Okta Classic Engine release notes (Production)

Version: 2024.08.0

August 2024

Generally Available

IWA Agent, version 1.17.0

This version of the agent contains security enhancements. See Okta SSO IWA Web App version history.

Detect and block requests from anonymizing proxies

Orgs can now detect and block web requests that come from anonymizers. This helps improve the overall security of your org. See Enhanced dynamic zones.

New View client credentials admin role permission

The new View client credentials permission lets admins view OAuth client secrets. The View applications and their details permission no longer includes this privilege. This enhancement lets admins assign more granular permissions and reduce the risk of creating roles with too many privileges. This feature will be gradually made available to all orgs.

ADSSO authentication parameters

When a state token is used, Okta removes the fromURI parameter from the ADSSO authentication POST request.

View System Logs for Office 365 authentication events

You can now view authentication events in the System Log when using WS-Fed to authenticate through Office 365 active (WS-Trust-1.2) and username13 (WS-Trust-1.3) endpoints.

Updates to the Suspicious Activity report

The Suspicious Activity report has been updated to a System Log report. Use the System Log query to search and filter for unusual activities in your org. The query allows you to filter events with more precision and provides more information about each event than what the previous report provided. This information can help you better determine the validity of user actions. See Suspicious activity events.

Updates to Deprovisioning Details report

The Deprovision Details report has been updated to a System Log report. Use the System Log query to search and filter for deprovisioned users with more context and precision than the previous report. See Deprovision Details report.

Deprecating Current Assignments report

The Current Assignment report has been deprecated. Use the User App Access report to identify users currently assigned to applications. See User App Access report. Use the System Log event application.user_membership.remove to identify users who have been unassigned from an application. See Recently unassigned users.

Prevent new single-factor access to the Admin Console

This feature prevents admins from configuring any new single-factor access to the Admin Console. This feature will be gradually made available to all orgs.

System Log enhancement

Certain system log events now contain a new property called changeDetails in the target. When this property is populated, it reflects new, changed, or removed attributes of the target resource that has been modified. See changeDetails property.

System Log event updates

The following System Log events are now available:

  • application.provision.group_push.deactivate_mapping
  • system.agent.register
  • security.attack_protection.settings.update
  • system.self_service.configuration.update
  • user.behavior.profile.reset
  • system.identity_sources.bulk_upsert
  • system.identity_sources.bulk_delete
  • system.import.schedule
  • system.import.user_match.confirm
  • system.import.user_match.unignore
  • system.import.user_match.update
  • The application.lifecycle.update event now has the sessionIdleTimeoutMinutes and sessionMaxLifetimeMinutes fields. These fields add more session details to the event.

See Event types.

System Log event updates for Universal Directory

The following System Log events are now available:

  • Linked object created
  • Linked object deleted
  • User profile updated
  • Group owner updated
  • Group owner removed

Identity Provider external names

Okta now warns admins if an Identity Provider (IdP) with custom attributes has an empty externalName field. Admins must now update the custom attribute through the API or delete it from the Admin Console and re-add it with the externalName field defined. This ensures that Okta receives the custom attribute when users enroll through Just-In Time provisioning scenarios.

Request throttling for jwks_uri

Okta has decreased the frequency at which it reloads JWKs from a customer's jwks_uri.

Rate limit for telephony inline hook

Okta now enforces by default a rate limit for the telephony inline hook to protect your org from toll-fraud attacks. See Connect to an external telephony service provider.

Enforce an email verification when a user's email changes

Each time that a user attempts to update their email, Okta sends an email to verify that their primary or secondary email address is up to date.

Authorization server default access policy deprecation

The authorization server default access policy is no longer provided in child orgs that are generated from APIs. Users can click Add New Access Policy to add policies. See Create access policies.

Early Access

Require MFA for accessing Identity Governance admin apps

If your org uses Okta Identity Governance, you can require MFA for admins who access these first-party apps:

  • Okta Access Certifications
  • Okta Entitlement Management
  • Okta Access Requests Admin

If you have auto-enabled Early Access features in your org, MFA is automatically enforced for those apps. See Enable MFA for the Admin Console.

OAuth 2.0 security for invoking API endpoints

Okta Workflows users can now securely invoke API endpoints using OAuth 2.0 protocols and their Okta org authorization server. Compared with the existing token authorization option, this feature is more secure while also being easier to implement. Add the okta.workflows.invoke.manage scope to any new or existing app integration to make it eligible to invoke your API endpoint. See Invoke a flow with an API endpoint.

