March 2020

2020.03.0: Monthly Production release began deployment on March 9

* Features may not be available in all Okta Product SKUs.

Generally Available Features

New Features

Changes to admin permissions

Super admins can no longer edit their own role assignment. The Edit and Delete actions are removed from their profile row on the Administrators page. See Super admin role.

Pagination is now available when listing Authorization Servers

Pagination is now available for lists of authorization servers. See API Access Management.

Custom Email events added to the System Log

Updates to custom email templates are now tracked in the System Log.

Email verification added as optional enrollment factor

If admins configure email verification as an optional MFA factor, end usersEnd users are people in your org without administrative control. They can authenticate into apps from the icons on their My Applications home page, but they are provisioned, deprovisioned, assigned, and managed by admins. can select email as a factor during MFA enrollment. To complete enrollment, end users enter the code sent to their primary email address. The verification UI is redesigned.

Sign-in attempt behavior evaluation is logged when there is no client information

Sign-in attempt behavior evaluation is logged in the debugContext object of the user.session.start and policy.evaluate.sign_on events even when clientEssentially, a client is anything that talks to the Okta service. Within the traditional client-server model, Okta is the server. The client might be an agent, an Okta mobile app, or a browser plugin. information is missing for all behaviors.

Jira Authenticator, version 3.1.3

This release contains a bug fix for SAMLAn acronym for Security Assertion Markup Language, SAML is an XML-based standard for exchanging authentication and authorization data between an identity provider (IdP) and a service provider (SP). The SAML standard addresses issues unique to the single sign-on (SSO) solution, and defines three roles: the end user, the IdP, and the SP. Here's how SAML works through Okta: SP-initiated flow: the end user requests (principally through a browser) a service from the SP. The SP requests and obtains an identity assertion from the IdP (in this case, Okta). On the basis of this assertion, the SP can decide whether or not to authorize or authenticate the service for the end user. IdP-initiated flow: with Okta as the IdP, an end user goes to the Okta browser and clicks on an app, sending a SAMLResponse to the configured SP. A session is established with the SP, and the end user is authenticated. SPAn acronym for service provider. Generally, an SP is a company, usually providing organizations with communications, storage, processing, and a host of other services. Within Okta, it is any website that accepts SAML responses as a way of signing in users, and has the ability to redirect a user to an IdP (e.g., Okta) to begin the authentication process.-initiated flows, to ensure that all supported URLs redirect to Okta.  See Okta Jira Authenticator Version History.

Active Directory improvements

To assist orgs with more than 10,000 Organizational Units (OUs), improvements were made to the User OUs connected to Okta and Group OUs connected to Okta fields on the Active DirectoryActive Directory (AD) is a directory service that Microsoft developed for the Windows domain networks. It is included in most Windows Server operating systems as a set of processes and services. Initially, Active Directory was only in charge of centralized domain management. Settings page.

Mobile tab available for mobile-capable apps

The Mobile tab available in the AdminAn abbreviation of administrator. This is the individual(s) who have access to the Okta Administrator Dashboard. They control the provisioning and deprovisioning of end users, the assigning of apps, the resetting of passwords, and the overall end user experience. Only administrators have the Administration button on the upper right side of the My Applications page. Console for mobile-capable OINAn acronym for the Okta Integration Network. The OIN is comprised of thousands of public, pre-integrated business and consumer applications. As an on-demand service, OIN integrations are continuously validated, always up to date, and constantly growing both in number and capability. Okta performs a single integration with an ISV or SP, providing thousands of end users with point-and-click customization for their orgs. apps allows you to publish mobile applications to an AppAn abbreviation of application. Essentially, it is a web-based site used to perform any number of specific tasks, and requires authentication from end users by signing in. Store and deploy them to your end users. See Enable access to managed mobile apps.

Deleted admin users

When a user who has an admin role and privileges assigned to them is deleted, their admin privileges are revoked. The deleted user is removed from the Administrators page and CSV download list of administrators. For information about Admin roles, see Administrators.

Generally Available Enhancements

Veeva Vault integration update

The Veeva Vault integration has a new check box on the Provisioning tab that allows admins to choose whether to use Email instead of Username.

Spotlight search bar changes

The spotlight search bar is no longer visible to Report Admins because they do not have search permissions.

Accessibility enhancement for Okta Sign-in Widget

The Username and Password form fields on the Sign-In page now include the aria-required property. This property is not visible to end users, but indicates to screen readers that these fields are required.

Profile Editor improvements

The Profile Editor page has been improved to simplify navigation and clarify functionality.

