Early Access

  Current Upcoming
Production 2022.05.0 2022.05.1 Production release is scheduled to begin deployment on May 16
Preview 2022.05.0

2022.05.1 Preview release is scheduled to begin deployment on May 11

To enable Early Access (EA) features, contact Okta Support.

Generally Available items are listed under the Preview and Production tabs as appropriate.

Currently in Production

Group search in the Admin Console

Admins can now use the Search bar to quickly find groups, in addition to users and apps. See 管理コンソールの検索.

Automatically update public keys in the Admin Console

Using private_key_jwt as your app's client authentication method requires that you upload public keys to Okta and then use the private keys to sign the assertion. Then, you must update the client configuration each time you rotate the key pairs. This is time-consuming and error-prone. To seamlessly use key pairs and rotate them frequently, you can now configure private_key_jwt client authentication in the Admin Console for OAuth clients by specifying the URI where you store your public keys. See Manage secrets and keys for OIDC apps.

User accounts report

Use this report to view users with accounts in Okta and their profile information. It helps you manage and track user access to resources, meet audit and compliance requirements, and monitor the security of your org. The report is located in the Entitlements and Access section of the Reports page. See User Accounts report.

Incremental Imports for the Org2Org app

Okta now supports incremental imports for the Org2Org app. Incremental imports improve performance by only importing users that were created, updated, or deleted since your last import. See Okta Org2Org.

Additional Okta username formats for LDAP-sourced users

Three additional Okta username formats are now available for LDAP-sourced users. In addition to the existing options, admins can now select Employee Number, Common Name, and Choose from schema to form the Okta username. These new options allow admins to use both delegated authentication and Just-In-Time (JIT) provisioning with LDAP directory services. With these new provisioning options, it is now easier for admins to integrate their LDAP servers with Okta. See LDAP統合設定の構成.

Okta Epic Hyperspace agent, version 1.3.2

This EA version of the agent contains security enhancements. See Okta Hyperspaceエージェントのバージョン履歴.

Okta AD Agent automatic update support

Admins can now initiate or schedule automatic updates to Okta AD agents from the Admin Console. With agent auto-update functionality, admins no longer need to manually uninstall and then reinstall Okta AD agents when a new agent version is released. Agent auto-updates keep your agents up to date and compliant with the Okta support policy, and help ensure your org has the latest Okta features and functionality. Single or multiple agents can be updated on demand, or updates can be scheduled to occur outside of business hours to reduce downtime and disruption to users. See Automatically update Okta agents.

Admins may now enable the Recent Activity feature

The Recent Activity functionality may now be enabled or disabled by admins. Recent Activity displays recent sign-in events and associated security events so admins can track suspicious activity and keep their environment safe. See 最近のアクティビティー.

Log Streaming

While Okta captures and stores its System Log events, many organizations use third-party systems to monitor, aggregate, and act on event data.

Log Streaming enables Okta admins to more easily and securely send System Log events to a specified system such as Amazon Eventbridge in real time with simple, pre-built connectors. They can easily scale without worrying about rate limits, and no admin API token is required. See Log Streaming.

Edit resource assignments for standard roles

Super admins can now quickly and easily search for, add, and remove the resource assignments for a standard role. See Edit resources for a standard role assignment.

Manage email notifications for custom admin roles

Super admins can configure the system notifications and Okta communications for custom admin roles. Configuring the email notifications helps ensure admins receive all of the communications that are relevant to their role. See Configure email notifications for an admin role.

New Velocity email templates

Orgs with Enhanced Email Macros enabled can now customize Factor Reset and Factor Enrollment email templates with Velocity Template Language. See メール・テンプレートをカスタマイズする.

Early Access features from this release are now Generally Available.

New grant type for native SSO

A new grant type, Token Exchange, is available for Authorization Server configuration. Admins can select the grant type to enable SSO for native apps. For more information see Configure SSO for Native apps.

Third-Party Risk

Okta Risk Eco-System API / Third-Party Risk enables security teams to integrate IP-based risk signals to analyze and orchestrate risk-based access using the authentication layer. Practitioners can step up, reduce friction or block the user based on risk signals across the customer’s security stack. Apart from improving security efficacy, this feature also enhances the user experience by reducing friction for good users based on positive user signals. See リスク・スコアリング.

Okta Brands API

The Okta Brands API allows customization of the look and feel of pages and templates. It allows you to upload your own brand assets (colors, background image, logo, and favicon) to replace Okta's default brand assets. You can then publish these assets directly to the Okta-hosted Sign-In Page, error pages, email templates, and the Okta End-User Dashboard. See Customize your Okta experience with the Brands API.

