Preview
September 2019
2019.09.0: Monthly Preview release began deployment on September 4
* Features may not be available in all Okta Product SKUs.
Generally Available Features
New Features
Customizable email template for LDAP users
The LDAPLightweight Directory Access Protocol (LDAP) is a lightweight client-server protocol for accessing directory services, specifically X.500-based directory services. LDAP runs over TCP/IP or other connection oriented transfer services. Forgot Password Denied email template can now be customized for LDAP users who have requested a password reset but must have their password reset by an adminAn abbreviation of administrator. This is the individual(s) who have access to the Okta Administrator Dashboard. They control the provisioning and deprovisioning of end users, the assigning of apps, the resetting of passwords, and the overall end user experience. Only administrators have the Administration button on the upper right side of the My Applications page.. See Email and SMS Options.
New System Log event for event hooks
Event hook eligible System Log events now display the event hook ID in the Debug Context object under the TargetEventHookId field.
For a list of event hook eligible System Log events, filter our Event Types Catalog by the event-hook tag.
Add event hooks from the Admin Console
Admins can now add event hooks from the Admin Console. Event hooks send outbound calls from Okta that trigger asynchronous process flows in admins' own software. For more details, see Event Hooks.
Okta Browser Plugin, version 5.32.0 for all browsers
This version includes the following:
- Custom URL domainA domain is an attribute of an Okta organization. Okta uses a fully-qualified domain name, meaning it always includes the top-level domain (.com, .eu, etc.), but does not include the protocol (https). support for the plugin (available through the EA Feature Manager)
- Back-end enhancements
End of support for Okta Mobile Connect on iOS 13 and iPad OS 13
Okta Mobile Connect will not function on iPhones and iPads that upgrade to iOS 13 and iPad OS 13, respectively, because version 13 introduces changes that affect the way an Apple API handles external requests to open Okta Mobile. See Okta Mobile Connect.
User enrollment of multiple Web Authentication factors
End usersIn Okta literature, we generally refer to "end users" as the people who have their own Okta home page (My Applications), using chiclets to authenticate into all of their apps. End users do not have any administrative control. When we refer to "users" we are generally referring to the individual(s) who have administrative control. now have the option to enroll in more than one instance of a WebAuthn-based factor, which can be set up either from the sign-in widget or from the end user dashboard settings. See Web Authentication (FIDO2) .
Agentless Desktop SSO
Agentless desktop SSOAn acronym for single sign-on. In a SSO system, a user logs in once to the system and can access multiple systems without being prompted to sign in for each one. Okta is a cloud-based SSO platform that allows users to enter one name and password to access multiple applications. Users can access all of their web applications, both behind the firewall and in the cloud, with a single sign in. Okta provides a seamless experience across PCs, laptops, tablets, and smartphones. and Silent Activation now support KerberosKerberos is a computer-network authentication protocol that works on the basis of tickets to allow nodes communicating over a non-secure network to prove their identity to one another in a secure manner. alias authentication for customers implementing these features for the first time. See Configure Agentless Desktop SSO - new implementations and Office 365 Silent Activation.
Group push mapping change
When admins create a group push mapping and link it to a group whose members were imported through another method, those users are now Okta mastered. See Using Group Push.
UI element change
Drop-down menus on the ProvisioningProvisioning is the enterprise-wide configuration, deployment, and management of multiple types of IT system resources. Specifically, provisioning provides users access to equipment, software, or services. This involves creating, maintaining and deactivating required business process automation objects and attributes in systems, directories, and applications. page (General Settings) are standardized. See Provisioning and Deprovisioning .
Required update for Microsoft Dynamics CRM, admin consent needed
We have updated the landing URL for the Microsoft Dynamics 365 appAn abbreviation of application. Essentially, it is a web-based site used to perform any number of specific tasks, and requires authentication from end users by signing in. to use OAuth and to be accessible globally. The updated app resolves the issue where end-users outside the USA could not access Dynamics 365 and were redirected to an error page.
You need to provide or renew Admin consent within the Okta Office 365 app instance to continue using Dynamics 365 app in your Okta orgThe Okta container that represents a real-world organization..
Early Access Features
New Features
Suspicious Activity Reporting
End users can now report unrecognized activity to their org admins when they receive an account activity email notification. This feature is now available through the EA feature manager. See Suspicious Activity Reporting.
