Preview

  Current Upcoming
Production 2020.09.3 2020.09.4 Production release is scheduled to begin deployment on October 5
Preview 2020.09.4

2020.10.0 Preview release is scheduled to begin deployment on October 7

September 2020

2020.09.0: Monthly Preview release began deployment on September 2

* Features may not be available in all Okta Product SKUs.

Content

Generally Available Features

New Features

New features for SuccessFactors integration

The following new features have been added to the SuccessFactors integration:

  • Time zone based pre-hires and deactivations: Admins can deactivate SuccessFactors users and import pre-hires into Okta based on the time zone of their location.
  • Incremental imports: Incremental imports improve performance by importing only users who were created, updated, or deleted since the last import.

See Learn about SAP SuccessFactors Employee Central data provisioning.

Default sign on rule set to Deny in Client Access Policies for new Office 365 app instances

In Client Access Policies for new Office 365 app instances, the Default sign on rule is now set to Deny access (formerly set to Allow). Additionally, we've provided a rule above the Default sign on rule that allows access to only web browsers and apps that support Modern Authentication. This change is designed to help customers implement more secure policies by default. Note: Existing O365 app instances are unaffected by this change. For more information, see Get started with Office 365 sign on policies.

New features for HealthInsight

  • Administrators can now enable end user email notifications when an end user changes or resets their password. See General Security and HealthInsight.
  • HealthInsight now includes a recommendation for admins to enable Password Changed email notifications if the notification isn't yet enabled for the org. See Password changed notification for end users.
  • HealthInsight now displays a suspicious sign-in count within the recommendation that users enable ThreatInsight in block mode. See Okta ThreatInsight

Password requirements formatting

When setting a password, requirements are now shown in a list format rather than a sentence format.

Self-Service improved plugin onboarding experience

The improved Okta Browser Plugin onboarding experience for new end users is now available on all web browsers except Safari. After installing the plugin, new end users will be automatically directed to the sign in page or will have their dashboard refreshed, and will be shown an introduction banner on their dashboard. See Install the Okta Browser Plugin.

OAuth Consent enabled as event hook

The event app.oauth2.as.consent.grant is now eligible for use as an event hook.

Early Access Features

New Features

New Recent Activity page on the new Okta end-user dashboard

The Recent Activity page provides end users with a summary of recent sign-in and security events for their Okta account. End users can also report suspicious activity to their Okta admin by clicking I don’t recognize this. See Recent Activity.

Multiple active user statuses for SuccessFactors integration

Support for multiple active user statuses: When importing users from SuccessFactors into Okta, admins can now select more than one active user status, such as Leave of Absence.

See Learn about SAP SuccessFactors Employee Central data provisioning.

Vendor-specific attributes

RADIUS agents now support vendor specific attributes. With this feature, admins can use optional settings to configure vendor specific attributes to include group membership. See Configure group response in the following topics:

Salesforce REST OAuth

Admins can now upgrade to the latest version of Salesforce. OAuth authentication will be now used for Provisioning and Imports.

Fixes

General Fixes

OKTA-276604

Filtering groups that were pushed by group also displayed groups that were pushed by name.

OKTA-312642

On the Activate User page, Search by Group didn't work if the search term included the vertical bar sign |.

OKTA-319877

In some cases, creating a custom SAML or SWA app using a bearer token failed.

OKTA-323045

Okta Workflows didn’t restrict application assignment to super admins.

OKTA-324983

When defined for an MFA Enrollment policy, the App Condition was not enforced when a user signed in to an application.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • Autotask (OKTA-318506)

  • ccLink Provider Portal (OKTA-324140)

  • Chubb Personal Insurance (OKTA-323264)

  • Earth Class Mail (OKTA-322840)

  • Jobvite (OKTA-318586)

Applications

Application Updates

  • The Zoom SCIM app schema is updated. See Configuring Zoom with Okta for more information.
  • Provisioning support has been removed from the BigMachines and GoToMeeting apps due to their low customer usage, lack of standards based integration, and high supportability cost.

New Integrations

New SCIM Integration Applications

The following partner-built provisioning integration apps are now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified applications

  • Australian Access Federation (OKTA-317867)

  • Estateably (OKTA-324912)

  • Hopin (OKTA-324248)

  • Signal AI (OKTA-322928)

  • SocialHP (OKTA-322572)

  • Thematic (OKTA-322576)

OIDC for the following Okta Verified applications

Weekly Updates

September 10

Fixes

General Fixes

OKTA-307089

When attempting to reset a user's password using the password reset link, admins received a 500 Internal Server error rather than the correct error message if the user's email address was invalid.

