provisioning for BambooHR.

UltiPro integration enhancement

In new instances of UltiPro, app user profile templates now contain a required EepPersonID field for external IDs. See UltiPro.

Group Password Policy enhancement

The Group Password Policies enhancement is now available for all Production orgs. By using Group Password Policies and associated rules, admins can configure and enforce password settings and set account recovery options for groups. See Sign-on policies.

Early Access Features

New Features

One Time Use Refresh Token

One Time Use Refresh Token, also called Refresh Token Rotation, helps a public client to securely rotate refresh tokens after each use. A new refresh token is returned each time the client makes a request to exchange a refresh token for a new access token. See Refresh Token Rotation.

Fixes

General Fixes

OKTA-325406

The Italian translation in the MFA Factor Enrolled email template was inaccurate.

OKTA-328882

The Japanese translation during the password reset process was inaccurate.

OKTA-329447

In the Integration settings of the LDAP Provisioning tab, the User Attribute help link was broken.

OKTA-335816

The password requirement message displayed to some users during the self-registration process was misleading.

OKTA-337663

The Hungarian translation during the sign-in process was inaccurate.

App Integration Fixes

The following SWA app was not working correctly and is now fixed

  • GetFeedback (OKTA-348946)

Applications

New Integrations

New SCIM Integration Applications

The following partner-built provisioning integration apps are now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified applications

  • Adra by Trintech (OKTA-348038)

  • Authomize (OKTA-347099)

  • Axomo (OKTA-341694)

  • DefenseStorm (OKTA-345662)

  • Forcepoint Private Access (OKTA-338537)

  • IntelligenceBank (OKTA-347415)

  • KHA Online - SDS (OKTA-347435)

  • Rootly (OKTA-348648)

  • Smarklook (OKTA-346263)

  • TenForce (OKTA-338549)

  • Toggl Plan (OKTA-347528)

  • Upmarket (OKTA-344925)

  • Very Good Security (OKTA-348624)

  • WIREWAX (OKTA-347407)

Weekly Updates

December 21

Fixes

General Fixes

OKTA-303280

The ThumbnailPhoto attribute for Office 365 was hidden or uneditable, which prevented admins from making changes to Office 365 profile mapping.

OKTA-330732

The Japanese translation for password policy messages was inaccurate.

OKTA-333711

An incorrect error was returned when an admin tried to delete an app sign-on policy rule that was already deleted.

OKTA-338458

Routing rules were not honored for end users who attempted to access their orgs using an iPad.

OKTA-347185

End users couldn't sign in with Personal Identity Verification (PIV) cards when they were in a Password Expired state.

OKTA-351052

Language used in OIDC app creation was outdated.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • Advanced MD (OKTA-351889)

  • Deloitte Connect (OKTA-349765)

  • RUN Powered by ADP (OKTA-351720)

  • Sigma Aldrich (OKTA-351026)

  • TSheets QuickBooks (OKTA-350027)

  • UMR (OKTA-351440)

Applications

New Integrations

SAML for the following Okta Verified applications

  • Alchemer (OKTA-338554)

  • Bullseye TDP (OKTA-350352)

  • SQLDBM (OKTA-348943)

SWA for the following Okta Verified application

  • HomeStreet Bank Business (OKTA-343128)

OIDC for the following Okta Verified application

January 4

Fixes

General Fixes

OKTA-312643

The Okta LDAP agent couldn't set the correct account enable/disable values for IBM LDAP accounts.

OKTA-334346

When admins attempted to approve Self Service app requests from users on the new Okta End-User Dashboard, they were unable to select values for the user assignment.

OKTA-338621

When a user with a CamelCase Okta username was provisioned to Google Workspace, their username was converted to lowercase and they were unassigned during the next import into Okta.

OKTA-340092

The System Log still used Daylight Savings Time for the America: Sao Paulo time zone.

OKTA-342401

If a Workday mobile phone number wasn't mapped to Okta, it was removed from Workday during the Okta to Workday updates.

OKTA-342757

New contingent users from Workday weren't imported and the existing users weren't updated during incremental imports.

OKTA-346242

On the new Okta End-User Dashboard, end users could make an app request even when Self Service was disabled.

OKTA-347247

Self-Service Registration form fields didn't apply minimum length requirements.

OKTA-348756

Pushing new user profiles to Google Workspace failed with an Invalid User error.

OKTA-349883

The first password wasn't included in the password history when an account was created through Self-Service Registration.

OKTA-351779

Some full imports from Active Directory and LDAP failed with a This choice creates a conflict error.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • Adobe Stock (OKTA-353598)

  • Express Scripts (OKTA-353604)

  • Visionplanner (OKTA-353502)

  • WebTimeClock (OKTA-353608)

Applications

New Integrations

New SCIM Integration Application

The following partner-built provisioning integration app is now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified application

  • GRAVTY (OKTA-349790)

SWA for the following Okta Verified applications

  • Bitrix24 (OKTA-354066)

  • Particle (OKTA-345520)

OIDC for the following Okta Verified application

November 2020

2020.11.0: Monthly Production release began deployment on November 9

* Features may not be available in all Okta Product SKUs.

Content

Generally Available Features

New Features

Okta Browser Plugin, version 5.42.0

This version includes the following:

  • Sign-in pages are opened in a new tab only after a user installs the plugin manually, and are not opened if the plugin is installed through a group policy for Chrome, Firefox, Legacy Edge, and Chromium Edge.
  • Performance improvements.

You can download the plugin for Internet Explorer from the Okta End-User Dashboard, or for other web browsers, install through their respective stores. See Okta Browser Plugin version history.

OIN Manager - add app instance properties

In the OIN Manager portal, new functionality in OIDC, SAML, and SCIM submission steps allow ISVs to create custom per-tenant URLs and URIs for app integration submissions. See Configure protocol-specific settings.

Tor Anonymizer recommendation

Admins can see a new HealthInsight recommendation to view failed sign-in rates from IPs categorized as Tor Anonymizer Proxies. Okta recommends using Dynamic Zones to blacklist IPs that are categorized as Tor anonymizer proxies. See and HealthInsight.

Vendor-specific attributes

RADIUS agents now support vendor specific attributes. With this feature, admins can use optional settings to configure vendor specific attributes to include group membership. Note that no agent update is required for this feature. See Configure group response in the following topics:

Client-based rate limiting

Client-based rate limiting for the OAuth API /authorize endpoint is now available in Preview. It provides granular isolation between requests made to the /authorize endpoint by using a combination of the Client ID, user's IP address, and the Okta device identifier. This isolates rogue OAuth clients and bad actors, ensuring valid users and applications don't run into rate-limit violations. The client-based rate-limiting framework can exist in one of three modes set in the Admin console. See Account settings.

User Consent for OAuth 2.0 Flows in API Access Management

A consent represents a user’s explicit permission to allow an application to access resources protected by scopes. As part of an OAuth 2.0 or OpenID Connect authentication flow, you can prompt the user with a popup window to approve your app's access to specified resources.

Consent grants are different from tokens because a consent can outlast a token, and there can be multiple tokens with varying sets of scopes derived from a single consent. When an application comes back and needs to get a new access token, it may not need to prompt the user for consent if they have already consented to the specified scopes. Consent grants remain valid until the user manually revokes them, or until the user, application, authorization server or scope is deactivated or deleted.

See User Consent for OAuth 2.0 and OpenID Connect Flows.

Generally Available Enhancements

Inclusive language updates

The OIN Catalog has been updated with inclusive terminology. Attribute Sourcing has replaced Attribute Mastering.

Changes in rate limit utilization notifications

All Customer Identity org super admins now get a detailed notification in the Okta Admin Console and an email when their org’s rate limit utilization meets the following criteria:

  • Crosses the threshold (60% for API products and 90% for Workforce products)
  • Reaches 100%

These warnings help super admins take preventative action and avoid service disruptions. See Account settings.

Group Password Policy enhancement

The Group Password Policies enhancement is now available for all new production orgs.

By using Group Password Policies and associated rules, admins can configure and enforce password settings and set account recovery options for groups. See Sign-on policies. This feature was already released to a subset of orgs, we are now releasing it to all new Production orgs.

ThreatInsight security enhancements

ThreatInsight enhancements improve detection of credential-based attacks from malicious IPs. See About Okta ThreatInsight.

Early Access Features

Early Access features from this release are now Generally Available.

Fixes

General Fixes

OKTA-293251

In some cases, reactivated AD users signing in to Okta were presented an empty Welcome screen although no user actions were required.

OKTA-297744

On the new Okta End-User Dashboard, wide logos were cut off.

OKTA-313490

In Okta End-User Dashboard > Settings > Personal Information, some editable fields extended past their border if they contained too many characters.

OKTA-321737

In some cases, admins didn't receive the Import Summary Notification Emails from Workday when an import was completed.

OKTA-321999

In some cases, users signing into Okta through email MFA received an error message despite entering the correct passcode.

OKTA-323345

The email template for password change notifications didn't allow certain expressions used in other email templates.

OKTA-323919

Admins could exclude the mandatory email field from the self-service registration form.

OKTA-326781, OKTA-329842

Admins were stuck when attempting to load Group Rules in Directory > Groups > Group Rules for certain expressions.

OKTA-328856

The Okta Browser Plugin didn’t inject credentials into sign-in pages for Org2Org SWA apps added to dashboards.

OKTA-330549

Disabled users were imported erroneously from Confluence to Okta during provisioning.

OKTA-330615

Invalid error objects returned through a Registration Inline Hook caused the client to see a 500 error rather than a 400.

OKTA-334126

Scheduled imports failed when CSV Directory Incremental Imports was enabled.

OKTA-334163

In some cases, admins erroneously received a rate limit error when viewing Access Policies through Security > API > Authorization Servers > Access policies > Select the policy.

OKTA-334255

Enrollment and reset emails were still sent to secondary email addresses even if the admin had disabled secondary email addresses.

OKTA-334929

Due to differences in the way the new RADIUS app handles username attributes, authentication failed for some users depending on whether their username had a UPN or sAMAccountName format.

OKTA-335890

Some SWA apps in the OIN App catalog were categorized incorrectly.

OKTA-337462

In some cases, custom app names for Wizard apps weren't globally unique and caused collision issues with apps from other cells.

OKTA-338863

Admins were unable to add IP addresses to the BlockedIpZone list from the System Log.

OKTA-342006

In some cases, the footer on the new Okta End-User Dashboard didn't maintain its position at the bottom of the page.

OKTA-343802H

In the Okta Admin Console, the message displayed when a rate limit was reached was incorrect.

OKTA-345672H

The new Okta End-User Dashboard was enabled for some end users even though it was disabled by the admin. The dashboard now displays the correct version depending on whether the new dashboard is enabled or not.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • 1Password Business (OKTA-340768)

  • ADP Portal (OKTA-339374)

  • ADP TotalSource (OKTA-339601)

  • CBT Nuggets (OKTA-340787)

  • Citrix Right Signature (OKTA-336890)

  • ECP (OKTA-340794)

  • FCO (OKTA-340785)

  • ISSUU (OKTA-340784)

  • Legrand Service Center (OKTA-340769)

  • Miro (OKTA-338110)

  • Sainsburys (OKTA-340792)

  • Schwab Advisors (OKTA-337947)

  • SEMrush (OKTA-340786)

  • SmartyStreets (OKTA-340781)

  • SunTrust SunView Treasury Manager (OKTA-338770)

  • vAuto (OKTA-340782)

  • Zurich Adviser Portal (OKTA-340770)

The following SAML app was not working correctly and is now fixed

  • Sentry (OKTA-332821)

Applications

New Integrations

New SCIM Integration Applications

The following partner-built provisioning integration apps are now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified applications

  • AlertEnterprise Guardian Access (OKTA-331898)

  • Cirrus Federation Bridge (OKTA-331296)

  • ERP Maestro 2.0 (OKTA-328139)

  • Helper Helper (OKTA-338542)

  • Nature Research (OKTA-337029)

  • Qualified (OKTA-336983)

  • Raketa (OKTA-336302)

  • Streams (OKTA-334367)

SWA for the following Okta Verified applications

  • Adyen (OKTA-337639)

  • BNP Paribas (OKTA-331531)

  • Freshbooks (OKTA-337319)

  • Schneider Electric (OKTA-330814)

OIDC for the following Okta Verified applications

Weekly Updates

November 16

Fixes

General Fixes

OKTA-322372

Users were prompted to set up a Password Recovery Question every time they signed in to Okta when Self-Service Password Reset was enabled.

OKTA-325372

Single sign-on events for OIDC apps with Federation Broker Mode enabled didn't appear in the System Log.

OKTA-328845

In the Directories tab of the Okta Admin Console, existing app assignment settings for Groups couldn't be modified.

OKTA-328900

Some attributes sourced from NetSuite weren't imported into Okta.

OKTA-329029

Bookmark apps that were added by users didn't have See Password and Update Credentials options in the Settings tab.

OKTA-330495

Disabling the app conditions for MFA enrollment policies removed all app conditions from existing factor enrollment policies.

OKTA-334118

Some reactivated G Suite users were mistakenly deactivated in Okta.

OKTA-335769

Some POST requests to the /users endpoint incorrectly triggered Inline Hooks, which resulted in higher latency.

OKTA-336865

In some cases, redirects to the Okta Admin Console resulted in a 404 error.

OKTA-339228

In some cases, app membership changes made by Group Membership Admins weren't pushed to the app.

OKTA-346079H

In some cases, inbound federation to preview failed for Generic OIDC Idps.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • ADP Workforce Now (Admin) (OKTA-341914)

  • ADP Workforce Now (Employee) (OKTA-336993)

  • Barracuda Networks (OKTA-341592)

  • CareFirst (OKTA-341601)

  • CVS Caremark (OKTA-343161)

  • Earth Class Mail (OKTA-340804)

  • Fiserv - Client Workstation (OKTA-341610)

  • Grammarly (OKTA-341608)

  • Informatica (OKTA-341605)

  • Justifacts (OKTA-341595)

  • LexisNexis Insurance Solutions (OKTA-341583)

  • Optimal Blue (OKTA-343800)

  • Safari Online Learning (OKTA-340799)

  • ShipStation (OKTA-342680)

  • Staples (OKTA-343167)

  • Trustwave (OKTA-340797)

Applications

Application Updates

The following apps have been deprecated from the OIN catalog:

  • Kato: Kato ceased to exist as of August 2015.
  • Datasite: A new Datasite integration has been published to the OIN. The previous integration has been deprecated (renamed to Datasite Deprecated) and can no longer be added by customers. If you are using the now-deprecated Datasite app, there is no impact on you. We recommend moving to the new app to take advantage of new updates to the app we may add to it in future.

New Integrations

SAML for the following Okta Verified applications

  • Airbnb for Work (OKTA-329468)

  • Axway - AMPLIFY Platform (OKTA-335106)

  • Baker Hill NextGen (OKTA-336078)

  • Lumity 2.0 (OKTA-342160)

  • Stratafax (OKTA-339889)

OIDC for the following Okta Verified application

November 30

Fixes

General Fixes

OKTA-293294, OKTA-293296

Some screen readers didn't read the elements on the new Okta End-User Dashboard correctly when tabbing over the sections or apps.

OKTA-302414

Profile mappings were not applied downstream for users after they were added to or removed from a group.

OKTA-316898

System Log messages for self-service account password reset events were misleading.

OKTA-324892

The Assignment tab on an app page was misaligned for some admins who filtered by Groups.

OKTA-325820

When an app that requires VPN was moved to a different section of the new Okta End-User Dashboard, the VPN dialog box didn't appear.

OKTA-327550

Re-authenticating API integration credentials for provisioning-enabled apps reset the app username format.

OKTA-330846

The report name was missing from reports delivered by email.

OKTA-336058

In some cases, the password reset workflow for end users failed if admins disabled the requirement for a security question.

OKTA-337304

Aliases in Office 365 were incorrectly removed when users were assigned to the app in Okta through Licenses/Roles Management Only provisioning.

OKTA-337563

Job requests to refresh app data for the Adobe Experience Manager timed out in Preview orgs.