Custom URL domain support for the Okta Browser Plugin
This support enables the Okta Browser Plugin to work on the configured custom URL domain. See Configure a custom URL domain.
Quick Access tab on the Okta Browser Plugin available through EA feature manager
Quick Access tab on the Okta Browser Plugin is now available through the EA feature manager. See Allow end-users to quickly access apps.
Resumable Import
Resumable Import is a performance enhancement that prevents imports from starting over in the event of a deployment or infrastructure issue. Instead, the import automatically pauses and continues from the most recently completed step. For information on importing users, see Import users from an app.
MFA for Oracle Access Manager
With Okta MFA for Oracle Access Manager (OAM), customers can use OAM as their Identity Provider (IdPAn acronym for Identity Provider. It is a service that manages end user accounts analogous to user directories such as LDAP and Active Directory, and can send SAML responses to SPs to authenticate end users. Within this scenario, the IdP is Okta.) to applications and also use Okta for MFA to provide a strong method of authentication for applications. For more information, see MFA for Oracle Access Manager.
New Windows Device Registration Task, version 1.4.0
This release includes the following:
- Support for Trusted Platform Module (TPM 1.2 or 2.0) on Windows 10 devices with TPM. Admin action is required. For installation instructions and other details, see Enhance Windows Device Trust security with Trusted Platform Module (TPM).
- Various fixes. See Device Trust for Windows Desktop Registration Task Version History.
Okta On-Prem MFA agent, version 1.4.1
This release of the agentA software agent is a lightweight program that runs as a service outside of Okta. It is typically installed behind a firewall and allows Okta to tunnel communication between an on-premises service and Okta's cloud service. Okta employs several agent types: Active Directory, LDAP, RADIUS, RSA, Active Directory Password Sync, and IWA. For example, users can install multiple Active Directory agents to ensure that the integration is robust and highly available across geographic locations. contains security enhancements. See On-Prem MFA Agent Version History.
Factor Sequencing
Admins can now provide end users with the option to sign in to their org using various MFA factors as the primary method of authentication in place of using a standard password. See Factor Sequencing.
Fixes
General Fixes
OKTA-192270
The translations were missing for the API AM User Consent buttons.
OKTA-230781
On the Push GroupsGroups allow you to organize your end users and the apps they can access. Assigning apps to large sets of end users is made easier with groups. to Active DirectoryActive Directory (AD) is a directory service that Microsoft developed for the Windows domain networks. It is included in most Windows Server operating systems as a set of processes and services. Initially, Active Directory was only in charge of centralized domain management. > Push Groups by Name page, clicking Show more incorrectly redirected the admin to the People page.
OKTA-232406
The Self-Service Create Account Registration form did not clear a failed password validation status even after the password was updated to meet complexity requirements.
OKTA-237684
The last MFA factor used was not remembered for some orgs that use app-level MFA rules and a custom URL domain for sign-in attempts initiated by a Service Provider.
OKTA-237864
The Active Directory Settings page was slow or unresponsive for directories with more than 10,000 Organizational Units (OUs). To obtain the fix for this bug, contact Support.
OKTA-238146
When Factor Sequencing was enabled and a user clicked Sign Out from the sign-in widget, the browser page had to be refreshed manually for the user to sign in again.
OKTA-240089
Some authentication error messages for the custom IdP factor were not displayed by the sign-in widget.
OKTA-242345
Some sign-on policies and rules for IWA were not applied when a user signed in.
OKTA-246020
An extra character > appeared in the Admin navigation header.
OKTA-246246H
The temporary password was not displayed in developer account activation emails.
OKTA-247093
Web Authentication factor names were not displayed correctly under Extra Verification in end user settings.
