March 2021

2021.03.0: Monthly Production release began deployment on March 8

* Features may not be available in all Okta Product SKUs.

Generally Available Features

New Features

LDAP agent, version 5.7.2

This version of the agent contains:

  • Support for Lightweight Directory Access Protocol (LDAP) group password policies

  • Internal improvements and security fixes

  • Bug fixes

To view the agent version history, see Okta LDAP Agent version history.

RADIUS Agent, version 2.15.1

RADIUS agent version 2.15.1 GA contains all updates release since version 2.7.4 EA, including:

  • Support for EAP-GTC and EAP-TTLS to improve security and extend support network access vendors, such as Netmotion Mobility.

  • Support for TLS 1.2, which is required for all connections to Okta.

  • Support for internet proxies.

  • A simplified installer, which no longer requires shared secrets and ports.

And has been tested on new Linux operating systems:

  • CentOS 7.6.

  • Ubuntu 20.04.1 LTS.

  • Red Hat Enterprise Linux release 8.3.

  • Windows Server 2016.

  • Windows Server 2019.

In summary, the new agent provides admins with an easier installation, configuration, and run-time experience, and we recommend it for all Okta RADIUS customers.

See Okta RADIUS Server Agent Version History.

Okta Sign-In Widget, version 5.4.0

For details about this release, see the Sign-In Widget Release Notes.

For more information about the Widget, see the Okta Sign-In Widget Guide.

New number challenge options in Okta Verify admin settings

New Okta Verify settings in the Admin Console now allow admins to control when users receive a number challenge. Number challenge is an existing Okta Verify feature in eligible orgs that helps Android and iOS users enrolled in Okta Verify with Push avoid accepting fraudulent push notifications when they try to access a protected app. Completing the challenge ensures that the sign-in attempt came from the user and not from an unauthorized person. Admins can now choose to never challenge users, challenge with all push notifications, or challenge only for high-risk sign-in attempts. See Enable Number Challenge with Okta Verify with Push.

Option to switch between Admin Experience Redesign and the old experience

Super admins can now switch between Admin Experience Redesign and the old experience by using the option provided on the Okta Admin Dashboard. This gives admins time to adapt to the new user experience, which is on by default, and the option to revert to the old experience if required.

OIN Catalog enhancements

The OIN catalog adds several customer identity categories, highlights key app integrations, and now shows relevant Okta Workflow connectors and templates. Administrators can click Add integration to add a specific app integration directly to their org. These improvements make it easier for administrators and application developers to learn about Okta’s customer identity integrations. They can browse for relevant integrations like social identity providers and identity proofing solutions and add these integrations to their Okta org.

This feature will be gradually made available to all orgs.

Deleted schema property scrubber

All existing data associated with a schema property is now removed when a schema property is deleted. To prevent data corruption, the property cannot be recreated until the existing data is fully removed. Previous data is no longer restored when recreating a deleted schema property with the same definition. This new functionality prevents the corruption of profile data and the associated Elastic search issues. See Add or remove custom directory schema attributes.

This feature will be gradually made available to all orgs.

OIDC App tab improvements

The following improvements have been made to the OIDC App tab:

  • The default tab is now General instead of Assignments.

  • Client Credentials moved to the top of the page.

  • Downloaded sample apps now have pre-populated environment variables.

See Create an OIDC app integration using AIW.

This feature is available for all new Production orgs.

LDAP self-service password reset

End users can now perform a self-service reset of their LDAP password using SMS (Short Message Service). Without compromising security, this functionality simplifies the password reset process and removes the need to involve IT Help Desk for credential management. Using SMS for password resets reduces the Help Desk workload and support costs. See Manage self-service password reset.

Improved auto-complete functionality

To improve the accuracy and speed of user searches, the auto-complete functionality on the Okta Admin Console administrator pages is updated.

Generally Available Enhancements

Improvements to the OIN Manager submission QA process

The Okta Operations team now conducts a final internal QA test for app integration submissions in the OIN Manager Portal and sends an email when the final review is complete. If the review is successful, your submission is automatically published in the OIN. These changes streamline the QA and approval process for OIN app integrations.