OKTA-338055

Salesforce integration caches were not cleared if an admin authenticated using different credentials.

OKTA-343777

Enrolling in Okta Verify with SMS push sometimes failed.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • Adobe (OKTA-344942)

  • Adobe Admin Console (OKTA-345276)

  • Alaska Airlines (OKTA-344936)

  • American Express Online by Concur (OKTA-343173)

  • Autotask (OKTA-345338)

  • Backblaze (OKTA-343168)

  • Chatham Direct (OKTA-343202)

  • Citizens Bank accessOPTIMA (OKTA-343176)

  • Conservice (OKTA-343192)

  • DoorDash (OKTA-343177)

  • FullStory (OKTA-343704)

  • HelloSign (OKTA-342994)

  • International Air Transport Association (IATA) (OKTA-343209)

  • Linode (OKTA-343086)

  • Nice inContact Workforce Management (OKTA-343175)

  • One America (OKTA-344616)

  • Rakuten Advertising (OKTA-345250)

Applications

New Integrations

SAML for the following Okta Verified applications

  • Datasite (OKTA-333536)

  • Hover, Inc. (OKTA-343149)

  • Mosio (OKTA-343051)

  • TVU Service (OKTA-344929)

  • uStudio (OKTA-342622)

OIDC for the following Okta Verified applications

December 7

Fixes

General Fixes

OKTA-311308

Admins couldn't configure LDAP instances unless usernames were formatted as email addresses.

OKTA-324213

Options to configure an inline hook for an AD instance were missing for some admins.

OKTA-325684

Some group admins received errors when they navigated to Directory > People.

OKTA-328593

After the Office 365 app was enabled, Outlook didn't appear on some end users' dashboards.

OKTA-333901

When base attributes were set as read-only, some attributes were missing from the user profile.

OKTA-336862

Admins who selected an LDAP instance with no connected agents were directed to the Agents tab instead of the Provisioning tab.

OKTA-337494

Some AD-managed users were incorrectly displayed as having admin roles.

OKTA-339859

When API Integration was enabled, some ServiceNow imports didn't import all active users.

OKTA-343355

The 3-number challenge that is part of the Okta Verify risk-based authentication feature appeared on end user mobile devices in LDAPi environments even though the feature isn't supported in those environments.

OKTA-344772

When an end user made two SMS or voice MFA enrollment requests, the second request was only sent to the backup provider if it was made within one minute of the first.

OKTA-347213

Email notifications sent through the report workflow incorrectly listed the report expiration as 30 days later, instead of 7.

OKTA-347218

The map view in the System Log still appeared even after the functionality was unavailable.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • ADP Workforce Now (Employee) (OKTA-343365)

  • Airtasker (OKTA-348075)

  • Akamai (OKTA-344943)

  • BSA E-Filing (OKTA-346870)

  • Dell Boomi (OKTA-348090)

  • Hartford Retirement (OKTA-346843)

  • Innovative (OKTA-348491)

  • Nextiva NextOS 3.0 (OKTA-346866)

Applications

Application Update

The Cloudvisor.io integration has now been deprecated from the OIN as Cloudvisor is now rebranded as Zesty. Use Zesty.co SAML app instead.

New Integrations

New SCIM integration applications

The following partner-built provisioning integration apps are now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified applications

  • Animaker (OKTA-344080)

  • Clockwork Recruiting (OKTA-346859)

  • CrisisGo (OKTA-335097)

  • EureQa (OKTA-348851)

  • Immuta (OKTA-343150)

  • Lawvu (OKTA-336365)

  • Mooncamp (OKTA-344916)

  • Palo Alto Networks - Prisma Access (OKTA-343825)

  • Zesty.co (OKTA-340116)

SWA for the following Okta Verified applications

  • CitiDirect BE (OKTA-340862)

  • Inside Mortgage Finance (OKTA-335129)

  • NewRez Correspondent (OKTA-339224)

  • ProofPoint Community (OKTA-340034)

OIDC for the following Okta Verified applications

October 2020

2020.10.0: Monthly Production release began deployment on October 12

* Features may not be available in all Okta Product SKUs.

Content

Generally Available Features

New Features

Inclusive language and terminology

Okta is focused on the adoption of inclusive language and communication. Some long-standing industry terminology and expressions have been updated in this release and will continue to be made in future releases. Click the Feedback button on any Okta Help page to share your suggestions on the use of inclusive language.

The following inclusive language changes have been made:

  • Allow list has replaced whitelist
  • Block list has replaced blacklist

See Network zones.

The following topics have begun to adopt the new inclusive language:

The network zones user interface has been updated with inclusive terminology:

  • Add IP Zone
  • Add Dynamic Zone

The OIN Manager user interface has been updated with inclusive terminology:

  • Profile Sourcing has replaced Profile Mastering

API Access Management enables scope as a claim

Admins can now name a claim scope in API Access Management custom authorization servers. Admins can also use the EL expression access.scope in custom claims to return an array of granted scope strings. See API access management.

OIN Manager - enable profile sourcing

For developer orgs, the Profile Sourcing option (previously Profile Mastering) for SCIM apps must be enabled by Okta developer support. If you're an ISV and need this functionality temporarily activated when you're testing and submitting a SCIM app integration, see Submission support.

Changes to removing personal app instances

When an end user adds an app from the OIN catalog that is not self-service within their org, a personal instance of the app integration is created. Previously, if the end user removed the app integration from their dashboard, then the app instance was kept but marked as deactivated in the System Log. Now, when the user removes the app integration, the personal instance is removed and it is marked as deleted in the System Log. See Common SSO Tasks for End Users.

On-Premise Jira versions confirmed for OKTA Jira Authenticator

The Okta JIRA authenticator has been certified to work with new On-Prem Jira versions. See Okta Jira Authenticator Version History .

Default sign on rule set to Deny in Client Access Policies for new Office 365 app instances

In Client Access Policies for new Office 365 app instances, the Default sign on rule is now set to Deny access (formerly set to Allow). Additionally, we've provided a rule above the Default sign on rule that allows access to only web browsers and apps that support Modern Authentication. This change is designed to help customers implement more secure policies by default. Note: Existing O365 app instances are unaffected by this change. For more information, see Get started with Office 365 sign on policies.

Self-Service improved plugin onboarding experience

The improved Okta Browser Plugin onboarding experience for new end users is now available on all web browsers except Safari. After installing the plugin, new end users will be automatically directed to the sign in page or will have their dashboard refreshed, and will be shown an introduction banner on their dashboard. See Install the Okta Browser Plugin.

Provision out of sync users

If you enable provisioning for an app that already has users assigned to it, Okta can sync these users so they now have provisioning capabilities. See Provision applications.

Email address change notification templates

Email address change notification templates are now available. These templates notify users of an email address change and let them confirm the change. See Customize an email template.

Password requirements formatting

When setting a password, requirements are now shown in a list format rather than a sentence format.

Generally Available Enhancements

Okta LDAP agent log enhancement

To help identify and correct latency issues between Okta and on-premises Okta LDAP agents, a delAuthTimeTotal field has been added to the Login Events section of the Okta LDAP agent log. This field displays the time in milliseconds taken to complete a delegated authentication request between Okta and the Okta LDAP agent. See Locate the Okta LDAP agent log.

Sign-In page auto refresh

In some cases, if end users don’t sign in on the Sign-In page and leave it idle until the authentication session expires, the Sign-In page now refreshes automatically to establish a new session.

NetMotion Mobility

The NetMotion Mobility (RADIUS) app is now available on the OIN. It supports the EAP-GTC protocol with RADIUS agent version 2.12.0 or later. See Configure NetMotion Mobility.

OIN Manager - submission process improvements

The final processing step has been removed from the OIN app integrations submission process. Submitted app integrations that pass quality assurance (QA) testing by the OIN Operations team don't require further ISV input and are now automatically approved and published to the OIN.

OIN Manager - update submission email text

The email text sent to ISVs during the quality assurance (QA) portion of the OIN submission process has been clarified to make the information easier to understand.

Early Access Features

New Features

Custom IdP factor authentication with OIDC support

Custom IdP factor authentication now supports OpenID Connect. See Custom IdP factor.

Optional Display Preferences for new Okta End-User Dashboard

Users can now set Display Preferences on the new Okta End-User Dashboard. They can enable or disable the Recently Used section and organize their dashboard as a grid or a list. See End-user experience.

Fixes

General Fixes

OKTA-277851

In some cases, removing tasks from the Okta Admin Dashboard failed.

OKTA-283085

When searching for apps on the new Okta End-User Dashboard, app logos included in the search results were too large.

OKTA-314990

In some cases, a user's DisplayName appeared as their user ID in the System Log.

OKTA-315076

For certain app admin operations, rate-limit error messages in the System Log erroneously suggested that admins retry failed operations manually instead of waiting for the operations to be rescheduled.

OKTA-315286

After selecting certain attributes in Advanced RADIUS settings, the On-Prem MFA agent returned the proxy IP instead of the IP address of the RSA agent.

OKTA-315638

Grammarly and Dragon extensions on Chrome caused issues for users who attempted to sign in to apps that required Okta MFA.

OKTA-321996

Users deactivated in Okta weren't deactivated correctly in the Salesforce app.

OKTA-322115

If an account was deleted while the user was in an active session, Okta presented an error instead of redirecting the user to the Sign-in page.

OKTA-322925

Certain custom attributes that were updated in Okta weren't subsequently updated in LDAP.

OKTA-325636

Admin privileges couldn't be removed from users who had an invalid email address.

OKTA-327165

When updating a security question for password recovery, end users could use the non-domain part of their email as an answer.

OKTA-327188

Some Japanese translations on the Sign-In page weren't displayed correctly.

OKTA-329289

Some email templates in Italian were inaccurately translated.

OKTA-329756

In some cases, the Pending email address change email sent to end users didn't include dynamic content.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • Acronis Cloud (OKTA-333972)

  • Cisco Partner Login (OKTA-334409)

  • Flipboard (OKTA-332426)

  • Flock (helloflock.com) (OKTA-333132)

  • The Hartford EBC (OKTA-332871)

Applications

New Integrations

New SCIM Integration Applications

The following partner-built provisioning integration apps are now Generally Available in the OIN as partner-built:

New RADIUS integration

SAML for the following Okta Verified applications

  • CodeSignal (OKTA-333537)

  • Lexion (submitted via ISV Portal). SLA: 22/Sep/20 (OKTA-331539)

  • Mindtickle (OKTA-331529)

  • TerraTrue (OKTA-331899)

  • TransPerfect GlobalLink Dashboard (OKTA-331544)

  • Trotto Go Links (OKTA-330216)

  • WorkSafe (OKTA-334374)

Weekly Updates

October 19

Fixes

General Fixes

OKTA-296041

When searching for apps on the new Okta End-User Dashboard, all search results remained even after an app was selected.

OKTA-316869

The ShareFile app couldn't send the user.username attribute as NameID in SAML assertions.

OKTA-324814

The NetSuite app didn't display updated instance type URLs in the API integration drop down.

OKTA-330424

The Norwegian translation for the Send SMS Code MFA prompt was unclear.

Applications

New Integrations

New SCIM Integration Applications

The following partner-built provisioning integration apps are now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified applications

  • Beautiful.ai (OKTA-333538)

  • Brightflag (OKTA-325633)

  • Gamma Data Leak Prevention (OKTA-335554)

  • Gremlin (OKTA-333666)

  • Learnerbly (OKTA-332872)

  • Profit.co (OKTA-321220)

  • Pudding (OKTA-333992)

  • RemotePC (OKTA-335105)

SWA for the following Okta Verified application

  • Pacific Western Bank - Business eBanking (OKTA-330791)

October 26

Fixes

General Fixes

OKTA-309244

Although users successfully signed in to a RADIUS app using Okta Verify, the System Log recorded a failed email factor event.

OKTA-322108

When self-service registration was enabled, adding a required attribute to a non-default User Type profile threw an error.

OKTA-324298

The tool tips on the Email and SMS Customization page were missing instructions on how to edit the email template.

OKTA-325353

The error message displayed when revoking the last individually assigned Super Admin was unclear.

OKTA-328337

In some cases, the new Okta End-User Dashboard wasn't translated properly.

OKTA-328953

Approval Action and Message requests were missing from the Request History section of the new Okta End-User Dashboard.

OKTA-329123

When updating user profile mappings for Okta-to-Slack provisioning, an internal server error was thrown in some cases.

OKTA-330017

In an org with self service registration enabled, a user pushed to an Active Directory group was sent two activation emails instead of one.

OKTA-332039

Okta returned a 500 Internal Server error when the LDAP agent was disconnected and users attempted to sign into Okta with an incorrect password.

OKTA-332891

One-time MFA Usage reports contained outdated information about user status and their enrolled MFA factors.

OKTA-336169

No warnings were displayed when disabling a custom URL domain.

OKTA-337002

In developer orgs, users who were trying to reset their password were sent an email that didn't contain a password reset link.

Applications

New Integrations

New SCIM Integration Applications

The following partner-built provisioning integration apps are now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified applications

  • Funnel.io (OKTA-335549)

  • Query.AI (OKTA-325342)

SWA for the following Okta Verified application

  • Moffi (OKTA-331031)

September 2020

2020.09.0: Monthly Production release began deployment on September 08

* Features may not be available in all Okta Product SKUs.

Content

Generally Available Features

New Features

New features for SuccessFactors integration

The following new features have been added to the SuccessFactors integration:

  • Time zone based pre-hires and deactivations: Admins can deactivate SuccessFactors users and import pre-hires into Okta based on the time zone of their location.
  • Incremental imports: Incremental imports improve performance by importing only users who were created, updated, or deleted since the last import.

See Learn about SAP SuccessFactors Employee Central data provisioning.

Modern authentication support

We have extended our Office 365 Sign On policies to include the ability to distinguish between web browser and modern authentication clients, giving you even more granularity in controlling how users are accessing corporate data. You access this functionality by creating a new App Sign On Rule. See Get started with Office 365 sign on policies.

Inline Hook preview

The Inline Hook preview feature lets admins preview and validate Inline Hook requests before making them active. See Preview an inline hook .

Okta mastered attribute updates

Okta mastered attributes are now updated in a master app user profile when an org disables email customization.

Base attributes added to user profiles

When users access the Okta End-User Dashboard, all default base attributes are now added to their user profile.

Identity Provider Discovery

Using Identity Provider Discovery and routing rules, Okta directs users to different identity providers based on certain criteria. These criteria include location, device, the app being accessed, the user's domain, and specific user attributes. See Identity Provider Discovery. This feature will be gradually made available to all orgs.

Early Access Features

Early Access features from this release are now Generally Available.

Fixes

General Fixes

OKTA-276604

Filtering groups that were pushed by group also displayed groups that were pushed by name.

OKTA-312642

On the Activate User page, Search by Group didn't work if the search term included the vertical bar sign |.

OKTA-319877

In some cases, creating a custom SAML or SWA app using a bearer token failed.

OKTA-323045

Okta Workflows didn’t restrict application assignment to super admins.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • Autotask (OKTA-318506)

  • ccLink Provider Portal (OKTA-324140)

  • Chubb Personal Insurance (OKTA-323264)

  • Earth Class Mail (OKTA-322840)

  • Jobvite (OKTA-318586)

Applications

Application Updates

  • The Zoom SCIM app schema is updated. See Configuring Zoom with Okta for more information.
  • Provisioning support has been removed from the BigMachines and GoToMeeting apps due to their low customer usage, lack of standards based integration, and high supportability cost.

New Integrations

New SCIM Integration Applications

The following partner-built provisioning integration apps are now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified applications

  • Australian Access Federation (OKTA-317867)

  • Estateably (OKTA-324912)

  • Hopin (OKTA-324248)

  • Signal AI (OKTA-322928)

  • SocialHP (OKTA-322572)

  • Thematic (OKTA-322576)

OIDC for the following Okta Verified applications

Weekly Updates

September 14

Fixes

General Fixes

OKTA-307089

When attempting to reset a user's password using the password reset link, admins received a 500 Internal Server error rather than the correct error message if the user's email address was invalid.