OKTA-318040

The voice call used for MFA with Twilio as the call provider wasn't translated in Simplified Chinese, Traditional Chinese, and Portuguese.

OKTA-321794

App Admins who were granted permissions through the group assignment API could see all apps in the OIN catalog when adding an app even though they didn't have the permissions to create them.

OKTA-324295

Inline hooks that should have updated multiple user attributes only updated one.

OKTA-326226

The Origin header value was missing from the System Log event for the user.session.start debug context.

OKTA-326955

When a geographical network zone that included Okta routers was added to an IP blacklist zone, all requests to the org were blocked.

OKTA-326962

The On-Prem MFA agent was inconsistent with other agents in how often it conducted system health checks.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • ADP Portal (Employee) (OKTA-325832)

  • Bananatag (OKTA-324700)

  • ClearCompany (OKTA-323156)

  • Ecogent (OKTA-324473)

  • Figma (OKTA-324979)

  • Fullstory (OKTA-324977)

  • LucidPress (OKTA-322083)

Applications

New Integrations

New SCIM Integration Applications

The following partner-built provisioning integration app is now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified applications

  • Cloudvisor.io (OKTA-322418)

  • Indition (OKTA-321249)

  • KeySix (OKTA-322969)

  • Zenefits (OKTA-322575)

SWA for the following Okta Verified applications

  • BeyondID (OKTA-312394)

  • Tecnis (OKTA-309904)

OIDC for the following Okta Verified application

September 17

Fixes

General Fixes

OKTA-190533

Events were missing from the System Log when Identity Providers were added, updated, activated, deactivated, or deleted.

OKTA-284904

Some groups didn’t render properly under Directory > Groups after a group rule was deleted.

OKTA-328123

Importing users from SuccessFactors failed with a Java exception error.

App Integration Fixes

The following SWA app was not working correctly and is now fixed

  • SAP Litmos (OKTA-328160)

Applications

Application Update

  • The AlertMedia SCIM app guide link has been updated.
  • The Zepl OIDC app has been updated to include the Initiate Login URI value.

New Integrations

New SCIM Integration Applications

The following partner-built provisioning integration apps are now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified applications

  • Encoding (OKTA-296011)
  • MediaPlatform (OKTA-328133)
  • ProWriters Cyber IQ (OKTA-328138)
  • Pubble (OKTA-322567)
  • SparkPost (OKTA-326370)
  • Vote.gov (OKTA-327834)

OIDC for the following Okta Verified applications

September 23

Fixes

General Fixes

OKTA-290250

The directNumber value wasn't correctly imported from RingCentral.

OKTA-309276

On the Add Apps page of the new Okta End-User Dashboard, the placeholder text in the search field was misleading.

OKTA-309423

On the Okta End-User Dashboard, app notes weren’t visible for bookmark apps that were assigned through self-service.

OKTA-318189

When using the LDAP interface to view user objects with empty middle names, additional spaces were present in the Common Name (CN) field even though they weren't present in the CN that was returned with an API call.

OKTA-320453

Updating a routing rule failed when a network zone was deleted before removing it from the routing rule.

OKTA-322271

On the new Okta End-User Dashboard, users could auto-launch SWA apps configured with the setting Administrator sets username, user sets password without being prompted to update their credentials.

OKTA-328536

For some orgs that stopped setting up a custom URL domain partway through the process, completing the setup later failed.

OKTA-329650

On the new Okta End-User Dashboard, some app card logos were oversized.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • Alexa (OKTA-330529)

  • Jobvite (OKTA-328688)
  • TransUnion (OKTA-328858)

Applications

Application Update

  • The Internap Portal app is deprecated. This app is rebranded as INAP.

New Integrations

New SCIM Integration Application

The following partner-built provisioning integration app is now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified applications

  • Estateably (OKTA-324912)
  • Optymyze (OKTA-326879)
  • Query.ai (OKTA-325342)

SWA for the following Okta Verified applications

  • Clarity (OKTA-301636)
  • Horizon (OKTA-330251)
  • TSheets (OKTA-322853)

OIDC for the following Okta Verified applications

  • Chargifi: For configuration information, see Chargifi documentation here (you need a Chargifi account to access this documentation).

  • WarehouseTWO: For configuration information, see How to Enable Okta Login.

September 30

Fixes

General Fixes

OKTA-306373

Imports from UltiPro got stuck in the Queued status.

OKTA-309646

When adding an Access Policy to an Authorization Server, using scrollbars to navigate caused search criteria to be lost and scrollbars to disappear.