FIPS compliance for iOS or Android devices

Federal Information Processing Standards (FIPS) compliance is now available for iOS or Android devices. FIPS can be enabled on the Okta Verify configuration page. When FIPS compliance is enabled, admins can be confident that only FIPS-compliant software is used. See .

OAuth redirect URI wildcards

Admins can now use a wildcard for multiple redirect URI subdomains when configuring OIDC applications. See AIWを使用してOIDCアプリ統合を作成する.

 Early Access features from this release are now Generally Available.

Okta Admin Console Groups page enhancements

EA 2021.05.0 GROUP_MEMBERSHIP_UI

The Okta Admin Console Groups page has been updated to simplify the addition of large numbers of users to groups and reduce the likelihood that all users can be accidentally removed from a group. In addition, search functionality has been significantly improved to make adding and removing users from groups quicker and easier. See グループを管理する.

Customize Okta domains

The ability to customize your Okta domain has now been rolled out to all orgs. With this feature, you can customize your Okta organization by replacing the Okta domain name with your own domain name. This allows you to create a seamless branded experience for your users so that all URLs look like your application. See Custom Domain API.

Early Access Features

Custom help links on the Sign-In Widget

Admins can now customize the help links on the MFA verification page of the Sign-In Widget. This allows admins to link their end users to a custom app or page for factor resets. See サインイン・ページのテキストをカスタマイズする.

Early Access Features

New Features

Event Hook preview

Event Hook preview lets admins easily test and troubleshoot their Event Hooks, as well as send sample requests without manually triggering an actual event. This means admins can preview the payload of a specific Event Hook type and make sure that it's what they need to move forward before a full deployment to production. See イベント・フックのプレビュー.

Enhanced Admin Console search

Admins can now search for end user email addresses in the Spotlight Search field in the Admin Console. You can also view the user's status in the search results when you search by username and email address. This robust global search helps you find what you need in the Admin Console quickly, thereby, saving time and increasing productivity. See 管理コンソールの検索.

RADIUS Agent, version 2.15.0

This version includes all changes released since the EA version 2.7.4. When configuring RADIUS apps, admins seek ways to constantly enhance network security and expand the server OS coverage. To meet these goals, the RADIUS agent version 2.15.10 now supports:

New network access authentication protocols:

  • PEAP-EAP-GTC

  • EAP-TTLS

New Linux operating systems:

  • Red Hat Enterprise Linux release 8.0

  • CentOS 7.6

  • Ubuntu 18.04.4

With the latest updates, admins gain more flexibility in deployment use cases. For example, the Okta RADIUS agent now interoperates with Netmotion Mobility using EAP-GTC.

RADIUS agent version 2.15.10 also includes support for TLS 1.2, which is required for all connections to Okta, and a simplified installer, which supports proxies and no longer requires shared secrets and ports. The new agent provides admins with an easier installation, configuration, and run-time experience. See Okta RADIUS Serverエージェントのバージョン履歴.

Early Access Features

New Features

Workplace by Facebook Push AD Manager functionality

Admins can choose to disable Push AD Manager functionality using this self-service Early Access feature. This enables admins to control the manager attribute using Okta Expression Language syntax to avoid being dependent on AD for the field. See Workplace by Facebook.

LDAP agent, new version 5.7.1

This version of the agent contains:

  • Internal improvements

  • Security fixes

To view the agent version history, see Okta LDAP Agentのバージョン履歴.

Okta Provisioning agent, version 2.0.2

This release of the Okta Provisioning agent includes vulnerability and security fixes. See Okta Provisioning AgentとSDKのバージョン履歴.

Enhancements

Skip to Content improvements

End users can now click Skip to Content on the new Okta End-User Dashboard to navigate directly to the Add Apps page.

Options relocation

The Recent Activity tab, End-User preferences, Admin View, and Sign Out options are now displayed in the user drop down menu on the Okta End-User Dashboard.

Early Access Features

New Features

One Time Use Refresh Token

One Time Use Refresh Token, also called Refresh Token Rotation, helps a public client to securely rotate refresh tokens after each use. A new refresh token is returned each time the client makes a request to exchange a refresh token for a new access token. See Refresh Token Rotation.

Early Access Features

New Features

Okta SSO IWA Web App agent, version 1.13.1

This release of the Okta SSO IWA Web App agent includes security enhancements and internal fixes. See Okta SSO IWA Webアプリのバージョン履歴.