Early Access Features

New Features

Okta Verify support for risk-based authentication

Okta Verify with Push now supports risk-based authentication. With this feature, admins can assess the level of risk when an end user signs in to their orgThe Okta container that represents a real-world organization. and attempts to authenticate with Okta Verify. See Enable risk-based authentication for Okta Verify with Push.

New Group Membership Admin role

The new Group Membership Admin role grants permission to view all users in an org and manage the membership of groupsGroups allow you to organize your end users and the apps they can access. Assigning apps to large sets of end users is made easier with groups.. See Group Membership Admin role.

App-level safeguard

To guard against an unusual number of app un-assignments during user import, the admin can set the safeguard to org-level, app-level, or both. See Import safeguards.


General Fixes


App admins were able to modify all profiles in the Profile Editor even when the admin was limited to only administer certain apps.


The Okta Admin Console displayed options to delete or deactivate app instances that can't be deleted or deactivated.


When the App Catalog feature was enabled, app admins with required permissions received a blank page when they clicked the Add Application button.


In some cases, a SAML assertion incorrectly included extra Attribute Statements. Note that this fix currently only applies to Preview orgs.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • Blanchard Exchange (OKTA-278301)

  • ConnectWise Automate (OKTA-278300)

  • Playbook (OKTA-279423)


New Integrations

New SCIM Integration Applications

The following partner-built provisioningThis term is obsolete. See "Okta Verified". integration apps are now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified applications

  • Halogen (OKTA-280008)

  • OneDesk (OKTA-276015)

  • Parabol (OKTA-278665)

SWA for the following Okta Verified application

  • Altair Eyewear (OKTA-277992)

Weekly Updates

February 2020

2020.02.0: Monthly Production release began deployment on February 18

* Features may not be available in all Okta Product SKUs.

Generally Available Features

New Features


Active Directory, new import and provisioning settings experience

The AD settings user interface had been updated. It is now more consistent with how other application settings are configured. All orgs will now use the Okta expression language for the Okta username format field.

If your org was created before October 4th (Preview) or October 9th, 2017 (Production), a legacy expression language that is different than the Okta expression language was used for the Okta username format field. For more information, see Configure the Okta Active Directory (AD) agent: new user interface and Updated AD Profile Mapping options.

This feature will be gradually made available to all orgs.

Enhanced provisioning for Office 365

With additional enhancements to Microsoft Office 365 integration admins can now synchronize identities from on-premises to cloud-based Office 365, provision a user profile that is extended further to include over 100 attributes, as well as synchronize distribution groups, contacts, and resources such as conference rooms.

Admins can also manage user licenses and roles, independent of other provisioning flows. The new provisioning type for Office 365, License/Roles Management Only, allows admins to manage user license assignment and role delegation for existing Office 365 users and for users provisioned to Office 365 with third-party tools. For more details, see Okta Enhancements with Microsoft Office 365 Integration.

Password Import Inline Hook

The Password Import Inline Hook lets you interface with an external service to verify a user-supplied password when the user signs in to Okta for the first time. This supports scenarios in which users are migrated from an existing user store while allowing them to retain their passwords.

See Inline hooks

SAML Assertion Inline Hook now supports URI formatting in claims

Okta now supports URI claims with SAML assertion hooks. When you need to replace or add a URI claim, you must encode the claim name within the command based on the JavaScript Object Notation (JSON) Pointer specification. Specifically, this replaces ~ with ~0 and / with ~1.

See Inline hooks

OAuth for Okta Enabled for Policy API

The Policy API now has OAuth for Okta enabled.

widget error messaging

The error message Unable to sign in is now displayed if authentication fails when signing in to Okta.

Provisioning Capable Apps report

The Provisioning Capable Apps report contains data about available apps for orgs that can have provisioning enabled.

See Reports

Okta Browser Plugin, version 5.37.0 for all browsers

This version includes:

  • New user experience for the plugin (available as an EA feature), see New Okta End-User experience
  • Fix for re-authentication modal getting stuck in some browsers
  • Fix for the Firefox download link in the Okta Admin Console > Downloads page
  • For Internet Explorer installer, the name Okta Secure Web Authentication Plugin changed to Okta Browser Plugin
  • Back-end enhancements

See Okta Browser Plugin: Version History

Get User API Support for sort parameters

The Get User API now supports sortBy and sortOrder parameters.

New System Log event for user type changes

A new System Log event is added when the user type for an end user changes.

Send Device Context using Limited Access

Limited Access allows you to configure Okta to pass device context to certain SAML apps through the SAML assertion during app authentication. The app uses this data to limit access to certain app-specific behaviors. For more information, see Pass Device Context to SAML apps using Limited Access.