OKTA-318040

The voice call used for MFA with Twilio as the call provider wasn't translated in Simplified Chinese, Traditional Chinese, and Portuguese.

OKTA-321794

App Admins who were granted permissions through the group assignment API could see all apps in the OIN catalog when adding an app even though they didn't have the permissions to create them.

OKTA-324295

Inline hooks that should have updated multiple user attributes only updated one.

OKTA-326226

The Origin header value was missing from the System Log event for the user.session.start debug context.

OKTA-326955

When a geographical network zone that included Okta routers was added to an IP blacklist zone, all requests to the org were blocked.

OKTA-326962

The On-Prem MFA agent was inconsistent with other agents in how often it conducted system health checks.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • ADP Portal (Employee) (OKTA-325832)

  • Bananatag (OKTA-324700)

  • ClearCompany (OKTA-323156)

  • Ecogent (OKTA-324473)

  • Figma (OKTA-324979)

  • Fullstory (OKTA-324977)

  • LucidPress (OKTA-322083)

Applications

New Integrations

New SCIM Integration Applications

The following partner-built provisioning integration app is now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified applications

  • Cloudvisor.io (OKTA-322418)

  • Indition (OKTA-321249)

  • KeySix (OKTA-322969)

  • Zenefits (OKTA-322575)

SWA for the following Okta Verified applications

  • BeyondID (OKTA-312394)

  • Tecnis (OKTA-309904)

OIDC for the following Okta Verified application

September 21

Fixes

General Fixes

OKTA-190533

Events were missing from the System Log when Identity Providers were added, updated, activated, deactivated, or deleted.

OKTA-284904

Some groups didn’t render properly under Directory > Groups after a group rule was deleted.

OKTA-328123

Importing users from SuccessFactors failed with a Java exception error.

App Integration Fixes

The following SWA app was not working correctly and is now fixed

  • SAP Litmos (OKTA-328160)

Applications

Application Update

  • The AlertMedia SCIM app guide link has been updated.
  • The Zepl OIDC app has been updated to include the Initiate Login URI value.

New Integrations

New SCIM Integration Applications

The following partner-built provisioning integration apps are now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified applications

  • Encoding (OKTA-296011)
  • MediaPlatform (OKTA-328133)
  • ProWriters Cyber IQ (OKTA-328138)
  • Pubble (OKTA-322567)
  • SparkPost (OKTA-326370)
  • Vote.gov (OKTA-327834)

OIDC for the following Okta Verified applications

September 28

Fixes

General Fixes

OKTA-290250

The directNumber value wasn't correctly imported from RingCentral.

OKTA-309276

On the Add Apps page of the new Okta End-User Dashboard, the placeholder text in the search field was misleading.

OKTA-309423

On the Okta End-User Dashboard, app notes weren’t visible for bookmark apps that were assigned through self-service.

OKTA-318189

When using the LDAP interface to view user objects with empty middle names, additional spaces were present in the Common Name (CN) field even though they weren't present in the CN that was returned with an API call.

OKTA-320453

Updating a routing rule failed when a network zone was deleted before removing it from the routing rule.

OKTA-322271

On the new Okta End-User Dashboard, users could auto-launch SWA apps configured with the setting Administrator sets username, user sets password without being prompted to update their credentials.

OKTA-328536

For some orgs that stopped setting up a custom URL domain partway through the process, completing the setup later failed.

OKTA-329650

On the new Okta End-User Dashboard, some app card logos were oversized.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • Alexa (OKTA-330529)

  • Jobvite (OKTA-328688)
  • TransUnion (OKTA-328858)

Applications

Application Update

  • The Internap Portal app is deprecated. This app is rebranded as INAP.

New Integrations

New SCIM Integration Application

The following partner-built provisioning integration app is now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified applications

  • Estateably (OKTA-324912)
  • Optymyze (OKTA-326879)
  • Query.ai (OKTA-325342)

SWA for the following Okta Verified applications

  • Clarity (OKTA-301636)
  • Horizon (OKTA-330251)
  • TSheets (OKTA-322853)

OIDC for the following Okta Verified applications

  • Chargifi: For configuration information, see Chargifi documentation here (you need a Chargifi account to access this documentation).

  • WarehouseTWO: For configuration information, see How to Enable Okta Login.

October 5

Fixes

General Fixes

OKTA-306373

Imports from UltiPro got stuck in the Queued status.

OKTA-309646

When adding an Access Policy to an Authorization Server, using scrollbars to navigate caused search criteria to be lost and scrollbars to disappear.

OKTA-310688

Searching groups by name on the Push Groups tab returned duplicate search results.

OKTA-315564

An internal server error was thrown and the System Log didn't record an event when sending a self-service account unlock or password reset email failed due to an invalid email recipient. A System Log event is now added to notify the admin.

OKTA-320265H

When a custom unique attribute from the Okta user profile was added to self-service registration, in certain instances user imports and creation failed.

OKTA-324204

Selecting Request Integration in the Okta Bookmark App Settings pane had no effect.

OKTA-325469

New users provisioned from Okta to DocuSign couldn’t send documents despite having correct permissions.

OKTA-325492

Reactivated users couldn’t access apps that were assigned their group while they were inactive.

OKTA-332102

User activations were logged erroneously as user.account.privilege.revoke in the System Log.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • Kingsley Associates Portal (OKTA-331176)

  • MessageBird (NL) (OKTA-330524)

  • PaloAlto Networks Support (OKTA-329881)

  • Pond5 (OKTA-330614)

  • The Washington Post (OKTA-330607)

  • Trello (OKTA-330012)

  • Upwork (OKTA-331969)

  • Wells Fargo (Commercial Electronic Office) (OKTA-330311)

Applications

New Integrations

New SCIM Integration Applications

The following partner-built provisioning integration apps are now Generally Available in the OIN as partner-built:

  • Sparkpost: For configuration information, see SCIM User Provisioning Through Okta.

  • Gong: For configuration information, see Gong documentation here (you need a Gong account to access this documentation).

SAML for the following Okta Verified applications

  • WorkSafe (OKTA-331532)
  • Teubora (OKTA-330214)

  • Flock (helloflock.com) (OKTA-328135)

OIDC for the following Okta Verified application

August 2020

2020.08.0: Monthly Production release began deployment on August 10

* Features may not be available in all Okta Product SKUs.

Content

Generally Available Features

New Features

G Suite Role Management support

Admins can manage G Suite admin roles directly from the Okta Assignments tab during user create, update, or delete operations. See Google Workspace Provisioning.

Note: Customers need to contact Okta Support to migrate their Universal Directory profile template to enable this feature.

Delete OIN draft submissions

Draft submissions of app integrations in the OIN Manager portal can now be deleted. See Update your published integration.

Configurable email OTP lifetime

Admins can now set the expiration of one-time passcodes in email messages up to 30 minutes when email is enabled for multifactor authentication. See Multifactor Authentication in MFA.

Okta IWA Web agent Just-In-Time operation failures

When using Agentless Desktop Single Sign-on (DSSO) or the Okta IWA Web agent, Just-In-Time (JIT) operations fail when users are disconnected from Active Directory (AD) and the Profile & Life cycle Mastering settings don’t allow user reactivation. This behavior is expected, and consistent with JIT operations in non-IWA AD environments. See Install and configure the Okta IWA Web agent for Desktop Single Sign-on.

Group push for Active Directory

You can now use group push on the Okta Admin Console to copy groups and their members to Active Directory. See Push groups from Okta to Active Directory.

Custom TOTP Factor for MFA

Admins can now enable a custom MFA factor based on the Time-based One-time Password (TOTP) algorithm. See .

Apple as an Identity Provider

Adding Apple as an Identity Provider allows users to sign in to your app using their Apple ID. See Add an external Identity Provider.

PIV Card authentication option added to identifier first Sign In page

A PIV Card authentication option is now provided on the identifier first Sign In page when you configure a Smart Card Identity Provider and a corresponding IdP Routing Rule in the Okta Admin console. See Identity Providers.

Multiple Smart Card/PIV Card Identity Providers

Our Multiple Certificate Chain Support for PIV Auth feature allows you to leverage multiple Smart Card/PIV Card IdPs, each with different certificate chains, to allow access to a single Okta org. The correct IdP will be automatically selected based on matching the user's chosen certificate to a configured certificate chain. See Identity Providers.

End-user profile reauthentication

The Customization section has a new setting that allows an admin to set the re-authentication time when an end user edits their profile. See Configure general customization settings.

MFA for reactivated accounts

End users are now prompted for MFA before landing on the Welcome page if their accounts were reactivated and already enrolled in one or more MFA factors. This feature is currently enabled by default for new orgs only.

Extended Client Access policy capability for apps

When creating App Sign-On Policy rules to manage access to apps, admins can now specify additional granularity for platform types. Office 365 Client Access policies will continue to provide additional granularity for clients (that is, Web vs EAS). See Add Sign-On policies for applications and Office 365 Client Access Policies.

App condition for MFA enrollment policy

Admins can now use a new condition when setting a rule for an MFA enrollment policy. When this condition is configured, end users are prompted for factor enrollment when accessing all of their applications or only for those selected by their org admin. See App condition for MFA enrollment policies.

Generally Available Enhancements

System Log enhancement

When a System Log event contains more than two targets, they're now displayed in an expandable list.

Workday time zone-based user deactivation support check box

The feature that allows Workday users to be deactivated based on their local time zone is now enabled using a check box on the Workday Provisioning page. See Workday.

Improved AWS Provisioning

When a customer has an AWS instance that was configured to use the Amazon AWS IAM role as the Sign On mode, and removes an optional child account from that instance, they're warned in the UI that their role provisioning will be removed and an event is generated in the System Log.

Add Administrator Group update

To prevent permission overrides, existing admin groups can only be granted new roles through the Edit option. The Add Administrator Group feature is available for new admin groups only.

OIN Manager improvements

The OIDC tab in the OIN Manager portal has been updated with new fields - a configuration guide link, additional URI tenant customization questions, and a sign-in flow option question. The improvements also include minor fixes to the UI text on the SAML tab. See Configure protocol-specific settings.

OIN Manager automated emails for discarded submissions

The OIN Manager sends an automated email to an ISV when an app integration submission is moved back to a draft state due to inaction by the ISV.

Early Access Features

Early Access features from this release are now Generally Available.

Fixes

General Fixes

OKTA-267328

Group members in a BambooHR-mastered group weren't correctly reflected into Okta after the group import.

OKTA-300889

The Remember me check box on the Sign On page didn't respond to the space key when using Firefox, Internet Explorer, or Edge.

OKTA-300957

The German translation of password policy requirements wasn't accurate.

OKTA-301352

Some Turkish characters in email templates didn't render correctly.

OKTA-303517

A user could be created without providing values for required custom arrays.

OKTA-310089

When the API Access Management feature was enabled, end users signing in to an OIDC app using Agentless Desktop SSO weren't correctly redirected to the app.

OKTA-313852

The position of the app logo was mis-aligned on the Add Application page.

OKTA-320854H

When existing apps that were incorrectly labeled as new were selected, errors occurred.

OKTA-321489H

L10N_ERROR[connector-agents] errors erroneously appeared in the UI in some Security > Multifactor sections.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • Cloud Guru (OKTA-315734)

  • Google AdWords (OKTA-312421)

  • Vision Planner (OKTA-316019)

Applications

New Integrations

New SCIM Integration Applications

The following partner-built provisioning integration apps are now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified applications

  • Coursera (OKTA-315355)

  • MediaValet (OKTA-313684)

  • Security Studio (OKTA-313793)

OIDC for the following Okta Verified application

Weekly Updates

August 17

Fixes

General Fixes

OKTA-265994

When, in the General tab of the Salesforce app, User Profile and Type was selected as Standard Salesforce, additional import options appeared erroneously on the Salesforce to Okta Provisioning tab.

OKTA-293366

The Profile Editor displayed incorrect length constraint instructions for usernames formats.

OKTA-301252

The Okta Browser Plugin didn't generate System Log events when users accessed an app through an SP-initiated flow.

OKTA-301760

In some cases, provisioning errors occurred in Box when selecting Group Push via User Attributes.

OKTA-304562

App admin assignments for groups weren't applied properly to RADIUS apps.

OKTA-305132

SMS messages in Chinese, Portuguese, and Dutch didn't support translation.

OKTA-310687

Groups created through Group Push erroneously showed up multiple times in the group list.

OKTA-310750

System Log events weren't logged when modifying Advanced RADIUS settings in the Sign On tab of the app.

OKTA-312588

Inbound federation for some orgs failed because metadata elements of the SAML specification were missing.

OKTA-316684

Admins couldn't create service clients without the API Access Management feature.

OKTA-317457

The User Search by first and last name on the People page didn't work as expected for all search keyword counts.

OKTA-318384

In some cases, deactivating users in Workday failed for scheduled imports.

OKTA-320235

The error message displayed when creating an admin group that already had existing admin roles was ambiguous.

OKTA-321665H

Provisioning to Office 365 using User Sync or Universal Sync failed in some cases.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • Adobe Sign Provisioning (OKTA-315230)

  • American Express - Work (OKTA-318244)

  • CenPOS (OKTA-320689)

  • Formstack (OKTA-318620)

  • PaloAlto Networks Support (OKTA-312790)

Applications

New Integrations

New SCIM Integration Applications

The following partner-built provisioning integration apps are now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified applications

  • Ally (OKTA-317614)

  • BirdEye (OKTA-314483)

  • Cequence Security (OKTA-315329)

  • Closing Folders (OKTA-315330)

  • Datasite (OKTA-313781)

  • Documo (OKTA-318832)

  • Dundas BI (OKTA-319258)

  • Ermetic (OKTA-318858)

  • Evergreen (OKTA-318831)

  • Five9 Plus Adapter for ServiceNow (OKTA-314639)

  • Jira SAML SSO by miniOrange (OKTA-304222)

  • Netskope Admin Console (OKTA-320867)

  • OwnBackup (OKTA-298672)

  • Qase (OKTA-317609)

  • Rstudio Server Pro (OKTA-312993)

  • SecureW2 (OKTA-313771)

  • TransPerfect (OKTA-303677)

  • Tribeloo (OKTA-319293)

  • Userflow (OKTA-318828)

  • Workable (OKTA-315969)

SWA for the following Okta Verified applications

  • Chubb Personal Insurance (OKTA-317081)

  • Nutanix Partner Login (OKTA-315291)

  • TerraTrue (OKTA-319285)

OIDC for the following Okta Verified application

August 24

Fixes

General Fixes

OKTA-285972

Users encountered scrolling problems when dragging and dropping apps on the new Okta End-User Dashboard.

OKTA-313812

Help Desk and Read Only admins received false successful MFA reset confirmations for users they didn’t manage.

OKTA-318437

In orgs with Factor Sequencing enabled, customers always had password as one of the factor types in their ID token's amr claim, regardless of which factor was actually used.

OKTA-319515

On the Okta End-User Dashboard, some managed apps were listed more than once.

OKTA-320675

For some orgs with both Passwordless Authentication and Improved New Device Behavior Detection enabled, Okta treated all authentication attempts as though they came from new devices.

OKTA-325206H

Deleted Custom Domains also deleted OIDC client secrets.

OKTA-3253931H

Help Desk admins could not reset passwords.

App Integration Fixes

The following SAML apps were not working correctly and are now fixed

  • Netskope Admin Console (OKTA-322294)

  • RStudio Connect (OKTA-320865)

  • TeamzSkill (OKTA-321223)

The following SWA apps were not working correctly and are now fixed

  • Google AdWords (OKTA-319559)

  • New Relic by Account (OKTA-319755)

  • ShipStation (OKTA-319715)

Applications

Application Update

monday.com now supports the following Provisioning features (this is in addition to the other provisioning features that it already supports):

  • Group Push
  • Update User Attributes
  • Password Sync

For configuration information, see Provisioning Configuration - Okta.

