Okta Classic Engine release notes (Production)

Version: 2025.03.0

March 2025

Generally Available

Sign-In Widget, version 7.28.3 and 7.29.0

For details about this release, see the Sign-In Widget Release Notes.

For more information about the Widget, see the Okta Sign-In Widget Guide.

Okta MFA Credential Provider for Windows, version 1.4.3

This version includes bug fixes and security enhancements. See Okta MFA Credential Provider for Windows version history.

Okta LDAP agent, version 5.23.0

This version of the agent includes security enhancements.

Updated Japanese translations

The Admin Dashboard, Administrator pages, and Admin Console search now provide updated Japanese translations.

Improved group search functionality

You can now search for groups whose names or descriptions contain specified text. This makes it easier to find a group when you don't recall its exact name.

Improved user search functionality

You can now search for users whose names, email addresses, or usernames contain specified text, making it easier to do user lookups and add users to groups.

Identity Security Posture Management functionality in the OIN catalog

The Okta Integration Network page now provides Identity Security Posture Management functionality. When you select it, the OIN catalog displays only the apps with Identity Security Posture Management functionality.

Realms for Workforce

Realms allow you to unlock greater flexibility in managing and delegating the management of your distinct user populations within a single Okta org. See Manage realms.

Granular account linking for certain identity providers is GA

When admins link users from SAML and OIDC identity providers, they can now exclude specific users and admins. This improves security by allowing admins to configure granular access control scenarios. See Add a SAML Identity Provider.

OIDC identity providers now support group sync

OpenID Connect identity providers (IdPs) now support full group sync and adding a user to a group that they don't already belong to. A user who authenticates with an external IdP is added to all available groups when Full sync of groups is enabled. The user is added to any groups that they don't already belong to when Add user to missing groups is enabled. This allows you to specify certain groups that users should be added to. See Generic OpenID Connect.

Entitlement management for Microsoft Office 365

The Microsoft Office 365 app now supports entitlement management. See Apps with entitlement support

Early Access

Entitlement support for disconnected apps

Disconnected apps are apps that aren't LCM integrated within Okta. This feature allows you to use CSV files to import users and entitlements into Okta from disconnected apps. This enables consistent governance and compliance across all apps, including those not fully integrated with Okta. See Import user entitlements from CSV.

New look and feel in the Admin Console

The Admin Console now provides a new look and feel, including redesigned side and top navigation menus and the addition of a gray background.

Bypass ASN binding with the Default Exempt IP Zone

The ASN binding feature associates admins with the IP address that they signed in from. If the IP changes during a session, the admin is signed out of Okta, and an event appears in the System Log. To bypass IP and ASN binding, you can add the client IP to the Default Exempt IP Zone. See IP exempt zone.

App Switcher for Okta first-party apps

The End-User Dashboard, Admin Console, and Workflows Console now have an App Switcher that helps admins quickly navigate between their assigned Okta apps. Note that you must enable the Unified look and feel for Okta Admin Console and Unified look and feel for Okta Dashboard Early Access features for the App Switcher to appear.

New look and feel in the End-User Dashboard

The End-User Dashboard now provides a new look and feel, including redesigned side and top navigation menus and the addition of a gray background.

New System Log event

The policy.evaluate_sign_on event has a new DebugData item: IdpVerifiedFactorMode. This new item indicates whether a user authenticated with one or two factors with their identity provider when they signed in through a service provider. See System Log.

Enhancement to a System Log event

The IdpVerifiedFactorMode item has been added to the policy.evaluate_sign_on event. It appears when claims sharing is enabled in the org and indicates whether the identity provider verified the user's authentication factors. See System Log.

New attributes in Universal Sync

The following attributes are now supported in Universal Sync: AuthOrig, DLMemRejectPerms, DLMemSubmitPerms, and UnauthOrig.

Okta-to-Okta claims sharing enhancement

Okta-to-Okta claims sharing now supports the use of the smart card authenticator and Active Directory for Single Sign-On. This removes the need for users to authenticate with a service provider when they've already authenticated to an Okta org. See Add a SAML Identity Provider.

