Okta Classic Engine release notes (Production)

Okta LDAP Agent, version 5.22.0

This version of the agent includes the following:

• Agent now uses OAuth 2.0 and OAuth 2.0 Demonstrating Proof-of-Possession (DPoP) to securely communicate with Okta.
• New agents are registered through the OAuth 2.0 device registration flow.
• Agents now operate independently from the accounts used to register them.
• Agents can now be installed by super admins and admins with a custom role that includes agent registration permissions. See LDAP integration prerequisites.
• Linux LDAP agents are now managed using systemd instead of sysvinit. See Manage the Okta LDAP Agent.

See Okta LDAP Agent version history.

Improved user experience for group member counts

Groups now use async counts to determine user membership for groups that exceed 10,000 users. This improves the performance of both the Groups page and the group selector on the Sign-on policy page.

Give access to Okta Support

Admins can now control how members of the Okta Support team access their org. To support this, the Account page provides the following two options:

• Impersonation Grants for Cases: Allows the Okta Support team to sign in to your org as a read-only admin to troubleshoot issues.
• Support User Grants for Self-Assigned Cases: Allows an Okta Support representative to access your org settings after they've opened a case. Using these settings, admins can select the right level of Support access for their org.

See Give access to Okta Support.

Seamless ISV experience for SCIM

Okta now provides a seamless ISV experience to optimize the Okta Integration Network (OIN) submission experience for SCIM integrations. This new experience enables independent software vendors (ISVs) to build and manually test their SCIM integration metadata before submission to the OIN. This reduces the time needed for the OIN team to review and validate that the SCIM integration functions as intended, which shortens the time to publish in the OIN. This experience also incorporates communication processes in Salesforce, enabling improved collaboration internally within Okta teams and externally with ISVs. See Publish an OIN integration overview and Submit an integration with the OIN Wizard guide.

New column in Application Usage report

The Application Usage report now provides an Instance Name column. The new column helps users identity which apps the report was generated for.

Improved Access Requests error message

When you navigate to the Access Requests tab for an app, the resulting error message is now clearer.

Updates to User Accounts report

The maximum number of rows in a CSV export has been increased from 1 million to 5 million.

Hyperspace Agent version 1.5.0

Hyperspace Agent version 1.5.0 is now available. This version uses Microsoft Edge WebView2 Runtime to display Sign-In Widget content. See Okta Hyperspace Agent version history.

Enhanced dynamic zones

Use enhanced dynamic network zones to define IP service categories (proxies, VPNs), locations, and Autonomous System Numbers (ASNs) that are allowed or blocked in a zone. See Enhanced dynamic zones.

Nonce rollout for Content Security Policy

Okta is rolling out nonces for the script-src directive of the Content Security Policy for every endpoint that returns html content. This is a two stage process: first, the nonce is added to the Content-Security-Policy-Report-Only header script-src directive; later, after any unsafe inline scripts are identified and fixed, the nonce is added to the Content-Security-Policy header script-src directive. This update will be gradually applied to all endpoints.

Deprecating provisioning for Confluence (Atlassian)

Provisioning for Confluence (Atlassian) has been deprecated.

UI update on the Brands page

Dropdown menus on the Brands page have been updated to provide a more consistent look and feel.

OIN connector support for Entitlement Management

The following connectors have been updated to support Entitlement Management:

• Coupa
• DocuSign
• WebEx

See Provisioning-enabled apps.

Group Owner assignments removed

The Group Owner assignment option has been removed from Access Requests for admin roles sequences.

New Okta Secure Identity collection in the OIN catalog

A new Okta Secure Identity collection is available in the Okta Integration Network (OIN) catalog. This collection identifies integrations that are part of the Okta Secure Identity commitment. See the OIN catalog for a list of integrations assigned to this collection.

System Log event types and outcome reasons

The user.authentication.auth_via_IDP and user.authentication.auth_via_social System Log event types now indicate whether a successful Identity Provider sign-in attempt was due to JIT provisioning or account linking. See Event types.

OIDC Identity Provider options

OIDC Identity Providers can now have both the Account Link and JIT policies set to disabled.

Event hooks for Identity Provider authentication

You can now use user authentication with Identity Provider events as event hooks. See Event Types for a list of events that you can use with event hooks.