Early Access Features

New Features

Okta Active Directory agent, version 3.6.0

This release includes performance improvements, security enhancements, and bug fixes. See Okta Active Directoryエージェントのバージョン履歴.

On-Prem MFA agent, version 1.4.4

This version includes hardening around certain security vulnerabilities and includes a new version of the Log4J library.

Note: The new Log4J library stores properties in log4j2.xml. Before upgrading, save a copy of C:\Program Files (x86)\Okta\Okta On-Prem MFA Agent\current\user\config\rsa-securid\log4j.properties and enter any changes into the new configuration file. See Okta On-Prem MFAエージェントのバージョン履歴.

RADIUS agent, version 2.14

This version includes hardening around certain security vulnerabilities and includes support for the PEAP-EAP-GTC protocol. See Okta RADIUS Serverエージェントのバージョン履歴.

ADFS plugin, version 1.7.8

This version includes bug fixes and hardening around certain security vulnerabilities. See Okta ADFSプラグインのバージョン履歴.

MFA Credential Provider for Windows, version 1.3.1

This version includes hardening around certain security vulnerabilities. See Okta MFA Credential Provider for Windowsのバージョン履歴 .

Custom IdP factor authentication with OIDC support

Custom IdP factor authentication now supports OpenID Connect. See カスタムIdP.

Optional Display Preferences for new Okta End-User Dashboard

Users can now set Display Preferences on the new Okta End-User Dashboard. They can enable or disable the Recently Used section and organize their dashboard as a grid or a list. See Oktaの新しいエンド・ユーザー・エクスペリエンス.

Early Access Features

New Features

New Recent Activity page on the new Okta end-user dashboard

The Recent Activity page provides end users with a summary of recent sign-in and security events for their Okta account. End users can also report suspicious activity to their Okta admin by clicking I don’t recognize this. See 最近のアクティビティー.

Early Access Features

New Features

LDAP agent, version 5.7.0

This version of the agent contains:

  • Support for LDAP group password policies
  • Bug fixes

See Okta LDAP Agentのバージョン履歴.

MFA for Windows Credential Provider, version 1.3.0

MFA for Windows Credential Provider version 1.3.0 is now available, adding support for Windows Server 2019. See Okta MFA Credential Provider for Windowsのバージョン履歴 .

Early Access Features

New Features

New RADIUS agent, version 2.13

This version includes security enhancements, a buffer overrun fix, and a dialog title change to the RADIUS Agent installer. See Okta RADIUS Serverエージェントのバージョン履歴.

Litmos supports Advanced Custom Attributes

The Litmos provisioning app now supports Advanced Custom Attributes. See Litmos Provisioning Guide.

Early Access Features

New Features

Smart Card Authentication

When initially accessing applications using a custom sign-in widget, users have the option to use a PIV/CAC card for authentication. See IDプロバイダー.s

Early Access Features

New Features

Okta RADIUS Server agent, version 2.11.0

This version includes support for EAP-TTLS. See Okta RADIUS Serverエージェントのバージョン履歴.

Early Access Features

New Features

Okta RADIUS Server agent, version 2.10.1

This version includes support for Linux, including .rpm and .deb installers. See Okta RADIUS Serverエージェントのバージョン履歴.

LDAP agent, version 5.6.4

This version of the agent contains internal improvements. See Okta LDAP Agentのバージョン履歴.

Early Access features from this release are now Generally Available.

Early Access Features

New Features

Okta ADFS Plugin version 1.7.5

This version includes:

  • A fix that removed an extra scroll bar when integrated on an ADFS page with two or more factors.
  • Security enhancements and bug fixes

See Okta ADFSプラグインのバージョン履歴

Okta RADIUS Server Agent for Windows, version 2.9.6

This version includes:

  • An update that no longer requires entering a port or shared secret in the installer.
  • Various bug fixes

See Okta RADIUS Serverエージェントのバージョン履歴

Okta Windows Credential Provider, version 1.2.4

This version includes security enhancements. See Okta MFA Credential Provider for Windowsのバージョン履歴

LDAP agent, version 5.6.3

Support for Oracle Directory Server Enterprise Edition (ODSEE). See Okta LDAP Agentのバージョン履歴

This release does not have any Early Access features.

This release does not have any Early Access features.

Early Access Features

New Features

Okta RADIUS Service Agent Update, version 2.9.5

The Okta RADIUS Server Agent version 2.9.5 is updated to run under the LocalService account, which has lower privileges than LocalSystem. The service has also been configured with a write-restricted token to further restrict access.