OIN Manager additional fields

The OIN Manager portal now accepts encrypted SAML assertion certificates. Also, fields are added to clarify OIDC configuration requirements and to confirm that SCIM app integrations are prepared properly for submission. See Configure protocol-specific settings. These changes simplify the ISV submission process, reducing unnecessary communications with the Okta Operations team.

Early Access Features

New Features

Custom help links on the Sign-In Widget

Admins can now customize the help links on the MFA verification page of the Sign-In Widget. This allows admins to link their end users to a custom app or page for factor resets. See Customize text on your sign-in page.

Application SAML Certificates

Separate SAML signing certificates are now assigned when admins create new SAML applications or configure SAML-enabled OIN apps. Okta previously created SAML certificates that were scoped to an entire org. With this feature, SAML certificates are issued and scoped at the application level to provide more fine-grained control and a more secure solution overall. See Create a SAML integration using AIW.

SAML 2.0 Assertion grant flow

You can use the SAML 2.0 Assertion flow to request an access token when you want to use an existing trust relationship without a direct user approval step at the authorization server. The flow enables a client app to reuse an authorization by supplying a valid, signed SAML assertion to the authorization server in exchange for an access token. This flow is often used in migration scenarios from legacy Identity Providers that don't support OAuth. See Create Rules for Each Access Policy.


General Fixes


Updating a user address field with a string that was too long returned a 500 error response instead of a 400 error with appropriate details.


In rare cases when an admin re-typed their password in the Office 365 Admin Password field and then clicked Fetch and Select on the Sign On tab, the Fetch and Select command failed with an error.


Sometimes, when the Office 365 Provisioning option was selected to Licenses/Roles Management Only, roles and licenses assigned to Office 365 users in Okta didn't sync in Microsoft.


Text on some AD Import pages in the new Okta Admin Console was misaligned.


Workday incremental imports sometimes failed with a NullPointerException error.


Expanding Admin Tasks on the Admin Dashboard changed the index value of the tasks.


When IDP as Factor was enabled, some users received the Invalid Token error on stale sign-in pages.


The QR code image in the Setup Okta Verify flow didn't include alt text, which caused screen readers to not recognize the image.


The SCIM provisioning feature was not enabled for the Lifecycle Management SKUs included with API products.


Some end users were stuck in an authentication loop when trying to sign in to Okta.


Text on some pages in the new Okta Admin Console was misaligned.


Text on the LDAP tab of the Delegated Authentication page was not rendered properly.


Text on the Sign On tab of the App Settings page was misaligned.


An issue with ThreatInsight was resolved for some organizations who upgraded a free trial edition to Production.


Sometimes the sign-in page didn't refresh if the token was expired.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • Aflac (OKTA-372087)

  • Alarm (OKTA-372091)

  • CBRE (Employee Login - The Navigator) (OKTA-370216)

  • Frontier Communications (OKTA-370218)

  • GoCompare (OKTA-370219)

  • MX Merchant (OKTA-370217)

  • MxToolbox (OKTA-370503)

  • Premium Audit Advisory Service (PAAS) (OKTA-368399)

  • Rippe and Kingston LMS (OKTA-372081)

  • ShopAtHome (OKTA-372067)

  • The Economist (OKTA-372207)

  • Visage MobilityCentral (OKTA-372095)


New Integrations

SAML for the following Okta Verified applications

  • Banyan Command Center (OKTA-370640)

  • Five9 Plus Adapter for Microsoft Dynamics CRM (OKTA-367992)

  • Noticeable (OKTA-370631)

SWA for the following Okta Verified application

  • Clarizen One (OKTA-371928)

OIDC for the following Okta Verified application

Weekly Updates

February 2021

2021.02.0: Monthly Production release began deployment on February 8

* Features may not be available in all Okta Product SKUs.

Generally Available Features

New Features

Option to activate and deactivate rate limit warning and violation notifications for all orgs

All admins now receive the warning and violation notifications for rate limits. Additionally, you have the option to activate and deactivate the notification from the Admin Console.