Schedule user imports

When you set up Provisioning to import users from an app or from a CSV directory to Okta, you can set up a schedule for imports at regular intervals on an hourly, daily, or weekly basis. If your app supports incremental imports, then you can set up both full and incremental import schedules. This integration applies to all non-AD and LDAP applications that support imports such as CSV directory, Workday, SuccessFactors, BambooHR, Salesforce, and so on. For more information, see Scheduling imports.

Enhancements to identify user addition and removal status and improve performance

The addition or removal of users from a group now runs as a background task. During the process, the Manage People button is inactive and a notification appears to indicate the progress of the request. For more information, see Group rules.

Enhancements to identify org user deactivation status and improve performance

Org user deactivation now runs as a background task. Notifications have been added to indicate request progress and successful request completion. For more information, see Activate and deactivate users.

Early Access Features

New Features

Okta ADFS Plugin version 1.7.5

This version includes:

  • A fix that removed an extra scroll bar when integrated on an ADFS page with two or more factors.
  • Security enhancements and bug fixes

See Okta Active Directory Federated Services Plugin Version History

Okta RADIUS Server Agent for Windows, version 2.9.6

This version includes:

  • An update that no longer requires entering a port or shared secret in the installer.
  • Various bug fixes

See Okta RADIUS Server Agent Version History

Okta Windows Credential Provider, version 1.2.4

This version includes security enhancements. See Okta MFA Credential Provider for Windows Version History

LDAP agent, version 5.6.3

Support for Oracle Directory Server Enterprise Edition (ODSEE). See Okta Java LDAP agent version history

Windows Device Registration Task, version 1.4.1

This release fixed the following issues:

  • If there was a space in the sAMAccountName, an error appeared when installing the Okta Device Registration task and the installation completed but didn't function.
  • An unknown publisher warning appeared after double-clicking the Okta Device Registration MSI file.

Affected customers should uninstall the registration task and install 1.4.1 or later.

See B.2 — Obtain and install the Device Registration Task and Device Trust for Windows Desktop Registration Task Version History

New Okta End-User Dashboard and Okta Browser Plugin

The newly redesigned Okta End-User Dashboard and Okta Browser Plugin boost user productivity and provides a faster, more intuitive, and more responsive user experience.. See New Okta End-User experience


General Fixes


A user inadvertently retained access to an admin app when the only group/app assigned to the user was deleted.


Attributes with null or blank values were not updated to RingCentral.


When a user was locked out due to multiple failed password attempts, the UI incorrectly showed the following error message: Your account was locked due to excessive MFA attempts.


When an end user set their preferred language to Spanish, email notifications in English that were sent to the user contained a typo.


When using the SAML Assertion Inline Hook, if there was an optional attribute statement configured for the app and the attribute statement had no value specified, commands returned from SAML Inline Hook responses were not applied.


When using a custom domain, the PIV button look and feel was inconsistent on the sign-in page.


When batch imports were enabled, group memberships were sometimes not handled correctly.

App Integration Fixes

The following SAML apps were not working correctly and are now fixed

  • Qualys Guard (OKTA-270318)

  • Sage Intacct (OKTA-268392)

  • Socialbakers (OKTA-273050)

The following SWA apps were not working correctly and are now fixed

  • Adobe (OKTA-272864)

  • Adobe Creative (OKTA-272880)

  • Adobe Enterprise (OKTA-272879)

  • Apple Business Manager (OKTA-264263)

  • connectwise_automate (OKTA-272812)

  • Iola (OKTA-272811)

  • Statuspage (OKTA-272865)


Application Updates

Provisioning support has been removed from the Crashplanpro, Bloomfire, and Confluence apps due to their low customer usage, lack of standards based integration, and high supportability cost.

New Integrations

New SCIM Integration Applications

The following partner-built provisioning integration apps are now Generally Available in the OIN as partner-built:

Note: The following apps were previously released as Early Access, but as part of our process changes the apps have now been updated and released as Generally Available, Okta VerifiedEach integration in the Okta Integration Network has one of the following status designations: Okta Verified, Community Created, or Community Verified. Integrations receive Okta Verified status: 1) if the integration is Okta-built, and is then tested and verified by Okta; or 2) if the integration is ISV-built (partner-built), and is then tested and verified by Okta..

SAML for the following Okta Verified applications

  • activpayroll - activ8 (OKTA-271002)

  • Nethris (OKTA-266636)

  • Octarine (OKTA-272822)

  • Openpath Security (OKTA-272571)

  • Reachdesk (OKTA-272823)

  • Rescana (OKTA-270985)

SWA for the following Okta Verified application

  • Aquera (OKTA-272801)

Weekly Updates

January 2019

2019.01.0: Monthly Production release began deployment on January 14

* Features may not be available in all Okta Product SKUs.

