Okta Classic Engine release notes (Production)

June
May
April

Version: 2025.06.0

June 2025

Generally Available

Per-app SAML certificate expiry notifications

The Tasks page now displays certificate expiry notifications for individual SAML apps.

App permissions no longer include agent permissions

Now when you assign the Manage applications permission to an admin, the Manage agents permission isn't automatically granted. For existing admin role assignments that include the Manage applications permission, the Manage agents permission is retained in the assignment. See Role permissions.

Okta Provisioning Agent now supports Group Push with SCIM 2.0

You can now use Group Push with on-premises apps by using Okta Provisioning Agent and SCIM 2.0. See Create SCIM connectors for on-premises provisioning.

New look and feel in the Partner Admin Portal app

The Partner Admin Portal app pages now have a new look and feel, including redesigned side and top navigation menus.

Define default values for custom user attributes

You can now define default values for custom attributes in a user profile. See Add custom attributes to an Okta user profile.

Domain restrictions on Realms

You can now limit users to a specific domain in Realms, which adds an extra layer of oversight for realm and partner admins and enforces boundaries between user populations. See Manage realms.

Authentication claims sharing between Okta orgs

Authentication claims sharing allows an admin to configure their Okta org to trust claims from third-party IdPs during SSO. Sharing claims also allows Okta to interpret the authentication context from an IdP. This helps eliminate duplicate factor challenges during user authentication and helps improve security posture. See Add a SAML Identity Provider.

Improvements to Okta RADIUS

Okta RADIUS now supports Java version 17 and has a new 64-bit installer.

Authentication claims sharing between Okta orgs

Authentication claims sharing allows an admin to configure their Okta org to trust claims from IdPs during SSO. Sharing claims also allows Okta to interpret the authentication context from an IdP. This helps eliminate duplicate factor challenges during user authentication and helps improve security posture. See Add a SAML Identity Provider.

Create dynamic resource sets with conditions

Resource set conditions help you limit the scope of a role by excluding an admin's access to certain apps. This gives you more granular control over your custom admin roles and helps meet your org's unique security needs. See Resource set conditions.

Manage Subscription button removed

The Manage Subscription button has been removed from the Settings page.

Admins prevented from deleting published app instances

When an app instance has the Published version status, admins can no longer delete it from their org.

Early Access

RingCentral uses new default phone number logic

The RingCentral app integration's logic for detecting and populating phone numbers has been updated to work with both DirectNumber and IntegrationNumber entries.

Fixes

SDK strings that contained iOS were parsed as unknown operating systems. (OKTA-856044)
On the Settings page, the Technical contact field displayed a "This field cannot be left blank" error even when there was text in the field. (OKTA-939469)
In the End-User Dashboard, if a user resized the browser to a mobile-sized view, the navigation menu opened and closed repeatedly. (OKTA-940213)
Admins received a 500 error when they attempted to delete an optional attribute in Profile Editor. (OKTA-941778)

Okta Integration Network

Pluto Bioinformatics is now available (SAML). Learn more.
FORA is now available (OIDC). Learn more.
Teamplify is now available (OIDC). Learn more.
XOPS is now available (API Service Integration). Learn more.

Version: 2025.05.0

May 2025

Generally Available

App permissions no longer include agent permissions

Realms per org limit expanded

You can now create up to five thousand realms per org. See Manage realms

Microsoft Office 365 Single Sign-on integration supports SHA-256

The Office 365 SSO integration (WS-Fed Auto and Manual) now uses SHA-256 for signing the authentication token.

New versions of Okta Provisioning agent and SDK

Okta Provisioning agent 2.3.0 and Okta Provisioning agent SDK 2.2.0 are now available. These releases contain bug fixes and minor improvements. See Okta Provisioning agent and SDK version history.