Fixes

  • Some certificates with trailing characters were uploaded successfully despite their invalid format. (OKTA-486406)

  • The consent buttons for the Office 365 and Office 365 GCC High apps didn't render correctly. (OKTA-488281)

  • The Microsoft Office 365 Government - GCC High app integration didn't have the correct metadata tags. (OKTA-509443)

  • Users weren't automatically confirmed when the inline hook updated conflicting appuser values during import. (OKTA-792372)

  • An invalid authentication error sometimes occurred when an admin assigned users to the ShareFile app. (OKTA-850064)

  • Emails intended for an unverified primary or secondary email were dropped when the Audience setting for the template was Admin only. (OKTA-852156)

  • When the Send all admin emails as BCC notification setting was selected, all email recipients were sent to the To field instead of the BCC field for protected actions. (OKTA-856627)

  • Some pages in the End-User Dashboard had a typo in the footer. (OKTA-877065)

  • The Entitlement SAML Assertions and OIDC Claims feature wasn't available in the Settings Features menu for some customers. (OKTA-880967)

  • An error occurred in the Okta Provisioning Agent when trying to import users from on-premises apps through CSV files. (OKTA-880996)

  • Access requests for admin role bundles weren't processed properly. (OKTA-892613)

Okta Integration Network

  • Better Stack (SCIM) is now available. Learn more.
  • Employment Hero by Aquera (SCIM) is now available. Learn more.
  • Harriet (OIDC) is now available. Learn more.
  • Harriet (SCIM) is now available. Learn more.
  • HYCU R-Cloud (OIDC) is now available. Learn more.
  • Kyriba By Aquera (SCIM) is now available. Learn more.
  • MySQL by Aquera (SCIM) is now available. Learn more.
  • ZAMP (SCIM) is now available. Learn more.
  • Zoom (SAML) has updated endpoints.

Weekly Updates

2025.3.1: Update 1 started deployment on March 17

Generally Available

Sign-in Widget 7.18 for Same-Device Enrollment

If you use the Same-Device Enrollment feature in your org, the Sign-In Widget version must be 7.18 or later.

Fixes

  • createdBy and lastUpdatedBy custom attributes couldn't be used in group rules. (OKTA-566492)

  • Some issues occurred during the creation of Devices Assurance settings. (OKTA-603807)

  • Custom admins who were limited to viewing only application group members received incomplete results when using the List All Users API without a search or filter. (OKTA-801592)

  • In some orgs, unnecessary writebacks were made to Workday when a sync was performed from Okta. (OKTA-817160)

  • Users who were excluded from a group rule were displayed incorrectly in the Admin Console. (OKTA-838039)

  • The System Log displayed two usernames in the user.authentication.auth_via_social event when a user signed in to Okta with an identity provider in the same browser as a user who was already signed in. (OKTA-842179)

  • Users authenticating to Microsoft Office 365 on macOS were matched to a rule with a Modern Authentication condition only when using the Edge browser. (OKTA-847605)

  • Admins who were assigned the super admin role through group assignments couldn't run password hash exports or view the reports. (OKTA-851991)

  • The MFA enrollment by user report displayed inaccurate figures for the security question factor. (OKTA-858427)

  • Admins didn't receive the correct notifications when they had both role and admin email notifications selected. (OKTA-876846)

  • When the Unified look and feel for Okta Admin Console feature was enabled, the Settings and Features pages didn't render correctly in the Safari browser. (OKTA-884821)

  • Some users weren't able to sign in with Okta Mobile on iOS devices. (OKTA-892669)

  • Admins couldn't create or edit third-party identity providers in orgs with Okta-to-Okta claims sharing enabled. (OKTA-893483)

Okta Integration Network

  • Better Stack (SAML) has a new integration guide.
  • Bundle by freee (SCIM) is now available. Learn more.
  • Chargebee (SAML) has a new integration guide.
  • Chargebee (SCIM) is now available. Learn more.
  • Lobbipad (SCIM) has updated help text.
  • Marfeel (OIDC) is now available. Learn more.
  • Oracle Cloud Applications by Aquera (SCIM) is now available. Learn more.