Fixes

  • When the display language was set to Japanese, some text on the Upgrade Okta Verify with Push window wasn’t translated. (OKTA-658461)

  • Some Identity Providers didn't share custom attributes with Okta when the externalName field was empty. (OKTA-713526)

  • The Sign-In Widget didn't display the correct client ID when a customized client ID was used. (OKTA-722623)

  • Users with a custom admin role that included the View Directory permission were unable to view the Directory Integration page in the Admin Console. (OKTA-733030)

  • In some cases, an Okta org edition couldn't be changed. (OKTA-741688)

  • Admins couldn't edit IP restrictions for tokens created by agents. (OKTA-745048)

  • Some Android, iOS, and iPadOS users couldn't enroll with Okta Verify when the Higher security methods enrollment option was enabled. (OKTA-745318)

  • In some instances, a rate limit was reached when assigning entitlements to a user. (OKTA-746095)

  • The Universal Logout endpoint (oauth2/v1/global-token-revocation) used the incorrect OAuth 2.0 scope. (OKTA-747477)

  • Some users couldn't sign in if the global session policy that applied to them was deleted. (OKTA-754352)

  • System Log events weren't produced when admins changed an app's Radius Authentication Protocol settings. (OKTA-755604)

  • Admins received report emails with links to empty CSV exports. (OKTA-756393)

Okta Integration Network

  • BRM (OIDC) is now available. Learn more.
  • Getty Images (SAML) now has additional ACS endpoints.
  • GitHub Enterprise Server is now called GitHub Enterprise Server (legacy).
  • Haystack (SAML) is now available. Learn more.
  • IBM AS/400 by Aquera (SCIM) is now available. Learn more.
  • INCRMNTAL (OIDC) is now available. Learn more.
  • Kuggar (OIDC) is now available. Learn more.
  • Pmovel (OIDC) is now available. Learn more.
  • Salesforce Social IdP was updated (OKTA-733640).
  • UKG Ready by Aquera (SCIM) is now available. Learn more.
  • Vinkey (OIDC) is now available. Learn more.
  • WebWork Time Tracker (SCIM) is now available. Learn more.
  • Wiz (API service) is now available. Learn more.

Weekly Updates

2024.08.1: Update 1 started deployment on August 19

Generally Available

Enforce MFA for Identity Governance admin apps update

The Enforce MFA for Identity Governance admin apps feature is available as a self-service Early Access feature only if the Enforce MFA to access the Admin Console feature is enabled.

Fixes

  • When admins viewed an OAuth client's secrets, Okta didn't trigger a System Log event. (OKTA-692600)

  • The Identity Providers filter was missing from the Profile Editor page for some users in orgs that had the Enable Custom Admin Roles for Identity Providers feature turned on. (OKTA-724750)

  • Super admins who were assigned permissions through a group assignments couldn't see the Password Hash Export option even when it was enabled in the org. (OKTA-736079)

  • The Allow Unknown Devices button wasn't visible on the user's profile page. (OKTA-746893)

  • Two Session timeout warning modals appeared when a user's session was about to expire. (OKTA-748766)

  • Admins couldn't search for AuthenticatorContext in the user.authentication.auth_via_mfa event in the System Log. (OKTA-750669)

  • The activation link in the Welcome email didn't always work. (OKTA-752981)

  • On the Roles, Resources, and Admins tabs on the Administrators page and in the Edit resources to a standard role dialog, admins couldn't use an ampersand (&) in their search. (OKTA-753904)

  • When a user verified or deleted a mobile phone number, it wasn't recorded in the System Log. (OKTA-790334)

Okta Integration Network

  • Anzenna has a new icon.
  • Brainier LMS by Aquera (SCIM) is now available. Learn more.
  • Cezanne (SCIM) is now available. Learn more.
  • CloudAcademy has been rebranded as QA.
  • DeleteMe (SCIM) now supports creating and updating users.
  • dscout (SCIM) is now available. Learn more.
  • Floqast has a new icon.
  • IBM AS 400 by Aquera has been rebranded as IBM OS/400 on AS/400 (IBM i on Power Systems) by Aquera.
  • Jellyfish (SCIM) has two new default user roles for the roles attribute.