Device assurance OS version updates

Device assurance policies now support the following OS versions

Android 12, 13, 14, and 15 to security patch 2025-05-01
iOS 18.4.1
macOS Sequoia 15.4.1
Windows 10 (10.0.17763.7136, 10.0.19044.5737, 10.0.19045.5737)
Windows 11 (10.0.22621.5189, 10.0.22631.5189, 10.0.26100.3775)

Removal of device support for Windows 11 21H2

Okta Verify no longer supports devices that use Windows 11 21H2. See Supported platforms for Okta Verify.

Support for additional attributes in Office 365's Universal Sync

Office 365's Universal Sync now enables users to access Kerberos resources with Windows Hello for Business. See Supported user profile attributes for Office 365 provisioning

Improved Documentation Search

The search functionality on help.okta.com has been updated with the following improvements:

Localized Japanese search: Supports localized searches in Japanese for all translated content.
Focused results: Searches take place directly in Okta help instead of rerouting users to the Okta Help Center.

These features are now available on help.okta.com to help users quickly locate relevant documentation for their specific needs.

Okta Active Directory agent, version 3.20.0

This release includes support for enhanced incremental imports from AD using DirSync. Incremental import with DirSync avoids full imports and offers delta imports with AD that significantly improves performance. Configuration and opt-in is required within Okta after an agent update. This release also includes security enhancements and bug fixes. See Okta Active Directory agent version history

New protected action

Creating API tokens is now a protected action. When you enable this feature in your org, admins are prompted for authentication when they perform create an API token, at an interval that you specify. This additional layer of security helps ensure that only authorized admins can perform key tasks in your org. See Protected actions in the Admin Console.

Updates to the advanced search filters

The operators dropdown menu in the Advanced search section on people, groups and group membership pages shows all options and grays out the options that aren't applicable.

ADFS version 1.8.3

Bug fixes and security hardening.

Updated text for the Login.gov IdP

For the Login.gov IdP, the Type of Identity Verification label has been updated to Type of Service Level, and the list of possible service levels has been updated.

MFA enabled by default in new app sign-on rules

Multifactor authentication (MFA) is now enabled by default in new app sign-on rules when MFA factors are available to users. Additionally, reauthentications are now set to once per day by default.

Entitlement claims

You can now enrich tokens with app entitlements that produce deeper integrations. After you configure this feature for your app integration, use the Okta Expression Language in Identity Engine to add entitlements at runtime as OIDC claims and SAML assertions. See Generate federated claims.

Early Access

Breached Credentials Protection

Protect your org from the impact of credentials that have been compromised. If Okta determines that a username and password combination has been compromised after being compared to a third-party curated dataset, the protection response is customizable through password policies, including resetting the user's password, forcing a logout, or calling a delegated Workflow. See Breached credentials detection.

This feature is following a slow rollout process beginning on May 15.

DirSync group imports for Active Directory

For Active Directory (AD) integrations, the Provisioning tab now provides an Enable imports with AD using DirSync checkbox. When you enable the checkbox, admins can perform incremental group imports using DirSync. See Configure Active Directory import and account settings.

Fixes

When doing incremental imports using Okta Provisioning agent, users whose profiles weren't modified were removed from groups in Okta. (OKTA-884952)
The border for the table of Active Directory instances on the Delegated Authentication page was missing. (OKTA-893589)
When admins enabled the Unified Look and Feel for Okta Admin Console feature, some user interface elements didn't render correctly on Default Policy pages. (OKTA-903370)
Some users saw a login hint in the UserHome page URL for OIDC apps even though login hints were disabled. (OKTA-919432)
Super admins couldn't always access Workflows with the role-based access control (RBAC) feature enable. (OKTA-920704)
When third-party IdP claims sharing was enabled, the redirect to the IdP happened during reauthentication even if IdP didn't provide any AMR claims. (OKTA-922086)
PERIMETER81_VPN was incorrectly announced as a supported IP service category in enhanced dynamic zones. (OKTA-923426)
When a call to activate a downstream app user failed while activating a user, the user was stuck in an activating status. (OKTA-925217)
If a third-party SAML IdP sent the session.amr SAML attribute without the attribute schema type, Okta rejected the response when the third-party claims sharing feature was enabled. (OKTA-925864)
Starting with version 136, Chrome no longer returned the thirdPartyBlockingEnabled signal, and users whose Device Assurance policies relied on the signal were denied access to their resources. (OKTA-927884)

Okta Integration Network

JoVE (SAML) is now available. Learn more.
Partner Element (OIDC) is now available. Learn more.

