February 2020

2020.02.0: Monthly Production release began deployment on February 18

* Features may not be available in all Okta Product SKUs.

Generally Available Features

New Features


Active Directory, new import and provisioning settings experience

The AD settings user interface had been updated. It is now more consistent with how other application settings are configured. All orgs will now use the Okta expression language for the Okta username format field.

If your orgThe Okta container that represents a real-world organization. was created before October 4th (Preview) or October 9th, 2017 (Production), a legacy expression language that is different than the Okta expression language was used for the Okta username format field. For more information, see Configure the Okta Active Directory (AD) agent: new user interface and Updated AD Profile Mapping options.

This feature will be gradually made available to all orgs.

Enhanced provisioning for Office 365

With additional enhancements to Microsoft Office 365 integration admins can now synchronize identities from on-premises to cloud-based Office 365, provision a user profile that is extended further to include over 100 attributes, as well as synchronize distribution groupsGroups allow you to organize your end users and the apps they can access. Assigning apps to large sets of end users is made easier with groups., contacts, and resources such as conference rooms.

Admins can also manage user licenses and roles, independent of other provisioning flows. The new provisioning type for Office 365, License/Roles Management Only, allows admins to manage user license assignment and role delegation for existing Office 365 users and for users provisioned to Office 365 with third-party tools. For more details, see Okta Enhancements with Microsoft Office 365 Integration.

Password Import Inline Hook

The Password Import Inline Hook lets you interface with an external service to verify a user-supplied password when the user signs in to Okta for the first time. This supports scenarios in which users are migrated from an existing user store while allowing them to retain their passwords.

See Inline hooks

SAML Assertion Inline Hook now supports URI formatting in claims

Okta now supports URI claims with SAMLAn acronym for Security Assertion Markup Language, SAML is an XML-based standard for exchanging authentication and authorization data between an identity provider (IdP) and a service provider (SP). The SAML standard addresses issues unique to the single sign-on (SSO) solution, and defines three roles: the end user, the IdP, and the SP. Here's how SAML works through Okta: SP-initiated flow: the end user requests (principally through a browser) a service from the SP. The SP requests and obtains an identity assertion from the IdP (in this case, Okta). On the basis of this assertion, the SP can decide whether or not to authorize or authenticate the service for the end user. IdP-initiated flow: with Okta as the IdP, an end user goes to the Okta browser and clicks on an app, sending a SAMLResponse to the configured SP. A session is established with the SP, and the end user is authenticated. assertion hooks. When you need to replace or add a URI claim, you must encode the claim name within the command based on the JavaScript Object Notation (JSON) Pointer specification. Specifically, this replaces ~ with ~0 and / with ~1.

See Inline hooks

OAuth for Okta Enabled for Policy API

The Policy API now has OAuth for Okta enabled.

widget error messaging

The error message Unable to sign in is now displayed if authentication fails when signing in to Okta.

Okta Browser Plugin, version 5.37.0 for all browsers

This version includes:

See Okta Browser Plugin: Version History

Get User API Support for sort parameters

The Get User API now supports sortBy and sortOrder parameters.

New System Log event for user type changes

A new System Log event is added when the user type for an end user changes.

Send Device Context using Limited Access

Limited Access allows you to configure Okta to pass device context to certain SAML apps through the SAML assertion during appAn abbreviation of application. Essentially, it is a web-based site used to perform any number of specific tasks, and requires authentication from end users by signing in. authentication. The app uses this data to limit access to certain app-specific behaviors. For more information, see Pass Device Context to SAML apps using Limited Access.

Schedule user imports

When you set up Provisioning to import users from an app or from a CSV directory to Okta, you can set up a schedule for imports at regular intervals on an hourly, daily, or weekly basis. If your app supports incremental imports, then you can set up both full and incremental import schedules. This integration applies to all non-AD and LDAPLightweight Directory Access Protocol (LDAP) is a lightweight client-server protocol for accessing directory services, specifically X.500-based directory services. LDAP runs over TCP/IP or other connection oriented transfer services. applications that support imports such as CSV directory, Workday, SuccessFactors, BambooHR, Salesforce, and so on. For more information, see Schedule imports.