Additional events available for use as Event Hooks

The following event types are now available for use as an Event Hook:

  • The user.account.lock event makes admins aware of accounts that are locked because of suspicious activity or due to multiple incorrect sign-in attempts. Admins can also use this Event Hook to take action against affected accounts.
  • The user.account.unlock event makes admins aware of accounts that are no longer locked. Admins can also notify users of appropriate next steps to prevent future account locking.
  • The group.lifecycle.create event notifies admins when new Okta groups are created. The group.lifecycle.delete event notifies admins when new Okta groups are deleted. Admins can use Event Hooks based on these events to initiate automated custom flows.
  • The event notifies admins when their org is approaching an org-wide rate limit. The event notifies admins when their org has exceeded an org-wide rate limit. Admins can use Event Hooks based on these events to trigger a real-time alert to a downstream system, such as PagerDuty.
  • The event helps admins to automate IT processes, such as providing members of the imported group with access to applications.
  • The event helps admins use these events to trigger actions in downstream systems, such as an Okta Workflows Flow that creates a Slack notification.
  • The user.mfa.factor.suspend and user.mfa.factor.unsuspend events notify your service when enrolled MFA factors are suspended or unsuspended. This typically occurs when a registered device associated with the factor is suspended or unsuspended either through the Okta Admin Console or the Okta API.

New System Log events for MFA factor activity and for importing users through CSV

The following System Log event types are now available:

  • The system.mfa.factor.activate event indicates that the MFA factor is activated.

  • The system.mfa.factor.deactivate event indicates that the MFA factor is deactivated.

These events help admins collect metrics for MFA factor activity and track user action for activating and deactivating an MFA factor. These events are triggered when an MFA factor is activated and when it is deactivated.

  • The system.import.user_csv.start event indicates that the process to import users from CSV is started.

  • The system.import.user_csv.complete event indicates that the process to import users from CSV is completed.

These events help admins track user activity of batch importing users through CSV. These events are triggered when the process to import users from CSV is started and when it is completed.

Support for Safari user interaction requirement for WebAuthn flows

Okta now supports Safari's user interaction security requirement for WebAuthn flows. When accessing resources protected by an Okta WebAuthn MFA policy, end users now must tap Verify before they're challenged to provide biometrics or a security key.

General Availability of Workflows

Okta Workflows is now Generally Available for additional customers in the APAC cell.

Okta Workflows is an interface-driven, no-code platform for business process automation that provides integration with some of the most widely used third-party APIs in the industry, including Box, Slack, Salesforce, and Google Workspace. See Okta Workflows.

Deployment is taking place over the course of several days to entitled orgs with the following SKUs:

  • IT Products - Advanced Lifecycle Management

  • Legacy SKU: IT Products - Lifecycle Management, Unlimited

  • Legacy SKU: IT Products - Lifecycle Management, Unlimited OIN Apps

  • Legacy SKU: IT Products - Lifecycle Management, 10 OIN Apps

To access Workflows, select the Workflow > Workflows console menu option from the Okta Admin Console.

Limit group stats when searching for user groups during admin assignment

In search results, groups with more than 10,000 users or apps now appear with a count of 10,000. This speeds up results when super admins search for groups to assign admin privileges. The actual totals are not impacted and can be viewed on the group's page.

New System Log delAuthTimeout and LDAP delAuth values

The following values now appear in the System Log:

  • The delAuthTimeout value identifies the authentication timeout value. The delegated authentication timeout value is the time in milliseconds that Okta waits for delegated authentication responses. Knowing this value can help identify when timeout values are too high and consuming system resources unnecessarily. See System Log.

  • The Ldap delAuth value identifies the delegated authentication type. The values returned are LDAP or AD. Knowing this value can help you identify and resolve delegated authentication issues. See Delegated authentication.

Generally Available Enhancements

Admins only receive rate limit warning and violation notifications for org events

All admins are notified for rate limit warning and violations for their orgs in the Admin Console and by email. These notifications are for org-wide events and not for client and operations-based events. This reduces unnecessary email notifications.

Updates to the text in rate limit warning and violation notifications

The text in the rate limit warning and violations notification in the Admin Console and email has been updated to make it more user-friendly. Now, the email notification also contains a link to the Rate limit overview document to boost your understanding of rate limits. See Rate limits.