Weekly Updates

2025.5.1: Update 1 started deployment on May 19

Generally Available

On-Prem MFA agent, version 1.8.2

Version 1.8.2 of the On-Prem MFA agent is now available. This version includes security enhancements.

New filter and columns for Access Certifications reports

You can use the Campaign ID filter in the Past campaign details and Past campaign summary reports. You can find a campaign's ID from System Log events or from the URL for the campaign details page. Additionally, the following columns are available for use in the Admin Console.

Past campaign details report:
- User email
- Reviewer email
- Reviewer reassigned
Past campaign summary report:
- Campaign resource count

Fixes

Some System Log entries showed the wrong user agent operating system version for risk scoring and new device detection events. (OKTA-792841)
The Application Usage report didn't include successful RADIUS authentications. (OKTA-815504)
Some users didn't receive emails from Okta. (OKTA-826144)
When users edited an authorization server on the Security > API page, the value of the Type column on the Claims tab incorrectly wrapped to a second line. (OKTA-863707)
Admins didn't receive the correct notifications when they had both role and admin email notifications selected. (OKTA-876846)
Some ADSSO functionality didn't work as expected. (OKTA-880273)
When users edited an authorization server on the Security > API page, some user interface elements had the wrong background color. (OKTA-893509)
Some user interface elements on the API Token page had the wrong background color. (OKTA-893608)
Some users saw an extra line at the bottom of the Identity Providers page. (OKTA-893613)
Some user interface elements had incorrect spacing on the Okta API Scopes tab of app pages. (OKTA-905018)
Email notifications for the super admin role weren't applied consistently when all admin email notification settings were selected for the role. (OKTA-906587)
Agents in an error state were properly displayed on the Agent Monitors page for their respective directory integration but weren't displayed on the Admin Dashboard. (OKTA-910056)
On the Add resource dialog, the Show more button didn't display all the resources that were already included in the resource set. (OKTA-921890)
Some Org2Org users were unable to sign in after they completed multifactor authentication. (OKTA-932258)
Some Org2Org users saw an error message after they completed multifactor authentication when Claims Sharing was enabled. (OKTA-932402)
When Okta-to-Okta claims sharing was enabled for a Classic Engine org to an Identity Engine org flow, and the State Token for All Flows feature flag was enabled in the Classic Engine org, users were prompted for MFA on the Identity Engine org when MFA had already been completed on the Classic Engine org. (OKTA-932454)
After signing in to Okta on a mobile device (either Android or iOS), opening the menu resulted in the screen flickering. (OKTA-933477)
Updating an LDAP-sourced user profile sometimes resulted in an error. (OKTA-939330)

Okta Integration Network

Attribute Dashboard (OIDC) now supports IdP-initiated SSO flows.
DX (SAML) is now available. Learn more.
Embrace (SAML) is now available. Learn more.
Merkle (OIDC) is now available. Learn more.
SAP Concur by Aquera is now available. Learn more.
SAP S/4HANA by Aquera (SCIM) is now available. Learn more.

2025.5.2: Update 2 started deployment on May 27

Fixes

The online help link on the Brands page didn't link to the correct page. (OKTA-654709)
LDAP agents were displayed as operational after registration, even if they hadn't successfully connected to Okta. (OKTA-886963)
Some user interface elements in pages under the Customizations menu didn't render correctly when the Unified UI for the Admin App feature was enabled. (OKTA-893521)
The border on the Delegated Authentication page for LDAP used squared corners instead of rounded corners. (OKTA-893569)
Some Org2Org users were unable to sign in after they completed multifactor authentication. (OKTA-932258)
Several of the Administrators pages didn't render correctly when the Unified look and feel for Okta Admin Console feature was enabled. (OKTA-934633)
Some pages didn't load correctly when the Unified look and feel for Okta Admin Console feature was enabled. (OKTA-938750)

Okta Integration Network

CyberDefenders (OIDC) is now available. Learn more.
Google Cloud Workforce Identity Federation (OIDC) is now available. Learn more.
Pro-Vigil (SAML) is now available. Learn more.

