Okta Identity Engine release notes (Production)

Version: 2025.02.0

February 2025

Generally Available

Sign-In Widget, version 7.28.0

For details about this release, see the Sign-In Widget Release Notes.

For more information about the Widget, see the Okta Sign-In Widget Guide.

Request expiration and enhanced notifications for Access Requests

To prevent accumulation of stale requests and improve the notification experience, Okta is making the following changes:

  • New requests now automatically expire after 60 consecutive days of inactivity. Completing a task, answering a question, or leaving a message on a request resets the 60-day expiration period. Any requests created before the general availability of this feature expire after 60 days of inactivity (on or around April 7, 2025).

  • Notifications about expiring requests are sent at 30 days, 5 days, and 1 day before the request expires.

  • The user setting to receive daily reminders about overdue tasks and requests is no longer available. It is replaced by the new request expiration notifications.

Universal Logout for Cerby app

Cerby now supports Universal Logout. This enables admins to automatically sign users out of this app when Universal Logout is triggered.

New look and feel in Access Certifications

In Access Certifications, the Access Certification Reviews app located on your dashboard now has a new look and feel, including a restyled top navigation bar and the addition of a gray background.

Authentication method chain options

The Pin or biometric verification label for authentication method chains on the authentication policy rule page has been changed to User interaction. See Authentication method chain.

New System Log attribute

The application.policy.sign_on.deny_access System Log event now shows the app instance ID. This makes it easier to identify the affected app and enables resource-based filtering for the event.

New System Log attributes

The PolicyName field was added to the policy.evaluate_sign_on System Log event. This change makes it easier for admins to identify the policy that was involved in user sign-in attempts.

Delete users with granular deprovisioning in Microsoft Office 365

You can now delete users as part of the deprovisioning process in Office 365. See Deprovisioning options for Office 365.

RADIUS push notifications

The operating system is no longer included in RADIUS push notifications. Customers can contact Okta Support if they need to display this information.

Support for importing Active Directory group descriptions

The descriptions of groups sourced from Active Directory now use their description from AD. These replace any previous descriptions of AD-sourced groups in Okta, which used a pretty-printed version of the distinguished name (DN) instead.

New Hyperdrive agent version

This version includes the Microsoft Edge WebView2 control. See Okta Hyperdrive agent version history.

Authentication policy rule page updated

The If Okta FastPass is used section of the the authentication policy rule page has been removed. Users can select the Require user interaction option in the Possession factor constraints are section instead. See Add an authentication policy rule.

Polling for Agentless Desktop Single Sign-on and Integrated Windows Authentication

Agentless Desktop Single Sign-on (ADSSO) and Integrated Windows Authentication (IWA) authentication sessions now include polling to reduce the likelihood of service disruptions when bandwidth use peaks. For users authenticating with ADSSO or IWA during peak use periods, this change increases the likelihood that a server will be available to process their authentication request.

Case numbers for impersonation events

When an org grants impersonation for a support case, the case number now appears in the System Log. See Give access to Okta Support.

System Log event for public client app admins

When an admin selects the Automatically assign the super admin role to all newly created public client apps checkbox on the Account page, the System Log now records an event.

Step-up authentication for Office 365

This enhancement enables customers to dynamically prompt for Okta MFA when needed, without having MFA configured in the authentication policy. See Use Okta MFA for Azure Active Directory.

ADSSO authentication parameters

When a state token is used, Okta removes the fromURI parameter from the ADSSO authentication POST request.

Enforce Number Challenge for Desktop MFA

You can now enforce number challenge on all push notifications for Desktop MFA, regardless of the authentication policy. See Configure access policies.

Improved password reset process for Active Directory-sourced users

The password reset process now sends the password update and verification requests to the same Active Directory agent to avoid replication delay.

Role-based access control now available

As Okta Workflows can make comprehensive changes both inside Okta and out to other connected SaaS apps, access to Workflows was previously restricted to Okta super admins. While this regulation enhanced the security of Okta Workflows, it limited the number of users, restricted the scalability of Okta Workflows, and reduced overall value to customers.

With role-based access control (RBAC), you can now assign Workflows privileges to more users without granting unnecessary access.

To support this feature, three new roles are available:

  • Workflows Administrator: For full-access administration within Okta Workflows only
  • Workflows Auditor: For compliance management with read-only access
  • Connection Manager: For securely handling accounts and credentials

RBAC allows customers to expand the use of Okta Workflows beyond super admins, enabling more team members to build, run, and manage Workflows securely and efficiently.

See Access Control.

There are four new event types that record the RBAC feature activity in the Okta System Log:

  • workflows.user.role.user.add
  • workflows.user.role.user.remove
  • workflows.user.role.group.add
  • workflows.user.role.group.remove

See the Event Types API.

Early Access

Authentication claims sharing between Okta orgs

Authentication claims sharing allows an admin to configure their Okta org to trust claims from IdPs during SSO. Sharing claims also allows Okta to interpret the authentication context from an IdP. This helps eliminate duplicate factor challenges during user authentication and helps improve security posture. See Add a SAML Identity Provider.

Custom admin role for Okta Device Access

You can now configure custom admin roles to view and manage Okta Device Access functionality. This enhancement enables IT teams to designate admins who can effectively manage Okta Device Access capabilities without requiring them to have the most elevated security permissions. See Desktop MFA Recovery.

On-prem Connector for SAP Netweaver ABAP

On-prem Connector for SAP NetWeaver ABAP provides an out-of-the-box solution that connects SAP on-premises apps with Okta Identity Governance. It enables the discovery, visibility, and management of SAP entitlements (roles) directly in Okta. This integration enhances security, saves time, and simplifies governance by eliminating the need for custom integrations and by streamlining entitlement management. See SAP Netweaver ABAP.

