Okta Identity Engine release notes (Production)

Version: 2024.12.0

December 2024

Generally Available

Sign-In Widget, version 7.26.0

For details about this release, see the Sign-In Widget Release Notes.

For more information about the Widget, see the Okta Sign-In Widget Guide.

Okta MFA Provider for ADFS, version 1.8.2

This version includes bug fixes and security hardening.

Okta On-Prem MFA agent, version 1.8.0

This version includes security enhancements. See Okta On-Prem MFA agent version history.

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

  • Android 12, 13, 14, 15 security patch 2024-12-05
  • iOS 17.7.2, 18.1.1
  • macOS Sequoia 15.1.1

Allow or disallow an authenticator instance in an authentication policy rule

You can now specify a custom authenticator instance in the allow or disallow lists of an authentication policy rule. This provides more granular control over which authenticators are available to users. See Add an authentication policy rule.

Automatically assign the Okta Access Certifications app

When you assign the super admin role to a user, the Okta Access Certifications app is automatically assigned.

Industry term update in the OIN catalog

The NGO industry term has been updated to Nonprofit Organizations in the Okta Integration Network (OIN) catalog. All published integrations with the NGO designation now have the Nonprofit Organizations designation.

System Log event for emails added to the bounced email list

A System Log system.email.bounce.removal event is now triggered when an API request is made to remove bounced emails (POST /org/email/bounces/remove-list). This request sends a list of emails to a third-party email service to remove the emails from the bounce list. The event is triggered when the API request is made. The event doesn’t indicate when the emails are actually removed by the third-party email service.

Haitian Creole translation for end users

On the End-User Settings page, users can now set their display language to Haitian Creole. See Supported display languages.

Filters for network zones

New filters in the network zones table help admins quickly distinguish between system-defined zones and those they have created. See Manage network zones.

Request access on behalf of another user

You can now allow users to request admin access for other users from their own dashboard. After you enable the option in the access requests conditions that manage admin role bundles, you can grant this permission to all users or limit it to managers only. See Create an access request condition.

Use case selection in the OIN Wizard

Independent software vendors (ISVs) can now select the following use case categories when they submit their integration to the Okta Integration Network (OIN):

  • Zero Trust
  • Identity Verification
  • Identity Governance and Administration (IGA)

See Use case guidelines for the OIN Wizard.

New task for orgs with one super admin

The Tasks dashboard widget and the HealthInsight page now indicate when an org has fewer than two super admins. This helps prevent orgs from losing access to the Admin Console.

Download links for Okta Jira and Confluence Authenticators in Admin Console

The download links for Okta Jira and Confluence Authenticators are no longer available in the Admin Console.

IdP client secret System Log event update

The system.idp.lifecycle.read_client_secret System Log event now includes an API key. The System Log event is triggered when you make a GET api/v1/idps or api/v1/idps/{idpId} request that returns the client secret or API key. See Event types.

Updated translations

Translations of text on the Sign-In Widget have been updated.

Early Access

New skipping of entitlement sync during import of a user Systems Log event

The following System Log event has been added: Sync skipping of entitlement during import of a user.

Force rematching of imported users

This feature enforces a rematch for unconfirmed users imported from a profile source, whether through full or incremental imports. It attempts to match these imported users with existing Okta users. When this feature is enabled, every import re-evaluates matches for unconfirmed users.

Create dynamic resource sets with conditions

Resource set conditions help you limit the scope of a role by excluding an admin’s access to certain apps. This gives you more granular control over your custom admin roles and helps meet your org’s unique security needs. See Resource set conditions.

Granular account linking for certain Identity Providers

When admins link users from SAML and OIDC Identity Providers, they can now exclude specific users and admins. This improves security by allowing admins to configure granular access control scenarios.

Self-service toggle for Deactivate App Users

Admins can now use the self-service toggle to change what happens to an Okta user’s individual app assignments upon deactivation. If enabled, the user's individual app assignments deactivate instead of suspend. If a user is reactivated in Okta, the individual app assignments don't reactivate.

Restrict access to the Admin Console

By default, users and groups with assigned admin roles have access to the Admin Console app. With this feature, super admins can choose to manually assign the app to delegated admins instead. This is recommended for orgs with admins who don't need access, like business partners, third-party admins, or admins who only use the Okta API. See Configure administrator settings.