2025.5.3: Update 3 started deployment on June 2

Generally Available

RingCentral uses new default phone number logic

The RingCentral app integration's logic for detecting and populating phone numbers has been updated to work with both DirectNumber and IntegrationNumber entries.

Integrator Free Plan org now available

The Integrator Free Plan org is now available on the Sign up page of the developer documentation site. These orgs replace the previous Developer Editions Service orgs, which will start being deactivated on July 18th. See Changes Are Coming to the Okta Developer Edition Organizations. For information on the configurations for the Integrator Free Plan orgs, see Okta Integrator Free Plan org configurations.

Fixes

When an admin changed a user attribute in Okta, the profile in Zendesk reverted back to the default language of the Zendesk account. (OKTA-916240)
Some users incorrectly received an Invalid Phone Number error when they enrolled an SMS factor. (OKTA-923373)
When an admin configured the Salesforce.com connector with the Customer Portal user type and then ran an import, no users were fetched. (OKTA-931016)
After signing in to Okta on a mobile device (either Android or iOS), opening the menu resulted in the screen flickering. (OKTA-933477)
When third-party IdP claims sharing was enabled, some claims were missing from the System Log. (OKTA-936530)
Some pages didn't load correctly when the Unified look and feel for Okta Admin Console feature was enabled. (OKTA-938750)
Updating an LDAP-sourced user profile sometimes resulted in an error. (OKTA-939330)

Okta Integration Network

Conviva (SCIM) is now available. Learn more.
Paylocity (Demo)(SCIM & SAML) is now available. Learn more.
SELR.ai (OIDC) is now available. Learn more.
Wirespeed (API service) is now available. Learn more.

Version: 2025.04.0

April 2025

Generally Available

Secure Identity Integrations

Secure Identity Integrations (SII) provides additional depth for the 50+ most-used enterprise SaaS applications with the inclusion of SSO, SCIM, Apps with entitlement support, Universal Logout, Workflows, and Identity Security Posture Management (ISPM).

New versions of Okta Provisioning agent and SDK

Okta Provisioning agent 2.2.1 and Okta Provisioning agent SDK 2.1.1 are now available. These releases contain bug fixes and minor improvements.

OIN test account information deleted after 30 days

Okta deletes your test account credentials 30 days after you publish your app in OIN Wizard. You must create a new test account and re-enter the required information before submitting the app.

MyAccount Management scopes

The MyAccount Management scopes have been updated to non-system scopes and are now configurable by admins. See Create API access scopes .

Step-up authentication for updating policies

Okta prompts for step-up authentication when admins perform protected actions in the Admin Console, like updating sign-on policies. The changes are only allowed after the admin authenticates successfully. This feature enhances org security by allowing admins to require MFA before performing protected actions. See Protected actions in the Admin Console.

Okta Verified text removed from the OIN

In the OIN catalog, the Okta Verified disclaimer has been removed from the app integration pages.

Early Access

Manage Active Directory accounts in Okta Privileged Access

This feature allows management of Active Directory (AD) account passwords through Okta Privileged Access using the Okta AD Agent. Admins can set discovery rules for accounts in specific organizational units (OUs) and create policies for user access, ensuring passwords are rotated upon check-in or on a schedule. Users with access can view their assigned accounts and retrieve passwords. To enable this feature, contact Okta support. See Manage Active Directory accounts

OAuth 2.0 provisioning for Org2Org with Auto-Rotation

Admins deploying multi-org architectures (for example Okta hub-and-spoke orgs) need to secure user and group provisioning. Provisioning using OAuth2.0 scoped tokens has several advantages over API tokens, including more access granularity, shorter token lifespans, and automatic key rotation. You can now enable OAuth 2.0 Auto-Rotation for Org2Org app provisioning directly from the Admin Console.