App Integration Fixes
The following SWA apps were not working correctly and are now fixed
-
Active Campaign (OKTA-245468)
-
Aegify (OKTA-245093)
-
BSPlink (OKTA-239934)
-
Check Point (OKTA-244812)
-
CultureIQ (OKTA-245092)
-
DesignCrowd (OKTA-245635)
-
Google Play Developer Console (OKTA-241992)
-
Hippo CMMS (OKTA-246930)
-
Key Bank (OKTA-245091)
-
MyFax (OKTA-244628)
-
OnePath Advisor (OKTA-243552)
-
ProjectManager.com (OKTA-244279)
-
Shutterfly (OKTA-245801)
-
Wells Fargo Funding (OKTA-244825)
Applications
Application Updates
To reflect Webex name changes we have updated our documentation as follows:
- Webex (Cisco) is renamed to Cisco Webex Meetings
New Integrations
SAML for the following Okta Verified applications
-
15five (OKTA-245730)
-
Centrify Privilege Access Service (OKTA-244805)
-
COMPASS by Bespoke Metrics (OKTA-246403)
-
Gateway Software Solutions (OKTA-231714)
-
Good2Give (OKTA-244842)
-
Legal Diary (OKTA-231714)
-
Wellness360 (OKTA-242402)
SWA for the following Okta Verified application
-
United Capital (OKTA-240147)
Weekly Updates
2019.09.1: Update 1 started deployment on Fixes
General Fixes
OKTA-239075
After having their passwords reset by an admin, AD-mastered users who changed their AD password and then used Delegated Authentication to sign in to Okta encountered an unnecessary password reset page during the IWA Desktop SSO sign-in flow.
OKTA-239805
It was possible to remove the last individually assigned super admin from an org.
OKTA-243796
The Import Now button did not appear for newly created OPP app instances.
OKTA-244073
Jira service failed to start after upgrading the Jira Authenticator from 3.0.7 to 3.1.1.
Note: To receive this bug fix, download the latest Jira Authenticator 3.1.2.
OKTA-248184
Suspicious Activity emails sent to admins erroneously included information about actions taken as a result of the suspicious activity.
OKTA-248458
When an org admin toggled the WebAuthn factor feature, non-Windows users with their browsers open to the sign-in page erroneously saw the Windows Hello factor.
OKTA-249451
Sending an Okta Verify push, then while waiting for the end user's response, switching to WebAuthn as a factor resulted in an error.
Applications
New Integrations
SAML for the following Okta Verified applications
-
Airbrake (OKTA-247505)
-
Parley Pro (OKTA-239461)
2019.09.2: Update 2 started deployment on Fixes
General Fixes
OKTA-221735
The Docusign app did not display the Permission profile values correctly.
OKTA-230033
Admins were allowed to attempt to assign a U2F factor to a user even when it was disallowed by policy.
OKTA-238336
Provisioning more than 3600 requests from Okta to Salesforce caused both user creation and user updates to fail.
OKTA-240371
During an SPAn acronym for service provider. Generally, an SP is a company, usually providing organizations with communications, storage, processing, and a host of other services. Within Okta, it is any website that accepts SAML responses as a way of signing in users, and has the ability to redirect a user to an IdP (e.g., Okta) to begin the authentication process.-initiated app sign in to a custom domain, the behavior of the Remember Device check box was inconsistent for App-level and Org-level MFA.
OKTA-240769
WebEx was not provisioning the correct email attribute value.
OKTA-241439
User profile mappings did not generate errors when Expression Language group functions were used inside an App to Okta mapping.
OKTA-241761
A new NetSuite domain name was missing from the list of NetSuite options.
OKTA-241916
There was a typo in one of the Feature Manager Early Access features.
OKTA-244297
After having their passwords reset by an admin, AD-mastered users who changed their AD password and then signed in to Okta encountered an unnecessary password reset page during the IWA Desktop SSO sign-in flow.
To obtain the fix for this bug, contact Support.
OKTA-244537
Users were able to re-enroll in a previously enrolled WebAuthn authenticator.
OKTA-245768
While it was still pending verification, WebAuthn appeared on the end user's Settings page as an enrolled factor.
OKTA-249689
System Log Advanced Search failed and was therefore disabled. The underlying issue is now fixed and Advanced Search is re-enabled. Additionally, it is now case-sensitive and the UUID field is not searchable.