For more information, see Okta RADIUS Serverエージェントのバージョン履歴.

Okta MFA Credential Provider for Windows, version 1.2.2

The Okta MFA Credential Provider version 1.2.2 includes bug fixes and adds self-service password reset.

For more information, see Okta MFA Credential Provider for Windowsのバージョン履歴 .

Admin settings for selecting identity providers

Admins now have the option to configure a sign-on policy based on a specific identity provider.

For more information, see Adding Rules in © Copyright 2022 Okta, Inc All Rights Reserved. それぞれの商標は、それぞれの商標所有者に帰属します。 .

Early Access features from this release are now Generally Available.

Early Access Features

New Features

Quick Access tab on the Okta Browser Plugin available through EA feature manager

Quick Access tab on the Okta Browser Plugin is now available through the EA feature manager. See .

MFA for Oracle Access Manager

With Okta MFA for Oracle Access Manager (OAM), customers can use OAM as their Identity Provider (IdP) to applications and also use Okta for MFA to provide a strong method of authentication for applications. For more information, see Oracle Access Manager用のMFA.

New Windows Device Registration Task, version 1.4.0

This release includes the following:

Okta On-Prem MFA agent, version 1.4.1

This release of the agent contains security enhancements. See Okta On-Prem MFAエージェントのバージョン履歴.

Factor Sequencing

Admins can now provide end users with the option to sign in to their org using various MFA factors as the primary method of authentication in place of using a standard password. See 多要素認証の要素シーケンス .

Early Access Features

New Features

Custom Factor Authentication

Custom Factor Authentication allows admins to enable an Identity Provider factor using SAML authentication. For more information, see カスタムIdP.

Integrate Okta Device Trust with VMware Workspace ONE for iOS and Android devices

The Okta + VMware integration is a SAML-based solution that combines the power of Okta Contextual Access Management with device signals from VMware Workspace ONE to deliver a secure and seamless end-user experience. For details, see Okta Device TrustをiOSおよびAndroidデバイス用のVMware Workspace ONEと統合する.

On Premises Provisioning agent, version 1.3.3

This release changes from Oracle JRE to Amazon Corretto JRE 8.202.08.2. The OPP Agent now supports CSV Directory imports from a CSV file with a byte order mark. Additionally, imports will now fail if the OPP Agent attempts to send a message that is too large for Okta. For agent version history, see Okta Provisioning AgentとSDKのバージョン履歴.

Early Access Features

New Features

LDAP agent, version 5.6.1

This version of the agent contains internal improvements. For version history, see Okta LDAP Agentのバージョン履歴.

Enforce Okta Device Trust for Native Apps and Browsers on MDM-managed Android devices

Okta Device Trust for Native Apps and Browsers on MDM-managed Android devices allows you to prevent unmanaged Android devices from accessing enterprise services through browsers and native applications.

Note: This feature requires Okta Mobile 3.14.1 for Android (or later). For details, see MDMの管理対象Androidデバイスへのネイティブ・アプリとブラウザーに対応したOkta Device Trustの適用.

Okta SSO IWA Web App agent, version 1.13.0

This release of the Okta SSO IWA Web App agent includes bug fixes. For version history, see Okta SSO IWA Webアプリのバージョン履歴.

Early Access Enhancements

Agentless Desktop SSO, feature dependency

If you are using Agentless Desktop Single Sign On, there is now a dependency on Identity Provider Routing Rules. If you do not have Identity Provider Routing Rules enabled, contact Support. For feature details, see エージェントレス・デスクトップ・シングル・サインオンを構成する and IDプロバイダーのルーティング・ルール.

New System Log events for Inline Hooks

  • Log all Inline Hook response events: All inline hook success and failure events are now logged. Logged events provide context around how the response was used.
  • Inline Hook Type events also log the type of Inline Hook.

For more feature information, see インライン・フック.

New System Log event for ThreatInsight

When ThreatInsight configuration is updated, the System Log now displays a new event to reflect these configuration changes. For more information about this feature, see Okta ThreatInsight.

Sign-In Widget labeling

The Sign-In Widget has been updated to use labels for form fields instead of placeholder text.

Note: This update applies to the default login page. If you are using a custom login page you need to manually upgrade to the 3.0 version of the Widget to get this update.

For more feature information, see Oktaでホストされるカスタムのサインイン・ページを構成する.