Enhancements to identify user addition and removal status and improve performance

The addition or removal of users from a group now runs as a background task. During the process, the Manage People button is inactive and a notification appears to indicate the progress of the request. For more information, see Group rules.

Enhancements to identify org user deactivation status and improve performance

Org user deactivation now runs as a background task. Notifications have been added to indicate request progress and successful request completion. For more information, see Activate and deactivate users.

Early Access Features

New Features

Okta ADFS Plugin version 1.7.5

This version includes:

  • A fix that removed an extra scroll bar when integrated on an ADFS page with two or more factors.
  • Security enhancements and bug fixes

See Okta Active Directory Federated Services Plugin Version History

Okta RADIUS Server Agent for Windows, version 2.9.6

This version includes:

  • An update that no longer requires entering a port or shared secret in the installer.
  • Various bug fixes

See Okta RADIUS Server Agent Version History

Okta Windows Credential Provider, version 1.2.4

This version includes security enhancements. See Okta MFA Credential Provider for Windows Version History

LDAP agent, version 5.6.3

Support for Oracle Directory Server Enterprise Edition (ODSEE). See Okta Java LDAP agent version history

Windows Device Registration Task, version 1.4.1

This release fixed the following issues:

  • If there was a space in the sAMAccountName, an error appeared when installing the Okta Device Registration task and the installation completed but didn't function.
  • An unknown publisher warning appeared after double-clicking the Okta Device Registration MSI file.

Affected customers should uninstall the registration task and install 1.4.1 or later.

See B.2 — Obtain and install the Device Registration Task and Device Trust for Windows Desktop Registration Task Version History

New Okta End-User Dashboard and Okta Browser Plugin

The newly redesigned Okta End-User Dashboard and Okta Browser Plugin boost user productivity and provides a faster, more intuitive, and more responsive user experience.. See New Okta End-User experience

Provision out of sync users

If you enable provisioning for an app that already has users assigned to it, Okta can sync these users so they now have provisioning capabilities.

See Provisioning and Deprovisioning


General Fixes


A user inadvertently retained access to an admin app when the only group/app assigned to the user was deleted.


Attributes with null or blank values were not updated to RingCentral.


When a user was locked out due to multiple failed password attempts, the UI incorrectly showed the following error message: Your account was locked due to excessive MFA attempts.


When an end user set their preferred language to Spanish, email notifications in English that were sent to the user contained a typo.


When using the SAML Assertion Inline Hook, if there was an optional attribute statement configured for the app and the attribute statement had no value specified, commands returned from SAML Inline Hook responses were not applied.


When using a custom domain, the PIV button look and feel was inconsistent on the sign-in page.


When batch imports were enabled, group memberships were sometimes not handled correctly.

App Integration Fixes

The following SAML apps were not working correctly and are now fixed

  • Qualys Guard (OKTA-270318)

  • Sage Intacct (OKTA-268392)

  • Socialbakers (OKTA-273050)

The following SWA apps were not working correctly and are now fixed

  • Adobe (OKTA-272864)

  • Adobe Creative (OKTA-272880)

  • Adobe Enterprise (OKTA-272879)

  • Apple Business Manager (OKTA-264263)

  • connectwise_automate (OKTA-272812)

  • Iola (OKTA-272811)

  • Statuspage (OKTA-272865)


Application Updates

Provisioning support has been removed from the Crashplanpro, Bloomfire, and Confluence apps due to their low customer usage, lack of standards based integration, and high supportability cost.

New Integrations

New SCIM Integration Applications

The following partner-built provisioningThis term is obsolete. See "Okta Verified". integration apps are now Generally Available in the OINAn acronym for the Okta Integration Network. The OIN is comprised of thousands of public, pre-integrated business and consumer applications. As an on-demand service, OIN integrations are continuously validated, always up to date, and constantly growing both in number and capability. Okta performs a single integration with an ISV or SP, providing thousands of end users with point-and-click customization for their orgs. as partner-built:

Note: The following apps were previously released as Early Access, but as part of our process changes the apps have now been updated and released as Generally Available, Okta VerifiedEach integration in the Okta Integration Network has one of the following status designations: Okta Verified, Community Created, or Community Verified. Integrations receive Okta Verified status: 1) if the integration is Okta-built, and is then tested and verified by Okta; or 2) if the integration is ISV-built (partner-built), and is then tested and verified by Okta..

