Okta Identity Governance release notes

Generally Available features

Certify resource collections - Resource campaigns is Generally Available in Preview environments

Use access certification resource campaigns to certify user access to resource collections. Rather than reviewing individual apps, entitlements, or bundles separately, running resource campaigns for resource collections helps you reduce the volume of review items for reviewers and provide them with the necessary context to make informed decisions. See Create resource campaigns.

Certify resource collections - User campaigns is Generally Available in Preview environments

Run access certification identity campaigns (previously called user campaigns) to certify user access to resource collections. Running identity campaigns that include collections helps you reduce the volume of review items for reviewers and accelerate campaign completion. Using the Contextual Information settings, you can also provide reviewers with the necessary context to help them make informed and more accurate decisions. See Create identity campaigns.

Unified requester experience is Generally Available in Preview environments

Use this feature to create a consistent and unified experience for initiating requests in End-User Dashboard, Slack, and Microsoft Teams regardless of whether the request is managed by conditions or request types. This gives you the flexibility to use either or both methods together to manage resource access without altering the requester experience.

• Request types now appear as tiles in the End-User Dashboard resource catalog alongside other resources. Your settings for a request type audience continue to govern which users can view the request type on their dashboard and request access.

• In Slack and Microsoft Teams, users can now request access to resources that are governed by access request conditions, and the user experience for requesting resources that are managed by request types has also been changed.

Additionally, in the Okta Access Requests app, the Access requests page has been renamed to Resource catalog. Selecting it redirects requesters to the resource catalog on the End-User Dashboard. The Request types section in the web app is only visible to admins and team members who own the request type. See Create requests.

Stage certification campaigns before launch is Generally Available in Preview environments

Staging a campaign lets you preview target users, resources, and reviewer assignments in advance to ensure accurate scope, fix configuration errors, and guarantee that requests reach the correct reviewers from day one. See Stage a campaign.

Convert users from custom to policy without access changes is Generally Available in Production environments

Users can now be converted from custom entitlement and bundle assignments to policy while keeping their existing entitlements. See Manage user entitlements.

Campaign notifications frequency

You can now configure reminders for reviewers on up to three separate days before the review period of a campaign ends. Sending reminders on multiple days helps increase the number of reviews completed before the campaign closes.

Access Request email notification settings

You can now turn off Access Request email notifications at the org level. This is useful for orgs that want to build their own custom-branded email notification instead of using the default Okta emails.

Early Access features

Separation of duties for groups

Use separation of duties (SOD) rules to define which combinations of groups within an app (assignment or push groups) create conflicts of interest in an org. Divide tasks and responsibilities using these rules so that the same user in an org doesn't have control over all aspects of a critical process. You can configure SOD rules to help reduce the risk of error, fraud, or unauthorized actions.

With SOD rules, you can adopt a two-pronged approach to manage conflicting group and push group assignments: preventative and remediative.

Use Access Requests to specify whether users are allowed (or allowed with custom settings) or blocked from requesting access that can cause an SOD rule conflict. You can also run the Past Access Requests (Conditions) report to view access requests that have an SOD rule conflict using the Conflict name column.

Use Access Certifications to review and remediate existing user access if they have an SOD rule conflict by running a resource campaign.

In addition, SOD conflict information is also available when you run any of the Separation of duties, Past campaign details, or Past Access Requests (Conditions) reports.

See Separation of duties.

This is an Early Access release. See Enable self-service features.

Fixes

• Sometimes you received the campaign launch validation emails after the campaign staging email notifications, which may have led to campaigns failing to launch. (OKTA-1247953)