New Integrations

New SCIM Integration application

The following partner-built provisioning integration app is now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified applications

  • Databox (OKTA-321227)

  • ENTOUCH (OKTA-321208)

  • Ramp (OKTA-312623)

  • Terraform Cloud (OKTA-315643)

OIDC for the following Okta Verified applications

August 31

Fixes

General Fixes

OKTA-294233

In some orgs configured with a custom URL domain, the password reset link provided in the custom email template redirected users to the Sign In page instead of the reset password flow.

OKTA-306130

The error message admins received when trying to add a second password inline hook was misleading.

OKTA-309244

Successfully authenticating into a Radius app using Okta Verify logged a failure event in the System Log.

OKTA-318932

Okta Confluence Authenticator dependencies caused problems with 3rd party Confluence Plug-ins using the javax.inject library. To obtain this fix, upgrade to the latest Okta Confluence Authenticator, version 3.1.4, see Okta Confluence Authenticator version history.

OKTA-323151

App notes on the Okta End-User Dashboard were misaligned.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • Cisco Meraki Dashboard SAML (OKTA-322785)

  • Jobvite (OKTA-318586)

  • LucidChart (OKTA-320576)

Applications

New Integrations

SAML for the following Okta Verified applications

  • CloudSign (OKTA-316737)

  • MyCompliance (OKTA-318059)

SWA for the following Okta Verified application

  • Internap (OKTA-321035)

OIDC for the following Okta Verified applications

July 2020

2020.07.0: Monthly Production release began deployment on July 13

* Features may not be available in all Okta Product SKUs.

Content

Generally Available Features

New Features

LDAP agent, version 5.6.6

This release provides the same functionality as release 5.6.5. Some default settings have been updated. See Okta LDAP Agent version history.

Reduced LDAP Interface inactive connection time out

The time out for inactive LDAP Interface connections that don't receive LDAP operations has been reduced from 120 seconds to 30 seconds, and they are now disconnected after 30 seconds of inactivity. Connections that receive an LDAP bind operation time out after 120 seconds.

Warning message added to the Import Settings page

A warning message now appears on the Active Directory Import Settings page to warn users that changing the user and group organizational unit settings can result in the deprovisioning of users.

App integration logos

The maximum size for an app integration logo has been increased from 100 KB to 1 MB. For best results, use a PNG file with a minimum resolution of 420 x 120 pixels, with landscape orientation, and with a transparent background.

Terms of Service acceptance required

Terms of Service acceptance is required from the first super admin to initiate access to OCC (Okta Cloud Connect), Developer, and Free Trial editions of Okta.

New Group Membership Admin role

The new Group Membership Admin role grants permission to view all users in an org and manage the membership of groups.

Dynamic authentication context for SAML apps

Admins can configure a custom attribute statement for SAML assertions to send user's authentication context to SAML apps during the app authentication process. The app uses this information to limit access to certain app-specific behaviors and calculate the risk profile for the signed-in user. See Pass Dynamic Authentication Context.

Prevent web browsers from saving sign-in credentials

You can prevent browsers such as Chrome from saving an end user's sign-in credentials for Okta as well as for third-party apps accessed through the Okta Dashboard. See Prevent browsers from saving sign-in credentials.

ASN Support for Dynamic Zones

Admins can now enter ASNs (Autonomous System Numbers) when creating or editing a dynamic zone. See Dynamic Zones.

DocuSign support update

DocuSign now supports workers who have an Activation Sent status in DocuSign.

Schema Discovery for Cornerstone On Demand

The Cornerstone On Demand provisioning app now supports Universal Directory and Schema Discovery. See the Cornerstone On Demand Provisioning Guide.

Profile Sourcing and Push can be enabled together

Admins can enable both Profile Sourcing and Push for an app. This allows all Okta-to-App mappings to push, regardless of whether Active Directory is the Profile Source.

OIN Manager supports multiple application submissions

When submitting a new application integration for review by Okta, the OIN Manager now supports multiple concurrent application submissions:

Risk Scoring sign-on policy rule

Admins can now set a risk level as part of a sign-on policy rule. Setting a risk level helps determine potential security risks that are associated with an end user when they attempt to sign in to their org. This feature will be gradually made available to all orgs.

see Risk scoring.

Generally Available Enhancements

Okta Browser Plugin enhancements

The following improvements have been added to the Okta Browser Plugin:

  • The plugin icon displays a green exclamation point (!) to alert users of new plugin features that have been added.
  • The plugin settings highlights new opt-in features when they are made available.
  • In Firefox, the Close tab button, shown to users after granting privacy-related permissions for the Okta Browser Plugin, is removed due to browser limitations.
  • In Chrome, when the Offer to Save Passwords setting is controlled by a group policy, the popover setting to prevent the browser from prompting to save passwords is hidden from end-users.

Inline Hook links to Overview page

In the Okta Admin Console > Inline Hooks page, clicking an Inline Hook now directly opens the Overview page. See Inline hooks.

File size and file hash information for Okta Active Directory and LDAP agents

File size and file hash information is now provided for the Okta Active Directory and Okta LDAP agents on the Okta Admin Console > Downloads page.

Early Access Features

Early Access features from this release are now Generally Available.

Fixes

General Fixes

OKTA-290791

Users who switched to a new app section in the Okta Browser Plugin weren't redirected to the top of that section.

OKTA-292056

The percentage listed in messages on the Okta Admin Dashboard occasionally contained an extra percentage symbol.

OKTA-292816

Group membership roles on the Assignments tab didn't reflect the actual membership roles of users in the Confluence app.

OKTA-296301

Users configuring voice call as an MFA factor were redirected to a wrong page if they refreshed the page during the setup.

OKTA-302908

Admins received a 404 error when opening the Rules tab on the Groups page in a new tab.

OKTA-304503

Users repeatedly received prompts to reinstall or update the Okta Browser Plugin regardless of its version and were given false warnings that the plugin was infected or unsafe.

OKTA-304770

The publisher for the Okta Browser Plugin for Internet Explorer was incorrectly listed as Internal Okta CA instead of Okta, Inc. in Internet Explorer > Tools > Manage add-ons.

OKTA-306546

The incorrect plugin version number was displayed for the Okta Browser Plugin in Internet Explorer > Tools > Manage add-ons.

OKTA-306663

Custom string attributes couldn't be updated for NetSuite.

App Integration Fixes

The following SWA app was not working correctly and is now fixed

  • Meraki Dashboard (OKTA-305864)

Applications

New Integrations

New SCIM Integration Applications

The following partner-built provisioning integration apps are now Generally Available in the OIN as partner-built:

New RADIUS integration

The Cisco Meraki RADIUS app is now available.

SAML for the following Okta Verified applications

  • Catalyser (OKTA-304474)

  • Flux (OKTA-306648)

  • InSights (OKTA-296073)

SWA for the following Okta Verified applications

  • Openpath (OKTA-296212)

  • United HealthCare Oxford (OKTA-306125)

OIDC for the following Okta Verified application

Weekly Updates

July 20

Fixes

General Fixes

OKTA-296243

Admins experienced significant delays when trying to load the Provisioning tab for custom SAML apps with SCIM provisioning.

OKTA-296456

Using the API to unlock a user that was also in a suspended state incorrectly returned a successful response.

OKTA-296598

When successfully authenticating using email as an MFA factor, users received an error message due to duplicate verification requests.

OKTA-303162

The Learn More documentation link in the Need more provisioning for this App? section of the SAML application settings was outdated.

OKTA-305486

Attributes weren't visible for some Okta-mastered users under Directory > People > User Profile > Profile.

OKTA-312218

Users using the new Okta End-User Dashboard received notifications that VPN was required when accessing apps that were configured to ignore VPN notification rules.

OKTA-312248

The Help documentation link for Office 365 Silent Activation was broken.

OKTA-312957

In some scenarios, the custom sign-in page did not properly encode all parameters.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • Bloomberg (OKTA-310150)

  • Cisco Webex Meetings (OKTA-306061)

  • Concur - ProTrav (OKTA-309107)

  • Wrike (OKTA-305767)

Applications

New Integrations

SAML for the following Okta Verified applications

  • DeployGate (OKTA-305110)

  • Ebenefit Sync (OKTA-309219)

  • Procaire (OKTA-309779)

  • S&P Market Intelligence (OKTA-306170)

  • Skedda (OKTA-310320)

  • Textline (OKTA-306986)

  • User Interviews (OKTA-306649)

OIDC for the following Okta Verified application

  • Nedap ONS: For configuration information, see Single Sign-On instructions.

Mobile application for use with Okta Mobility Management (OMM) (Android and iOS)

  • NowSpace (OKTA-309446)

Mobile application for use with Okta Mobility Management (OMM) (Android)

  • AuthControl Mobile (OKTA-306981)

  • Twilio Authy (OKTA-306982)

August 3

Fixes

General Fixes

OKTA-275700

Updates to tabs managed by admins on the new Okta End-User Dashboard were incorrectly shown as banners, rather than notifications in the Notifications tab.

OKTA-294716

The Import Groups option couldn't be disabled when using Google Push Group functionality.

OKTA-296526

Report Admins were unable to view YubiKey reports due to insufficient permissions in Reports > YubiKey Report.

OKTA-298061

If an IP range was configured in a network zone that included IP addresses that are part of the Okta infrastructure, users coming from that range didn’t receive MFA prompts.

OKTA-298724

Adding an admin who already had admin roles resulted in that admin's permissions being overwritten rather than updated.

OKTA-299210

When using a custom URL domain, attempts to download metadata for an identity provider from the Okta Admin Console sometimes failed.

OKTA-302644

Address attributes from a generic OIDC identity provider weren't correctly mapped to an Okta user profile during social login.

OKTA-302876

Disabling the Import Groups option under Org2Org provisioning incorrectly created duplicate groups and threw timeout errors.

OKTA-304184

The Allow Pushing Null Values functionality of Salesforce failed when applied to the manager id field during SOAP integration.

OKTA-304895

UltiPro User Imports failed for users who were missing the External Id attribute in UltiPro.

OKTA-305272

The Group Membership Admin role was still available in the drop down under Settings > Account > Admin Email Notifications after the role was disabled.

OKTA-305287

A button linking to the Tasks page was incorrectly shown to users who had no pending tasks on the new Okta End-User Dashboard.

OKTA-306031

When setting up a custom domain that had previously been verified, uploading TLS certificates failed if the admin had skipped the domain verification step.

OKTA-307235

When trying to access an OIDC app using Desktop SSO in a Preview environment, some users experienced sign-in loops.

OKTA-313477

Some life cycle event hooks for user activation incorrectly failed because Certificate Authority endpoints were unrecognized.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • Acronis Cloud (OKTA-313976)

  • Formstack (OKTA-314095)

  • Lucernex IWMS (OKTA-315510)

  • Timesheet (OKTA-311299)

Applications

New Integrations

New SCIM Integration Applications

The following partner-built provisioning integration apps are now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified applications

  • Appaegis Access Cloud (OKTA-310778)

  • BoostUp (OKTA-310661)

  • DEEM SAML (OKTA-291393)

  • Galaxkey (OKTA-304840)

  • Hub Planner (OKTA-312621)

  • Kiva (OKTA-303274)

  • Land Gorilla (OKTA-306647)

  • Marin One (OKTA-310324)

  • Proggio (OKTA-312282)

  • Reftab (OKTA-306646)

  • seoClarity (OKTA-312622)

  • Syxsense (OKTA-311073)

  • Zercurity (OKTA-311985)

SWA for the following Okta Verified application

  • John Hancock Pensions (OKTA-312845)

  • ManageEngine EventLog Analyzer (OKTA-309417)

  • TicketMaster (OKTA-309879)

OIDC for the following Okta Verified applications

Mobile application for use with Okta Mobility Management (OMM) (iOS)

  • Microsoft Whiteboard (OKTA-312273)

June 2020

2020.06.0: Monthly Production release began deployment on June 8

* Features may not be available in all Okta Product SKUs.

Content

Generally Available Features

New Features

Deprecated metrics removed from the Okta Admin Dashboard

The following aggregated metrics have been removed from the Okta Admin Dashboard:

  • Count users who have never signed in
  • Count users who have signed in
  • Count apps with unused assignments
  • Count unused app assignments

All reports are still available. See Dashboard.

Okta Browser Plugin for Internet Explorer, version 5.38.1

This version includes the following:

  • With the Okta Browser Plugin, end users can prevent browsers from prompting to save their sign-in credentials for Okta or any third-party apps accessed through the Okta End User Dashboard. See Prevent browsers from saving sign-in credentials. Note that this feature is only available in Preview orgs.
  • For the new Okta End-User Dashboard: Search in the Okta Browser Plugin is updated to have the same search accuracy as the Okta End-User Dashboard.
  • Font sizes in the Okta Browser Plugin popover are updated.

See Okta Browser Plugin version history.

Okta Browser Plugin: Password Suppression UI changes

The two plugin UI elements that configure blocking browsers from saving passwords are now managed by end users in the plugin popover, and have been removed from the Admin customization settings.

Old UI

New UI

Improvements to the Disconnect People from Active Directory page

In the Okta Admin Console, the Disconnect People from Active Directory page now displays all users and not just those from the first app instance. See Disconnect users from Active Directory.

ODSEE LDAP Support

Okta now supports Oracle Directory Server Enterprise Edition (ODSEE) LDAP integrations with the upgrade to LDAP agent version 5.6.3 and later. See Oracle Directory Server Enterprise Edition LDAP integration reference.

Extensibility Inline Hooks usage metrics

Hook metrics display all successful and unsuccessful executions of enabled Inline Hooks. Admins can use metrics to assess the performance of their hooks and troubleshoot unexpected behavior. See Inline hooks.

Generally Available Enhancements

Improved Risk Scoring model

Risk scoring evaluation has been enhanced to improve the detection of high risk sign-on activity. See Risk scoring.

Improvements to developer onboarding experience

The Okta developer site has enhanced the onboarding experience for new developers:

  • Added task for customizing developer goals
  • Updated text on the developer profile panel
  • Added numbering to tasks
  • Improved usability and process flow

File size and hash added to Downloads page

The Downloads page now displays the file size and SHA-512 hash for the RADIUS and OPP agents. Admins can use the file size and hash to verify the integrity of the files. See Install Okta RADIUS Server agent on Windows and Okta Provisioning agent and SDK version history.

Box integration enhancement

When Box users are deactivated, and the option Transfer user’s files to account user is selected, the following warning is displayed: Caution: Files owned by the user will be inaccessible while they are being transferred. This also means that any shared content owned by the user may be inaccessible to all collaborators during the move. Depending on the volume of content, this operation may take a significant amount of time.

Early Access Features

Early Access features from this release are now Generally Available.

Fixes

General Fixes

OKTA-280844

In some Group Rules, if the User Attribute was very long, the value field didn't display properly.

OKTA-282532

In the new Okta End-User Dashboard, after dragging and dropping an app, end users were scrolled to the top of the dashboard.

OKTA-284835

The new Applications page used the term WS-Fed instead of WS-Federation.

OKTA-292924

User import from Workday failed if a username exceeded 100 characters.

OKTA-299093/299098

The Email as an MFA Factor for Authentication feature was not made available for some orgs when it was released earlier. Some customers who were eligible to use the Email factor with the factor API could not use the Email factor with the authentication API.

OKTA-299102

The Importing People page had the wrong documentation link.

OKTA-300069

When creating an event hook, if Subscribe to events was set to any of the Application life cycle events options, it resulted in the error Invalid list of events provided.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • Acorns (OKTA-299038)

  • Adobe.com (OKTA-299039)

  • Aetna Health Insurance (OKTA-301364)

  • AT& T (OKTA-299679)

  • Bitdefender (OKTA-301600)

  • Chase (OKTA-299437)

  • Delighted (OKTA-300045)

  • Expensify (OKTA-299222)

  • iHeartRadio (OKTA-301357)

  • iOvation (OKTA-300980)

  • Jetblue (OKTA-301355)

  • Kace (OKTA-299033)

  • LucidPress (OKTA-300843)

  • Mathworks (OKTA-299040)

  • myuhc - United Healthcare (OKTA-301360)

  • Sophos Partner Portal (OKTA-300844)

  • Staples Advantage (OKTA-297714)

Applications

New Integrations

New SCIM Integration Applications

The following partner-built provisioning integration apps are now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified application

  • Otter.ai (OKTA-298298)

OIDC for the following Okta Verified applications

Weekly Updates

June 15

Fixes

General Fixes

OKTA-277693

When the Application Entitlement Policy feature was enabled and the admin was prompted to Reapply Mapping for some fields on the App Assignment page, the Username field appeared blank.