2025.3.2: Update 2 started deployment on March 24

Generally Available

Fixes

  • createdBy and lastUpdatedBy custom attributes couldn't be used in group rules. (OKTA-566492)

  • Workday imports sometimes failed when the number of parameters sent in a query exceeded the maximum. (OKTA-819984)

  • Authentication was interrupted or prevented in legacy embedded browsers due to a DNS issue. (OKTA-845120)

  • Changes to the manager attribute in Workday were only reflected in Okta after a full import. (OKTA-846352)

  • The MobilePhone target (the user phone number) wasn't present in the System Log when a telephony inline hook was used. (OKTA-849440)

  • The View Client Credentials permission didn't appear when the App settings for custom admin roles feature was enabled. (OKTA-851994)

  • AWS account federation with SWA was incompatible with the new AWS sign in page. (OKTA-856995)

  • When the Enable Sync Account Information setting was disabled for a custom domain, login.okta.com still loaded iframes. (OKTA-865098)

  • In Dynamic Zones, some IPs were classified incorrectly as anonymous proxies because of a misconfiguration by a third-party provider. (OKTA-867976)

  • Admins couldn't increase the global session policy maximum idle time if they set it to a longer duration than the previously saved maximum session time. (OKTA-891348)

Okta Integration Network

  • Attribute Dashboard (OIDC) is now available. Learn more.
  • Balsamiq (SAML) has a new app name, icon, and integration guide.
  • bob (SCIM, SAML) now supports sandbox environments.
  • Drata (OIDC) has a new icon.
  • Mighty ID (OIDC) is now available. Learn more.
  • Salesloft (SAML) is now available. Learn more.
  • Salesloft (SCIM) is now available. Learn more.

Version: 2025.02.0

February 2025

Generally Available

Request expiration and enhanced notifications for Access Requests

To prevent accumulation of stale requests and improve the notification experience, Okta is making the following changes:

  • New requests now automatically expire after 60 consecutive days of inactivity. Completing a task, answering a question, or leaving a message on a request resets the 60-day expiration period. Any requests created before the general availability of this feature expire after 60 days of inactivity (on or around April 7, 2025).

  • Notifications about expiring requests are sent at 30 days, 5 days, and 1 day before the request expires.

  • The user setting to receive daily reminders about overdue tasks and requests is no longer available. It is replaced by the new request expiration notifications.

New look and feel in Access Certifications

In Access Certifications, the Access Certification Reviews app located on your dashboard now has a new look and feel, including a restyled top navigation bar and the addition of a gray background.

New System Log attributes

The PolicyName field was added to the policy.evaluate_sign_on System Log event. This change makes it easier for admins to identify the policy that was involved in user sign-in attempts.

Updated Features page description

The Features page now provides updated information about Okta's Privacy Policy and Free Trial Services.

Delete users with granular deprovisioning in Microsoft Office 365

You can now delete users as part of the deprovisioning process in Office 365. See Deprovisioning options for Office 365.

RADIUS push notifications

The operating system is no longer included in RADIUS push notifications. Customers can contact Okta Support if they need to display this information.

Support for importing Active Directory group descriptions

The descriptions of groups sourced from Active Directory now use their description from AD. These replace any previous descriptions of AD-sourced groups in Okta, which used a pretty-printed version of the distinguished name (DN) instead.

New Hyperdrive agent version

This version includes the Microsoft Edge WebView2 control. See Okta Hyperdrive agent version history.

Polling for Agentless Desktop Single Sign-on and Integrated Windows Authentication

Agentless Desktop Single Sign-on (ADSSO) and Integrated Windows Authentication (IWA) authentication sessions now include polling to reduce the likelihood of service disruptions when bandwidth use peaks. For users authenticating with ADSSO or IWA during peak use periods, this change increases the likelihood that a server will be available to process their authentication request.

Case numbers for impersonation events

When an org grants impersonation for a support case, the case number now appears in the System Log. See Give access to Okta Support.

System Log event for public client app admins

When an admin selects the Automatically assign the super admin role to all newly created public client apps checkbox on the Account page, the System Log now records an event.

ADSSO authentication parameters

When a state token is used, Okta removes the fromURI parameter from the ADSSO authentication POST request.

Improved password reset process for Active Directory-sourced users

The password reset process now sends the password update and verification requests to the same Active Directory agent to avoid replication delay.