Fixes

  • When an admin clicked the Next button multiple times in succession while the table was loading, the number of Realm Assignments erroneously increased. (OKTA-725359)

  • Okta MFA for Active Directory Federation Services (ADFS) code wasn't signed. (OKTA-802958)

  • When using the Authenticator Method Chain feature with the Okta Admin Dashboard authentication policy, an error appeared if the chain didn't include the password authenticator. (OKTA-803569)

  • During self-service registration, the third-generation Sign-In Widget incorrectly validated some passwords that didn't meet the requirements. (OKTA-806543)

  • An authentication policy rule created with an authenticator instance couldn't be deactivated when the authenticator feature was disabled. (OKTA-806803)

  • When an API Service integration was assigned a custom admin role, it couldn't access certain OIDC apps. (OKTA-814731)

  • The MFA enforcement warning on the Admin Console Policy didn't appear in non-English locale settings. (OKTA-815246)

  • The description on the Entity Risk Policy page was incomplete for non-English locales. (OKTA-815370)

  • Some users couldn't sign in to Okta after an OIDC client was added to a new custom access policy. (OKTA-815668)

  • Some System Log events were displayed in Japanese instead of English. (OKTA-817904)

  • The Tasks dashboard widget had extra white space next to the Type column. (OKTA-818109)

  • Okta didn't check if generic and specific authenticator methods for the same authenticator were both present in a policy rule. (OKTA-818111)

  • The Sign-In Widget didn't correctly display warning text if the user entered an incorrect one-time passcode. (OKTA-819536)

  • The Application Usage report displayed an error message for Bookmark apps instead of usage data. (OKTA-819931)

  • Some users received an error message when they canceled the Sign in with Okta FastPass operation in the Sign-In Widget (second generation). (OKTA-820509)

  • Some users received an error message when they tried to delete the One factor access authentication policy if it contained mappings to deleted apps. (OKTA-822822)

  • System Log entries were created without information about changes made to Identity Provider discovery policy rules. (OKTA-824865)

  • An Authentication Method Chain rule was incorrectly flagged as not complying with the MFA requirements in the MFA Enforcement warning in the Admin Console. (OKTA-827219)

  • The Symantec Web Security Services app was timing out too quickly when doing a group push. (OKTA-829357)

  • Super admins who were assigned the role through a group couldn't view all support cases. (OKTA-831270)

  • An error occurred when admins attempted to deactivate some devices. (OKTA-835427)

  • Secure Partner Access app users were able to view and manage their own lifecycle actions. (OKTA-838254)

  • The Edit resource set page sometimes indicated that an unconditioned resource had conditions. (OKTA-838265)

  • The Create a resource set page was sometimes blank after an admin added an additional resource to a resource set. (OKTA-838266)

  • When the Authentication Method Chain was used, if a rule applied to registered and managed devices, the Are you trying to sign in? prompt didn't appear in the Okta Verify desktop app even though the Okta Verify FastPass authentication method required user interaction. (OKTA-838919)

  • Some text on the security methods page of the Sign-In Widget wasn't rendered correctly. (OKTA-839889)

  • The UI strings for the Secure Partner Portal app that were translated to Japanese were outdated. (OKTA-839956)

Okta Integration Network

  • Arxspan (SAML) has an updated ACS URL and Audience URI.
  • Avigilon Alta (SCIM) is now available. Learn more.
  • Brevity (SAML) is now available. Learn more.
  • Cisco User Management Connector (SCIM) has a new dynamic base URL.
  • DeepInfra (OIDC) is now available. Learn more.
  • Dext (OIDC) is now available. Learn more.
  • Kibana by Tech Prescient (SCIM) is now available. Learn more.
  • Smartsheet by Tech Prescient (SCIM) is now available. Learn more.
  • Speeda Customer Analytics (OIDC) is now available. Learn more.
  • XFA Discovery (API Service) is now available. Learn more.

Weekly Updates

2024.12.1: Update 1 started deployment on January 7

Fixes

  • In orgs with the Same-Device Enrollment for Okta FastPass Early Access feature enabled, some users were stuck on the enrollment setup screen. (OKTA-747278)

  • Users couldn't sign in because AD SSO didn't support the prompt=login parameter for OIDC apps. (OKTA-798545)

  • On the Tasks page, if an app assignment model contained an array type with CVD properties and the user clicked Retry selected, the properties were sent in the wrong format. (OKTA-802994)

  • Updating the label of an OIDC app sometimes resulted in an incorrect label appearing in System Log events. (OKTA-816204)

  • In orgs with Identity Threat Protection with Okta AI, some admins received a 500 Internal Server Error during authorization with a session token under certain authentication policy conditions. (OKTA-816476)

  • Importing between apps created duplicate groups, even if Import Groups was disabled. (OKTA-819677)

  • Policy mappings for deleted apps weren't removed. (OKTA-821039)

  • The Add nickname button sometimes didn't appear on the Settings page. (OKTA-821649)

  • The MFA Usage report didn't display the correct time for users' last enrollments. (OKTA-826975)

  • In orgs with the Same-Device Enrollment for Okta FastPass Early Access feature enabled, some users didn't receive the device-to-device setup instructions if the security was set to high. (OKTA-833402)