Link to Okta agent support policies

The Downloads page in the Admin Console now has a direct link to the latest Okta agent support policies. See Okta agent support policies.

Enhancement to the OIDC app creation message

After an OIDC application is created, the Application created successfully notification is frequently missed because it only appears briefly after an app is saved. The message now appears after the UI redirects to the new application's main page.

Okta Workflows URL verification in Event Hooks

Admins can now enter a Workflow API Endpoint URL as an Event Hook URL without the need for verification. This helps admins easily configure a Workflow to be triggered from an Event Hook for multiple events or for events not yet available in Workflows.

See Event Hooks.

Enhancements to policy scheduled execution System Log events

The policy.scheduled.execute event has been updated. When triggered by Okta Automations, this event now displays the number of user lifecycle state changes for deactivations, deletions, and suspensions in the SuccessfulDeactivations, SuccessfulDeletions, and SuccessfulSuspensions fields under the DebugContext object. This event is useful for admins to measure the number of user accounts that have been affected by Okta Automations.

New color scheme for the map view in System Log

The mapview in the System Log now has a new color scheme that increases visibility and clarity.

Early Access Features

New Features

Event Hook preview

Event Hook preview lets admins easily test and troubleshoot their Event Hooks, as well as send sample requests without manually triggering an actual event. This means admins can preview the payload of a specific Event Hook type and make sure that it's what they need to move forward before a full deployment to production. See Event Hook Preview.

Wildcards for OAuth redirect subdomains

Developers can now use the Apps API to set multiple redirect URI subdomains with a single parameter using the asterisk * wildcard. This feature provides convenience and flexibility in cases where subdomains vary by only a few characters. For example: https://subdomain* may be used to represent subdomain1, subdomain2, and subdomain3.

Enhanced Admin Console search

Admins can now search for end user email addresses in the Spotlight Search field in the Admin Console. You can also view the user's status in the search results when you search by username and email address. This robust global search helps you find what you need in the Admin Console quickly, thereby, saving time and increasing productivity. See Admin Console search.

RADIUS Agent, version 2.15.0

This version includes all changes released since the EA version 2.7.4. When configuring RADIUS apps, admins seek ways to constantly enhance network security and expand the server OS coverage. To meet these goals, the RADIUS agent version 2.15.10 now supports:

New network access authentication protocols:



New Linux operating systems:

  • Red Hat Enterprise Linux release 8.0

  • CentOS 7.6

  • Ubuntu 18.04.4

With the latest updates, admins gain more flexibility in deployment use cases. For example, the Okta RADIUS agent now interoperates with Netmotion Mobility using EAP-GTC.

RADIUS agent version 2.15.10 also includes support for TLS 1.2, which is required for all connections to Okta, and a simplified installer, which supports proxies and no longer requires shared secrets and ports. The new agent provides admins with an easier installation, configuration, and run-time experience. See Okta RADIUS Server Agent Version History.


General Fixes


Some Office 365 users were deprovisioned with an incorrect localization error.


During account creation, if a user's input violated the length constraints, the error message didn't include the value of the length constraint.


SuccessFactor users weren't deactivated by timezone.


SAML Preview returned the 400 Bad Request error if the SAML sign-on mode for an app was configured with Single Logout.


Some users who had successfully authenticated received a sign-in failed error when they attempted to sign in to an app that wasn't assigned to them.


The Okta Admin Dashboard wasn't properly aligned in Internet Explorer 11.


Admins couldn't approve or deny app access requests in the new Okta End-User Dashboard.


Resend SMS factor sometimes resulted in a 400 error upon app sign-in.


Some base attributes were missing from the User Profile.


The Preview banner in Preview orgs wasn't properly displayed.


The new Okta End-User Dashboard didn't show all company-managed apps or the Show More button.


In an IdP-initiated flow, end users were prompted to verify the IdP factor when they accessed an app even if they'd verified a factor when they signed in to the Okta End-User Dashboard.


In some browsers, extra scroll bars appeared on the Okta Admin Dashboard.