Role-based access control now available

As Okta Workflows can make comprehensive changes both inside Okta and out to other connected SaaS apps, access to Workflows was previously restricted to Okta super admins. While this regulation enhanced the security of Okta Workflows, it limited the number of users, restricted the scalability of Okta Workflows, and reduced overall value to customers.

With role-based access control (RBAC), you can now assign Workflows privileges to more users without granting unnecessary access.

To support this feature, three new roles are available:

  • Workflows Administrator: For full-access administration within Okta Workflows only
  • Workflows Auditor: For compliance management with read-only access
  • Connection Manager: For securely handling accounts and credentials

RBAC allows customers to expand the use of Okta Workflows beyond super admins, enabling more team members to build, run, and manage Workflows securely and efficiently.

See Access Control.

There are four new event types that record the RBAC feature activity in the Okta System Log:

  • workflows.user.role.user.add
  • workflows.user.role.user.remove
  • workflows.user.role.group.add
  • workflows.user.role.group.remove

See the Event Types API.

Early Access

Authentication claims sharing between Okta orgs

Authentication claims sharing allows an admin to configure their Okta org to trust claims from IdPs during SSO. Sharing claims also allows Okta to interpret the authentication context from an IdP. This helps eliminate duplicate factor challenges during user authentication and helps improve security posture. See Add a SAML Identity Provider.

On-prem Connector for SAP Netweaver ABAP

On-prem Connector for SAP NetWeaver ABAP provides an out-of-the-box solution that connects SAP on-premises apps with Okta Identity Governance. It enables the discovery, visibility, and management of SAP entitlements (roles) directly in Okta. This integration enhances security, saves time, and simplifies governance by eliminating the need for custom integrations and by streamlining entitlement management. See On-prem Connector for SAP Netweaver ABAP.

Step-up authentication for updating policies

Okta prompts for step-up authentication when admins perform protected actions in the Admin Console, like updating sign-on policies. The changes are only allowed after the admin authenticates successfully. This feature enhances org security by allowing admins to require MFA before performing protected actions. See Protected actions in the Admin Console.

Fixes

  • A warning banner was incorrectly displayed during the WS-Federation setup, even though the setup was completed successfully. (OKTA-807313)

  • In Org2Org configurations where Okta is the source org, passwords weren't synced after the user signed in using a newly reset password. (OKTA-833862)

  • When employees were imported into SuccessFactors, past employment records were imported instead of current records. (OKTA-844570)

  • When a custom domain was deleted or its enrollment was reset, the resulting email confirmation had a broken link and no branding. (OKTA-848261)

  • Users couldn't sign in to their org after certain policies were deleted. (OKTA-856596)

  • Microsoft's MSOL deprecation testing triggered the last remaining MSOL call in Okta's Office 365 provisioning, resulting in a failure to synchronize user attributes. (OKTA-870164)

Okta Integration Network

  • Calendly by Aquera (SCIM) is now available. Learn more.
  • Payflows has an additional SAML attribute.
  • SAP ERP by Aquera (SCIM) is now available. Learn more.
  • SAP HANA Provisioning Connector by Aquera has a new display name.

Weekly Updates

2025.2.1: Update 1 started deployment on February 18

Generally Available

New On-Prem MFA agent version

Version 1.8.1 of the On-Prem MFA agent is now available. This version includes security enhancements.

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

  • Android 12, 13, 14, 15 security patch 2025-02-05
  • iOS 18.3
  • macOS Ventura 13.7.3
  • macOS Sonoma 14.7.3
  • macOS Sequoia 15.3
  • Windows 10 (10.0.17763.6775, 10.0.19044.5371, 10.0.19045.5371)
  • Windows 11 (10.0.22621.4751, 10.0.22631.4751, 10.0.26100.2894)

New System Log event for third-party identity verification

The event type user.identity_verification is triggered when a request is sent to a third-party service for user identity verification as a result of an Okta Account Management Policy (OAMP) evaluation.