  • The Device platform condition in the Okta account management policy wasn't correctly evaluated for some orgs. (OKTA-834858)

  • If a user's phone authenticator enrollment had an extension, the telephony inline hook payload to the external web service didn't include it. (OKTA-835398)

  • Sometimes, users could access resources without providing biometrics, even though the authentication method chain required biometrics. (OKTA-838604)

  • The Add nickname button sometimes didn't appear on the Settings page. (OKTA-839607)

  • When navigating to resource catalog items using direct links, requesters were redirected to the Request Access page instead. (OKTA-841323)

  • An Invalid Phone Number error sometimes appeared during SMS factor enrollment. (OKTA-842270)

  • The Admin Created filter for network zones only showed a single page of results, and the Show More link didn't work. (OKTA-842468)

  • Admins couldn't click Edit for the Give Access to Okta Support option to control Okta Support team access to their org. (OKTA-843678)

  • The Application Usage report displayed an error message for bookmark apps instead of usage data. (OKTA-845343)

  • New device notification emails were sent if a request had an X-Device-Fingerprint header with an empty value. (OKTA-845617)

  • The Administrator assignment by role page for the super admin role displayed the internal first-party apps that were assigned to the role. (OKTA-846207)

Okta Integration Network

  • DeleteMe (SCIM) has a new DOB attribute and integration guide.
  • Dext (SAML) has a new logo.
  • dscout (SCIM) now supports group push.
  • Hyperproof (SAML) has a new logo.
  • Revolut People (SAML) is now available. Learn more.

Version: 2024.11.0

November 2024

Generally Available

Okta LDAP Agent, version 5.22.0

This version of the agent includes the following:

  • Agent now uses OAuth 2.0 and OAuth 2.0 Demonstrating Proof-of-Possession (DPoP) to securely communicate with Okta.
  • New agents are registered through the OAuth 2.0 device registration flow.
  • Agents now operate independently from the accounts used to register them.
  • Agents can now be installed by super admins and admins with a custom role that includes agent registration permissions. See LDAP integration prerequisites.
  • Linux LDAP agents are now managed using systemd instead of sysvinit. See Manage the Okta LDAP Agent.

See Okta LDAP Agent version history.

Improved user experience for group member counts

Groups now use async counts to determine user membership for groups that exceed 10,000 users. This improves the performance of both the Groups page and the group selector on the Sign-on policy page.

Give access to Okta Support

Admins can now control how members of the Okta Support team access their org. To support this, the Account page provides the following two options:

  • Impersonation Grants for Cases: Allows the Okta Support team to sign in to your org as a read-only admin to troubleshoot issues.
  • Support User Grants for Self-Assigned Cases: Allows an Okta Support representative to access your org settings after they've opened a case. Using these settings, admins can select the right level of Support access for their org.

See Give access to Okta Support.

YubiKey preregistration

Customer admins were previously unable to enroll and ship YubiKeys as WebAuthn enrollments in a quick and automated way. The YubiKey preregistration feature enables admins to preregister YubiKey factors as WebAuthn enrollments for both staged and existing (active) users using a Workflows and Yubico integration to seamlessly handle the registration and shipment. See Require phishing-resistant authentication with pre-enrolled YubiKey.

Seamless ISV experience for SCIM

Okta now provides a seamless ISV experience to optimize the Okta Integration Network (OIN) submission experience for SCIM integrations. This new experience enables independent software vendors (ISVs) to build and manually test their SCIM integration metadata before submission to the OIN. This reduces the time needed for the OIN team to review and validate that the SCIM integration functions as intended, which shortens the time to publish in the OIN. This experience also incorporates communication processes in Salesforce, enabling improved collaboration internally within Okta teams and externally with ISVs. See Publish an OIN integration overview and Submit an integration with the OIN Wizard guide.

Read-only admin permissions

Read-only admins can now view user profile policies and inline hooks. See Read-only administrators.

New column in Application Usage report

The Application Usage report now provides an Instance Name column. The new column helps users identity which apps the report was generated for.

Improved Access Requests error message

When you navigate to the Access Requests tab for an app, the resulting error message is now clearer.

Updates to User Accounts report

The maximum number of rows in a CSV export has been increased from 1 million to 5 million.

Early Access

IP Exempt Zone

Use this feature to allow traffic from specific gateway IPs irrespective of Okta ThreatInsight configurations, blocked network zones, or IP change events within Identity Threat Protection with Okta AI. See IP Exempt Zone.

OpenID Connect Identity Providers now support group sync

OpenID Connect Identity Providers now support full group sync and adding a user to a group that they don't already belong to. A user who authenticates with an external IdP is added to all available groups when Full sync of groups is enabled. The user is added to any groups that they don't already belong to when Add user to missing groups is enabled. This allows you to specify certain groups that users should be added to.