2024.08.2: Update 2 started deployment on August 26

Fixes

  • Custom Boolean fields appeared as a checkbox instead of a dropdown. (OKTA-185091)

  • When two or more OIDC Identity Providers (IdPs) were configured in an org, one of the IdPs' authorization codes could be processed by another IdP. (OKTA-672676)

  • A blank warning message appeared when a report was blocked by a browser's pop-up blocker. (OKTA-692566)

  • Some admins couldn't view the Edit profile and mappings button on the Edit IdP page when the identity provider custom admin role was enabled. (OKTA-747255)

  • Some group admins couldn't use the CSV uploader. (OKTA-756654)

  • When a user verified a recovery factor, the event wasn't logged in the System Log. (OKTA-790370)

  • Sometimes when a user changed their password, the change wasn't logged in the System Log. (OKTA-791175)

Okta Integration Network

  • Acsense (API service) is now available. Learn more.
  • Backupta (OIDC) is now available. Learn more.
  • Cisco User Management Connector Gov (SCIM) is now available. Learn more.
  • Clutch Security (API service) now has the okta.oauthIntegrations.read scope.
  • Figma (SCIM) is now available. Learn more.
  • Greenhouse Onboarding by Aquera (SCIM) is now available. Learn more.
  • myComply (OIDC) is now available. Learn more.
  • Pendo (SAML) has a new integration guide.
  • Reftab Discovery (API service) now has the okta.logs.read scope.
  • Supernormal (SAML) is now available. Learn more.
  • Syncly, Inc (OIDC) is now available. Learn more.

2024.08.3: Update 3 started deployment on September 3

Generally Available

Sign-In Widget, version 7.21.1

For details about this release, see the Sign-In Widget Release Notes.

For more information about the Widget, see the Okta Sign-In Widget Guide.

Improved event reporting

The IP reputation data is now reported more frequently in System Log events. You can find this information in the DebugData or SecurityContext sections of the event.

Fixes

  • Admins couldn't create routing rules using the Policy API due to a cache issue. (OKTA-712397)

  • Group membership changes in Okta were sometimes incomplete in ServiceNow when Group Push was used. (OKTA-716692)

  • When the display language was set to Japanese, some text on the Create new resource set page wasn't translated. (OKTA-742653)

  • Okta didn't check whether operating system versions were greater than or equal to a required version. (OKTA-743658)

  • Provisioning of a user from a source to a target org failed in some Org2Org configurations because the user in the target org was still activating. (OKTA-747231)

  • When multiple PIV user identities were enabled, active identities with an expired password didn't show up as an option when a user signed in. (OKTA-791790)

  • When a user entered the wrong password to sign in to an org using delegated authentication to LDAP, the login cache was cleared.(OKTA-799642)

Okta Integration Network

  • Adyen by Aquera (SCIM) is now available. Learn more.
  • CloudAcademy (SAML) has a new logo, display name, support for additional endpoints.
  • Command Zero (API service) now has additional scopes.
  • Currents (SCIM) is now available. Learn more.
  • DeleteMe now has SCIM functionality.
  • Experience.com (OIDC) now has additional redirect URIs.
  • TerraTrue (SCIM) now supports group push.
  • Summize (SCIM) now has the openid scope.

Version: 2024.07.0

July 2024

Generally Available

Okta Provisioning agent, version 2.1.0

This release of the Okta Provisioning agent contains vulnerability fixes. See Okta Provisioning agent and SDK version history.

Okta Active Directory agent, version 3.18.0

This release of the Okta Active Directory agent uses OAuth 2.0 for authorization and OAuth 2.0 Demonstrating Proof-of-Possession (DPoP) to securely communicate with Okta. Agents are now registered through the OAuth 2.0 device registration flow and operate independently from the account used to register them. This release also includes security enhancements and bug fixes. See Okta Active Directory agent version history.

New maximum session lifetime for SAML apps

Users can now configure the maximum app session lifetime for SAML apps.

Improved JIT performance for directory integrations

JIT-enabled directory integrations now have improved response times for JIT requests.

New Manage API tokens admin role permission

The new Manage API tokens permission lets admins view, revoke, and update the principle rate limit for a token. This enhancement lets admins assign more granular permissions and reduce the risk of creating roles with too many privileges.

Protected actions in the Admin Console

The protected actions feature provides an additional layer of security to your org. It prompts admins for authentication when they perform critical tasks in the Admin Console and helps ensure that only authorized admins can perform these tasks. Super admins can configure the authentication interval for their org. See Protected actions in the Admin Console and MFA for protected actions in the Admin Console. This feature will be gradually made available to all orgs.