Fixes

  • When the third-party admin status was granted or revoked from an admin or group, the System Log didn't record an event. (OKTA-823842)
  • In the Admin Console, updates in the code editor that Okta couldn't parse returned a 500 Internal Server Error. (OKTA-837068)
  • Users whose account had a password expired status couldn't be added as group owners. (OKTA-846195)
  • Admins without proper permissions were able to view the Import Monitoring report. (OKTA-850050)
  • NORDLAYER_VPN was incorrectly announced as a supported IP service category in enhanced dynamic zones. (OKTA-857826)
  • AMR values weren't forwarded to the app when a user signed in and Okta-to-Okta claims sharing was configured. (OKTA-860242)
  • The help link for the Okta-to-Okta claims sharing feature was missing. (OKTA-860321)

Okta Integration Network

  • ADP Recruiting Management by Aquera (SCIM) is now available. Learn more.
  • Console (API Service) is now available. Learn more.
  • Console (OIDC) is now available. Learn more.
  • Dayforce by Aquera (SCIM) now has additional use cases.
  • Microsoft SQL Server by Aquera (SCIM) now has additional use cases.
  • Neowit (SAML) is now available. Learn more.
  • Neowit (SCIM) is now available. Learn more.
  • NordPass (OIDC) is now available. Learn more.
  • QuickBooks Online by Aquera (SCIM) now has additional use cases.
  • Redshift by Aquera (SCIM) now has additional use cases.
  • Subble (API Service) is now available. Learn more.
  • Symantec ZTNA (SAML) is now available. Learn more.
  • Udemy Business (SAML) is now available. Learn more.

2025.2.2: Update 2 started deployment on February 24

Fixes

  • Okta LDAP agent installation failed when using an inactive LDAP instance. (OKTA-467846)

  • When an admin tried to use a feature that wasn't enabled in their org, a long error message appeared instead of a 403. (OKTA-733031)

  • When the third-party admin status was granted to or revoked from an admin or group, the System Log didn't record an event. (OKTA-823842)

  • In orgs with the Okta account management policy enabled, federated users who successfully completed self-service account unlock still couldn't sign in. (OKTA-839418)

  • The contains operator sometimes gave unclear error messages when using less than 3 characters or with other operators. (OKTA-846206)

  • Full imports from LDAP sometimes failed due to a timeout. (OKTA-849200)

  • Users weren't prompted for multifactor authentication when the Sessions API was used to create sessions. (OKTA-858391)

  • Some endpoints didn't block access to external redirect URLs. (OKTA-860388)

  • When the Okta account management policy was enabled, some users who navigated to the End User Settings page were redirected to their Okta Dashboard. (OKTA-864257)

  • Admins couldn't retrieve more than five entitlement SAML assertions and OIDC claims when configuring apps. (OKTA-865900)

  • Users were incorrectly prompted for multifactor authentication in org-to-org chains with the Trust claims from IDP option enabled. (OKTA-866178)

Okta Integration Network

  • AWS S3 by Aquera (SCIM) is now available. Learn more.
  • Clutch Security (API Service) is now available. Learn more.
  • Datadog (SCIM) now supports group push.
  • Oracle Database by Aquera (SCIM) is now available. Learn more.
  • Perimeter 81 (SAML/SCIM) has a new icon, display name, and description.

2025.2.3: Update 3 started deployment on March 3

Fixes

  • In Dynamic Zones, some IPs were classified incorrectly as anonymous proxies because of a misconfiguration by a third-party provider. (OKTA-864349)

  • The System Log didn't display accurate client IP address data for refresh requests from first-party apps. (OKTA-864998)

Okta Integration Network

  • Chaos (OIDC) is now available. Learn more.
  • Chaos (SCIM) is now available. Learn more.
  • Jobvite by Aquera (SCIM) is now available. Learn more.
  • Lifebalance Program (OIDC) has a new Redirect URI.
  • Lobbipad (OIDC) is now available. Learn more.
  • Lobbipad (SCIM) is now available. Learn more.
  • narrativ.ai (OIDC) is now available. Learn more.
  • NordPass (OIDC) has a new Redirect URI.
  • Okta ISPM (API Service) now has the okta.roles.read and okta.factors.read scopes.
  • Relvy AI (OIDC) is now available. Learn more.
  • Zoom (SAML) now has a configurable ACS and Audience URLs.

Version: 2025.01.0

January 2025

Generally Available

Okta Provisioning agent, version 2.2.0

This release contains bug fixes and minor improvements. The RPM installer is now signed. See Okta Provisioning agent and SDK version history.