Before:

After:

Early Access Features

New Features

Allow end users to quickly access recently used apps

End users can find recently used apps in a separate Recently Used section on their dashboard as well as in the Recently Used option from the Okta Browser Plugin. For more information, see Find recently used apps.

LDAP agent, version 5.6.0

This version of the agent contains internal improvements. For version history, see Okta LDAP Agentのバージョン履歴.

System Log event for Agentless Desktop SSO configuration updates

When changes are made to the Agentless DSSO configuration, the System Log tracks the action as shown below. For more information on Agentless Desktop SSO, see Configure Agentless Desktop SSO.

System Log event for Kerberos realm settings

When changes are made to the Kerberos realm settings, the System Log tracks the action as shown below. This event also indicates the initiator of the event and the current setting for Kerberos Realm. For more information on Agentless Desktop SSO, see エージェントレス・デスクトップ・シングル・サインオンを構成する.

System Log event for Agentless Desktop SSO redirects

When Agentless Desktop SSO redirects to the IWA SSO agent or the default Sign In page, the System Log tracks the action as shown below. For more information on Agentless Desktop SSO, see エージェントレス・デスクトップ・シングル・サインオンを構成する.

Early Access Enhancements

Updated labels in Device Trust enablement flow for Integration types

Some labels in the Admin Console for Device Trust enablement are updated to align with changes in partner branding. Existing functionality is unaffected by this update. For details, see .

Web Authentication security key enrollment

Admins may now enroll a WebAuthn security key on behalf of their end users through user profile settings. For more information about MFA and WebAuthn, see © Copyright 2022 Okta, Inc All Rights Reserved. それぞれの商標は、それぞれの商標所有者に帰属します。 .

Early Access features from this release are now Generally Available.

Early Access Features

Early Access Enhancements

Automation Policies enhancement

Run Once Automation policies can be optionally run without any conditions. For more information about Automations, see 自動化

Early Access Features

New Features

Okta LDAP agent, version 5.5.5

This release contains:

  • Support for a configurable number of agent polling threads  
  • Internal fixes

For details, see Okta LDAP Agentのバージョン履歴 and Okta LDAPエージェントのスレッド数を変更する.

Review prompt on Okta Mobile for iOS

End-users using Okta Mobile on iOS are prompted to provide an App Store rating for the app. When they provide a rating in the app and click Submit, they are taken to the App Store page for the Okta Mobile app to provide more optional feedback about the app. They can click Not now to dismiss the option. For more information, see Okta Mobileについて.

Okta On-Prem MFA Agent, version 1.4.0

This release replaces the JRE with the Amazon Corretto 8.0 version of OpenJDK JRE. For the agent version history, see Okta On-Prem MFAエージェントのバージョン履歴.

OIN Manager supports multiple application submissions

When submitting a new application integration for review by Okta, the OIN Manager now supports multiple concurrent application submissions (for new orgs only).

 

Early Access Enhancements

Custom domain HTTP to HTTPS redirect

Custom domain can redirect from HTTP to HTTPS. For more information about custom domains, see Configure a custom URL domain.

Early Access Features

New Features

Okta Active Directory agent, version 3.5.6

This release includes the following changes:

  • Back-end changes to improve how the agent refreshes its DNS entries and connects to servers during disaster recovery.

  • The MaxRetryLimitSleep parameter default is now 8 minutes.
  • A bug fix resolving group membership issues when a user is created by JIT.

For more information, see Okta Active Directoryエージェントのバージョン履歴.

Okta LDAP agent, version 5.5.4

This release contains internal changes and bug fixes. For more information, see Okta LDAP Agentのバージョン履歴.

MFA for ePCS

Okta provides multifactor authentication for the Electronic Prescribing for Controlled Substances (ePCS) system with its integration to Epic Hyperspace, which is the front-end software that launches ePCS. For more information, see 規制薬物の電子処方箋（ePCS）用のMFA

Early Access Enhancements

Inline MFA Enrollment for RADIUS Apps

Admins can now either allow or prohibit end users to access resources protected by RADIUS to enroll in MFA while authenticating. For more information, see OktaのRADIUSアプリケーション.

Early Access Features

New Features

Multi-forest support for Windows Device Trust enrollment

IWA web app version 1.12.2 supports cross-forest/cross-domain Windows device trust enrollment. Now an IWA web app running in one forest can detect and assess the trust posture of Windows desktop devices located in another trusted forest and then allow these devices to enroll in Windows Device Trust. For more about Windows Device Trust, see Enforce Okta Device Trust for managed Windows computers.