SAML for the following Okta Verified applications

  • activpayroll - activ8 (OKTA-271002)

  • Nethris (OKTA-266636)

  • Octarine (OKTA-272822)

  • Openpath Security (OKTA-272571)

  • Reachdesk (OKTA-272823)

  • Rescana (OKTA-270985)

SWA for the following Okta Verified application

  • Aquera (OKTA-272801)

Weekly Updates

January 2020

2020.01.0: Monthly Production release began deployment on January 13

* Features may not be available in all Okta Product SKUs.

Generally Available Features

New Features

Okta Browser Plugin version 5.36.1 for Chromium-based Microsoft Edge and Mozilla Firefox

This version includes the following:

For version history, see Okta Browser Plugin: Version History

New System Log event for Grant User Privilege

The Grant User Privilege System Log event now logs activity for each user in a group when an Admin role is assigned to the group.

New System Log events for OIDC scope grants

System Log events are now triggered when an administrator grants consent for OpenID Connect scopes.

Rogue Accounts Report End of Life (EOL)

The Rogue Accounts Report feature has been removed due to low usage, high cost of maintenance, and the availability of custom solutions. For example, admins can retrieve similar data by using the List Users Assigned to Application API to see users who were assigned to an app in Okta, and then using custom code to generate a list of users assigned in the app itself. For more information, see this Support Article.

Federate multiple Office 365 domains in a single app instance

You can automatically federate multiple Microsoft Office 365 domains within a single Office 365 app instance in Okta. This eliminates the need to configure a separate Office 365 app instance for each Office 365 domain. This feature will be slowly made available to all orgs. For more information, see Federate multiple Office 365 domains in a single app instance.

Support for Salesforce Government Cloud

You can create instances of the Salesforce app that can integrate with Salesforce Government Cloud. For more details, see the Salesforce Provisioning Guide.

Box integration enhancement

The Box integration is enabled for Universal DirectoryUniversal Directory enables you to store an unlimited amount of users and attributes from applications and sources like AD or HR systems. Any type of attributes are supported including linked-objects, sensitive attributes, and pre-defines lists. All of it accessible by all apps in our OIN catalog, over LDAP or via API. and is enhanced by the following additional properties in the User Profile:

  • firstName
  • lastName
  • timezone
  • language
  • space_amount (RO)
  • max_upload_size (RO)
  • job_title
  • phone
  • address
  • avatar_url (RO)
  • groups
  • space_used (RO)

See the Box Provisioning Guide for more information.

Resumable Import

Resumable Import is a performance enhancement that prevents imports from starting over in the event of a deployment or infrastructure issue. Instead, the import automatically pauses and continues from the most recently completed step. For information on importing users, see Import users from an app.


HealthInsight audits an organization’s security settings and suggests recommended tasks to improve an org's security posture. Security tasks and recommendations are intended for admins who manage employee security within their organization.

HealthInsight may now be accessed directly from the Admin Console dashboard.

Fore more information, see HealthInsight.

App Catalog Search Improvements

The enhanced Okta Integration Network (OIN) App Catalog now features:

  • A new incremental search and an improved search results preview
  • Expanded search capabilities to check app integration names, descriptions, or categories
  • Fuzzy search logic to match partial hits and name variations
  • Tiles highlight the protocols supported by the app integration

This feature will be gradually made available to all orgs.

Generally Available Enhancements

UI Enhancements for HealthInsight

The HealthInsight card on the Admin Console dashboard and HealthInsight actions have been updated for improved usability. For more information about HealthInsight, see HealthInsight.

Additional context in MFA authentication in some apps

We have added an additional target element containing application information to MFA events triggered by authentication to Epic Hyperspace EPCS (MFA) and Microsoft RDP (MFA) apps.

Improved text in single line challenge for RADIUS MFA

The text displayed during the a single line MFA challenge via RADIUS authentication has been improved to fixed grammatical errors.

Notification when adding a user to an Admin group

Admins now see a notification that admin privileges will be granted when adding a user to a group with Admin privileges.

Updated Privacy Policy

Okta has updated its Privacy Policy. See to review the latest version.