Okta Active Directory agent, version 3.19.0

This release of the Okta Active Directory agent includes an additional layer of end-to-end encryption for payloads that are exchanged between Okta and the agent. Support for monitoring the Active Directory agent configuration file has been added, where a System Log event is emitted when the agent configuration has been changed on premises. This release also includes security enhancements and bug fixes. See Okta Active Directory agent version history

OAuth 2.0 security for invoking API endpoints

Okta Workflows users can now securely invoke API endpoints using OAuth 2.0 protocols and their Okta org authorization server. Compared with the existing token authorization option, this feature is more secure while also being easier to implement. Add the okta.workflows.invoke.manage scope to any new or existing app integration to make it eligible to invoke your API endpoint. See Invoke a flow with an API endpoint.

Granular deprovisioning in Microsoft Office 365

You can now deprovision users in Office 365 using multiple methods. See Deprovisioning options for Office 365.

Block syncable passkeys

You can now block syncable passkeys during authentication. Previously, you could only block them during enrollment. This enhances the security of your org by preventing users from presenting such passkeys to attempt to enroll new, unmanaged devices. See FIDO2 (WebAuthn).

Additional use case selection in the OIN Wizard

Independent software vendors (ISVs) can select the following additional use case categories when they submit their integration to the OIN:

  • Automation

  • Centralized Logging

  • Directory and HR Sync

  • Multifactor Authentication (MFA)

See Use case selection in the OIN Wizard.

Early Access

Entitlement claims

You can now enrich tokens with app entitlements that produce deeper integrations. After you configure this feature for your app integration, use the Okta Expression Language in Identity Engine to add entitlements at runtime as OIDC claims and SAML assertions. See Generate federated claims.

Block syncable passkeys

You can now block syncable passkeys during authentication. Previously, you could only block them during enrollment. This enhances the security of your org by preventing users from presenting such passkeys to attempt to enroll new, unmanaged devices. See FIDO2 (WebAuthn).

Fixes

  • Incremental imports on a custom SCIM server sometimes removed user group memberships. (OKTA-736111)

  • In some orgs, users were unlocked based on the settings of the default AD password policy rather than a higher priority password policy. (OKTA-755979)

  • Leaving the Custom character restriction field empty in the Profile Editor resulted in an error. (OKTA-811861)

  • The Manage Applications permission for Custom Admin roles unnecessarily allowed admins to mange the client credentials section for OAuth 2.0 Service apps. (OKTA-821119)

  • Long group names were truncated on the Edit resources to a standard role page. (OKTA-839491)

  • Viewing group members in the Admin Console sometimes displayed an error. (OKTA-844568)

Weekly Updates

2025.1.1: Update 1 started deployment on January 21

Generally Available

New IP service categories

The NORDLAYER_VPN and PIA_VPN proxy services are now supported as IP service categories in enhanced dynamic zones. See Supported IP service categories.

Fixes

  • The Slack start date wasn't imported through schema discovery. (OKTA-826971)

  • User movement logs for Realm assignment jobs didn't display correctly. (OKTA-844398)

  • When an Okta group was deleted while an app group reconciliation job was in progress, the job to delete the downstream app group wasn't scheduled. (OKTA-826938)

Okta Integration Network

  • Airflow by Tech Prescient (SCIM) is now available. Learn more.
  • Asana by Aquera (SCIM) is now available. Learn more.
  • Avigilon Alta (SCIM) now supports user deactivation.
  • Corma (API Service) is now available. Learn more.
  • Dovetail (OIDC) has a new icon and integration guide.
  • ELMO (SCIM) is now available. Learn more.
  • FCTR Identity Support Portal (SAML) is now available. Learn more.
  • Jotform (SAML) is now available. Learn more.
  • Island (SAML) has updated endpoints.
  • Natoma (SAML) is now available. Learn more.
  • Posit Workbench (SAML) is now available. Learn more.
  • Posit Workbench (OIDC) is now available. Learn more.
  • PrimeDrive (SAML) is now available. Learn more.
  • Rocketlane (SCIM) is now available. Learn more.
  • SAP HANA Provisioning Connector by Aquera (SCIM) is now available. Learn more.
  • Udemy Business (SCIM) is now available. Learn more.
  • UKG Pro Workforce Management by Aquera (SCIM) is now available. Learn more.
  • VASTOnline (SCIM) is now available. Learn more.
  • Vbrick Rev Cloud (SCIM) is now available. Learn more.