Create dynamic resource sets with conditions

Resource set conditions help you limit the scope of a role by excluding an admin's access to certain apps. This gives you more granular control over your custom admin roles and helps meet your org's unique security needs. See Resource set conditions.

Seamless and secure authentication with passkey autofill

Passkeys offer a streamlined sign in experience to users by leveraging their browser's existing autofill capabilities. This allows users to quickly and intuitively sign in to an org without typing their credentials or seeing extra prompts. This secure, phishing-resistant solution works seamlessly across devices, delivering both enhanced security and convenience for modern authentication needs. See Configure the FIDO2 (WebAuthn) authenticator.

Secure Partner Access for external partners

Secure Partner Access provides a secure way for external business partners to access your org's resources. It streamlines your partner management tasks, reduces IT workload, and simplifies the process of configuring your org's security requirements. See Manage Secure Partner Access.

Secure SaaS service accounts

This feature enables customers to monitor, manage, and secure access to service accounts in their SaaS apps. This new feature in Okta Privileged Access improves the Okta platform by safeguarding non-federated accounts across an org's apps. See Manage service accounts.

Fixes

  • The user count on the Groups page wasn't displayed correctly. (OKTA-603239)

  • The group picker in the Okta Browser Plugin showed an inaccurate user count. (OKTA-603587)

  • After account recovery was deferred to the Okta account management policy, users still couldn't delete authenticators that were required by the password policy. (OKTA-740130)

  • When the Settings page prompted an end user for reauthentication, the Sign-In Widget sometimes wasn't displayed correctly. (OKTA-793598)

  • Admins couldn't retry failed provisioning tasks. (OKTA-795934)

  • Admins who only had the View applications and their details and Run imports permissions could deactivate apps. (OKTA-798693)

  • SUSPENDED app users weren't supported during a group push. (OKTA-803747)

  • The authenticator enrollment and email notifications for new Okta Verify enrollments on custom domains weren't correctly branded. (OKTA-805671)

  • When the Okta account management policy was configured to control recovery, all selected authenticators in the password policy were cleared. (OKTA-812311)

  • The text overflowed the Application notes for admins field in the General Settings section of the OIDC app page. (OKTA-813866)

  • When an admin clicked Show more tasks on the Tasks page after a Profile Push error occurred, the list of affected users appeared twice. (OKTA-814527)

  • Self-service unlock didn't work if user enumeration prevention was disabled and Show lock out failures was turned on. (OKTA-815680)

  • The security.partner.report.risk and user.session.end events were missing from the user.risk.change System Log event. (OKTA-818603)

  • Sometimes when an admin tried to view the Salesforce app integration, they were prompted to sign in. (OKTA-820465)

  • Sometimes an error occurred when pushing groups without a group description. (OKTA-820782)

  • On the Okta Admin Dashboard, the information in the Tasks widget wasn't aligned correctly. (OKTA-822294)

  • Sometimes there was an unexpected profile sync. You may experience one more unexpected profile sync. (OKTA-822824)

  • On the Edit role page, some role permissions weren't in the correct order. (OKTA-823779)

Okta Integration Network

  • Datadog (SAML) is now available. Learn more.
  • Diminish (OIDC) is now available. Learn more.
  • Docusign by Aquera (SCIM) is now available. Learn more.
  • EveryKey SSO (SAML) is now available. Learn more.
  • Five9 Identity Service based SSO (SAML) is now available. Learn more.
  • Fullstory (SAML) is now available. Learn more.
  • getregistered (SCIM) is now available. Learn more.
  • GitHub by Tech Prescient (SAML) is now available. Learn more.
  • LenelS2 Elements (SCIM) is now available. Learn more.
  • Lumos (SCIM) is now available. Learn more.
  • Metaphor (SCIM) has a new integration guide.
  • Ninth Brain Suite (SAML) is now available. Learn more.
  • Poggio (SAML) is now available. Learn more.
  • Schoox (SWA) has a new icon.
  • SecureTrustZone (SCIM) is now available. Learn more.
  • Seesaw (OIDC) is now available. Learn more.
  • Spherexx (SAML) has a new icon, description, and integration guide.
  • Upaknee Cloud Messaging Stack (OIDC) is now available. Learn more.

Weekly Updates

2024.11.1: Update 1 started deployment on December 2

Generally Available

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

  • Android 12, 13, 14, 15 security patch 2024-11-05
  • iOS 17.7.1 iOS 18.1
  • macOS Ventura 13.7.1
  • macOS Sonoma 14.7.1
  • macOS Sequoia 15.1
  • Windows 10 (10.0.17763.6532, 10.0.19044.5131, 10.0.19045.5131)
  • Windows 11 (10.0.22000.3260, 10.0.22631.4460, 10.0.26100.2314)

Sign-In Widget, version 7.25.1

For details about this release, see the Sign-In Widget Release Notes.