Active Directory Bidirectional Group Management

Bidirectional Group Management for Active Directory (AD) allows you to manage AD groups from within Okta. You can add or remove users from groups based on their identity and access requirements. This ensures that changes made to user access in Okta are reflected in AD. When you use Okta Access Certifications to revoke a user's membership to an AD group, the removal is reflected in AD. Okta can only manage group memberships for users and groups imported into Okta using the AD integration. It isn't possible to manage users and groups that weren't imported through AD integration. It's also not possible to manage users and groups that are outside the organizational unit's scope for the integration using this feature. See Bidirectional Group Management with Active Directory.

MyAccount Management scopes

The MyAccount Management scopes are no longer added to custom authorization servers by default when an authorization server is created.

Enhanced System Log events table

The value of a client IP address, if present, is now shown below the actor in the events table.

Network Zones and API token restrictions

You can no longer update network zones so they're invalid for use with an API token. This applies only to network zones that are used as restrictions to API tokens. You can update network zones if you first remove them from the API token restriction. These zones can't be deactivated, deleted, blocklisted, or made anything other than an active IP zone.

Event hook limit increased

The limit on active event hooks per org has been increased from 10 to 25. See Create an event hook and Workflows System limits.

New System Log events for Workflows subfolder actions

Improved folder organization gives admins the flexibility to drag and drop folders into other folders or move them up to become a top-level folder. See Move a folder into another folder. When this action happens, the new workflows.user.folder.move event type appears in the System Log. See the Event Types API.

Additional System Log event information

The user.account.privilege.grant System Log event now includes information about the assigned role and target, and indicates if it was a group or individual role assignment.

Early Access

Entitlement Management with Okta Provisioning Agent with SCIM 2.0 support

This agent supports Entitlements Management for app integrations that have enabled Governance Engine. This allows the provisioning of entitlements between Okta and on-premises apps.

Fixes

  • System Log events for API token management didn't include the token's network restriction information in the debug context. (OKTA-724469)

  • When editing a user's assignments, roles with numeric values appeared in the wrong position in the Role dropdown menu. Selecting Not mapped set the role to 629. (OKTA-729800)

  • The enrollment instructions on the Google Authenticator page incorrectly mentioned barcode instead of QR code. (OKTA-735775)

  • Errors appeared on a token's page when a network zone that was used by a token was deleted. (OKTA-736539)

  • Push Group jobs that included deleting group memberships failed if their execution time exceed one minute. (OKTA-741405)

  • The Back to Settings button wasn't visible on the End User Settings page. This occurred when managing the user's authenticators if the user completed MFA using a Smart Card or IdP authenticator. (OKTA-743091)

  • The Okta logo was missing from email notifications for protected actions. (OKTA-743776)

  • The Generated Password Health report was incomplete. (OKTA-746008)

  • The number of group members returned from the /api/v1/groups/<group_id>/users API call was inconsistent with the database query count of the same group. (OKTA-747426)

Okta Integration Network

  • Aiven (SCIM) now has sync password support.
  • Lever by Aquera (SCIM) is now available. Learn more.
  • RICOH Smart Integration (SCIM) is now available. Learn more.

Weekly Updates

2024.07.1: Update 1 started deployment on July 22

Generally Available

New IP service categories added

Additional IP service categories have been added to the enhanced dynamic zones IP service category list. See Supported IP service categories.

Fixes

  • Some text strings on the General Settings page for custom OIDC apps weren't translated. (OKTA-739262)

  • When an admin clicked Show more on the Administrator assignment by role page, additional admins with the super admin role didn't appear. (OKTA-743378)

  • When a user tried to access OneDrive from the app on the Okta End-User Dashboard, an error occurred if there was an active Office 365 session. (OKTA-744748)

  • When the display language was set to Japanese, some text on the Deactivate People page wasn't translated. (OKTA-745642)

  • The Reset Password modal had a grammatical error. (OKTA-747866)

  • If an API request in Preview contained any malformed syntax within the query string, the request was still processed. (OKTA-748246)

  • The EAP-TTLS option wasn't available for all RADIUS app integrations. (OKTA-750253)

Okta Integration Network

  • Call2Action (OIDC) is now available. Learn more.
  • ClickUp (SCIM) is now available. Learn more.
  • Clutch Security (API service) is now available. Learn more.
  • Cortex (SCIM) is now available. Learn more.
  • Exaforce (API service) is now available. Learn more.
  • LiveEdge Cloud (SAML) is now available. Learn more.
  • MangoApps (SAML) now has configurable domain support for endpoints.
  • MangoApps (SCIM) is now available. Learn more.
  • NinjaOne (SCIM) is now available. Learn more.
  • Pendo (SAML) has a new integration guide.
  • SGNL (CAEP Hub) (API service) is now available. Learn more.
  • Teamgo Visitor Sign-in (SAML) is now available. Learn more.
  • UKG Pro by Aquera (SCIM) is now available. Learn more.
  • Vanta (SCIM) is now available. Learn more.
  • Wundergraph Cosmo (SCIM) is now available. Learn more.