Okta collecting product feedback from end users

Admins can allow Okta to collect feedback from end users. If this feature is turned on, end users will see a prompt on their Okta dashboard requesting feedback about our products and services. You can opt out of Okta User Communication in Settings > Customization > General. For more information, see End User Communication.

Web Authentication for U2F as a Factor

Admins can enable the factor Web Authentication for U2F, where U2F keys are authenticated using the WebAuthn standard. For more information, see Web Authentication for U2F.

Okta SSO IWA Web App Agent, version 1.12.2

This EA release includes: Security fixes. Support for cross-forest/cross-domain Windows device trust enrollment. Now an IWA web app running in one forest can detect and assess the trust posture of Windows desktop devices located in another trusted forest and then allow these devices to enroll in Windows Device Trust. For details, see Okta SSO IWA Webアプリのバージョン履歴.

New Features

Okta Active Directory agent, version 3.5.5

This release includes:

  • A bug fix for errors when importing a group with more than 1,500 users.
  • Internal bug fixes

For version history details, see Okta Active Directoryエージェントのバージョン履歴.

View admin list by role

Super admins can now filter the list of admins by role and type for easier searching.

Early Access Enhancements

FIPS-mode encryption enhancement

We have updated the Okta Verify configuration UI label for the FIPS-Mode encryption setting. For more information, see Enabling FIPS-mode encryption.

We have removed UI elements supporting account link and provisioning Callouts when configuring social authentication.

Note that Callouts are still supported via the APIs. See Identity Provider API reference documentation for more details.

Okta has added a new setting to enable FIPS-mode encryption for all security operations using the FIPS 140-2 standards. For more information about this feature, refer to Using Okta Verify. 閉じたScreenshot:

Okta end users need to reverify their password if they want to update their personal information in Okta five minutes after a successful login. For more information about letting end users manage their personal information in Okta, see Configure whether user passwords and personal information are managed by Okta or externally.

For Desktop Device Trust Authentication flows, the System Log now reports the CredentialType as CERTIFICATE. 閉じたScreenshot:

This feature enables you to customize where Okta will redirect your users when they visit your org URL directly and the specific app they are attempting to use is unknown. For more details, see Okta組織をカスタマイズする.

The System Log now reports when Windows Device Trust certificates are revoked during certificate renewal (pki.cert.revoke).閉じたScreenshot

Admins can generate a report of proxy IP addresses that have been used by end users who have signed in to Okta. This feature is Generally Available for new orgs that have the Geolocation for Network Zones feature and is available with either of the following Early Access Features:

For more information on Proxy IP Usage Reports, see Reports.

Windows and macOS Device Trust certificate issuance and renewal failures are now reported in the System Log. 閉じたScreenshot:

Windows Device Trust certificate renewals are now reported in the System Log by event type pki.cert.renew. This new event type allows you to distinguish certificate renewal events from certificate issue events (pki.cert.issue). 閉じたScreenshot

Users logging into a RADIUS app will now be prompted to enroll in MFA factors if they have not already enrolled. Admins can configure a specific RADIUS app to enable the inline MFA enrollment for the app. For more information, see OktaのRADIUSアプリケーション.

In Okta Plug-in version 5.23.0 for IE, the popover now scales properly to correspond to the window's zoom level. For version history, see Okta Plugin Version History.

When configuring RADIUS applications, the Single line MFA prompt is the default in the Advanced RADIUS Settings section for new RADIUS and VPN app instances. This option controls whether all MFA prompts are displayed on a single line. For more information, see Configuring RADIUS applications in Okta.

You can configure RADIUS applications to show prompts on a single line with no line breaks in MFA prompts. 閉じたScreenshot

Okta has added an Update Now button that allows admins to update a username from the app’s Sign On tab. For more details, see Overriding the app username.

Admins can send themselves a test email to see how their custom email templates will look and function. This allows them to validate macro attributes and translations in the customized template and to see how the template will render in different email environments. This eliminates the need to create a real end-to-end workflow to test customization. The test email will be sent to the primary email address of the admin initiating the test email. For more information, see Email Options. 閉じたScreenshot

Improved IdP lookup when Multiple PIV IdPs are enabled by using the client certificate Issuer to identify the signing certificate, if the Authority Key Identifier property cannot be used. For more details see Identity Providers.

A new security feature provides admins with an option to require user data storage in the Android hardware-backed keystore. Enabling this feature offers additional security based on the Federal Identity, Credential, and Access Management architecture. 閉じたScreenshot:

For more information, see Using Okta Verify.