See Integrate Okta Org2Org with Okta.

On-prem Connector for SAP Netweaver ABAP supports more attributes

Okta On-prem Connector now supports more user attributes, which enables better integration between Okta and SAP Netweaver ABAP.

Fixes

Custom app logos didn't appear on the app's page. (OKTA-655724)
This update applied general security fixes. (OKTA-690936)
The reported results of an import varied between what was displayed when the import finished, the import summary email, and the values displayed on the Import Monitoring page. (OKTA-739010)
The MFA Factor column in the MFA Usage report displayed the name Windows Hello (Web Authentication) for the FIDO2 (WebAuthn) factor.
(OKTA-848611)
The SettingsAPI menu appeared to some admins who didn't have permission to view it. (OKTA-856337)
Admins using multiple user types sometimes encountered an internal error when attempting to update an app instance. (OKTA-880825)
The Import Monitoring page was viewable by admins who didn't have the necessary permissions. Accessing the page resulted in a 403 error. (OKTA-880835)
Sometimes a Null Pointer Exception error occurred when performing a group push to Google Workspace. (OKTA-886861)
Admins couldn't disable the Trust claims from this identity provider setting. (OKTA-899883)
LDAP agents failed to parse queries when group names had special characters. (OKTA-902231)

Okta Integration Network

AppVentory (API Service) is now available. Learn more.
Curricula (SAML) has a new integration guide.
Fabrix (API Service) is now available. Learn more.
GoSearch (SCIM) now supports Group Push.
OpenAI by Aquera (SCIM) is now available. Learn more.
Peaxy Lifecycle Intelligence (OIDC) is now available. Learn more.
Suger (OIDC) is now available. Learn more.
Suger (SCIM) is now available. Learn more.
Warp Employee Provisioning (API Service) is now available. Learn more.

Weekly Updates

2025.4.1: Update 1 started deployment on April 14

Generally Available

New look and feel in Access Requests

The Access Requests console and Okta Access Requests web app now have a new look and feel, including redesigned side and top navigation menus and the addition of a gray background. Additionally, Dark mode is no longer available for Access Requests.

Fixes

In Preview orgs, org admins couldn't edit IdP group assignments when a super admin group was included in the group list. (OKTA-880124)
The Edit role screen didn't always display the correct Workflow permissions. (OKTA-886964)
Super admins saw an error when they attempted to reset a user's factors. (OKTA-890695)
The id_token_hint parameter was exposed in the System Log. (OKTA-890738)
When a user interacted with the Graph API in Azure Active Directory PowerShell, the activity was incorrectly logged in Office 365. (OKTA-896032)
Users couldn't sign in to the Office 365 GCC High OIN app if it was integrated with WS-Fed. (OKTA-899506)
On the Give access to Okta Support page, the Provide Support access for self-assigned cases section sometimes didn't display the correct cases. (OKTA-909308)
A JavaScript issue prevented users from accessing the Glory app. (OKTA-917414)

Okta Integration Network

Adroll by Aquera (SCIM) is now available. Learn more.
Hero (API Service) is now available. Learn more.
Hyperproof (SCIM) is now available. Learn more.
Microsoft Dynamics 365 BC by Aquera (SCIM) is now available. Learn more.
ZAMP (OIDC) has additional redirect URIs.

2025.4.2: Update 2 started deployment on April 21

Generally Available

Trust incidents and updates checkbox removed

On the Account page, the Admin email notifications section no longer has the Trust incidents and updates checkbox. Admins can subscribe to this communication type through https://status.okta.com.