The Tasks card on the Okta Admin Dashboard didn't load properly in Internet Explorer 11.


The Help documentation link under Customization > New End User Experience was broken.


In the SmartSheet provisioning profile, when admins tried to change the Group Priority setting to Combine values across groups for the variable smartsheet.userPermissions, the error message: Not allowed to modify property userPermissions from the base schema was returned.


Some imports from AD were delayed, especially when large number of import jobs were being run.


In some cases, MS Office authentication did not prompt for MFA and failed.


  • The Okta SAML Toolkit is deprecated and removed from the Okta Downloads page.

  • Google Apps is rebranded as Google Workspace. We have updated the OIN Application and associated documentation.

New Integrations

New SCIM Integration Applications

The following partner-built provisioning integration apps are now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified applications

  • TravelPerk (OKTA-362457)

Weekly Updates

January 2020

2020.01.0: Monthly Production release began deployment on January 13

* Features may not be available in all Okta Product SKUs.

Generally Available Features

New Features

Okta Browser Plugin version 5.36.1 for Chromium-based Microsoft Edge and Mozilla Firefox

This version includes the following:

For version history, see Okta Browser Plugin: Version history

New System Log event for Grant User Privilege

The Grant User Privilege System Log event now logs activity for each user in a group when an Admin role is assigned to the group.

New System Log events for OIDC scope grants

System Log events are now triggered when an administrator grants consent for OpenID Connect scopes.

Rogue Accounts Report End of Life (EOL)

The Rogue Accounts Report feature has been removed due to low usage, high cost of maintenance, and the availability of custom solutions. For example, admins can retrieve similar data by using the List Users Assigned to Application API to see users who were assigned to an app in Okta, and then using custom code to generate a list of users assigned in the app itself. For more information, see this Support Article.

Federate multiple Office 365 domains in a single app instance

You can automatically federate multiple Microsoft Office 365 domains within a single Office 365 app instance in Okta. This eliminates the need to configure a separate Office 365 app instance for each Office 365 domain. This feature will be slowly made available to all orgs. For more information, see Federate multiple Office 365 domains in a single app instance.

Support for Salesforce Government Cloud

You can create instances of the Salesforce app that can integrate with Salesforce Government Cloud. For more details, see the Salesforce Provisioning Guide.

Box integration enhancement

The Box integration is enabled for Universal Directory and is enhanced by the following additional properties in the User Profile:

  • firstName
  • lastName
  • timezone
  • language
  • space_amount (RO)
  • max_upload_size (RO)
  • job_title
  • phone
  • address
  • avatar_url (RO)
  • groups
  • space_used (RO)

See the Box Provisioning Guide for more information.

Resumable Import

Resumable Import is a performance enhancement that prevents imports from starting over in the event of a deployment or infrastructure issue. Instead, the import automatically pauses and continues from the most recently completed step. For information on importing users, see Import users.


HealthInsight audits an organization’s security settings and suggests recommended tasks to improve an org's security posture. Security tasks and recommendations are intended for admins who manage employee security within their organization.

HealthInsight may now be accessed directly from the Admin Console dashboard.

Fore more information, see HealthInsight.

App Catalog Search Improvements

The enhanced Okta Integration Network (OIN) App Catalog now features:

  • A new incremental search and an improved search results preview
  • Expanded search capabilities to check app integration names, descriptions, or categories
  • Fuzzy search logic to match partial hits and name variations
  • Tiles highlight the protocols supported by the app integration

This feature will be gradually made available to all orgs.

Generally Available Enhancements

UI Enhancements for HealthInsight

The HealthInsight card on the Admin Console dashboard and HealthInsight actions have been updated for improved usability. For more information about HealthInsight, see HealthInsight.

Additional context in MFA authentication in some apps

We have added an additional target element containing application information to MFA events triggered by authentication to Epic Hyperspace EPCS (MFA) and Microsoft RDP (MFA) apps.

Improved text in single line challenge for RADIUS MFA

The text displayed during the a single line MFA challenge via RADIUS authentication has been improved to fixed grammatical errors.