2024.07.2: Update 2 started deployment on August 5

Fixes

  • When the display language was set to Japanese, some text on the Delegated Authentication page wasn’t translated. (OKTA-658397)

  • Some users were redirected to the End-User Dashboard instead of the application they tried to access. (OKTA-717246)

  • Some customers signing in to Okta-hosted custom domains with the first or second-generation Sign-In Widget received communications from Monotype Imaging Inc. about licensing for the Proxima Nova font. (OKTA-731216)

  • When the Assign and revoke super admin role protected action was enabled and an admin revoked the super admin role from the Admins tab, they weren’t prompted for additional MFA. (OKTA-733379)

  • If API provisioning was enabled without enabling Update User Attributes, Docusign app usernames were set to the users' full names rather than email addresses. (OKTA-742584)

  • When the display language was set to Japanese, some text on the Sign on tab for the Google Apps instance wasn’t translated. (OKTA-742635)

  • When the display language was set to Japanese, some text on the Create new resource set page wasn’t translated. (OKTA-742653)

  • Some of the help links on the Downloads page weren’t correct. (OKTA-744866)

  • The SAML single logout URL wasn't embedded in the iFrame after the correct trusted origin was configured. (OKTA-744874)

  • When users tried to create SSWS tokens, Enhanced Dynamic Zones appeared in the list but users couldn't select them. (OKTA-745607)

  • The right-click menu didn't work in the Admin Console. (OKTA-745918)

  • No Profile Update event was added to the System Log when an AD-sourced user signed in to Okta for the first time. (OKTA-747439)

  • Users without the Okta Access Requests Admin app couldn't view any app instance pages. (OKTA-748462)

  • The protected actions email notification sometimes contained a broken link. (OKTA-749232)

  • In orgs using delegated authentication with either AD or LDAP, attempting to sign in when the username contained a wildcard character (*) resulted in an HTTP 500 error. (OKTA-749548)

Okta Integration Network

  • Cisco User Management for Secure Access (SCIM) is now called Cisco User Management Connector.
  • Clockwise (SCIM) now has Bookmark mode.
  • CoderPad has new SAML and SCIM integration guides, and the SWA app was updated.
  • Databricks has a new icon.
  • Exaforce (API service) has updated scopes.
  • getregistered (SAML) is now available. Learn more.
  • Nulab Pass (Backlog Cacoo Typetalk) (SCIM) is now available. Learn more.
  • Opensurvey Dataspace (OIDC) now supports IdP-initiated SSO.
  • Pleo (SCIM) is now available. Learn more.
  • Prowler (SAML) has a new icon.
  • Retail Zipline (SAML) now supports Single Logout (SLO) and has a new integration guide and icon.
  • Staircase AI (SCIM) is now available. Learn more.
  • WebWork Time Tracker (SCIM) is now available. Learn more.
  • Wiz (API service) is now available. Learn more.
  • Zip has an updated API.

Version: 2024.06.0

June 2024

Generally Available

Deprecated user profile attributes for Office 365

The following user profile attributes are no longer supported for Office 365:

  • AuthOrig
  • DLMemRejectPerms
  • DLMemSubmitPerms
  • IsTrackingChanges
  • UnauthOrig

See Supported user profile attributes for Office 365 provisioning.

Breached password protection

Protect your organization from the impact of passwords that have been compromised. If Okta determines that an Okta username and password combination has been compromised based on the data collected by our internal threat intelligence pipeline, Okta records a System Log event, expires the user's credentials, and requires the user to update their password before they can use their password to sign in again. See Breached password protection.

Rate limit update for using Okta fallback telephony provider

Orgs that use an active telephony inline hook now have a heavy rate limit for the Okta fallback mechanism.

Federation Broker Mode has been removed from OAuth Service Clients

The Federation Broker Mode option has been removed from OAuth Service Clients.