Generally Available Features

New Features

Email notifications for Factor Enrollment and Factor Reset

Admins can enable two new settings for email notifications that are sent to end users. When enabled, end users will receive an email confirmation if the end user or an admin enrolls in a new factor or resets an existing factor for their account. For more information on end user email notifications, see General Security.

Automatically send an email to locked-out end users

You can automatically send your users an email if their account becomes locked due to too many failed sign-in attempts. You can insert a link in the email to let users unlock their account. For details, see Configure lockout settings.

Group Push enhancements

Group Push now supports the ability to link to existing groups in the following application integrations:

  • Slack
  • Dropbox for Business
  • ServiceNow UD

You can centrally manage these apps in Okta. For details, see Using Group Push.

Modern authentication support

We have extended our Office 365 Sign On policies to include the ability to distinguish between web browser and modern authentication clients, giving you even more granularity in controlling how users are accessing corporate data. You access this functionality by creating a new App Sign On Rule.

Extended Client Access policy capability for apps

When you create App Sign on Policy rules, you can now specify platform types with greater granularity. For details, see Add Sign On policies for applications.  

Additional Custom Attributes for DocuSign integration

Our DocuSign integration is enhanced by adding support several new custom attributes. Okta imports these attributes that you can then map as additional custom properties. For details, see the DocuSign Provisioning Guide.

System Log save and reuse searches

After performing a System Log search, a Save button now appears next to the query. Click Save and you are prompted to name your search. Once saved, your named search appears on the main Reports page. You can reuse your saved search, modify it, or delete it. Note that saved searches can only be seen by the user who created them. A maximum of 20 searches can be saved at any time.

LDAP Interface, query performance improvement

LDAP Interface queries will no longer return the memberOf attribute unless requested specifically, or when all operational attributes are queried using “+”. This change brings performance improvement to searches that did not require this attribute. Improvements were also made to return additional operational attributes that were part of LDAP core schema. This list includes hasSubordinates, structuralObjectClass, entryDN, subschemaSubentry, and numSubordinates. Note that numSubordinates is not calculated for users and groups containers. For details, see Connecting to Okta using the LDAP Interface.

XFF Evaluation for Dynamic Zones and Behavior Detection

As part of Dynamic Zone and Behavior Detection evaluation, the client IP is now validated using the trusted proxies that have been configured for that org. In the admin System Log, this IP appears as the Client IP. For more information, see Dynamic Zone Evaluation.

New Windows Device Trust Registration Task, version 1.3.0

This release includes the following:

  • Improved support for organizations that route internet traffic through a proxy server.
  • Fixes an issue in which some Device Trust System Log events reported the Windows operating system version inaccurately on Windows desktops running Windows 8.1 or higher.

For version history, see Device Trust for Windows Desktop Registration Task Version History.

Support for Vietnamese language

Support for the Vietnamese language for the end user experience is now available to all customers. You can select the default language preference for your entire org, and your end users can select a different language preference for their own experience. For more information, see Configure the Display Language.

JIRA On-Prem Authenticator, version 3.0.7

This release includes enhanced SP-initiated SAML flow and support for spUsers and spGroups to handle JIRA only users. For version history, see JIRA Authenticator Version History.

Okta Browser Plug-in, version 5.25.0

Okta Browser Plug-in has been updated to version 5.25.0 for Chrome, Edge, Firefox, and Internet Explorer. This version contains security enhancements in addition to enhanced end user settings. For version history, see Okta Plug-in Version History. (Version history/browser ver history).

Enforce Device Trust for managed Windows computers

Okta Device Trust for Windows allows you to prevent unmanaged Windows computers from accessing enterprise services through browsers and native applications. For details, see Enforce Device Trust for managed Windows computers.

Generally Available Enhancements

EA Feature Manager

To provide more information about self-serviceable EA Features, links to help or developer documentation are now available for select features in the EA Feature Manager. For details, see Manage Early Access features.

New device notification enhancement

The setting for end users to receive a new device notification email when signing in to Okta from a new or unrecognized device is now enabled by default for all orgs. For more information about email notification settings, refer to New or Unknown Device Notification Emails.

Username passes to IdP when using identity-first IdP Discovery flow

When using an identifier-first IdPAn acronym for Identity Provider. It is a service that manages end user accounts analogous to user directories such as LDAP and Active Directory, and can send SAML responses to SPs to authenticate end users. Within this scenario, the IdP is Okta. discovery flow and the user is redirected to the Identity Provider, such as SAML, Google, Microsoft, or Generic OIDC, the username value is passed on to the Identity Provider so the user does not have to type it in again.