Condition update for MFA Enrollment policy rules

The name of the setting for the Any Application condition has been updated to specify app support for MFA Enrollment. For more information, see App Condition for MFA Enrollment Policy.

UI enhancements for profile and attribute selection

The appearance of profile and attribute selection elements is updated to be more consistent with other Okta select elements.

Toggle on/off the end user onboarding screen

In the Settings > Appearance settings in the Admin Console, admins can control whether or not new end usersEnd users are people in your org without administrative control. They can authenticate into apps from the icons on their My Applications home page, but they are provisioned, deprovisioned, assigned, and managed by admins. see the onboarding screen upon their first sign in to the Okta End User dashboard.

Early Access Features

New Feature

Deactivated admin users

When a user who has an admin role and privileges assigned to them is deactivated, their admin privileges are revoked. The deactivated user is removed from the Administrators page and CSV download list of administrators. For information about Admin roles, see Administrators. This feature is available from our Self Service Feature Manager, for more information, see Manage Early Access and Beta features .


General Fixes


The word Password was incorrectly translated in Dutch.


French translation for the Self-Service Unlock when Account is not Locked email template was not intuitive.


Microsoft RDP (MFA) prompts did not display the official Okta logo.


After an application was selected from the Okta Safari plugin toolbar menu, the selection window did not close as expected.


Searching for an app in App Administration Assignment did not display exact matches.


Fido 2.0 (Webauth) set as a secondary factor on Factor Sequencing failed on the user sign-in with the error We found some errors. Please review the form and make corrections.


In Okta Device Trust with VMware Workspace ONE implementations, app sign-on policy denied access on Android 10 even if the device was trusted.


App Admins who were configured to only see a subset of apps in the catalog were able to see all apps.


When creating a SAML integration using the AIW, the instructions contained the outdated acronym OAN instead of the current OIN (Okta Integration Network) acronym.


For orgs that had opted into the New Import and Provisioning Settings Experience for Active Directory EA feature, placeholder text was displayed instead of the correct text in the warning dialogue when the Profile and Lifecycle Mastering checkbox under Active Directory provisioning settings was checked and the Update Users checkbox was previously enabled.


The Settings tab for app provisioning failed to render in Internet Explorer 11.

App Integration Fixes

The following SWA apps were not working correctly and are now fixed

  • Aha (OKTA-266200)

  • American Express Work Reconciliation (OKTA-266198)

  • Apple ID (OKTA-264195)

  • Aveda (OKTA-266196)

  • Blackbaudhost Citrix (OKTA-266199)

  • Bloomfire (OKTA-266193)

  • Brex (OKTA-266241)

  • Cisco WebEx Meeting Center (OKTA-262750)

  • Citrix RightSignature (OKTA-268537)

  • DoorDash (OKTA-268780)

  • Firefox (OKTA-266201)

  • FullContact Developer Portal (OKTA-268538)

  • Google Analytics (OKTA-266914)

  • Impraise (OKTA-268534)

  • MKB Brandstof (OKTA-267534)

  • Nest (OKTA-267942)

  • NewEgg Business (OKTA-268840)

  • OnePath Advisor (OKTA-266925)

  • Principal Financial Personal (OKTA-268782)

  • RescueTime (OKTA-266197)

  • Rhino3d (OKTA-268531)

  • Seek (AU) - Employer (OKTA-266703)

  • Shipwire (OKTA-266919)

  • Site24x7 (OKTA-268622)

  • Vindicia (OKTA-266192)

  • Wombat Security Awareness (OKTA-268532)

The following SAML app was not working correctly and is now fixed

  • Datadog (OKTA-267430)


Application Updates

  • Zoom provisioning application now supports updating user email addresses.
  • Citrix NetScaler Gateway has changed its name to Citrix Gateway.

New Integrations

New SCIM Integration Application

The following partner-built provisioning integration apps are now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified applications

  • AppOmni (OKTA-266642)

  • Appsian Security Platform for PeopleSoft (Encrypted) (OKTA-265400)

  • Clinical Maestro (OKTA-264130)

  • Cmd (OKTA-266400)

  • Freshworks (OKTA-262038)

  • Grammarly (OKTA-266950)

  • Kisi Physical Security (OKTA-265701)

  • LoanBuddy (OKTA-266952)

  • Mode Analytics (OKTA-260404)

  • Reducer (OKTA-265134)

  • TeamzSkill (OKTA-265665)

SWA for the following Okta Verified application

  • Miniter (OKTA-262048)

Weekly Updates

December 2019

2019.12.0: Monthly Production release began deployment on December 16

* Features may not be available in all Okta Product SKUs.