For more information about the Widget, see the Okta Sign-In Widget Guide.

Fixes

  • When an admin updated the Configured SAML Attributes for a SAML 2.0 integration, the values weren't reflected in the Admin Console. (OKTA-694781)

  • The minimum OS version required for the Okta Active Directory agent was incorrectly listed as Windows Server 2012. (OKTA-718212)

  • Text on the Edit resource to a standard role dialog was sometimes misaligned. (OKTA-794559)

  • The group picker incorrectly listed Okta Administrators on the New Web App Integration page under Assignments Limit access to selected groups. (OKTA-794750)

  • Emails stating that agents were down included an incorrect link to check agent status. (OKTA-797414)

  • SUSPENDED app users weren't supported during a group push. (OKTA-803747)

  • When an Okta AD agent failed to be reactivated because it had no SSWS token in the database, the Admin Console erroneously displayed a message stating that the agent was reactivated. (OKTA-806425)

  • Users created through self-service registration couldn't reset their passwords if they signed out before enrolling more authenticators. (OKTA-812816)

  • There was an issue with the Sync Entitlements button on the Governance tab for the (Header Auth) Governance with SCIM 2.0 app. (OKTA-814934)

  • Some Microsoft Windows 365 Enterprise license names were missing or appeared incorrectly on the Edit Assignment page. (OKTA-817097)

  • Some text strings on the Settings page of the End-User Dashboard had incorrect spacing. (OKTA-820021)

  • Some text strings on the Settings page of the End-User Dashboard weren't translated. (OKTA-821610)

  • The security.partner.report.risk and user.session.end events were missing from the user.risk.change System Log event. (OKTA-825084)

  • The OIDC scopes required to use entitlement management in Okta weren't enabled in Coupa. (OKTA-825558)

  • A GET user request for newly created users in Staged status sometimes returned incorrect activated and statusChangedvalues. (OKTA-827818)

  • The Secure Partner Access app session remained active even when the browser was closed. (OKTA-828148)

  • The realms page for Secure Partner Access incorrectly displayed non-partner realms. (OKTA-829258)

Okta Integration Network

  • ADP Next Gen HCM by Aquera (SCIM) is now available. Learn more.
  • Analytic Index (OIDC) is now available. Learn more.
  • BarRaiser (SAML) is now available. Learn more.
  • CB Insights (SAML) is now available. Learn more.
  • Chili Piper (SAML) is now available. Learn more.
  • Clearout.io (OIDC) is now available. Learn more.
  • Cornerstone Core HR by Aquera (SCIM) is now available. Learn more.
  • Cyberlift SSO (OIDC) is now available. Learn more.
  • CytoTronics Pixel Pro (SAML) is now available. Learn more.
  • FastSpring (OIDC) is now available. Learn more.
  • Funnel.io (SAML) is now available. Learn more.
  • GitHub AE (SCIM) is now available. Learn more.
  • Greenhouse Recruiting by Aquera (SCIM) is now available. Learn more.
  • Hyperproof (SAML) has a new AIP, SSO URL, Audience URI, and integration guide.
  • LawVu (SCIM) now has Group Push, additional attributes, and an updated description.
  • LivePreso (SCIM) is now available. Learn more.
  • Marker.io (SAML) is now available. Learn more.
  • Moveworks (OIDC) has a new integration guide.
  • OPTIZMO (SCIM) is now available. Learn more.
  • Perimeter 81 (SAML) has an updated ACS URL and Audience URI.
  • Perimeter 81 (SCIM) now supports the EU location.
  • Sage HR by Aquera (SCIM) is now available. Learn more.
  • Secured Signing (OIDC) has a new icon.
  • Stripe (SAML) is now available. Learn more.
  • Vbrick Rev Cloud (SAML) is now available. Learn more.

2024.11.2: Update 2 started deployment on December 9

Fixes

  • Provisioning users from Okta to LDAP failed when multiple active app users had the same username in the same app instance. (OKTA-537618)

  • When an admin searched for an app on the Add Resource dialog, the Load More button didn't appear. (OKTA-646166)

  • Clicking Convert all Assignments for app integrations with large group memberships resulted in an error. (OKTA-731871)

  • Errors sometimes occurred when creating group rules due to validation failures in the group membership rule. (OKTA-792778)

  • User reconciliation failed during a real-time sync profile reload of users who belonged to large groups. (OKTA-793257)

  • On the Status dashboard widget, the bullet character overlapped the DEGRADATION status for Agents. (OKTA-805683)

  • The SAML IdP authenticator couldn't be configured if the org had too many SAML IdPs configured. (OKTA-807519)