DPoP available when creating OIDC apps

You can now require the Demonstrating Proof of Possession (DPoP) condition when you create an OIDC app. Previously, this option was only available after you create the app. This streamlines the process of creating and securing OIDC apps.

Increase to Inline Hooks

The maximum number of inline hooks an org can create is now 100. The previous maximum was 50. See Add an inline hook .

Support for migration to Microsoft Graph

You can now migrate your existing Office 365 WS-Fed Manual app instances to Microsoft Graph by using the migration banner on the app dashboard.

Early Access

Access request conditions and resource catalog

This feature provides a new method to streamline your access requests for apps, entitlements, and groups from the app's profile page in the Admin Console.

As super admins and access request admins, you can set up app-specific access request conditions that define requester scope, access level, expiration for the access level, and the approval sequence. Based on your active conditions, requesters can request access to an app or app access level directly from their End-User Dashboard.

Compared to request types, this approach allows you to reuse existing relationships between users, groups, and apps defined in Okta to govern access instead of recreating these in Okta Access Requests. This feature also integrates the app catalog in the End-User Dashboard with Access Requests to make the process of requesting access intuitive and user-friendly. See Access Requests and Create requests.

You can also view and edit a user's access duration for the app if the app has Governance Engine enabled. See Manage user entitlements.

Workspace ONE Device Trust orgs using Classic Engine can now migrate to Identity Engine

Admins can now migrate their existing Workspace ONE Device Trust configurations to Identity Engine. This feature unblocks Classic Engine tenant migrations by allowing both the existing admin configuration and the end-user authentication flows to be migrated when previously integrated with our Workspace ONE Device Trust feature. See Migrate Workspace ONE SAML-based mobile device trust.

Fixes

  • The list of languages in Customizations SMS wasn't translated. (OKTA-626381)

  • For custom SWA and SAML apps, the help links on the ApplicationProvisioning tab were incorrect. (OKTA-661972)

  • When an admin attempted to create a profile with a username that contained invalid characters, an unhelpful error message appeared in orgs using a custom character restriction for usernames. (OKTA-680557)

  • Users could bypass admin approval from the import screen to sign in to Okta when Active Directory Just-In-Time provisioning was disabled. (OKTA-706392)

  • The Disable Force Authentication option was ignored for org2org apps using the SAML sign-in mode and AMR claims mapping. (OKTA-711957)

  • Active Directory incremental imports were converted to full imports when a new OrganizationUnit was added or an existing OrganizationUnit was renamed. (OKTA-729735)

  • Admins couldn't enable the Enforce MFA to access the Admin Console feature in some orgs. (OKTA-730170)

  • New Dropbox Business instances were missing a profile attribute. (OKTA-733503)

  • The Provisioning tab wasn't saved when admins created Office 365 applications, and Japanese translations of the Session Lifetime for SAML apps feature didn't appear. (OKTA-735840)

Okta Integration Network

  • candidate.fyi (OIDC) is now available. Learn more.
  • Edify (OIDC) now has sign-in URLs.
  • KiteSuite (SAML) is now available. Learn more.
  • ParkZapp (W) (OIDC) is now available. Learn more.
  • ShareThis (SWA) was updated. (OKTA-723868)
  • Umbrella Faces (SCIM) is now available. Learn more.

Weekly Updates

2024.06.1: Update 1 started deployment on June 24

Generally Available

Sign-In Widget, version 7.19.4

For details about this release, see the Sign-In Widget Release Notes.

For more information about the Widget, see the Okta Sign-In Widget Guide.

Fixes

  • Some text on the Reset Password for a user page in the Admin Console wasn't translated. (OKTA-613937)

  • WebEx replaced the API used to retrieve session types with a REST API, which requires the integration to use OAuth for authentication. (OKTA-701227)

  • Clicking Sync Entitlements on the Governance tab displayed an error. (OKTA-720049)

  • Sometimes, concurrent Agentless Desktop SSO JIT operations for a user broke app assignments, which required admin intervention to correct. (OKTA-722648)

  • When admins manually confirmed users imported from a SCIM app, they were assigned apps that they weren't authorized to access. (OKTA-724859)

  • Opening a profile in a new tab from the Profile Editor displayed a list of profiles instead. (OKTA-725640)

  • The System Log didn't record the Network Zone of the IP at the time of global sign-on policy evaluation. (OKTA-727200)