Generally Available Features

New Features


Okta Browser Plugin version 5.35.0 for Safari and Internet Explorer

This version includes the following:

  • Bug fixes for custom URL domain support for the plugin
  • Okta privacy link
  • Back-end enhancements

For version history, see Okta Browser Plugin: Version History.

Okta Confluence Authenticator, version 3.1.2

This release contains a fix for OpenSaml initialization in OSGi environment and an update to OpenSaml library version 3.2.0. For version history, see Okta Confluence Authenticator Version History

Okta SAML Toolkit for Java, version 3.1.2

This release contains a fix for OpenSaml initialization in OSGi environment and an update to OpenSaml library version 3.2.0. For version history, see Okta SAML Toolkit for Java Version History

SAML or SCIM applications created in certain developer cells can now submit to ISV portal

Developers in the OK7 developer cell who create and test SAML or SCIM applications using the App Wizard can now submit directly to the ISVAn acronym for independent software vendors. Okta partners with various ISVs (usually producing enterprise applications) to integrate on-premises, in the cloud, or native-to-mobile devices with Okta. portal at

Increased timeout for Okta Sign In page

The initial timeout duration has been extended on the Okta Sign-In page.

ACS Limit Increased

The maximum number of Assertion Consumer Service (ACS) URLs for a SAML app is increased to 100.

LDAP Password Push

Okta now supports Password Push for LDAP. This allows each user's LDAP password to be synced to their Okta password. Any subsequent password changes users make are pushed to their user profile in LDAP. In addition to simplifying password management for orgs using LDAP, organizations using both Active Directory (AD) and LDAP can now synchronize their user passwords from AD through Okta to LDAP. For details, see the Provisioning section in Install and Configure the Okta Java LDAP Agent.

Suspicious Activity Reporting

End users can now report unrecognized activity to their org admins when they receive an account activity email notification. This feature is now available through the EA feature manager. See Suspicious Activity Reporting.

Group rules triggered by user reactivations

Group rules are now triggered when a user is reactivated. See Group rules for more information.

Multifactor Authentication for admins

MFA for Admins allows Super admins to enable mandatory multifactor authentication for all administrators accessing admin functionality. For details see Authentication.

Beta features available in Feature Manager

You can now enroll your Preview org in Open Betas in the Feature Manager. When you enroll in a Beta feature, you receive an email with further details. For details, see Manage Early Access and Beta features .

SAML Inline Hook

The SAML Inline Hook enables you to customize the authentication flow by allowing you to add attributes or modify existing attributes in outbound SAML assertions. For details, see our SAML Inline Hook page.

Admin Getting Started tasks

The new Admin Getting Started page helps super admins begin configuring their new Okta org.

For more information, see Get Started with Okta.

Token Inline Hook

The Token Inline Hook enables you to integrate your own custom functionality into the process of minting OAuth 2.0 and OpenID Connect tokens. For details, see our Token Inline Hook page.

SCIM Template Apps include ISV portal link

Any apps created from the SCIM app templates display a banner that directs developers to use the ISV portal at to submit their SCIM app to the OIN.

SAML App Wizard change for software developers

During the creation of a SAML app with the App Wizard, software vendors receive a link to the ISV portal at to submit their app to the OIN. If the software vendors elect not to submit through the App Wizard, a banner appears on their app configuration page with the link to the ISV portal.

OIN Manager supports multiple application submissions

When submitting a new application integration for review by Okta, the OIN Manager now supports multiple concurrent application submissions:


Custom URL domain support for the Okta Browser Plugin

This support enables the Okta Browser Plugin to work on the configured custom URL domain. See Configure custom URL domain.

Improved People page filter and Profile page details

We’ve added more detail to the user state labels on the People page.

And now provide the action required for users in a pending state on the User Profile page.

Generally Available Enhancements

OAuth Consent UX Enhancements

  • The OAuth Consent end-user dialog has been modified to improve the user experience.
  • For OAuth Scopes created for a new Authorization Server, the default values for Display Name and Description are updated to be more informative.