2025.1.2: Update 1 started deployment on February 3

Generally Available

RADIUS Server Agent version 2.24.2

This version fixes a bug in the Password Authentication Protocol, where in some instances the authentication failed if the user password was greater than 16 characters. It also includes security enhancements.

Sign-In Widget, version 7.27.3

For details about this release, see the Sign-In Widget Release Notes.

For more information about the Widget, see the Okta Sign-In Widget.

Fixes

  • When a super admin updated a deactivated user to a different realm, admins received a Resource not found error. (OKTA-699778)

  • Searching a name with special characters in Realms failed. (OKTA-801220)

  • If an error occurred while an admin performed a protected action, the resulting error message was sometimes unclear. (OKTA-808668)

  • Some users with the application administrator role weren't able to manage the apps they were assigned. (OKTA-814563)

  • The Manage Applications permission for custom admin roles unnecessarily allowed admins to manage the client credentials section of OAuth Service applications. (OKTA-821119)

  • The System Log sometimes displayed the org authorization server even though the error and the call were related to the custom authorization server. (OKTA-821988)

  • Users couldn't sign in to Okta after an app was deactivated and deleted. (OKTA-828955)

  • Events for tokens revoked in bulk for a resource didn't appear in the System Log. (OKTA-834025)

  • Custom app instance icons weren't displayed in Profile Editor in the Admin Console. (OKTA-837626)

  • Some service account users received an error message despite successfully changing their passwords. (OKTA-841078)

  • Some admins received an error message when they clicked Admin on the End-User Dashboard. (OKTA-842573)

  • The Atlassian Jira Cloud app didn't inject credentials when using SWA. (OKTA-843781)

  • Some users weren't prompted for multifactor authentication if another user was signed in to Okta with a different session on the same browser. (OKTA-846381)

  • Users received an error message when they enrolled a Personal Identity Verification card even though the System Log indicated that the enrollment was successful. (OKTA-846423)

  • Some users could enroll authenticators with self-attested passkeys even though the admin only allowed certificate-based attestation in their org. (OKTA-851468)

  • On the Admin Dashboard, the Tasks widget sometimes didn't load. (OKTA-851807)

  • When admins tried to customize the signing options of the SAML 1.1 app, their changes didn't appear. (OKTA-852911)

  • In orgs with Multiple Identifiers enabled, some users couldn't perform self-service registration. (OKTA-853911)

  • The Administrator assignment by role page displayed an error if an admin had duplicate assignments. (OKTA-854906)

  • The email notification for protected actions indicated that actions were taken instead of attempted. (OKTA-854973)

  • Users with passwords greater than 16 characters couldn't sign in when the Password Authentication Protocol with Message-Authenticator feature was enabled. (OKTA-856260)

Okta Integration Network

  • ADP Link by Aquera (SCIM) is now available. Learn more.
  • Cirro (OIDC) is now available. Learn more.
  • Concentric AI (SAML) is now available. Learn more.
  • Cyble Vision (SAML) is now available. Learn more.
  • Dayforce by Aquera (SCIM) is now available. Learn more.
  • Deel HR (SCIM) now supports profile sourcing.
  • FCTR Identity Support Portal (API Service) is now available. Learn more.
  • Gumband (OIDC) is now available. Learn more.
  • Island Management Console (SAML) has updated endpoints.
  • Microsoft SQL Server by Aquera (SCIM) is now available. Learn more.
  • Opensense (SAML) is now available. Learn more.
  • QuickBooks Online by Aquera (SCIM) is now available. Learn more.
  • Payflows (SAML) is now available. Learn more.
  • Redshift by Aquera (SCIM) is now available. Learn more.
  • Resonance by spiderSilk (SAML) is now available. Learn more.
  • SmartSite (OIDC) is now available. Learn more.
  • Speeda Sales Insights (OIDC) is now available. Learn more.
  • TrustWorks (SAML) is now available. Learn more.
  • XplicitTrust Network Access (API Service) is now available. Learn more.