  • The first-party apps for Secure Partner Access displayed inconsistent and misleading information. (OKTA-808128)

  • The Authentication Method Chain UI had the Require user interaction option even when admins couldn't turn off the setting. (OKTA-818622)

  • When the end-user language was set to Spanish, the text on the Reset Password dialog was incorrect. (OKTA-821354)

  • Registered device and managed device conditions appeared in Okta account management policy rules despite being unsupported. (OKTA-825595)

  • A GET user request for newly created users in the staged status sometimes returned incorrect activated and statusChanged values. (OKTA-827818)

  • The Okta RADIUS agent was updated to version 2.24.0 for security enhancements, including hardening of the Password Authentication Protocol. The version also adds the Message-Authenticator attribute to responses. (OKTA-834907)

Okta Integration Network

  • ADP Decidium by Aquera (SCIM) is now available. Learn more.
  • bob (SCIM) has a new logo and integration guide.
  • CloudPay Administrator Platform is now available. Learn more.
  • Descartes (SAML) is now available. Learn more.
  • Grafana by Tech Prescient (SCIM) now supports user imports.
  • Hyperproof (SAML) has a new API, SSO URL, Audience URI, and integration guide.
  • Jenkins by Tech Prescient (SCIM) is now available. Learn more.
  • M-Files (SCIM) is now available. Learn more.
  • Nametag (API Service) is now available. Learn more.
  • Oloid (SCIM) is now available. Learn more.
  • Omnissa Identity Service (SAML) is now available. Learn more.
  • Omnissa Identity Service (SCIM) is now available. Learn more.
  • Plumm (SAML) is now available. Learn more.
  • Productboard (SCIM) has a new description and supports group push.
  • SDWAN-FAST (OIDC) is now available. Learn more.
  • Simplebooklet (OIDC) is now available. Learn more.
  • Teamup Calendar (SCIM) is now available. Learn more.
  • TOMS-Europe (OIDC) is now available. Learn more.
  • TOMS-Global (OIDC) is now available. Learn more.
  • Wasabi Account Control Manager (SCIM) is now available. Learn more.

Version: 2024.10.0

October 2024

Generally Available

Sign-In Widget, version 7.24.1

For details about this release, see the Sign-In Widget Release Notes.

For more information about the Widget, see the Okta Sign-In Widget Guide.

Hyperspace Agent version 1.5.0

Hyperspace Agent version 1.5.0 is now available. This version uses Microsoft Edge WebView2 Runtime to display Sign-In Widget content. See Okta Hyperspace Agent version history.

JIT provisioning for Smart Card

This feature enables you to provision Just-In-Time (JIT) access to users. You can do this by configuring certificate attribute criteria so that PIV/CAC card holders of other orgs can gain access to the resources they need. See Add a Smart Card Identity Provider.

Enhanced dynamic zones

Use enhanced dynamic network zones to define IP service categories (proxies, VPNs), locations, and Autonomous System Numbers (ASNs) that are allowed or blocked in a zone. See Enhanced dynamic zones.

Device assurance OS version update

The following OS versions are now supported in device assurance policies: -

  • Android 15
  • iOS 17.7
  • macOS 13.7
  • macOS 14.7
  • Windows 10 (10.0.17763.6293, 10.0.19044.4894, 10.0.19045.4957)
  • Windows 11 (10.0.22000.3197, 10.0.22621.4249, 10.0.22631.4249)

Nonce rollout for Content Security Policy

Okta is rolling out nonces for the script-src directive of the Content Security Policy for every endpoint that returns html content. This is a two stage process: first, the nonce is added to the Content-Security-Policy-Report-Only header script-src directive; later, after any unsafe inline scripts are identified and fixed, the nonce is added to the Content-Security-Policy header script-src directive. This update will be gradually applied to all endpoints.

Deprecating provisioning for Confluence (Atlassian)

Provisioning for Confluence (Atlassian) has been deprecated.

UI update on the Brands page

Dropdown menus on the Brands page have been updated to provide a more consistent look and feel.

OIN connector support for Entitlement Management

The following connectors have been updated to support Entitlement Management:

  • Coupa
  • DocuSign
  • WebEx

See Provisioning-enabled apps.

Group Owner assignments removed

The Group Owner assignment option has been removed from Access Requests for admin roles sequences.

Updated content on Entity Risk Policy page

UI text on the Entity Risk Policy page is updated for clarity and consistency.

New Okta Secure Identity collection in the OIN catalog

A new Okta Secure Identity collection is available in the Okta Integration Network (OIN) catalog. This collection identifies integrations that are part of the Okta Secure Identity commitment. See the OIN catalog for a list of integrations assigned to this collection.

Improved notifications in Admin Console policy

Notifications in the Admin Console authentication policy have been improved for better user experience.