As a result of reports optimization efforts, our Applications Access Audit reports (Early Access) are now by default ordered by appUserId rather than lastName. For more information about these reports, see Applications Access Audit report.

In Self Service Registration settings you can now select an option to add a Sign Up link in your Okta hosted Sign-In page. This eliminates the need to configure the link via JavaScript in the Custom Sign In page editor. For more information, see Okta Self-Service Registration. 閉じたScreenshot

Improved configuration of the applicable applications in the IdP policy routing rule in the Identity Provider Discovery EA feature. The application selection is enhanced to show app logos to differentiate between apps and app instances more clearly. For more information see Identity Provider Discovery. 閉じたScreenshot:

This feature allows dynamic mapping of multiple accounts/roles within AWS by using group assignments from Okta. By using the App Filter and Group Filter, we can specify which account and role the user will use to login into AWS. For more information see the Okta AWS Multi-Account Configuration Guide. 閉じたScreenshot:

The enrollment flow for 3rd-party iOS Device Trust is improved for end users who are not enrolled in an MDM solution and do not have Okta Mobile installed. In cases where Okta cannot automatically redirect these end users to the admin-provided enrollment link configured in Okta, end users can now copy the link to the clipboard and paste it into Safari. 閉じたScreenshot:

For more about 3rd-party iOS Device Trust, see Configure Okta Device Trust for Native Apps and Safari on MDM-managed iOS devices.

Workday users can be deactivated based on the time zone of their location.

For more information about our Workday integration see our Workday Provisioning Guide.

We have enhanced OIN app catalog search, extending search capabilities to include partial matches and more attributes of the application metadata.

閉じたExample without enhanced search:

閉じたExample with enhanced search: 

End users can now toggle visibility of their password on the Okta Sign-In page, allowing end users to check their password before they click Sign In. Note that passwords are visible for 30 seconds and then hidden automatically. For more information about passwords in Okta, see Authentication. 閉じたScreenshot:

Okta Self Service Registration allows end users to self-register into your custom app or the Okta Homepage. Once enabled, a Sign up link appears in the Okta Sign-In widget. This link takes users to a new Create Account registration form based on a customized registration policy. For details, see Self Service Registration. 閉じたScreenshot:

The enrollment flow for 3rd-party iOS Device Trust is improved for unenrolled end users accessing certain native clients such as Outlook. End users can now copy a link to their organization's enrollment instructions and paste it into Safari. For details about this Device Trust solution, see Configure Okta Device Trust for Native Apps and Safari on MDM-managed iOS devices. 閉じたScreenshot:

This feature expands on existing behavior detection feature for user logins. Close successive user login attempts that are far apart geographically are detected and flagged as suspicious behavior. For more information, see Security Behavior Detection.

Are you tired of end users utilizing "Jaibroken" or "Rooted" devices to access sensitive apps? Admins will be pleased to hear that admins can now deny enrollment to compromised devices and/or any specific OS versions. Compliant users can enroll new devices or retain their current enrollments. See Restrictions based on Device Status and Operating System. 閉じたScreenshot:

A popup that informs users when a policy allows access without MFA, is removed.

The Okta System Log records system events related to your organization in order to provide an audit trail that can be used to understand platform activity and to diagnose problems.

The Okta System Log API provides near real-time read-only access to your organization’s system log and is the programmatic counterpart of the System Log user interface.

Often the terms “event” and “log event” are used interchangeably. In the context of this API, an “event” is an occurrence of interest within the system and “log” or “log event” is the recorded fact.

Notes:

The System Log API contains much more structured data than the Events API.

The System Log API supports additional SCIM filters and the q query parameter, because of the presence of more structured data than the Events API.

Okta supports salted SHA256 algorithms for password import.

Okta Device Trust for Native Apps and Safari on OMM managed iOS devices now supports use of the Not trusted option in Sign-On policy rules. This allows mobile admins to do the following:

  • Configure a Not Trusted + MFA rule so that users with untrusted iOS devices must MFA in order to access protected resources.
  • Configure a Not Trusted + Deny rule so that users with untrusted iOS devices are redirected to OMM enrollment in order to access protected resources.

This update requires Okta Mobile 5.14 for iOS, available in the App Store. For more information, see Configure Okta Device Trust for Native Apps and Safari on OMM managed iOS devices.

The Okta Windows Credential Provider prompts users for MFA when signing in to supported Windows servers with an RDP client. It supports all Okta-supported MFA factors except Windows Hello and U2F tokens. For details and setup instructions, see Okta Windows Credential Provider.