  • Sometimes, when users who hadn't enrolled in On-Prem MFA attempted to sign in using an RSA SecurID passcode in the New PIN Mode, the passcode verification failed. (OKTA-727554)

  • Processing GeneralizedTime attributes while confirming new users imported from LDAP to Okta resulted in an error. (OKTA-728398)

  • Users could reuse their temporary password. (OKTA-729189)

  • When the display language was set to Japanese, some role permissions weren't translated on the Admin role assignments screen. (OKTA-730832)

  • When the display language was set to Japanese, some text on the Administrators pages wasn't translated. (OKTA-730834)

  • Some customers signing in to Okta-hosted custom domains with the first or second-generation Sign-In Widget received communications from Monotype Imaging Inc. about licensing for the Proxima Nova font. (OKTA-731216)

  • When an admin clicked Show more on the Administrator assignment by role page, additional admins with the super admin role didn't appear. (OKTA-731416)

  • Some Group Push operations for ServiceNow failed due to timing out. (OKTA-731707)

  • Workday writeback operations failed when area codes were included in the request. (OKTA-733361)

  • The End User Browser Plugins pane on the Downloads page used an outdated icon for Chromium Edge. (OKTA-733813)

  • The security.breached_credential.detected System Log event had a typo. (OKTA-736552)

  • The Okta RADIUS Server Agent was updated for a security fix. Upgrade to version 2.22.0. (OKTA-737441)

  • Sometimes, Group Assignments involving the Everyone group failed because of a non-performant query. (OKTA-742083)

  • Full imports for OIG-enabled apps sometimes caused users to be unexpectedly deprovisioned. (OKTA-742996)

Okta Integration Network

  • Accend (OIDC) has a new icon and description.
  • Actioner (OIDC) is now available. Learn more.
  • Aerofiler (SAML) is now available. Learn more.
  • Aerofiler (OIDC) has a new icon and OIDC endpoints.
  • Aiven (SAML) is now available. Learn more.
  • Aiven (SCIM) is now available. Learn more.
  • Amazon WorkDocs by Aquera (SCIM) has a new icon.
  • Amazon WorkMail by Aquera (SCIM) has a new icon.
  • Autotab (OIDC) is now available. Learn more.
  • Bright Breaks (SCIM) is now available. Learn more.
  • Brivo Identity Management (SCIM) has a new display name, base URL, integration guide, app profile, and mappings.
  • Codefresh by Aquera (SCIM) has a new icon.
  • Cyolo SRA (SAML) is now available. Learn more.
  • Descope (OIDC) is now available. Learn more.
  • Descope (SCIM) is now available. Learn more.
  • Detexian SSPM (API service) is now available. Learn more.
  • Docker (SAML) is now available. Learn more.
  • DOTS (SAML) is now available. Learn more.
  • Elastic Agent (API service) is now available. Learn more.
  • Favro (SCIM) is now available. Learn more.
  • Floqast (SAML) is now available. Learn more.
  • GitHub Enterprise Managed User - ghe.com (SAML) is now available. Learn more.
  • GitHub Enterprise Managed User - ghe.com (SCIM) is now available. Learn more.
  • goFLUENT (SAML) is now available. Learn more.
  • JazzHR by Aquera (SCIM) supports profile sourcing.
  • Lark (SCIM) is now available. Learn more.
  • Lattice HRIS (SCIM) is now available. Learn more.
  • Manopay (OIDC) has a new integration guide and supports IdP-initiated flows.
  • Obsidian Security (API service) is now available. Learn more.
  • PerimeterX (SCIM) is now available. Learn more.
  • Plumm (SCIM) has a new integration guide.
  • ProdPad by Aquera (SCIM) has a new icon and support URL.
  • Prowler (SAML) is now available. Learn more.
  • Rezonate Security (API service) can now read network zones data.
  • Scrut Automation (OIDC) is now available. Learn more.
  • Select Admin (OIDC) is now available. Learn more.
  • ShareCal (SAML) has a new ACS URL.
  • SmarterSends (SAML) is now available. Learn more.
  • SwaggerHub by Aquera (SCIM) has a new icon and support URL.
  • TriNet by Aquera (SCIM) supports profile sourcing.
  • Trotto Go Links (SAML) has a new icon and integration guide.
  • UKG HR Service Delivery by Aquera (SCIM) has a new icon.
  • WebWork Time Tracker (SAML) is now available. Learn more.
  • WonderProxy (SAML) is now available. Learn more.
  • Workable Recruiting by Aquera (SCIM) supports profile sourcing and has a new icon, description, and support URL.
  • Wundergraph Cosmo (SCIM) is now available. Learn more.
  • Xakia (SCIM) has a new icon and supports group push.
  • Xero by Aquera (SCIM) has a new icon and support URL.