OKTA-282323

Editing the single sign-on URL for a custom SAML app sometimes resulted in an internal server error.

OKTA-286106

When the Application Entitlement Policy feature was enabled, some attribute types in the Provisioning tab of an app displayed incorrect values.

OKTA-287941

Group names and descriptions on the Assignments page were incorrectly auto-capitalized.

OKTA-287962

When using Okta Verify for MFA, users received duplicate error messages if they clicked the Verify button without entering a code.

OKTA-287972

Admins using Internet Explorer 11 didn't get user-reported suspicious activity notifications in the Okta Admin Dashboard.

OKTA-304082

Under specific conditions, a new user may have been able to login to Okta using an expired password only during the LDAP JIT flow.

OKTA-305356H

Default settings for the LDAP agent version 5.6.5 were incorrect. To obtain the new, correct default settings, please download LDAP agent version 5.6.6.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • Markel Insurance (OKTA-302146)

  • Palo Alto Networks (OKTA-301935)

  • Replicon (OKTA-302143)

  • Sherweb (OKTA-302150)

  • Zscaler (OKTA-301359)

Applications

New Integrations

New SCIM Integration Applications

The following partner-built provisioning integration apps are now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified applications

  • Ally.io (OKTA-300334)

  • Clue (OKTA-299668)

  • VictorOps (Beta) (OKTA-299182)

SWA for the following Okta Verified application

  • CitiDirect BE (OKTA-298279)

OIDC for the following Okta Verified application

June 22

Fixes

General Fixes

OKTA-258780

Admins were unable to properly scroll in the Edit Group Assignment and Edit App User Assignment pop-up windows.

OKTA-285380

When using the override with mapping feature, username was incorrectly editable on the Profile Editor > Edit Mappings > App to Okta page.

OKTA-291912

For end user password resets, the Password is managed by a different application customization option didn't work if a custom URL domain was also configured.

OKTA-299448

When the new provisioning settings UI for Active Directory was enabled on the Active Directory Settings > Assignments tab, the Assign button was incorrectly displayed.

OKTA-299708

Some deactivated end users weren't deprovisioned from their applications.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • Bank of America (OKTA-294552)

  • Barracuda Networks (OKTA-303543)

  • General Motors GlobalConnect (OKTA-303400)

  • LastPass (OKTA-303982)

  • Polygon (OKTA-304216)

Applications

New Integrations

New SCIM Integration Applications

The following partner-built provisioning integration apps are now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified applications

  • Greenhouse Recruiting (Subdomain) (OKTA-303238)

  • Kisi Physical Security (OKTA-303807)

  • Pymetrics (OKTA-299069)

  • TeamMood (OKTA-302178)

  • Valotalive (OKTA-298057)

OIDC for the following Okta Verified application

June 29

Fixes

General Fixes

OKTA-292734

The System Log didn't log an entry when a push notification for MFA was sent to a user.

OKTA-297792

When using email as an MFA factor, for some languages the text on the Sign-In page didn't display properly.

OKTA-298362

Workday imports sometimes failed when the Incremental Imports feature was enabled and used with Constrained Security Users (not recommended by Okta) instead of Unconstrained Security Users.

OKTA-301607

The Cancel and Request buttons on the Request Apps dialog in the new Okta End-User Dashboard were placed too closely together.

OKTA-301654

Some icons for MFA factor resets and enrollment policies were outdated.

OKTA-305633

When requests to the /auth/services/devicefingerprint failed, users trying to authenticate got stuck on the Sign-In page.

App Integration Fixes

The following SWA app was not working correctly and is now fixed

  • Nice inContact (OKTA-303178)

Applications

New Integrations

SAML for the following Okta Verified applications

  • aapi (OKTA-303606)

  • Github (OKTA-304435)

  • Go Moment (OKTA-302199)

  • Ironclad (OKTA-305082)

  • ProProfs Knowledgebase (OKTA-297807)

  • Rewatch (OKTA-303581)

  • S&P CapitalIQ (OKTA-300125)

Mobile application for use with Okta Mobility Management (OMM) (Android and iOS)

  • 1Password Business (OKTA-297855)

OIDC for the following Okta Verified applications

June 29

Fixes

General Fixes

OKTA-289516

When configuring the AWS application with AWS China Connected Accounts, and then trying to save the Provisioning tab settings, the following error was displayed: The security token included in the request is invalid.

OKTA-298403

Users that were assigned custom SAML apps through group assignment incorrectly retained custom attributes in their user profiles after the group was deleted.

OKTA-300720

The interstitial page during the Agentless Desktop SSO sign-in flow incorrectly displayed a server status banner when the server was in read-only.

OKTA-303164

The Using Groups Claim documentation link in the OIDC Application Settings page was outdated.

OKTA-303168

The Learn more documentation link for SAML settings on a SAML app page > General Settings tab was outdated.

OKTA-306103

The password icon for the Okta sign-in widget was inconsistent with the look and feel of other authentication factors.

OKTA-306978

The password icon in the Okta Admin Console was outdated.

App Integration Fixes

The following SWA app was not working correctly and is now fixed

  • App Store Connect (OKTA-302169)

  • YM Careers Partner (OKTA-304814)

Applications

New Integrations

New SCIM Integration Application

The following partner-built provisioning integration app is now Generally Available in the OIN as partner-built:

SWA for the following Okta Verified applications

  • Kamer van Koophandel (OKTA-304857)

  • Snap-on B2B (OKTA-285600)

SAML for the following Okta Verified applications

  • Adaptive Shield (OKTA-306991)

  • Charthop (OKTA-305581)

  • Clarizen One (OKTA-306617)

  • Lightstep (OKTA-305088)

  • Segment (OKTA-304217)

  • Spendesk (OKTA-303931)

OIDC for the following Okta Verified applications

May 2020

2020.05.0: Monthly Production release began deployment on May 11

* Features may not be available in all Okta Product SKUs.

Content

Generally Available Features

New Features

LDAP agent, version 5.6.5

This version of the agent contains internal improvements, including updating the JDK to Amazon Corretto and eDirectory support. See Okta LDAP Agent version history.

Application Lifecycle Event Hook

Application Lifecycle events are now available for use as Event Hooks. See Event Types for a list of Events that can be used with Event Hooks.

Assign users to multiple groups in one group rule

Users can be assigned to multiple groups in one group rule. It is no longer necessary to set up multiple rules for the same criteria to accommodate different groups. See About group rules. This feature is now available for more orgs.

Rate limit behavior for SAML sign-ins

When Just-In-Time provisioning is enabled and the number of users attempting to sign in using SAML or a Social Identity Provider exceeds rate limits, Okta displays a message that it will automatically retry the JIT request after waiting a few seconds.

Disable Import Groups per app

Admins have the option to choose whether groups are included in imports from apps. This new option is available when setting up provisioning for an app.

This feature should be used with care as disabling group imports will have the result of deleting all groups from the app you are configuring. As such, we provide a warning prior to disabling group imports:

Note that you will be unable to disable group imports for an app if the following conditions exist:

  • App Assignments based on Group exist
  • Group policy rules exist
  • Group Push mappings exist

In these cases, an error is displayed.

OIN App Catalog V2 available for Developer Edition and SKU Edition orgs

The enhanced OIN Catalog is now enabled for all new and existing Developer Edition or SKU Edition orgs.

This feature will be gradually made available to all orgs.

Enhancement: MFA phone-number enrollment restricted

End users are now prevented from enrolling premium numbers for SMS and phone multifactor authentication. Premiums numbers are those reserved for various services. In the U.S., they include numbers that begin with a zero or use area codes 900, 911, and 411. Internationally, the following phone-number types are restricted: Audiotext, Carrier selection, National rate, Premium rate, Shared cost, Satellite, and Short Code.

eDirectory LDAP support

Okta now supports eDirectory LDAP integrations with the upgrade to the LDAP agent version 5.6.2 or later. See eDirectory LDAP integration reference.

OUD LDAP Support

Okta now supports Oracle Unified Directory (OUD) LDAP integrations. See Oracle Unified Directory LDAP integration reference.

Deactivated admin users

When a user who has an admin role and privileges assigned to them is deactivated, their admin privileges are revoked. The deactivated user is removed from the Administrators page and from the CSV download list of administrators. See Administrators.

App-level safeguard

To guard against an unusual number of app un-assignments during user import, the admin can set the safeguard to org-level, app-level, or both. See Import safeguards.

This feature will be gradually made available to all orgs.

Generally Available Enhancements

New HealthInsight recommendation and updates

HealthInsight now recommends enabling Okta Verify for MFA. The existing recommendation to enable strong MFA factors now also recommends disabling weaker factors. See HealthInsight.

Copy and paste groups for admin permissions

You can now copy and paste group assignments when creating admin permissions.

Early Access Features

Early Access features from this release are now Generally Available.

Fixes

General Fixes

OKTA-210751

GitHub import into Okta only updated a subset of users.

OKTA-249695

The filter on the Directory > Profile Editor > Apps page didn't work for Org2Org and Bookmark apps.

OKTA-257761

Email templates that contain invalid or unknown expressions didn't display the right error message and were still saved.

OKTA-276226

Application group assignment windows didn't resize correctly when input was added.

OKTA-278184

In some cases, when a large number of groups were assigned to an application, assigning users to these groups took longer than usual.

OKTA-282594

Users couldn't use the arrow keys to navigate through app search results on the new Okta End-User Dashboard.

OKTA-282919

End users using the new Okta End-User Dashboard were incorrectly prompted to install or upgrade the Okta Browser Plugin even if it was IT-managed.

OKTA-284665

CSV files generated in the System Log sometimes incorrectly included carriage returns.

OKTA-284954

Search results were incorrectly sorted when searching for an app on the new Okta End-User Dashboard.

OKTA-286081

When Factor Sequencing was enabled and the authentication policy contained a method set to Password / Any IDP, the sign-in window froze when users reset their password.

OKTA-287673

Some users became stuck in an authentication loop when trying to access an app from the new Okta End-User Dashboard.

OKTA-288389

Some admins received errors when trying to approve app requests from end users made through the new Okta End-User Dashboard.

OKTA-289511

The Smart card sign-in button was visible without a Smart Card Identity Provider configured within the customer org.

OKTA-291259

Some identity providers didn't show up in the Device Identity Provider list when configuring Device Trust.

OKTA-291935

Users were prevented from disabling both app-level and org-level roadblocks.

OKTA-293240

When profile mastering was enabled, the Update application username field under the AD Provisioning settings tab didn't render correctly.

OKTA-294767

The Email as an MFA Factor feature was not made available for some orgs when it was released earlier. We are re-releasing it in 2020.05.0.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • 1Password Business (OKTA-291540)

  • 2020 Spaces (OKTA-293863)

  • Airship (OKTA-292749)

  • Bill.com (OKTA-292940)

  • CalPERS (OKTA-294342)

  • Cisco Webes (OKTA-292505)

  • IBM Cloud (OKTA-293426)

  • Sauce Labs (OKTA-292506)

  • Thomson Reuters MyAccount (OKTA-291630)

  • Twitter (OKTA-287886)

  • WP Engine (OKTA-293338)

Applications

New Integrations

New SCIM Integration Applications

The following partner-built provisioning integration apps are now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified applications

  • ACALL (OKTA-292094)

  • BigChange (OKTA-294316)

  • Freshworks (OKTA-290904)

  • Kintaba (OKTA-291174)

  • Lingotek (OKTA-292197)

  • Mapbox (OKTA-294374)

  • Odo (OKTA-294315)

  • Prezi (OKTA-293858)

  • Seculio (OKTA-293141)

  • Statusbrew (OKTA-292827)

SWA for the following Okta Verified application

  • Spreadshirt (OKTA-291601)

OIDC for the following Okta Verified application

  • FiveToNine: For configuration information, see FiveToNine documentation (note you need appropriate permissions to view this doc).

Weekly Updates

May 18

Fixes

General Fixes

OKTA-288102

Non-Okta-mastered groups incorrectly appeared in the Application Access Audit, Okta Usage, and Application Usage reports that were intended only for Okta-mastered groups.

OKTA-294756

In some cases when the server was in Read Only mode, the interstitial page displayed an error message in the browser console log.

OKTA-298064H

Samanage (Solarwinds) changed their API for Fetch Custom Forms which resulted in errors during user import operations from Samanage.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • Business Insider Prime (OKTA-295295)

  • Freshworks (OKTA-296513)

  • Hoovers (OKTA-296255)

  • HR Downloads (OKTA-295323)

  • John Hancock - MyLifeNow (OKTA-296484)

  • McMaster-Carr (OKTA-295420)

  • oDesk (OKTA-295425)

  • SEMrush (OKTA-292973)

  • Sophos Cloud (OKTA-294861)

Applications

New Integrations

New SCIM Integration Applications

The following partner-built provisioning integration apps are now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified applications

  • Apperio (OKTA-294671)

  • Valimail for Twilio SendGrid (OKTA-293379)

SWA for the following Okta Verified applications

  • Amazon Marketing Services (OKTA-292908)

  • Palo Alto Networks (OKTA-291327)

OIDC for the following Okta Verified application

May 26

Fixes

General Fixes

OKTA-283143

The default rule didn't follow the HealthInsight recommendation for the session lifetime for Default Policies to be two hours.

OKTA-289276

When launching Agentless Desktop Single Sign-on from a browser, the Japanese translation of the Verifying Desktop SSO message rendered incorrectly.

OKTA-296165

A banner that notifies users to trust the Okta account in the Okta Browser Plugin was missing from the new Okta End-User Dashboard.

App Integration Fixes

The following SAML app was not working correctly and is now fixed

  • YardiOne Dashboard (OKTA-295097)

The following SWA apps were not working correctly and are now fixed

  • 1Password Business (OKTA-298126)

  • Ebay (OKTA-296547)

  • Staples (OKTA-295631)

  • TriNet HR Passport (OKTA-296653)

The following Mobile app was not working correctly and is now fixed

  • MS Office (OKTA-296210)

Applications

New Integrations

New SCIM Integration Applications

The following partner-built provisioning integration app is now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified applications

  • Blink (OKTA-296246)

  • edQuire (OKTA-295419)

  • ideiio (OKTA-293373)

  • Intercom (OKTA-292194)

  • Proggio (OKTA-278233)

  • Shopify Plus (OKTA-292196)

June 1

Fixes

General Fixes

OKTA-283868

The new Okta End-User Dashboard didn’t display the VPN Required prompt for any app that required VPN access.

OKTA-293415

Okta Support Services sign-in didn’t differentiate users based on their organization and their unique identifier.

OKTA-297532

Certificate chains that were set up with custom URL domains had key length restrictions.

OKTA-297833

The help link on the Profile Editor page on the Okta Admin Console was broken.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • Cisco WebEx Meeting Center (OKTA-291966)

  • ComplianceDepot (OKTA-297545)

  • DoorDash (OKTA-297476)

  • John Hancock Pensions (OKTA-297543)

  • Lucidchart (OKTA-298005)

  • MINDBODY (OKTA-297847)

  • SalesLoft (OKTA-298142)

  • Siteimprove (OKTA-297116)

  • VSP (OKTA-297671)

  • Wayfair (OKTA-297401)

Applications

New Integrations

New SCIM Integration Application

The following partner-built provisioning integration app is now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified applications

  • Anvil Riskmatics (OKTA-296063)

  • Bugfender (OKTA-297637)

  • Cirricula (OKTA-296050)

  • ComplySci (OKTA-299148)

  • Jedox (OKTA-296058)

  • Moqups (OKTA-297808)

  • MyAryaka (OKTA-285423)

  • Oracle Identity Cloud Service (OKTA-297793)

  • Roadmunk (OKTA-296251)

SWA for the following Okta Verified application

  • Template Frame Plugin App (OKTA-294358)

April 2020

2020.04.0: Monthly Production release began deployment on April 13

* Features may not be available in all Okta Product SKUs.

