Okta Classic Engine release notes (Preview)

IWA Agent, version 1.17.0

This version of the agent contains security enhancements. See Okta SSO IWA Web App version history.

Detect and block requests from anonymizing proxies

Orgs can now detect and block web requests that come from anonymizers. This helps improve the overall security of your org. See Enhanced dynamic zones.

Okta LDAP Agent automatic update support

Admins can now initiate or schedule automatic updates to Okta LDAP agents from the Admin Console. With agent auto-update functionality, admins no longer need to manually uninstall and then reinstall Okta LDAP agents when a new agent version is released. Agent auto-updates keep your agents up to date and compliant with the Okta support policy, and help ensure your org has the latest Okta features and functionality. Single or multiple agents can be updated on demand, or updates can be scheduled to occur outside of business hours to reduce downtime and disruption to users. See Automatically update Okta LDAP agents.

Admin Console Japanese translation

When this feature is enabled, all admin users in the org who use Japanese as their display language will see the Admin Console in Japanese. See Supported display languages.

IP session restrictions for Okta Workflows

Okta super admins can now enable IP session restrictions for Okta Workflows. This feature ensures that all Workflows requests in a session use the same IP address that was logged when the session was created. If the IP address doesn't match any request, the session is terminated and the Workflows admin must sign in again.

Deprecating App Password Health report

The App Password Health report has been deprecated. Use the Sign On Mode filter in the User App Access report to view SWA application password reset dates. The capability to ask users to reset SWA passwords has been removed.

Deprecating Recent Unassignments report

The Recent Unassignments report has been deprecated.

• Use the System Log event application.user_membership.remove to identify users who have been unassigned from an application. See Recently unassigned users.
• Use the User App Access report to identify users currently assigned to applications. See User App Access report.

Updates to App Usage report

The Application Usage report has been updated.

• The maximum number of rows in a CSV is increased to five million.
• The date range field uses the user's local time zone when determining results.
• The report downloads automatically when possible.

Improved JIT performance for directory integrations

JIT-enabled directory integrations now have improved response times for JIT requests.

Require MFA for Admin Console access

You can require multifactor authentication to access the Okta Admin Console. When you enable this feature, all Admin Console authentication policy rules that allow single factor access are updated to require multifactor authentication. See Enable MFA for the Admin Console. This feature will be gradually made available to all orgs.

Prevent new single-factor access to the Admin Console

This feature prevents admins from configuring any new single-factor access to the Admin Console. This feature is now enabled by default for all orgs.

System Log event updates

The following System Log events are now available:

• application.provision.group_push.deactivate_mapping
• system.agent.register
• security.attack_protection.settings.update
• system.self_service.configuration.update
• user.behavior.profile.reset
• system.identity_sources.bulk_upsert
• system.identity_sources.bulk_delete
• system.import.schedule
• system.import.user_match.confirm
• system.import.user_match.unignore
• system.import.user_match.update
• The application.lifecycle.update event now has the sessionIdleTimeoutMinutes and sessionMaxLifetimeMinutes fields. These fields add more session details to the event.

See Event types.

System Log event updates for Universal Directory

The following System Log events are now available:

• Linked object created
• Linked object deleted
• User profile updated
• Group owner updated
• Group owner removed

Identity Provider external names

Okta now warns admins if an Identity Provider (IdP) with custom attributes has an empty externalName field. Admins must now update the custom attribute through the API or delete it from the Admin Console and re-add it with the externalName field defined. This ensures that Okta receives the custom attribute when users enroll through Just-In Time provisioning scenarios.

Request throttling for jwks_uri

Okta has decreased the frequency at which it reloads JWKs from a customer's jwks_uri.

Rate limit for telephony inline hook

Okta now enforces by default a rate limit for the telephony inline hook to protect your org from toll-fraud attacks. See Connect to an external telephony service provider.

Enforce an email verification when a user's email changes

Each time that a user attempts to update their email, Okta sends an email to verify that their primary or secondary email address is up to date.

Authorization server default access policy deprecation

The authorization server default access policy is no longer provided in child orgs that are generated from APIs. Users can click Add New Access Policy to add policies. See Create access policies.