2024.06.2: Update 2 started deployment on July 8

Generally Available

Sign-In Widget, version 7.19.6

For details about this release, see the Sign-In Widget Release Notes.

For more information about the Widget, see the Okta Sign-In Widget Guide.

Update to Universal Directory attribute limits

Universal Directory has increased the limit of the number of attributes per org.

Fixes

  • The help links on the Downloads page weren't localized. (OKTA-614688)

  • Admins without the View agents permission could see the Agents page. (OKTA-651508)

  • Setting the locale to Japanese resulted in some issues when working with CSV directories. An error string appeared when scheduling weekly imports and there was insufficient space to enter which hour the import should be performed. (OKTA-656418)

  • Group Push failed for Samanage when group names contained spaces. (OKTA-668498)

  • Password reset token expiration time was not localized for some orgs. (OKTA-673386)

  • Self-service unlock with email didn't work if a user's AD account was locked but their Okta account was unlocked. (OKTA-720267)

  • The notification email contained the modified IP address when X-Forwarded-For Header was modified. (OKTA-722815)

  • The oauth2/instrospect endpoint hit rate limits without logging it in the System Log. (OKTA-726680)

  • During JIT reactivation through IdP, group app assignment reconciliation wasn't processed asynchronously, which caused an unexpected delay in the sign-in process. (OKTA-729103)

  • Attempting to unassign a Google Workspace license from a user who didn't have that license resulted in an error message. (OKTA-731570)

  • When an app was created by an API call with an existing clientId in the request payload, this didn't match the way an app was created in the UI. This resulted in the wrong app rate limit displayed in the rate limit dashboard. (OKTA-736117)

  • On the Edit resource to a standard role page, resources with long names were cut off. (OKTA-736821)

  • When an admin uploaded a file while configuring an app, the dates that appeared on the page weren't translated. (OKTA-736916)

  • The Okta provisioning API didn't accept user IDs that contained a backslash (\) character when users were provisioned to Org2Org instances. (OKTA-737258)

  • NetSuite imports failed for new app instances that had Governance Engine enabled if users had an inactive department, location, or class. (OKTA-737844)

  • Sometimes a group owner wasn't resolved correctly and an invalid error was displayed on the Group Owner tab for the group. (OKTA-738426)

  • Gemini licenses for Google Workspace were unavailable. (OKTA-739005)

  • The wrong font was used for text in the Sign-In Widget. (OKTA-742100)

  • When running an import from Active Directory into Okta, the DirSync stopped working, which resulted in users being removed from multiple groups within the Office 365 app. (OKTA-742905)

  • Full imports for OIG-enabled apps sometimes caused users to be unexpectedly deprovisioned. (OKTA-742996)

  • When trying to access OneDrive using the app on the Okta Dashboard, an error occurred if there was an active Office 365 session. (OKTA-744748)

  • In Groups API queries, some users who weren't in the "Everyone" group were missing group memberships.(OKTA-747426)

Okta Integration Network

  • Authomize Identity Security (API service) has a new icon, display name, description, website, integration guide, and okta.policies.read scope.
  • Cisco Identity Intelligence - Read-Write Management (API service) is now available. Learn more.
  • Feishu (SCIM) is now available. Learn more.
  • Forethought Dashboard (SCIM) is now available. Learn more.
  • Funnel.io (SAML) has a new icon and integration guide.
  • Klue (SAML) is now available. Learn more.
  • Klue (SCIM) is now available. Learn more.
  • KSOC (OIDC) is now available. Learn more.
  • Medicat One (OIDC) is now available. Learn more.
  • Okta Identity Security Posture Management (API service) is now available. Learn more.
  • Own (SAML) is now available. Learn more.
  • Rewind Backups (API service) is now available. Learn more.
  • Seculio (SAML) is now available. Learn more.
  • Thoropass (SAML) is now available. Learn more.
  • TriNet Zenefits by Aquera (SCIM) is now available. Learn more.
  • WINN.AI (OIDC) is now available. Learn more.
  • Workshop (SAML) is now available. Learn more.
  • Zip (SCIM) now has the approvalLevel attribute.