Content

Generally Available Features

New Features

OAuth authentication for Workplace by Facebook

Workplace by Facebook now uses OAuth authentication instead of the custom Facebook authentication method that was used before.

Note: Existing customers have been migrated to use the new authentication method; new customers will only be able to use the new authentication method (OAuth).

Third-party admin role

Some organizations have a business need to to set up administrator roles in Okta for individuals who perform admin functions but are not direct employees of the organization. By introducing the concept of a third-party admin in Okta, we are able to treat these admins differently than the typical Okta admins who interact directly with the Okta Admin Console.

User Group Reassignments

When a user is moved to a different Okta group, that change is now reflected in Active Directory. See Enable Okta-sourced user Organizational Unit updates.

OAuth for Okta

With OAuth for Okta, you are able to interact with Okta APIs using scoped OAuth 2.0 access tokens. Each access token enables the bearer to perform specific actions on specific Okta endpoints, with that ability controlled by scopes that the access token contains. See OAuth for Okta guide.

Note that at this time, OAuth for Okta works only with the APIs listed in the Scopes & supported endpoints section of our developer docs. We are actively working towards supporting additional APIs. Our goal is to cover all Okta public API endpoints.

Dynamic SAML attribute statements for OIN apps

The Dynamic SAML feature allows admins to add and preview dynamic attribute statements to the SAML Assertion for existing OIN apps. For information how to use the SAML Attribute Statements, see Create SAML app integrations.

Email as a factor for MFA

Email is now an accepted factor for multifactor authentication for convenience and to expedite migration from legacy identity platforms. After setup, your end users receive a code in an email message to use during Okta sign in. For details on setting up this factor, see Multifactor Authentication.

User type support in Okta user profiles

Universal Directory now supports custom user types. You can customize the attributes in up to nine user types.

See About custom user types in Universal Directory.

New developer on-boarding experience

An updated developer on-boarding experience has been rolled out for new development orgs. New signups will be asked a series of questions about their goals and the initial on-boarding tasks will be tailored to match these requirements.

Generally Available Enhancements

Improvements to App Search results

When searching for an integration, the App Catalog results now display the protocol and capabilities alongside the app name, rather than the associated categories. To expand the results, click See All Results.

HealthInsight recommendation for SAML-based apps

A new HealthInsight recommendation now notifies an admin of all existing SAML-based apps that aren't using SAML authentication. See Enable SAML or OIDC authentication for supported apps.

Admin CSV file name updated

The naming format for Administrator CSV files has been updated to contain the report type and the org ID.

Admin role descriptions added

Admin role descriptions have been added to the Add Administrator and Edit Administrator dialog boxes.

Google Push Group enhancement

Google Push Group functionality remains available even when the ability to import groups has been disabled. See About Group Push

Enhanced UI for network zones

The network zones UI has been enhanced to improve readability and flow for IP, location, and ASN data. See Network zones.

New device behavior detection enhancement

The behavior detection of new devices has been updated to re-evaluate certain scenarios where a device fingerprint is missing when users sign in. See Behavior Detection and evaluation.

Additional validation to curtail abuse

For free and paid developer orgs, we have added additional validation to the org name and some user profile fields to curtail abuse.

Early Access Features

Early Access features from this release are now Generally Available.

Fixes

General Fixes

OKTA-128110

When editing an administrator's roles, toggling the Super Administrator check box on and off sometimes caused the UI to mistakenly issue a warning that no roles were selected.

OKTA-262777

New SAML apps had an active SAML assertion Inline Hook assigned to them automatically.

OKTA-267840, OKTA-274937, OKTA-279424, OKTA-279458

Several UI elements contained minor translation errors (Dutch, Korean, French, and Portugese).

OKTA-274995

After an admin enabled and configured SCIM for a wizard app, then disabled SCIM, the UI element to enable SCIM disappeared.

OKTA-275270

When using the Token Preview tool, an access policy was sometimes incorrectly applied for the client credentials flow.

OKTA-278738

In some cases, a SAML assertion incorrectly included extra Attribute Statements.

OKTA-280692

The Update application username field under the Provisioning settings tab didn't render correctly when profile mastering was enabled.

OKTA-281236

The Admin CSV file didn't have the Third-Party Admin column for orgs that have enabled the third-party admin assignment settings.

OKTA-282208, OKTA-286053

Modifying the settings in the Profile and Lifecycle Mastering section of the new import and provisioning settings experience for Active Directory sometimes failed.

OKTA-282798

Error messages concerning SAML Inline Hooks sometimes didn't populate in the System Log.

OKTA-283605

Sometimes when Application Entitlement Policy and Import Sync Callback feature flags were enabled, AD-imported attributes were not updated by mapping.

OKTA-284589

The App Catalog page sometimes did not render properly when the resolution was 1024x768 or lower.

OKTA-284903

Okta internal logging didn't handle valid special characters in the log field, resulting in issues.

OKTA-286144

When Federation Broker Mode was enabled for a SAML app using encryption, attempts to SSO into that app failed with a 400 Bad Request error.

OKTA-286370

Search results for users with invalid profile data due to a schema change incorrectly resulted in a 500 error instead of a 409 conflict error.

OKTA-286419

Add Section and Edit Section Name buttons didn't function properly in the new Okta End-User Dashboard in Internet Explorer 11 and Edge. Dragging application icons functionality didn't work in Internet Explorer 11.

OKTA-286428

Some UI elements were missing from the app settings sidebar in the new Okta End-User Dashboard in Internet Explorer 11 and Edge.

OKTA-287667

The Install the plugin button didn't display consistently in Internet Explorer 11 and Edge.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • Assure Sign (OKTA-284353)

  • AvaTax Admin Console (OKTA-285170)

  • Chase Mastercard (OKTA-284914)

  • Citi Credit Cards (OKTA-285965)

  • Citi Velocity (OKTA-286149)

  • Custom Report Sharing (OKTA-284638)

  • ezeep (OKTA-286381)

  • GoNoodle (OKTA-286382)

  • Meraki Dashboard (OKTA-286379)

  • Monster Hiring (OKTA-285556)

  • MyLexia (OKTA-286148)

  • Pinterest (OKTA-285778)

  • PremiumBeat (OKTA-284402)

  • Sagitta Propel Insurance (OKTA-285845)

  • Secureworks (OKTA-285995)

  • Service Channel (OKTA-286147)

  • Standout M (OKTA-284911)

  • TapInfluence (OKTA-286380)

  • TeamPassword (OKTA-286378)

  • The Business of Fashion (OKTA-280914)

  • Zapier (OKTA-284033)

Applications

New Integrations

New SCIM Integration applications

The following partner-built provisioning integration apps are now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified applications

  • BlogIn (OKTA-284052)

  • DiversityEduLLC (OKTA-284062)

  • Doppler (OKTA-283629)

  • Inspire (OKTA-283636)

  • Lola (OKTA-284376)

  • MyRIACompliance (OKTA-279290)

  • Paylocity Web Pay (OKTA-285418)

  • Psono Password Manager (EE) (OKTA-284898)

  • SurveyGizmo (OKTA-282980)

  • TelemetryTV (OKTA-284380)

SAML for the following Community Created application

  • The Respond Analyst (OKTA-278325)

SWA for the following Okta Verified application

  • Membee (OKTA-268688)

Weekly Updates

April 20

Fixes

General Fixes

OKTA-267519

Several UI elements contained minor translation errors (Dutch and German).

OKTA-277075

Switching back to the old interface from the Okta End-User Dashboard didn't also switch back to the old interface for the Okta Browser Plugin as expected.

OKTA-284391

In some cases, stale data from a removed Beta feature affected the ability to toggle Okta Verify.

OKTA-284861

In some cases, where Office 365 app was configured with SWA SSO, the updated General Settings couldn't be saved.

OKTA-286132

In some cases, when Agentless Desktop SSO state token support was enabled, Agentless Desktop SSO stopped working.

OKTA-288059

When an end user enrolling in Okta Verify clicked scan the barcode again and scanned the code, an incorrect error message appeared instead of signing the user out.

OKTA-289620

In some cases, personal apps were incorrectly counted in SAML-capable apps in the HealthInsight recommendation.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • ADP Run (OKTA-283497)

  • AIA (OKTA-287940)

  • CUES (OKTA-287109)

  • Goldman Sachs Personal Financial Management (OKTA-287106)

  • Greenhouse (OKTA-288627)

  • HelloSign (OKTA-288637)

  • Microsoft Office 365 (OKTA-283156)

  • MyLevel3 (OKTA-287098)

  • MyRouteOnline (OKTA-287112)

  • Olapic (OKTA-288638)

  • RescueAssist (OKTA-287108)

  • Soundcloud (OKTA-287116)

  • Unity Asset Store (OKTA-288616)

  • Wells Fargo Funding (OKTA-286470)

Applications

New Integrations

SAML for the following Okta Verified applications

  • Egencia (OKTA-287065)

  • k6 Cloud (OKTA-278242)

  • LogicGate (OKTA-286401)

  • MongoDB (OKTA-287432)

  • Pastel (OKTA-286360)

  • Splashtop (OKTA-284895)

  • Trelica (OKTA-288973)

SWA for the following Okta Verified applications

  • Aquera (OKTA-287101)

  • Foley (OKTA-286327)

  • Tenable.io (OKTA-287675)

  • TurboTax (OKTA-284883)

May 4

Fixes

General Fixes

OKTA-276722

Users imported from AD with a Staged status weren't automatically activated when they signed in with Just-in-Time provisioning and Interactive Windows Authentication.

OKTA-277814

Some directory logos (Directory > Directory Integrations > LDAP Integrations) didn't appear properly.

OKTA-277999

When all Behavior Detection policies for Adaptive MFA were set to Inactive, and the first rule in the sign-on policy included a risk condition, the first rule was applied without evaluating the risk score.

OKTA-279173

In some cases, when testing a SCIM connection on Okta, Okta returned an authentication error even when the certification was correctly installed on the server and was valid.

OKTA-281485

iPad versions 10 and above identified themselves as macOS devices and caused some Device Trust authentication flows to fail on those devices.

OKTA-281527

When a New Geo-location was enabled in Behavior Detection, some users received MFA prompts each time they signed in, even when they were signing in from the same location.

OKTA-282209

In some cases, the Okta Browser Plugin didn't auto-populate credentials for SWA apps using the basic authentication template.

OKTA-284330

Successful authentication responses didn't contain the sessionToken value when the response contained a state token.

OKTA-285857

When BambooHR SAML authentication was changed from API to OIDC, admins received an error when updating profiles for assigned users.

OKTA-286225

When the Workday Incremental Imports Early Access feature was enabled, incremental imports wrote null values to the uniquely mapped attributes when a user updated a Workday user profile.

OKTA-287647

A performance issue prevented Group Administrators, who manage a large number of groups, from saving additional groups in the Okta Admin Console.

OKTA-290828

Switching to another MFA factor verification sometimes failed if an Okta Verify push was already in progress.

OKTA-294630H

In some circumstances, changing an app's provisioning settings caused custom settings to revert to default values

OKTA-296659H

iPad using iOS 13.1 sometimes did not follow the login flow correctly.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • 1Password Business (OKTA-288555)

  • Adobe Sign Provisioning (OKTA-285816)

  • Cisco AMP for Endpoints (OKTA-289504)

  • Cisco Webex (OKTA-291196)

  • Customer.io (OKTA-290633)

  • Drift (OKTA-290029)

  • GSA EBUY (OKTA-290030)

  • Optimal Workshop (OKTA-290827)

  • Technology Review (OKTA-290023)

Applications

New Integrations

New SCIM Integration applications

The following partner-built provisioning integration apps are now Generally Available in the OIN as partner-built:

  • Okta Advanced Server Access : For configuration information, see Install Advanced Server Access and create a team.
  • Gong: For configuration information, see Provision team members (Okta) (you will need a Gong account to access this guide).

SAML for the following Okta Verified applications

  • Atscale (OKTA-291235)

  • AWS ClientVPN (OKTA-286416)

  • Lenses (OKTA-288610)

  • LIRNProxy (OKTA-289322)

  • Odo (OKTA-290019)

  • OpenAir (OKTA-290021)

  • Qualtrics XM (OKTA-286415)

  • Sobol (OKTA-289289)

  • SurveyGizmo (OKTA-290020)

  • Tradable Bits (OKTA-287954)

  • VNDLY (OKTA-284670)

  • Zenduty (OKTA-287957)

SWA for the following Okta Verified applications

  • Heritage Commercial Online Banking (OKTA-291006)

  • Immigration Connect by Fragomen (OKTA-286317)

Mobile application for use with Okta Mobility Management (OMM) (Android and iOS)

  • Miro (formerly RealtimeBoard) (OKTA-284127)

OIDC for the following Okta Verified applications

March 2020

2020.03.0: Monthly Production release began deployment on March 9

* Features may not be available in all Okta Product SKUs.

Content

Generally Available Features

New Features

Changes to admin permissions

Super admins can no longer edit their own role assignment. The Edit and Delete actions are removed from their profile row on the Administrators page.

Pagination is now available when listing Authorization Servers

Pagination is now available for lists of authorization servers. See API access management.

Custom Email events added to the System Log

Updates to custom email templates are now tracked in the System Log.

Email verification added as optional enrollment factor

If admins configure email verification as an optional MFA factor, end users can select email as a factor during MFA enrollment. To complete enrollment, end users enter the code sent to their primary email address. The verification UI is redesigned.

Sign-in attempt behavior evaluation is logged when there is no client information

Sign-in attempt behavior evaluation is logged in the debugContext object of the user.session.start and policy.evaluate.sign_on events even when client information is missing for all behaviors.

Jira Authenticator, version 3.1.3

This release contains a bug fix for SAML SP-initiated flows, to ensure that all supported URLs redirect to Okta. See Okta Jira Authenticator Version History.

Active Directory improvements

To assist orgs with more than 10,000 Organizational Units (OUs), improvements were made to the User OUs connected to Okta and Group OUs connected to Okta fields on the Active Directory Settings page.

Mobile tab available for mobile-capable apps

The Mobile tab available in the Admin Console for mobile-capable OIN apps allows you to publish mobile applications to an App Store and deploy them to your end users. See Enable access to managed mobile apps.

Deleted admin users

When a user who has an admin role and privileges assigned to them is deleted, their admin privileges are revoked. The deleted user is removed from the Administrators page and CSV download list of administrators. For information about Admin roles, see Administrators.

Generally Available Enhancements

Salesforce integration supports pushing null values

The Salesforce integration supports pushing null values to user profile updates. To enable this functionality, select the Allow Pushing Null Values option on the Provisioning tab.

Veeva Vault integration update

The Veeva Vault integration has a new check box on the Provisioning tab that allows admins to choose whether to use Email instead of Username.

Spotlight search bar changes

The spotlight search bar is no longer visible to Report Admins because they do not have search permissions.

Accessibility enhancement for Okta Sign-in Widget

The Username and Password form fields on the Sign-In page now include the aria-required property. This property is not visible to end users, but indicates to screen readers that these fields are required.

Profile Editor improvements

The Profile Editor page has been improved to simplify navigation and clarify functionality.

Early Access features from this release are now Generally Available.

Fixes

General Fixes

OKTA-267829

App admins were able to modify all profiles in the Profile Editor even when the admin was limited to only administer certain apps.

OKTA-268943

The Okta Admin Console displayed options to delete or deactivate app instances that can't be deleted or deactivated.