Notification when adding a user to an Admin group

Admins now see a notification that admin privileges will be granted when adding a user to a group with Admin privileges.

Updated Privacy Policy

Okta has updated its Privacy Policy. See to review the latest version.

Condition update for MFA Enrollment policy rules

The name of the setting for the Any Application condition has been updated to specify app support for MFA Enrollment. For more information, see App condition for MFA enrollment policies.

UI enhancements for profile and attribute selection

The appearance of profile and attribute selection elements is updated to be more consistent with other Okta select elements.

Toggle on/off the end user onboarding screen

In the Settings > Appearance settings in the Admin Console, admins can control whether or not new end users see the onboarding screen upon their first sign in to the Okta End User dashboard.

This release does not have any Early Access features.


General Fixes


The word Password was incorrectly translated in Dutch.


French translation for the Self-Service Unlock when Account is not Locked email template was not intuitive.


Microsoft RDP (MFA) prompts did not display the official Okta logo.


After an application was selected from the Okta Safari plugin toolbar menu, the selection window did not close as expected.


Searching for an app in App Administration Assignment did not display exact matches.


Fido 2.0 (Webauth) set as a secondary factor on Factor Sequencing failed on the user sign-in with the error We found some errors. Please review the form and make corrections.


In Okta Device Trust with VMware Workspace ONE implementations, app sign-on policy denied access on Android 10 even if the device was trusted.


App Admins who were configured to only see a subset of apps in the catalog were able to see all apps.


When creating a SAML integration using the AIW, the instructions contained the outdated acronym OAN instead of the current OIN (Okta Integration Network) acronym.


For orgs that had opted into the New Import and Provisioning Settings Experience for Active Directory EA feature, placeholder text was displayed instead of the correct text in the warning dialogue when the Profile and Lifecycle Mastering checkbox under Active Directory provisioning settings was checked and the Update Users checkbox was previously enabled.


The Settings tab for app provisioning failed to render in Internet Explorer 11.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • Aha (OKTA-266200)

  • American Express Work Reconciliation (OKTA-266198)

  • Apple ID (OKTA-264195)

  • Aveda (OKTA-266196)

  • Blackbaudhost Citrix (OKTA-266199)

  • Bloomfire (OKTA-266193)

  • Brex (OKTA-266241)

  • Cisco WebEx Meeting Center (OKTA-262750)

  • Citrix RightSignature (OKTA-268537)

  • DoorDash (OKTA-268780)

  • Firefox (OKTA-266201)

  • FullContact Developer Portal (OKTA-268538)

  • Google Analytics (OKTA-266914)

  • Impraise (OKTA-268534)

  • MKB Brandstof (OKTA-267534)

  • Nest (OKTA-267942)

  • NewEgg Business (OKTA-268840)

  • OnePath Advisor (OKTA-266925)

  • Principal Financial Personal (OKTA-268782)

  • RescueTime (OKTA-266197)

  • Rhino3d (OKTA-268531)

  • Seek (AU) - Employer (OKTA-266703)

  • Shipwire (OKTA-266919)

  • Site24x7 (OKTA-268622)

  • Vindicia (OKTA-266192)

  • Wombat Security Awareness (OKTA-268532)

The following SAML app was not working correctly and is now fixed

  • Datadog (OKTA-267430)


Application Updates

  • Zoom provisioning application now supports updating user email addresses.
  • Citrix NetScaler Gateway has changed its name to Citrix Gateway.

New Integrations

New SCIM Integration Application

The following partner-built provisioning integration apps are now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified applications

  • AppOmni (OKTA-266642)

  • Appsian Security Platform for PeopleSoft (Encrypted) (OKTA-265400)

  • Clinical Maestro (OKTA-264130)

  • Cmd (OKTA-266400)

  • Freshworks (OKTA-262038)

  • Grammarly (OKTA-266950)

  • Kisi Physical Security (OKTA-265701)

  • LoanBuddy (OKTA-266952)

  • Mode Analytics (OKTA-260404)

  • Reducer (OKTA-265134)

  • TeamzSkill (OKTA-265665)

SWA for the following Okta Verified application

  • Miniter (OKTA-262048)

Weekly Updates