OKTA-310688

Searching groups by name on the Push Groups tab returned duplicate search results.

OKTA-315564

An internal server error was thrown and the System Log didn't record an event when sending a self-service account unlock or password reset email failed due to an invalid email recipient. A System Log event is now added to notify the admin.

OKTA-324204

Selecting Request Integration in the Okta Bookmark App Settings pane had no effect.

OKTA-325469

New users provisioned from Okta to DocuSign couldn’t send documents despite having correct permissions.

OKTA-325492

Reactivated users couldn’t access apps that were assigned their group while they were inactive.

OKTA-332102

User activations were logged erroneously as user.account.privilege.revoke in the System Log.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • Kingsley Associates Portal (OKTA-331176)

  • MessageBird (NL) (OKTA-330524)

  • PaloAlto Networks Support (OKTA-329881)

  • Pond5 (OKTA-330614)

  • The Washington Post (OKTA-330607)

  • Trello (OKTA-330012)

  • Upwork (OKTA-331969)

  • Wells Fargo (Commercial Electronic Office) (OKTA-330311)

Applications

New Integrations

New SCIM Integration Applications

The following partner-built provisioning integration apps are now Generally Available in the OIN as partner-built:

  • Sparkpost: For configuration information, see SCIM User Provisioning Through Okta.

  • Gong: For configuration information, see Gong documentation here (you need a Gong account to access this documentation).

SAML for the following Okta Verified applications

  • WorkSafe (OKTA-331532)
  • Teubora (OKTA-330214)

  • Flock (helloflock.com) (OKTA-328135)

OIDC for the following Okta Verified application

Email address change notification templates

Email address change notification templates are now available. These templates notify users of an email address change and let them confirm the change. See Customize an email template.

Email address change notifications

Users without admin permissions now receive email notifications to confirm an email address change. See Customize an email template.

Office 365 Silent Activation

Using Okta as the Identity Provider, Okta Office 365 Silent Activation allows for a seamless experience for your Microsoft Office 365 end users accessing Office 365 apps on domain joined shared Workstations or VDI environments. Once your end users have logged into a domain-joined Windows machine, no further activation steps are required. See Office 365 Silent Activation: New Implementations.

Enhanced Admin Console search

Admins can now search for user email addresses in the spotlight search field. See Admin Console search.

End-user Welcome emails localized

The ability to localize the Welcome email that Okta sends to new end users by referencing the users' default locale property is now Generally Available. See General customization options.

Improved auto-complete functionality

To improve the accuracy and speed of user searches, the auto-complete functionality on the Okta Admin Console administrator pages is updated.

 

User Consent for OAuth 2.0 Flows in API Access Management

A consent represents a user’s explicit permission to allow an application to access resources protected by scopes. As part of an OAuth 2.0 or OpenID Connect authentication flow, you can prompt the user with a popup window to approve your app's access to specified resources.

Consent grants are different from tokens because a consent can outlast a token, and there can be multiple tokens with varying sets of scopes derived from a single consent. When an application comes back and needs to get a new access token, it may not need to prompt the user for consent if they have already consented to the specified scopes. Consent grants remain valid until the user manually revokes them, or until the user, application, authorization server or scope is deactivated or deleted.

See User Consent for OAuth 2.0 and OpenID Connect Flows.

Provision out of sync users

If you enable provisioning for an app that already has users assigned to it, Okta can sync these users so they now have provisioning capabilities. See Provisioning in applications.

People page improvements

The People page has been improved so the people list can be filtered by user type. See Universal Directory custom user types known issues.

Mobile tab available for mobile-capable apps

The Mobile tab available in the Okta Admin Console for mobile-capable OIN apps allows you to publish mobile applications to an App Store and deploy them to your end users.

See Enable access to managed mobile apps

 

 

Provisioning page UI element change

Drop-down menus on the Provisioning page (General Settings) were standardized.

Group push mapping change

When admins create a group push mapping and link it to a group whose members were imported through another method, those users are now Okta mastered. See About Group Push.

UI element change

Drop-down menus on the Provisioning page (General Settings) are standardized. See Provisioning in applications.

 

 

Early Access features, auto-enroll

You can now opt to auto-enroll in all Early Access features, instead of having to enable them as they become available. For more information, see Manage Early Access features.

Connecting Apps to Okta using the LDAP Interface

The LDAP Interface allows you to authenticate legacy LDAP apps to Universal Directory in the cloud. With the LDAP Interface, authentication is done directly against Okta via LDAP, without the need for an on-premise LDAP server. In addition, the LDAP interface supports other LDAP functions like search. See Set up and manage the LDAP Interface.