OKTA-277589

When the App Catalog feature was enabled, app admins with required permissions received a blank page when they clicked the Add Application button.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • Blanchard Exchange (OKTA-278301)

  • ConnectWise Automate (OKTA-278300)

  • Playbook (OKTA-279423)

Applications

New Integrations

New SCIM Integration Applications

The following partner-built provisioning integration apps are now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified applications

  • Halogen (OKTA-280008)

  • OneDesk (OKTA-276015)

  • Parabol (OKTA-278665)

SWA for the following Okta Verified application

  • Altair Eyewear (OKTA-277992)

Weekly Updates

March 16

Fixes

General Fixes

OKTA-235986

Searches for an app didn't yield any results in the Current Assignments report.

OKTA-259823

Password sync failed for the Org2Org app.

OKTA-263028

A 500 error instead of a 409 conflict error was thrown when searches for users failed due to invalid profile data.

OKTA-264155

In some cases, Event Hook verification failed when using certain Certificate Authorities.

OKTA-269534

Users saw an erroneous error message when they refreshed the page after completing self registration.

OKTA-271407

Admins assigned the App Admin role for selected apps were able to see private apps in the Add Application dialog.

OKTA-277954

For Preview orgs, User OUs and Group OUs failed to load the AD integrations Settings page.

OKTA-278961

Individual Admin Email Notification settings were not overwritten by global settings as expected.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • American Express Online by Concur (OKTA-281727)

  • Calpers (OKTA-281186)

  • Deltek Customer Care Connect (OKTA-281926)

  • Formstack (OKTA-280358)

  • Hippocmms (OKTA-281189)

  • MyFonts (OKTA-279931)

  • New York Magazine (OKTA-280591)

  • Office Vibe (OKTA-281190)

  • SAP Concur Solutions (OKTA-281180)

  • UserTesting (OKTA-280586)

Applications

New Integrations

New SCIM Integration Applications

The following partner-built provisioning integration apps are now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified applications

  • Axonius (OKTA-273528)

  • CrossKnowledge Learning Suite (OKTA-276017)

  • Keeni Operating Procedures (OKTA-279019)

  • Tevora Portal (OKTA-266963)

  • Virtru (OKTA-274953)

SWA for the following Okta Verified applications

  • Fisher Scientific (OKTA-279867)

  • Sagitta (OKTA-276292)

  • Thermofisher (OKTA-280605)

March 23

Fixes

General Fixes

OKTA-257061

Okta to DocuSign Provisioning mistakenly sent the same value for DocuSign attributes Title and JobTitle.

OKTA-263259

When Factor Sequencing was enabled, users that authenticated for the first time were incorrectly prompted for MFA enrollment.

OKTA-266146

Users with fewer than 13 apps were unnecessarily shown the Quick Access Apps page on the new Okta End-User Dashboard.

OKTA-267210

The new Okta End-User Dashboard redundantly displayed the Get the Plugin button.

OKTA-269649

When the meta data cache for an app was invalidated because the app was created or updated, the generated System Log event did not have a description.

OKTA-270685

When users searched for applications that didn't exist in the new Okta End-User Dashboard, the App catalog search result was empty with no message for the user.

OKTA-276950

Deleting pushed app groups in the Service Provider resulted in duplicate groups being created in Okta.

OKTA-277794

In some cases, testing a SCIM connection on Okta resulted in an authentication error.

OKTA-277802

The copyright year listed on the My Apps homepage on the new Okta End-User Dashboard was outdated.

OKTA-277898

After their session expired, end users on the new Okta End-User Dashboard were unable to access their apps instead of being prompted to sign in again.

OKTA-280874

The Edit App button on the new Okta End-User Dashboard was missing an ARIA attribute.

OKTA-282045

When a SWA app was set up with the sign-on policy Administrator sets username, password is the same as user's Okta password, end users that launched the app from the new Okta End-User Dashboard weren't properly redirected to the app sign-in page.

OKTA-282433

When apps were loading on the new Okta End-User Dashboard, end users incorrectly saw an Add apps to launcher message.

OKTA-282527

On the new Okta End-User Dashboard, the Help link in the footer incorrectly redirected to the Technical Contact even when the Help link was provided.

OKTA-283160

The Event Hook user.account.report_suspicious_activity_by_enduser was not visible in the Okta Admin Console UI.

OKTA-283333

Lists containing more than 10 IPs were not truncated in the Networks section in the Okta Admin Console.

OKTA-285079H

WebAuthN factors originally enrolled as U2F failed in some Preview orgs.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • Intercom (OKTA-282204)

  • Zoho Personal (OKTA-282338)

Applications

Application Update

The SolarWinds (formerly SAManage) provisioning app now supports Token Authentication.

Note that SolarWinds will be deprecating username/password authentication support. See SolarWinds Provisioning Guide.

New Integrations

SAML for the following Okta Verified applications

  • Arkphire - Ordering Portal (OKTA-274302)

  • Clock PMS (OKTA-282395)

  • Databook (OKTA-281177)

  • HackEDU (OKTA-281019)

  • Shutterstock (OKTA-278237)

SWA for the following Okta Verified application

  • Department 31 (OKTA-277108)

April 6

Fixes

General Fixes

OKTA-245252

In some cases, the custom domain URL of an org was not honored during certificate-based primary authentication using a Personal Identity Verification (PIV) card.

OKTA-261138

In the new Admin App Catalog, expanding the search results and clicking Show more didn't correctly fetch both public and private apps.

OKTA-273907H

Some users imported from Workday using Real Time Sync were subsequently deactivated in Workday.

OKTA-282600H

Routing rules for Agentless Desktop SSO sometimes failed for OIDC apps.

OKTA-282659

The new App Catalog didn't load properly and displayed a blank page if an App Catalog endpoint was down.

OKTA-282925

In the new Admin App Catalog, the inactive Add button for an app was clickable.

OKTA-284290

The Extra Verification section on the Okta End-User Dashboard > Settings page sometimes displayed Email as a factor even when the end user's policy didn't allow it.

OKTA-284451

The download link for Okta RADIUS Server Agent for Debian (Linux) was missing from the Downloads page for orgs that had the EA agent enabled.

OKTA-286344H

The Windows Autopilot feature did not appear on the Open Betas page in Okta.

App Integration Fixes

The following SWA app was not working correctly and is now fixed

  • MongoDB Cloud Manager (OKTA-282962)

Applications

New Integrations

SAML for the following Okta Verified applications

  • AssetSonar (OKTA-282381)

  • Blissfully (OKTA-280020)

  • Bridgecrew (OKTA-283634)

  • Planhat (OKTA-279291)

  • Reprise (OKTA-281179)

SWA for the following Okta Verified applications

  • 1Password (OKTA-274741)

  • Saba TalentSpace (OKTA-283095)

February 2020

2020.02.0: Monthly Production release began deployment on February 18

* Features may not be available in all Okta Product SKUs.

Content

Generally Available Features

New Features

Active Directory, new import and provisioning settings experience

The AD settings user interface had been updated. It is now more consistent with how other application settings are configured. All orgs will now use the Okta expression language for the Okta username format field.

If your org was created before October 4th (Preview) or October 9th, 2017 (Production), a legacy expression language that is different than the Okta expression language was used for the Okta username format field. See Manage your Active Directory integration and Manage profile and attribute sourcing.

This feature will be gradually made available to all orgs.

Enhanced provisioning for Office 365

With additional enhancements to Microsoft Office 365 integration admins can now synchronize identities from on-premises to cloud-based Office 365, provision a user profile that is extended further to include over 100 attributes, as well as synchronize distribution groups, contacts, and resources such as conference rooms.

Admins can also manage user licenses and roles, independent of other provisioning flows. The new provisioning type for Office 365, License/Roles Management Only, allows admins to manage user license assignment and role delegation for existing Office 365 users and for users provisioned to Office 365 with third-party tools. For more details, see Okta Enhancements with Microsoft Office 365 Integration.

Password Import Inline Hook

The Password Import Inline Hook lets you interface with an external service to verify a user-supplied password when the user signs in to Okta for the first time. This supports scenarios in which users are migrated from an existing user store while allowing them to retain their passwords.

See Inline hooks

SAML Assertion Inline Hook now supports URI formatting in claims

Okta now supports URI claims with SAML assertion hooks. When you need to replace or add a URI claim, you must encode the claim name within the command based on the JavaScript Object Notation (JSON) Pointer specification. Specifically, this replaces ~ with ~0 and / with ~1.

See Inline hooks

Changes to admin permissions

Only super admins and org admins can edit their org's custom domain settings.

OAuth for Okta Enabled for Policy API

The Policy API now has OAuth for Okta enabled.

Sign-in widget error messaging

The error message Unable to sign in is now displayed if authentication fails when signing in to Okta.

Provisioning Capable Apps report

The Provisioning Capable Apps report contains data about available apps for orgs that can have provisioning enabled.

See Monitoring and reports

Okta Browser Plugin, version 5.37.0 for all browsers

This version includes:

  • New user experience for the plugin (available as an EA feature), see End-user experience
  • Fix for re-authentication modal getting stuck in some browsers
  • Fix for the Firefox download link in the Okta Admin Console > Downloads page
  • For Internet Explorer installer, the name Okta Secure Web Authentication Plugin changed to Okta Browser Plugin
  • Back-end enhancements

See Okta Browser Plugin version history

Get User API Support for sort parameters

The Get User API now supports sortBy and sortOrder parameters.

New System Log event for user type changes

A new System Log event is added when the user type for an end user changes.

Send Device Context using Limited Access

Limited Access allows you to configure Okta to pass device context to certain SAML apps through the SAML assertion during app authentication. The app uses this data to limit access to certain app-specific behaviors. For more information, see Pass Device Context using Limited Access.

Enhancements to identify user addition and removal status and improve performance

The addition or removal of users from a group now runs as a background task. During the process, the Manage People button is inactive and a notification appears to indicate the progress of the request. For more information, see About group rules.

Enhancements to identify org user deactivation status and improve performance

Org user deactivation now runs as a background task. Notifications have been added to indicate request progress and successful request completion. See Activate user accounts and Deactivate and delete user accounts.

Early Access Features

Early Access features from this release are now Generally Available.

Fixes

General Fixes

OKTA-193648

A user inadvertently retained access to an admin app when the only group/app assigned to the user was deleted.

OKTA-251904

Attributes with null or blank values were not updated to RingCentral.

OKTA-259534

When a user was locked out due to multiple failed password attempts, the UI incorrectly showed the following error message: Your account was locked due to excessive MFA attempts.

OKTA-260403

When an end user set their preferred language to Spanish, email notifications in English that were sent to the user contained a typo.

OKTA-263494

When using the SAML Assertion Inline Hook, if there was an optional attribute statement configured for the app and the attribute statement had no value specified, commands returned from SAML Inline Hook responses were not applied.

OKTA-268604

When using a custom domain, the PIV button look and feel was inconsistent on the sign-in page.

OKTA-269675

When batch imports were enabled, group memberships were sometimes not handled correctly.

OKTA-272601

Deleted OIDC App Instances still showed up as inactive in database.

App Integration Fixes

The following SAML apps were not working correctly and are now fixed

  • Qualys Guard (OKTA-270318)

  • Sage Intacct (OKTA-268392)

  • Socialbakers (OKTA-273050)

The following SWA apps were not working correctly and are now fixed

  • Adobe (OKTA-272864)

  • Adobe Creative (OKTA-272880)

  • Adobe Enterprise (OKTA-272879)

  • Apple Business Manager (OKTA-264263)

  • connectwise_automate (OKTA-272812)

  • Iola (OKTA-272811)

  • Statuspage (OKTA-272865)

Applications

Application Updates

Provisioning support has been removed from the Crashplanpro, Bloomfire, and Confluence apps due to their low customer usage, lack of standards based integration, and high supportability cost.

New Integrations

New SCIM Integration Applications

The following partner-built provisioning integration apps are now Generally Available in the OIN as partner-built:

Note: The following apps were previously released as Early Access, but as part of our process changes the apps have now been updated and released as Generally Available, Okta Verified.

SAML for the following Okta Verified applications

  • activpayroll - activ8 (OKTA-271002)

  • Nethris (OKTA-266636)

  • Octarine (OKTA-272822)

  • Openpath Security (OKTA-272571)

  • Reachdesk (OKTA-272823)

  • Rescana (OKTA-270985)

SWA for the following Okta Verified application

  • Aquera (OKTA-272801)

Weekly Updates

February 24

Fixes

General Fixes

OKTA-275403

The System Log Advanced Search feature incorrectly listed the least common fields, rather than the most common fields, in the results.

OKTA-243812

The link text for the SolarWinds Service Desk app configuration documentation was wrong.

OKTA-250348

The .self scopes were displayed for Service clients on the Okta API Scopes page, despite the clients not having a user context.

OKTA-255236

MFA Enroll and MFA Reset emails in foreign languages contained an untranslated word.

OKTA-255878

The German translation on the Email Preview page contained incorrect capitalization.

OKTA-258904

The Dutch translation for the Phone Call factor contained a typo.

OKTA-260542

When deleting the SSPR factor on the Okta End-User Dashboard, Internet Explorer and Edge displayed a transparent window.

OKTA-266380

Import inline hooks was incorrectly triggered multiple times for the same user.

OKTA-267851

The WebAuthn(FIDO2) MFA enrollment prompt page did not support translation.

OKTA-268306

Expired AD users received different authentication errors depending on whether the Passwordless Policy was enabled or disabled.

OKTA-272891

Office 365 metadata in the /mex endpoint contained an unsupported URL that caused Single Sign-On to occassionally fail on Microsoft Dynamics CRM.

OKTA-273352

Authentication API returned a 500 error message instead of a 400 error message when the request was submitted in a SUCCESS state.

OKTA-274852

The name Import inline hook was not updated to reflect the current UI. It is now renamed as User import inline hook.

OKTA-275331

In certain SP-intiated flows, users were repeatedly prompted for credentials when ForceAuthN was requested.

OKTA-276093

When an admin's last role was revoked using the Roles API, it sometimes did not trigger a System Log event.

OKTA-276168

The autocomplete results for the field debugContext.debugData.url in the System Log Advanced Search feature affected performance and were removed. This field is still usable for queries in the System Log UI and in the Logs API.

OKTA-277609

Chromium-Edge new users who had not installed the Okta Browser plugin were displayed a banner stating that the plugin was required but the browser was unsupported.

App Integration Fixes

The following SAML app was not working correctly and is now fixed

  • RightScale (OKTA-274507)

The following SWA apps were not working correctly and are now fixed

  • Apple Search Ads (OKTA-276421)

  • Brex (OKTA-276715)

  • Brex (OKTA-274478)

  • Cisco WebEx Meeting Center (OKTA-270559)

  • Director's Desk (OKTA-275986)

  • Discovery Benefits (OKTA-274220)

  • Innovative (OKTA-274248)

  • RIMS (OKTA-275987)

  • Rubicon Project (OKTA-275990)

  • Safeco (OKTA-275248)

  • Spotlight Reporting (OKTA-275991)

  • Squarespace V5 (OKTA-277555)

  • The Economist (OKTA-274254)

  • Twitter Developer (OKTA-277553)

  • Webtrends Analytics (OKTA-275988)

  • Zions Bank (OKTA-277344)

  • Zoho CRM (OKTA-274715)

Applications

New Integrations

New SCIM Integration Application

The following partner-built provisioning integration apps is now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified applications

  • Folloze (OKTA-272837)

  • Orca Security (OKTA-273918)

  • Ovio Explore (OKTA-274954)

  • Percy (OKTA-275268)

  • Topbox.io (OKTA-274250)

  • Zoho Directory (OKTA-272820)

SWA for the following Okta Verified applications

  • AccessVA ID.me (OKTA-276941)

  • AssetWorks FleetFocus (OKTA-277749)

  • Brainerd Dispatch (OKTA-274549)

  • Colorado Springs Employee Self Service (OKTA-269168)

  • Elimity (OKTA-276935)

  • IBM Sterling File Gateway (OKTA-275226)

  • PSI True Talent (OKTA-277332)

Mobile application for use with Okta Mobility Management (OMM) (Android and iOS)

  • Kisi Physical Security (OKTA-276272)

OIDC for the following Okta Verified application

March 2

Fixes

General Fixes

OKTA-255792

Email notifications for MFA factor resets displayed no location if there was no geo-location information available for the event.