API Token size increased for OAuth

We have increased the API token size when configuring OAuth 2.0 based authentication from 2 kB to 64 kB. For more information about OAuth, see OpenID Connect & OAuth 2.0 API.

Logos available for all Social Identity Providers

All social identity providers have the default logos shown below:

LDAP Interface, increased page size

The LDAP page size is increased from 200 to 1001, allowing LDAP clients to use a multiple page size of 1000. For details, see Connecting to Okta using the LDAP Interface.

Search range for group membership

The Okta LDAP Interface previously limited membership searches to the first 200 users for a group. This restriction has been removed and the LDAP Interface will iterate through all pages before returning membership response back to the client. This applies to LDAP searches that query uniquemember and ismemberOf attributes. For details, see Connecting to Okta using the LDAP Interface.

Early Access Features

New Features

Multi-forest support for Windows Device Trust enrollment

IWA web app version 1.12.2 supports cross-forest/cross-domain Windows device trust enrollment. Now an IWA web app running in one forest can detect and assess the trust posture of Windows desktop devices located in another trusted forest and then allow these devices to enroll in Windows Device Trust. For more about Windows Device Trust, see Enforce Okta Device Trust for managed Windows computers.

Okta collecting product feedback from end users

Admins can allow Okta to collect feedback from end users. If this feature is turned on, end users will see a prompt on their Okta dashboard requesting feedback about our products and services. You can opt out of Okta User Communication in Settings > Customization > General. For more information, see End User Communication.

Web Authentication for U2F as a Factor

Admins can enable the factor Web Authentication for U2F, where U2F keys are authenticated using the WebAuthn standard. For more information, see Web Authentication for U2F.

Okta SSO IWA Web App Agent, version 1.12.2

This EA release includes: Security fixes. Support for cross-forest/cross-domain Windows device trust enrollment. Now an IWA web app running in one forest can detect and assess the trust posture of Windows desktop devices located in another trusted forest and then allow these devices to enroll in Windows Device Trust. For details, see Okta SSO IWA Web App agent Version History.


General Fixes


In the admin System Log, the zone field was populated for all events that matched a sign-on policy even when the IP of the client request did not match any zones configured in the policy.


A misleading error message was displayed when the rate limit was exceeded while using the LDAP Interface to query LDAP.


Fixed inconsistent behavior with the Reset Password Link for LDAP users.


In some cases, Okta-mastered users were deactivated when their linked accounts in Active Directory were deactivated.


Logging on through Jira on-prem chiclet didn't error out properly if the end user didn't exist in the target app.


Some orgs were unable to create the number of users that they were entitled to.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • ADP Portal (Admin) (OKTA-198299)

  • Bloomberg BNA (OKTA-202952)

  • Blue Cross Blue Shield North Carolina (OKTA-191585)

  • Coolblue (OKTA-203010)

  • Copper (OKTA-202311)

  • Dell EMC (OKTA-197625)

  • Egencia France (OKTA-202309)

  • Garveys (OKTA-202308)

  • Google AdWords (OKTA-200072)

  • Google Play Developer Console (OKTA-201061)

  • GT Nexus (OKTA-203008)

  • Monster Hiring (OKTA-202848)

  • Newton Software (OKTA-202111)

  • ONE by AOL Mobile (OKTA-201772)

  • SAP NetWeaver Application Server (OKTA-202310)

  • Tenable Support Portal (OKTA-201111)

  • The San Diego Union-Tribune (OKTA-202856)


Application Updates

The following partner-built provisioning integration app is now Generally Available in the OIN as partner-built:

New Integrations

New SCIM Integration Application

The following partner-built provisioning integration app is now available in the OIN as partner-built Early Access:

  • Effy: Freshservice Provisioning: For configuration information, see Effy: Freshservice Provisioning's Configuring SCIM with Okta.

SAML for the following Okta Verified applications

  • Oracle Cloud Infrastructure (OKTA-203179)

  • PerimeterX (OKTA-202317)

  • Visitly (OKTA-202988)

  • Workpath (OKTA-202894)

SWA for the following Okta Verified applications

  • AIMA (OKTA-197142)

  • BioDigital (OKTA-197194)

  • Cisco Registered Envelope Service (OKTA-197090)

  • DeKalb Physician Portal (OKTA-197193)

  • Financial News (OKTA-198739)

  • Fresh Direct (OKTA-197128)

  • My Eaton (OKTA-200770)

  • Ocado (OKTA-197129)

  • Private Advisors (OKTA-198720)

Weekly Updates