System Log event types and outcome reasons

The user.authentication.auth_via_IDP and user.authentication.auth_via_social System Log event types now indicate whether a successful Identity Provider sign-in attempt was due to JIT provisioning or account linking. See Event types.

OIDC Identity Provider options

OIDC Identity Providers can now have both the Account Link and JIT policies set to disabled.

Event hooks for Identity Provider authentication

You can now use user authentication with Identity Provider events as event hooks. See Event Types for a list of events that you can use with event hooks.

Early Access

Grace period for device assurance

Occasionally, users' devices might fall out of compliance with security policies due to temporary conditions such as missed software updates or unapproved network connections. Without a grace period, they would be immediately blocked from accessing critical resources, which disrupts productivity and causes frustration. The Grace period for device assurance feature allows you to define a temporary window during which non-compliant devices can still access resources. This gives users time to remediate issues without being locked out, balancing productivity with security standards. See Add a device assurance policy.

Same-Device Enrollment for Okta FastPass reactivated

Same-Device Enrollment for Okta FastPass is now available again. The feature had been removed to resolve an Okta Verify enrollment issue. On orgs with Okta FastPass, the Okta Verify enrollment process has been streamlined:

  • Users can initiate and complete enrollment on the device they're currently using. Previously, a second device was required for enrollments. Note that enrollment requires 2FA if possible, which may involve a second device.
  • Users no longer need to enter their org URL during enrollment.
  • The enrollment flow has fewer steps. This feature is supported on Android, iOS, and macOS devices.

To enable it, go to Admin ConsoleSettings and turn on Same-Device Enrollment for Okta FastPass.

Biometric user verification support in Authentication Method Chain

The Require biometric user verification option is now supported in Authentication Method Chains.

Authenticator actions hidden

Users must satisfy the requirements of an Okta account management policy to reset or remove their existing security methods. If they don't, the authenticator actions are now hidden from their Settings page. See Okta account management policy.

Custom Keep me signed in labels

Admins can now customize the Keep me signed in label on their sign-in page. See Branding.

Design enhancements for OIDC and SAML app integrations

When the Front-channel Single Logout feature is enabled, the OIDC and SAML app integration pages now have a single Logout section that includes all of the logout settings for the app. See Application Integration Wizard SAML field reference.

Fixes

  • If an error occurred while performing a group push, the Push Status of the push group was only updated after refreshing the page manually. (OKTA-710642)

  • When managing directories for a group, clicking Next without making any changes resulted in duplicate Previous and Cancel buttons being displayed. (OKTA-735984)

  • Sometimes trying to access a SAML app through a service provider flow resulted in a 500 Internal Server error. (OKTA-739430)

  • Admins couldn't set temporary passwords for users if Self-Service Password Reset was disabled. (OKTA-742231)

  • In orgs that used a custom domain, admins were prompted to enter their username when they performed a protected action. (OKTA-747566)

  • Sometimes, concurrent agentless DSSO JIT operations for a user broke app assignments, which required admin intervention to correct. (OKTA-752118)

  • Some users couldn't enroll in Okta Verify for Desktop using WebAuthn. (OKTA-753346)

  • The ability to view API tokens was incorrectly assigned to the custom admin role permissions for View users and their details. The ability to revoke API tokens was incorrectly assigned to the custom admin role permissions for Edit users' lifecycle states, Suspend users, and Clear users' sessions. (OKTA-801358)

  • User passwords could be updated to match the answer to the recovery question. (OKTA-804681)

  • The phone authenticator description about sending a security token by SMS or voice was misleading. (OKTA-804683)

  • Inactive Identity Verification IdPs were listed in Okta account management policy rules. (OKTA-807331)

  • The number of SAML-capable apps displayed on the Tasks page was incorrect. (OKTA-811744)

  • The Sign-In Widget displayed an error message instead of sign-in fields and MFA challenges. (OKTA-812099)

  • Sometimes, the Sign-In Widget didn't display remediation instructions when the Grace Period value was None. (OKTA-813942)

  • Some admins with a custom role saw an error when they attempted to import user attributes. (OKTA-815012)

  • After signing out of the Okta End-User Dashboard, users on ChromeOS devices couldn't sign back in. (OKTA-816091)

Okta Integration Network

  • Bob by Aquera (SCIM) is now available. Learn more.
  • Eccentex AppBase (SCIM) is now available. Learn more.
  • GitHub Enterprise Server by Aquera (SCIM) is now available. Learn more.
  • HPE Aruba Networking SSE - Axis (SAML) is now available. Learn more.
  • Jurnee (OIDC) now has an initiate login URI.
  • Oracle Cloud HCM by Aquera (SCIM) is now available. Learn more.
  • SecureTrustZone (SAML) is now available. Learn more.
  • Snowflake by Tech Prescient (SAML) is now available. Learn more.
  • Teamgo Visitor Sign-in (SCIM) is now available. Learn more.