OKTA-258881

When the Factor Sequencing EA feature was enabled, some users were incorrectly switched to a new factor chain after verifying the first factor of the default factor chain.

OKTA-264155

Event Hook verification failed in some cases when using certain HTTPS certificate authorities.

OKTA-274239

Certificates that contained wildcards in CN or SAN were wrongfully considered valid for subdomain.domain.com when they were issued for *.subdomain.domain.com.

OKTA-275890

When a customer configured a dynamic attribute for an OIN SAML 2.0 app, and then Okta added an attribute with the same name to that app, both attributes were sent in the SAML assertion. The assertion should have contained the customer's dynamic attribute only.

OKTA-275981

The Russian translation for set up was incorrect in the Extra Verification settings section of the end-user dashboard.

OKTA-277702

In some cases, the IP Address field for security events was not properly populated in the System Log.

OKTA-278773

If a sign-in did not have a device fingerprint it was not treated as a new device sign-in by the behavior policy rule for new device.

OKTA-280084

Users of free and developer editions of Okta could create and send customized email templates as an Automation action.

OKTA-280571

Testing API Credentials failed when adding additional child accounts to Connected Accounts IDs (optional) in AWS -Multiple instances.

OKTA-281195H

The Max Import Unassignment setting for some integrations could not be edited.

OKTA-281501H

The Import Safeguard Percentage setting from the AD integrations UI could not be edited.

App Integration Fixes

The following SAML apps were not working correctly and are now fixed

  • G Suite (OKTA-277619)

  • Mimeo (OKTA-268673)

The following SWA apps were not working correctly and are now fixed

  • Abstract (OKTA-278327)

  • Adobe Sign Provisioning (OKTA-275000)

  • Dell Boomi (OKTA-278299)

  • GatherContent (OKTA-278914)

  • Instacart (OKTA-277552)

  • Kenshoo (OKTA-277701)

  • MURAL (OKTA-278294)

  • ReverseRisk (OKTA-277977)

  • Roadmunk (OKTA-278298)

  • SharpSprings (OKTA-277613)

  • Society of Actuaries (OKTA-278302)

  • Woobox (OKTA-278292)

  • Wrike (OKTA-278293)

Applications

New Integrations

SAML for the following Okta Verified applications

  • Logikcull (OKTA-276909)

  • Odo (OKTA-277131)

  • Terranova Security Awareness Platform (OKTA-277333)

  • Zoomifier (OKTA-274951)

SWA for the following Okta Verified applications

  • AIB (OKTA-277420)

  • Nave Jira (OKTA-276706)

  • Titlesdesk (OKTA-277420)

January 2020

2020.01.0: Monthly Production release began deployment on January 13

* Features may not be available in all Okta Product SKUs.

Content

Generally Available Features

New Features

Okta Browser Plugin version 5.36.1 for Chromium-based Microsoft Edge and Mozilla Firefox

This version includes the following:

For version history, see Okta Browser Plugin version history

New System Log event for Grant User Privilege

The Grant User Privilege System Log event now logs activity for each user in a group when an Admin role is assigned to the group.

New System Log events for OIDC scope grants

System Log events are now triggered when an administrator grants consent for OpenID Connect scopes.

Rogue Accounts Report End of Life (EOL)

The Rogue Accounts Report feature has been removed due to low usage, high cost of maintenance, and the availability of custom solutions. For example, admins can retrieve similar data by using the List Users Assigned to Application API to see users who were assigned to an app in Okta, and then using custom code to generate a list of users assigned in the app itself. For more information, see this Support Article.

Federate multiple Office 365 domains in a single app instance

You can automatically federate multiple Microsoft Office 365 domains within a single Office 365 app instance in Okta. This eliminates the need to configure a separate Office 365 app instance for each Office 365 domain. This feature will be slowly made available to all orgs. For more information, see Federate multiple Office 365 domains in a single app instance.

Support for Salesforce Government Cloud

You can create instances of the Salesforce app that can integrate with Salesforce Government Cloud. For more details, see the Salesforce Provisioning Guide.

Box integration enhancement

The Box integration is enabled for Universal Directory and is enhanced by the following additional properties in the User Profile:

  • firstName
  • lastName
  • timezone
  • language
  • space_amount (RO)
  • max_upload_size (RO)
  • job_title
  • phone
  • address
  • avatar_url (RO)
  • groups
  • space_used (RO)

See the Box Provisioning Guide for more information.

Resumable Import

Resumable Import is a performance enhancement that prevents imports from starting over in the event of a deployment or infrastructure issue. Instead, the import automatically pauses and continues from the most recently completed step. For information on importing users, see Import users.

HealthInsight

HealthInsight audits an organization’s security settings and suggests recommended tasks to improve an org's security posture. Security tasks and recommendations are intended for admins who manage employee security within their organization.

HealthInsight may now be accessed directly from the Admin Console dashboard.

Fore more information, see HealthInsight.

App Catalog Search Improvements

The enhanced Okta Integration Network (OIN) App Catalog now features:

  • A new incremental search and an improved search results preview
  • Expanded search capabilities to check app integration names, descriptions, or categories
  • Fuzzy search logic to match partial hits and name variations
  • Tiles highlight the protocols supported by the app integration

This feature will be gradually made available to all orgs.

Generally Available Enhancements

UI Enhancements for HealthInsight

The HealthInsight card on the Admin Console dashboard and HealthInsight actions have been updated for improved usability. For more information about HealthInsight, see HealthInsight.

Additional context in MFA authentication in some apps

We have added an additional target element containing application information to MFA events triggered by authentication to Epic Hyperspace EPCS (MFA) and Microsoft RDP (MFA) apps.

Improved text in single line challenge for RADIUS MFA

The text displayed during the a single line MFA challenge via RADIUS authentication has been improved to fixed grammatical errors.

Notification when adding a user to an Admin group

Admins now see a notification that admin privileges will be granted when adding a user to a group with Admin privileges.

Updated Privacy Policy

Okta has updated its Privacy Policy. See https://okta.com/privacy-policy/ to review the latest version.

Condition update for MFA Enrollment policy rules

The name of the setting for the Any Application condition has been updated to specify app support for MFA Enrollment. For more information, see App condition for MFA enrollment policies.

UI enhancements for profile and attribute selection

The appearance of profile and attribute selection elements is updated to be more consistent with other Okta select elements.

Toggle on/off the end user onboarding screen

In the Settings > Appearance settings in the Admin Console, admins can control whether or not new end users see the onboarding screen upon their first sign in to the Okta End User dashboard.

This release doesn't have any Early Access features.

Fixes

General Fixes

OKTA-243820

The word Password was incorrectly translated in Dutch.

OKTA-246764

French translation for the Self-Service Unlock when Account is not Locked email template was not intuitive.

OKTA-253397

Microsoft RDP (MFA) prompts did not display the official Okta logo.

OKTA-257479

After an application was selected from the Okta Safari plugin toolbar menu, the selection window did not close as expected.

OKTA-259962

Searching for an app in App Administration Assignment did not display exact matches.

OKTA-262560

Fido 2.0 (Webauth) set as a secondary factor on Factor Sequencing failed on the user sign-in with the error We found some errors. Please review the form and make corrections.

OKTA-262649

In Okta Device Trust with VMware Workspace ONE implementations, app sign-on policy denied access on Android 10 even if the device was trusted.

OKTA-266237

App Admins who were configured to only see a subset of apps in the catalog were able to see all apps.

OKTA-267712

When creating a SAML integration using the AIW, the instructions contained the outdated acronym OAN instead of the current OIN (Okta Integration Network) acronym.

OKTA-268637

For orgs that had opted into the New Import and Provisioning Settings Experience for Active Directory EA feature, placeholder text was displayed instead of the correct text in the warning dialogue when the Profile and Lifecycle Mastering checkbox under Active Directory provisioning settings was checked and the Update Users checkbox was previously enabled.

OKTA-268720

The Settings tab for app provisioning failed to render in Internet Explorer 11.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • Aha (OKTA-266200)

  • American Express Work Reconciliation (OKTA-266198)

  • Apple ID (OKTA-264195)

  • Aveda (OKTA-266196)

  • Blackbaudhost Citrix (OKTA-266199)

  • Bloomfire (OKTA-266193)

  • Brex (OKTA-266241)

  • Cisco WebEx Meeting Center (OKTA-262750)

  • Citrix RightSignature (OKTA-268537)

  • DoorDash (OKTA-268780)

  • Firefox (OKTA-266201)

  • FullContact Developer Portal (OKTA-268538)

  • Google Analytics (OKTA-266914)

  • Impraise (OKTA-268534)

  • MKB Brandstof (OKTA-267534)

  • Nest (OKTA-267942)

  • NewEgg Business (OKTA-268840)

  • OnePath Advisor (OKTA-266925)

  • Principal Financial Personal (OKTA-268782)

  • RescueTime (OKTA-266197)

  • Rhino3d (OKTA-268531)

  • Seek (AU) - Employer (OKTA-266703)

  • Shipwire (OKTA-266919)

  • Site24x7 (OKTA-268622)

  • Vindicia (OKTA-266192)

  • Wombat Security Awareness (OKTA-268532)

The following SAML app was not working correctly and is now fixed

  • Datadog (OKTA-267430)

Applications

Application Updates

  • Zoom provisioning application now supports updating user email addresses.
  • Citrix NetScaler Gateway has changed its name to Citrix Gateway.

New Integrations

New SCIM Integration Application

The following partner-built provisioning integration apps are now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified applications

  • AppOmni (OKTA-266642)

  • Appsian Security Platform for PeopleSoft (Encrypted) (OKTA-265400)

  • Clinical Maestro (OKTA-264130)

  • Cmd (OKTA-266400)

  • Freshworks (OKTA-262038)

  • Grammarly (OKTA-266950)

  • Kisi Physical Security (OKTA-265701)

  • LoanBuddy (OKTA-266952)

  • Mode Analytics (OKTA-260404)

  • Reducer (OKTA-265134)

  • TeamzSkill (OKTA-265665)

SWA for the following Okta Verified application

  • Miniter (OKTA-262048)

Weekly Updates

January 21

Fixes

General Fixes

OKTA-172858

Help Desk and User admins could see the System Log page although it did not contain any events.

OKTA-239389

The Radius agent rpm uninstall command did not remove the .pid file.

OKTA-260178

Group rules that included a custom attribute based on a class name resulted in an Error in evaluating expression error.

OKTA-262628

A non-descriptive validation error was displayed when providing a non-unique value for a unique attribute during self-service registration. The error message now shows an appropriate message.

OKTA-265119

Profile Updates and User Deprovisioning did not run sequentially, which sometimes resulted in errors.

OKTA-265977

New users who tried to create an account received a 400 error when federating into applications such as Office 365.

OKTA-266061

The warning for Custom SMS stated that custom messages were limited to 160 characters instead of 159 characters.

OKTA-267419

For orgs with the latest App Catalog Search enabled, admins using Internet Explorer 11 who searched for an app to add were not redirected correctly to add applications.

OKTA-269174

The Chromium Edge Plugin store link was missing from the Downloads page in the Admin Console.

OKTA-270440H

Signing in from status.okta.com hung on the interstitial page.

OKTA-270581H

Attempts to access the HealthInsight section returned a 500 error.

App Integration Fixes

The following SAML app was not working correctly and is now fixed

  • Salesforce Marketing Cloud (OKTA-231271)

The following SWA apps were not working correctly and are now fixed

  • Guardian Insurance (OKTA-256039)

  • ARIN (OKTA-267889)

  • WealthEngine (OKTA-269191)

Applications

New Integrations

New SCIM Integration Application

The following partner-built provisioning integration app is now Generally Available in the OIN as partner-built:

February 03

Fixes

General Fixes

OKTA-252831

During PIV sign on, the error message for missing and invalid certificates did not instruct the user to close their browser before continuing, resulting in an error.

OKTA-253461

Attempts to use On-Prem MFA as an Authentication Method failed with a NullPointerException error.

OKTA-256707

When G-Suite is configured as Profile Master, custom attributes were not updated or imported from G-Suite apps to Okta.

OKTA-258610

Routing rules were incorrectly implemented for Chrome OS devices.

OKTA-259379

A non-existent Devices attribute for the Okta profile was displayed in the profile for Okta-mastered users.

OKTA-259826

Some users who had two sessions for the same authentication factor could become stuck in an infinite loop when they clicked the Edit Profile button on the end user dashboard.

OKTA-261365

When using Okta Verify and the LDAP Interface for authentication, rate limits sometimes caused OpenVPN account lockouts.

OKTA-261852

In specific use-cases, application-level MFA was not enforced for OIDC applications.

OKTA-262294

App assignment tasks for missing app username with AD SAM account name as the app username format were not updated after the AD SAM account name was defined for the user.

OKTA-262345

In the passwordless flow, AD users whose passwords were about to expire were not prompted to change or skip their passwords.

OKTA-262942

Okta Mobile on iOS devices that had never enrolled in the secure device mode received a session expired error after entering MFA.

OKTA-264570

A grant group privilege event was not logged when an admin role was assigned to a group of users.

OKTA-266432

The Okta Widget on the ADFS page generated a double scrolling bar when there were multiple factors available to enroll.

OKTA-267282

The browser name Chrome was logged in the System Log for newer versions of Edge.

OKTA-267492

In some cases, OAuth Clients erroneously displayed User Consent settings.

OKTA-268277

System Log events were logged for revoking user roles even when the deleted user was not assigned those roles.

OKTA-269153

SolarWinds Service Desk app API attribute mapping was sending incorrect values to Okta.

OKTA-269885

Sometimes the Self Service Registration form did not correctly display required custom properties.

OKTA-270752

When a user signs on using a PIV/CAC card, the IdP-based session timeout criteria were not applied.

OKTA-270835

Office 365 Admin Consent Flow did not respond after an admin clicked Accept.

OKTA-272110

A role to group assignment event was not logged.

OKTA-77623

The bar chart for Count of events per target displayed bars for null/unknown targets.

App Integration Fixes

The following SAML app was not working correctly and is now fixed

  • OpenAir (OKTA-267934)

The following SWA apps were not working correctly and are now fixed

  • Atlassian Jira Service Desk (OKTA-271831)

  • BPF Schilders Dolphijn (OKTA-253876)

  • Concur (OKTA-266431)

  • Hilti (OKTA-251935)

  • MongoDB Cloud Manager (OKTA-272327)

  • ReadyRefresh (OKTA-270892)

  • Vonage Business (OKTA-271832)

  • Wrike (OKTA-259989)

Applications

New Integrations

New SCIM integration applications

The following partner-built provisioning integration apps are now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified applications

  • BoardBookit (OKTA-270961)

  • BoardBookit Admin (OKTA-270960)

  • LogSnitch (OKTA-268634)

  • Pipedrive (OKTA-268053)

  • WEDO (OKTA-270937)

SWA for the following Okta Verified applications

  • Adesa CA (OKTA-265308)

  • Adobe (OKTA-272918)

  • Anyone Home CRM Outlook Login (OKTA-265223)

  • Bonusly (OKTA-269382)

  • CloudManager (OKTA-264840)

  • Collaboration Center (OKTA-261989)

  • ETQ Reliance (OKTA-263913)

  • Financial Accounting Support Tool (OKTA-249634)

  • Google Domains (OKTA-265048)

  • Google My Maps (OKTA-262690)

  • i-Ready (OKTA-265367)

  • New Hampshire MMIS Health Enterprise Portal (OKTA-270196)

  • NordVPN Teams (OKTA-267518)

  • USAC Applicant Login (OKTA-267402)

Mobile applications for use with Okta Mobility Management (OMM) (Android and iOS)

  • Envi MMIS (OKTA-264922)

  • Envoy (OKTA-264995

Mobile application for use with Okta Mobility Management (OMM) (iOS)

  • LiquidText (OKTA-267860)