Fixes

When users tried to sign in from outside of their permitted network zone, they saw a Contact your administrator link on the error page even though the admin disabled the link. (OKTA-874992)
Super admins couldn't update the operator for profile attribute conditions on a custom admin role. (OKTA-884966)
Sometimes, Google Workspace licenses couldn't be edited. (OKTA-892397)
Desktop Multifactor Authentication (MFA) push notifications gave the wrong name for the computer's operating system. (OKTA-902839)
When the Unified look and feel for Okta Admin Console feature was enabled, the headings on the Downloads page were misaligned. (OKTA-904262)
Some text strings in the Move user to realm page weren't translated. (OKTA-909317)
When the Unified look and feel for Okta Admin Console feature was enabled, users' names didn't always render correctly. (OKTA-909497)
Users received a 400 Bad Request error during self-service registration in preview orgs with inline hooks. (OKTA-918774)

Okta Integration Network

Adroll by Aquera (SCIM) has a new description and display name.
Files.com by Aquera (SCIM) is now available. Learn more.
Global Relay Identity Sync has a new display name.
GoTo Meeting by Aquera (SCIM) is now available. Learn more.
GroWrk (SAML) is now available. Learn more.
Helpjuice by Aquera (SCIM) is now available. Learn more.
Island Management Console (SCIM) is now available. Learn more.
OK2Pay (SAML) is now available. Learn more.

2025.4.3: Update 3 started deployment on May 5

Fixes

On the Networks page, the Add Zone button was unexpectedly available when Admin Created was selected for some environments. (OKTA-850713)
When a user was created and added to an app through group assignment, and the app had provisioning enabled, no application.user_membership.add event was logged. (OKTA-868825)
When an admin performed a protected action, they weren't prompted for authentication if they had recently signed in to Okta. (OKTA-889142)
On the End-User Dashboard, the side navigation panel didn't always reappear after a user resized their screen. (OKTA-900098)
When the Unified look and feel for Okta Admin Console feature was enabled, the headings on the Downloads page were misaligned. (OKTA-904262)
When the Unified look and feel for Okta Admin Console feature was enabled, admins couldn't edit a page or email template in full-screen mode in Customizations > Brands. (OKTA-905316)
Duplicate AD/LDAP app instances could be registered for a single domain. (OKTA-911468)
When an admin edited role notifications for the Workflows Administrator role, they saw an unresponsive dialog. (OKTA-918276)
Users received a 400 Bad Request error during self-service registration in preview orgs with inline hooks. (OKTA-918774)
When an Okta Classic Engine org was involved in a multi-org Okta-to-Okta authentication flow, and Okta-to-Okta claims sharing was enabled, the OktaAuth (SAML) and okta_auth (OIDC) claims weren't processed correctly. (OKTA-918969)
Users were deactivated during imports where Super Admin privileges had been granted through group membership assignment. (OKTA-831811)
Some admins with a custom role couldn't view client secrets for apps that they had permission to view. (OKTA-893511)
Admins sometimes received an error when they tried to change the sign in and sign out redirect URIs for OIDC app integrations. (OKTA-901862)
On the Admin Dashboard, the Tasks widget sometimes displayed incorrect provisioning tasks for the Okta ISV Portal App. (OKTA-902656)
Some colors and fonts were inconsistent across the Admin Console. (OKTA-904047)
When the Username attribute had no format restrictions applied to it, multiple identifiers could be associated with and gain access through the same account. (OKTA-910103)
Users were prompted for multifactor authentication twice when they signed in to a spoke org in an Okta Org2Org scenario even though the Trust claims from this identity provider option was selected for the hub org. (OKTA-912172)

Okta Integration Network

Applixure (OIDC) is now available. Learn more.
Degreed by Aquera (SCIM) is now available. Learn more.
LinearB (SAML) is now available. Learn more.
LinearB (SCIM) is now available. Learn more.
myComply (SAML) is now available. Learn more.
Othership Workplace Scheduler (SAML) is now available. Learn more.
Othership Workplace Scheduler (SCIM) is now available. Learn more.
Pandadoc by Aquera (SCIM) is now available. Learn more.
Saleo (SCIM) is now available. Learn more.
Splunk-On-Call by Aquera (SCIM) is now available. Learn more.