Select group UI enhancement

The appearance of Select Group elements are enhanced throughout the UI to be more visually intuitive and consistent with other Okta select elements:

Application Settings enhancements

  • When you create a new application in the dashboard, it will be created with a default Post Logout Redirect URI (previously this field existed but defaulted to blank).
  • When you create a new application of type Single Page Application (SPA), it will default to using Authorization Code with PKCE instead of defaulting to Implicit Flow.
  • The Post Logout Redirect URI only impacts users using our /logout API call (not using any of our SDKs), and it is a list of possible values just like the (Login) Redirect URI.

Event hooks support for MFA factor events

Event hooks are now enabled for MFA factor life-cycle events such as activating or resetting a factor.

Windows Mobile and Blackberry options removed

The option in the Okta Sign In Widget and in the End User Settings to enroll in Okta Verify or Google Authenticator using Windows Mobile or Blackberry devices is now removed.

Sorting functionality added for inline hooks and event hooks

Admins can now sort inline hooks by Status, Type, or Name, and event hooks by Verification, Status, or Name. For more information, see Inline hooks and Event Hooks.

Authentication Server display name enhancement

The Authorization Server scopeA scope is an indication by the client that it wants to access some resource. display name for new entries is now limited to 40 characters.

Use of admin information

Additional legal text regarding use of admin information is added to Settings > Account >Admin email notifications.

Email notification when org licensing changes

Super admins will now receive an email when their org is converted from a free trial and licensed based on a new active contract.

Addition of status text to status icons

The On-Prem MFA and RSA SecureID Agents status icons relied on color to provide status. Status is now also represented by text for improved accessibility.

Workplace by Facebook domain update

When setting up a Workplace by Facebook app, you now have the option to switch from the default domain to the domain.

Device fingerprinting for custom org URLs

Custom org URLs now support device fingerprinting for improved accuracy of new sign-in notifications and new device detection.

New device behavior detection

New device behavior detection is improved to provide better accuracy with new devices.

New warning modal for provisioning to apps

Admins who enable Profile Master and Push for the same app are now warned of the potential for overwritten attributes and the risk of lost data. For more information, see Profile mastering.

Early Access Features

This release does not have any Early Access features.


General Fixes


When using Factor Sequencing, the Custom Password label did not appear in the Password field on the Sign-In page.


Okta did not update null/blank profile attributes into RingCentral.


Country Code prefix for Kosovo was set to +undefined when enrolling SMS as a factor.


In some cases, Reapply mapping was displayed incorrectly when editing app users with an app user property that was sourced from two different groups.


Social Login created a race condition with Self Service Registration.


LDAPi searches using a filter containing entryDN=* failed with result code 80.


For customers who opted into the New Import and Provisioning Settings Experience for Active Directory Early Access feature, if an admin entered an invalid custom expression into the AD username format field on the AD Settings page, clicking Save caused infinite loading of the page without saving the settings.


Customers who opted into the New Import and Provisioning Settings Experience for Active Directory Early Access feature could not see the UI control for previewing the result of the custom expression underneath the AD username format field when custom was chosen in the drop down.


Additional customizations applied to the ADFS site were not displayed when users accessed the ADFS second factor challenge page.


In some cases, customers importing users from Workday (as a Master) got an undefined error when executing profile matching.

App Integration Fixes

The following SWA app was not working correctly and is now fixed

  • Ingram Micro (OKTA-260621)


Application Updates

Provisioning support has been removed from the following apps due to low customer usage, lack of standards based integration, and high supportability cost:

  • Veeva
  • Replicon
  • Roambi Business
  • Gooddata
  • Rightscale

New Integrations

New SCIM integration applications

The following partner-built provisioning integration app is now Generally Available in the OIN as partner-built:

SAML for the following Okta Verified applications

  • Appsian Security Platform for PeopleSoft (OKTA-258107)

  • Cincopa (OKTA-260900)

  • Cisco Webex (OKTA-263286)

  • Firmex VDR (OKTA-262869)

  • Juro (OKTA-258096)

  • TripActions (OKTA-263057)

  • Wochit Studio (OKTA-263299)

Weekly Updates