App Integration Fixes
The following SAML app was not working correctly and is now fixed
-
Workday (OKTA-245265)
The following SWA apps were not working correctly and are now fixed
-
Air Canada Travel Agency (OKTA-246673)
-
Alerus Retirement (OKTA-248084)
-
Alerus: Account Access (OKTA-246929)
-
BigBlueOnline (OKTA-248218)
-
Duo Security (OKTA-247829)
-
HackerRank For Work (OKTA-247487)
-
Mimecast (OKTA-246444)
-
OneSignal (OKTA-247482)
-
ProofHub (OKTA-247818)
-
Sun Life Financial (OKTA-246462)
-
SyncHR (OKTA-247514)
-
The Hartford At Work (OKTA-247955)
-
Wistia (OKTA-246913)
-
Zuman (OKTA-247537)
Applications
New Integrations
SAML for the following Okta Verified applications
-
Arxspan (OKTA-248526)
-
EdCast (OKTA-246404)
-
FaxLogic Advanced Web ClientEssentially, a client is anything that talks to the Okta service. Within the traditional client-server model, Okta is the server. The client might be an agent, an Okta mobile app, or a browser plugin. (OKTA-247506)
-
Heureka Platform Connector (OKTA-239141)
-
Mapbox (OKTA-247507)
-
Notion (OKTA-246110)
SWA for the following Okta Verified applications
-
ContentSquare (OKTA-244251)
-
Wells Fargo - Personal (OKTA-244153)
-
WhiteHat Customer Portal (OKTA-243554)
Mobile application for use with Okta Mobility Management (OMM) (Android and iOS)
-
Clarizen (OKTA-248809)
-
Doxis4 (OKTA-244112)
-
MobileIron Cloud (OKTA-248803)
-
xMatters (OKTA-248805)
-
Zscaler Private Access (OKTA-248807)
Mobile application for use with Okta Mobility Management (OMM) (Android)
-
Igloo (OKTA-248490)
-
Syncplicity (OKTA-248487)
Security Behavior Detection
To provide additional security without overburdening your end users, you can configure a Sign On policy for your organization to require additional authentication for behaviors defined as higher risk based on variance from individual users' prior sign ins. Admins can configure the system so that individual end users are only prompted for an additional MFA factor when there is a change in behavior that the admin defines. For more information, see Security Behavior Detection.
Profile Mastering and Push can be enabled together
Admins can enable both Profile MasterA profile master is an application (usually a directory service such as Active Directory, or human capital management system such as Workday) that acts as a source of truth for user profile attributes. A user can only be mastered by a single application or directory at any one time. For more details, see the Profile Master page. When users are mastered by attribute, we call this attribute-level mastery (ALM). ALM delivers finer grain control over how profiles are mastered by allowing admins to specify different profile masters for individual attributes. Profile mastering only applies to Okta user profiles, not app user profiles. For more details, see Attribute Level Mastering. and Push for an app. This allows all Okta-to-App mappings to push, regardless of whether Active Directory is the Profile Master.
App condition for MFA enrollment policy
Admins can now use a new condition when setting a rule for an MFA enrollment policy. When this condition is configured, end users are prompted for factor enrollment when accessing all of their applications or only for those selected by their org admin. For more information, see App Condition for MFA Enrollment Policy.
Okta Browser Plugin reflects real-time app and profile changes in the end user dashboard
The Okta Browser Plugin now reflects the real-time state of the end user dashboard, eliminating the need to refresh the dashboard for the plugin to reflect the latest app and profile changes. This feature is available on Okta Browser Plugin version 5.29.0 or higher. For more information, see About the Okta Browser Plugin.
Early Access features, auto-enroll
You can now opt to auto-enroll in all Early Access features, instead of having to enable them as they become available. For more information, see Manage Early Access and Beta features .
Connecting Apps to Okta using the LDAP Interface
The LDAP Interface allows you to authenticate legacy LDAP apps to Universal DirectoryUniversal Directory enables you to store an unlimited amount of users and attributes from applications and sources like AD or HR systems. Any type of attributes are supported including linked-objects, sensitive attributes, and pre-defines lists. All of it accessible by all apps in our OIN catalog, over LDAP or via API. in the cloud. With the LDAP Interface, authentication is done directly against Okta via LDAP, without the need for an on-premise LDAP server. In addition, the LDAP interface supports other LDAP functions like search. For details, see Using the LDAP Interface.
Identity Provider Discovery
Using Identity Provider Discovery and routing rules, Okta directs users to different identity providers based on certain criteria. These criteria include location, device, the app being accessed, the user's domain, and specific user attributes. For more information see Identity Provider Discovery.