Weekly Updates

2024.10.1: Update 1 started deployment on November 4

Generally Available

Sign-In Widget, version 7.24.2

For details about this release, see the Sign-In Widget Release Notes.

For more information about the Widget, see the Okta Sign-In Widget Guide.

New IP service category

The WARP_VPN proxy service is now supported as an IP service category in enhanced dynamic zones. See Supported IP service categories.

Fixes

  • Users couldn't add or edit a factor nickname in SettingsSecurity Methods. (OKTA-658434)

  • An error occurred when admins attempted to deactivate some devices. (OKTA-715650)

  • The Okta account management policy didn't support device IdP redirects through EL conditions. (OKTA-740746)

  • Deleting a pre-registered YubiKey enrollment didn't send an email notification or register a System Log event. (OKTA-750155)

  • Sometimes an error occurred when reactivating org2org users. (OKTA-755934)

  • When users tried to authenticate using an Identity Provider to activate a device, an error message appeared and the Try again button didn't work. (OKTA-756381)

  • If both email address and username were required during profile enrollment, and the values were different, users didn't know where their email enrollment verification was sent. (OKTA-756516)

  • Deactivated apps sometimes showed an Active status in the Admin Console. (OKTA-799257)

  • Some users were unable to save user attribute settings in Okta groups that were linked to directories. (OKTA-799880)

  • In some cases, AppUser profiles weren't updated when users were provisioned to AD using Okta Groups. (OKTA-800577)

  • Users couldn't click the Skip Profile link to bypass the secondary email prompt. (OKTA-803499)

  • The System Log displayed an incorrect actor when events were triggered by an Activate a factor API request. (OKTA-803794)

  • The app.keys.* System Log events didn't contain the root session ID. (OKTA-808707)

  • Authentication method chain didn't work properly in the Okta Account Management Policy and has been disabled. (OKTA-812749)

  • When the minimum password age was set in the password policy, new users without a password couldn't set their password after they first signed in until the set minimum password age had passed. (OKTA-814032)

  • A successful sign-in event for the PIV Identity Provider displayed information from an old certificate if an existing user used a renewed certificate for authentication. (OKTA-814630)

  • Some text strings on the End-User Settings page weren't translated. (OKTA-815053)

  • After signing out of the Okta End-User Dashboard, users on ChromeOS devices couldn't sign back in. (OKTA-816091)

  • Users could automatically sign in after reloading the grace period sign-in page instead of selecting Continue to the app. (OKTA-816770)

  • Users sometimes received a device remediation grace period although it wasn't applicable according to the authentication policy. (OKTA-817210)

  • The post-authentication Keep me signed in option was displayed in the dialog for Okta account management policy rules, even though it's not supported. (OKTA-818061)

  • Some text strings on the Settings page of the End-User Dashboard weren't translated. (OKTA-818090)

  • When you retrieved a policy rule that denied access and used an empty authentication method chain, a 500 validation error was returned. (OKTA-819217)

  • Users couldn't access a custom push app when the Okta account management policy's self-service unlock rule required one-factor authentication. (OKTA-819868)

  • When Workflows was used to request multiple bundles, some entitlements were missing. (OKTA-819958)

  • An authentication policy rule that was created using the API, and included authentication method chain and reauthentication data, wasn't saved even when the Admin Console displayed Advanced Mode. (OKTA-820653)

Okta Integration Network

  • Acronis Cyber Cloud (SCIM) has a new app profile and mappings.
  • Acsense (API Service) now has additional scopes.
  • Constant Contact by Aquera (SCIM) is now available. Learn more.
  • Cyberlift (API Service) now has an additional scope.
  • Domo by Aquera (SCIM) is now available. Learn more.
  • Eccentex AppBase (SAML) is now available. Learn more.
  • Go1 (SCIM) has an updated description.
  • Guide (OIDC) is now available. Learn more.
  • HPE Aruba Networking SSE (formerly Axis) (SAML) is now available. Learn more.
  • LegalOn Cloud (SAML) is now available. Learn more.
  • LivePreso (OIDC) is now available. Learn more.
  • Metaphor (SCIM) is now available. Learn more.
  • Netdata (SCIM) is now available. Learn more.
  • OPTIZMO (SAML) is now available. Learn more.
  • Scrut Automation (API Service) has a new logo.
  • Secured Signing (OIDC) is now available. Learn more.
  • Segment (SAML) is now available. Learn more.
  • Smallstep (SCIM) has a new logo and description.
  • Smartsheet v2 (SAML) now has an ACS URL and Audience URI.
  • Snowflake Provisioning Connector by Aquera (SCIM) is now available. Learn more.