Okta now supports incremental imports for the Workday app.

Incremental imports improve performance by only importing users that were created, updated, or deleted since your last import.

Admins can choose from a list of custom attributes to use for matching when using a personal identity verification (PIV) card. Note: This is an enhancement to our support for PIV smart card feature (EA), for more information, see Add a PIV Card.

The Add Notes screen has design improvements to improve the workflow. For details, see Add Notes to an App (an Early Access feature).

The Okta Windows Credential Provider prompts users for MFA when signing in to supported Windows servers with an RDP client. It supports all Okta-supported MFA factors except Windows Hello and U2F tokens. For details and setup instructions, see Okta Windows Credential Provider.

You can now revoke an end user's certificate(s) for Okta Device Trust for managed Windows computers through their Applications tab. This is recommended if an end user's Windows computer is lost or stolen. For details, see Revoke Device Trust certificates from the Okta Certificate Authority. 閉じたScreenshot

Okta Mobile user and device authentication events for OMM Device Trust for managed iOS devices are now written to the System Log.

The JIRA and Confluence apps now make use of a unique identifier during Atlassian API calls for profile updates instead of username. This allows users to be renamed.

Along with custom SAML Wizard apps, Federation Broker Mode now allows for OIDC apps. For details about this feature, see Federation Broker Mode.

OMM Device Trust for managed iOS devices allows you to prevent unmanaged iOS devices from accessing enterprise services through browsers and native applications. For details, see Configure OMM Device Trust for managed iOS devices.

The security question in the password recovery flow is now an optional factor. This feature requires the use of a group password policy. For more information, see Account Recovery.  閉じたScreenshot

The new Federation Broker Mode allows Okta SSO without the need to pre-assign apps to specific users. Access is managed only by sign-on policy and the authorization rules of each app. This mode can improve import performance and can be helpful for larger-scale orgs that manage many users and apps. For details, see Federation Broker Mode.

During inbound SAML authentication, you can configure the JIT settings for a SAML identity provider (IdP) to unsuspend Okta users. For more information, see the Identity Providers API.

Okta Device Trust for Microsoft Office 365 Exchange ActiveSync for iOS devices lets you:

  • Configure the iOS mail app to use certificates instead of passwords to allow OMM-enrolled users to authenticate to Microsoft Office 365 Exchange ActiveSync.

  • Configure the Microsoft Office 365 client access policy to prevent unmanaged devices from accessing Microsoft Office 365 Exchange ActiveSync.

For details, see Configure Okta Device Trust for Microsoft Office 365 Exchange ActiveSync for iOS devices. 閉じたScreenshot

Okta's Office 365 Exchange ActiveSync certificate-based authentication (CBA) for iOS devices allows users enrolled in Okta Mobility Management (OMM) to authenticate to iOS native apps without entering their credentials. For details, see Configure Office 365 EAS certificate-based authentication for iOS devices. 閉じたScreenshot

We have updated the Jira authenticator to support the following events:

  • fireLoginEvent
  • fireUserAuthenticatedEvent
  • userAuthenticatedEvent

This enhancement adds support for Just In Time provisioning of default group memberships when users log in. For details, see the Okta Jira Authenticator 3.x Configuration Guide

We strongly recommend that you download and upgrade the latest SAML toolkit and the necessary Jira or Confluence authenticators. You can access all of these tools from the Okta Downloads page (Settings > Downloads).

We’ve enhanced our System Log to take advantage of our new Network Zones feature. Admins can now hover over an IP address that's part of an event and navigate through the series of menus to add that IP address to either the gateway or proxy list of IP addresses:

We now support reactivation of users in the following cases:

  • During Just in Time provisioning (JIT), if a user is reactivated in a master app (for example, LDAP, AD), then the user is reactivated in Okta.
  • During imports, if a user is reactivated in a master app (for example, LDAP, AD), then the user is reactivated in Okta.

The Access Request Workflow feature is a complete, multi-step approval workflow through which end users can request access to apps. Admins can select approvers that have the ability to grant access to self-service applications. Access Request Workflow allows you to appoint group and individual approvers, create customized notifications, and add comments, notes, and timeout rules. You perform all setup from the Okta Admin Dashboard and no programming or configuration files are required. For more information, see Access Request Workflow.閉じたScreenshot

Note: This Early Access (EA) feature requires either the Enterprise Plus or Provisioning Product editions. To enable it, contact Okta Support.