Step-up authentication for updating policies

Okta prompts for step-up authentication when admins perform protected actions in the Admin Console, like updating sign-on policies. The changes are only allowed after the admin authenticates successfully. This feature enhances org security by allowing admins to require MFA before performing protected actions. See Protected actions in the Admin Console.

Granular account linking for certain Identity Providers

When admins link users from SAML and OIDC Identity Providers, they can now exclude specific users and admins. This improves security by allowing admins to configure granular access control scenarios.

OIDC IdPs now support group sync

OpenID Connect (OIDC) identity providers (IdPs) now support full group sync and adding a user to a group that they don't already belong to. A user who authenticates with an external IdP is added to all available groups when Full sync of groups is enabled. The user is added to any groups that they don't already belong to when Add user to missing groups is enabled. This allows you to specify certain groups that users should be added to.

Global token revocation for wizard SAML and OIDC apps

Universal Logout clears sessions and tokens for wizard SAML and OIDC apps. This enhancement extends Universal Logout functionality to more types of apps and provides greater flexibility to admins.

Track MFA abandonment in the System Log

You can now monitor abandoned MFA attempts in the System Log using the user.authentication.auth_via_mfa event. The event now has two additional statuses for the event outcome:

  • UNANSWERED: MFA prompt was abandoned, but the user eventually signed in using another authenticator.
  • ABANDONED: MFA prompt was abandoned and the user couldn't sign in. See Track MFA abandonment in the System Log

Fixes

  • The new end-user Settings page didn't display links, password source text, or custom profile data. (OKTA-806262)

  • A warning banner was incorrectly displayed during the WS-Federation setup, even though the setup was completed successfully. (OKTA-807313)

  • The Sign-In Widget (third generation) wasn't the correct size and was missing the app name. (OKTA-822649)

  • In Org2Org configurations where Okta is the source org, passwords weren't synced after the user signed in using a newly reset password. (OKTA-833862)

  • Autofilled passkeys in the Sign-In Widget (third generation) failed and displayed an Invalid passkey error. (OKTA-836910)

  • When employees were imported into SuccessFactors, past employment records were imported instead of current records. (OKTA-844570)

  • When a custom domain was deleted or its enrollment was reset, the resulting email confirmation had a broken link and no branding. (OKTA-848261)

  • When users signed in to the Secure Partner Access portal, they were redirected to the End-User Dashboard. (OKTA-855049)

  • Microsoft's MSOL deprecation testing triggered the last remaining MSOL call in Okta's Office 365 provisioning, resulting in a failure to synchronize user attributes. (OKTA-870164)

Okta Integration Network

  • Calendly by Aquera (SCIM) is now available. Learn more.
  • Payflows has an additional SAML attribute.
  • SAP ERP by Aquera (SCIM) is now available. Learn more.
  • SAP HANA Provisioning Connector by Aquera has a new display name.

Version: 2025.01.0

January 2025

Generally Available

Sign-In Widget, version 7.27.1

For details about this release, see the Sign-In Widget Release Notes.

For more information about the Widget, see the Okta Sign-In Widget Guide.

Okta Provisioning agent, version 2.2.0

This release contains bug fixes and minor improvements. The RPM installer is now signed. See Okta Provisioning agent and SDK version history.

Okta Active Directory agent, version 3.19.0

This release of the Okta Active Directory agent includes an additional layer of end-to-end encryption for payloads that are exchanged between Okta and the agent. Support for monitoring the Active Directory agent configuration file has been added, where a System Log event is emitted when the agent configuration has been changed on premises. This release also includes security enhancements and bug fixes. See Okta Active Directory agent version history

Multiple Identifiers

Today, end users must sign in to Okta with a username or email address only. With the Multiple Identifiers feature, admins can configure identifiers, or user attributes from Universal Directory, that an end user can enter to authenticate. Multiple identifiers work in sign-on, recovery, self-service registration, and unlock flows. Admins can configure up to three identifiers, including email (which is still a required identifier). See Multiple identifiers.

OAuth 2.0 security for invoking API endpoints

Okta Workflows users can now securely invoke API endpoints using OAuth 2.0 protocols and their Okta org authorization server. Compared with the existing token authorization option, this feature is more secure while also being easier to implement. Add the okta.workflows.invoke.manage scope to any new or existing app integration to make it eligible to invoke your API endpoint. See Invoke a flow with an API endpoint.

Granular deprovisioning in Microsoft Office 365

You can now deprovision users in Office 365 using multiple methods. See Deprovisioning options for Office 365.

Just-In-Time Local Account Creation for macOS

Just-In-Time Local Account Creation is available for Okta Device Access. Okta admins can allow macOS users to create a local account by entering their Okta username and Okta password in the macOS sign-in dialog. This feature enables easier account management for admins and streamlines the user account creation process for end users. This is especially beneficial for devices or workstations that support multiple users. See Just-In-Time Local Account Creation for macOS.

Identity Verification with third-party Identity Verification providers

When users take certain actions, Identity Verification enables you to use a third-party Identity Verification provider to verify the identity of your users. Verification requirements and the Identity Verification provider are based on your authentication policies and configurations within your Okta org. Okta supports Persona as a third-party Identity Verification provider. See Add an Identity Verification vendor as Identity Provider.

Block syncable passkeys

You can now block syncable passkeys during authentication. Previously, you could only block them during enrollment. This enhances the security of your org by preventing users from presenting such passkeys to attempt to enroll new, unmanaged devices. See Configure the FIDO2 (WebAuthn) authenticator.

Authentication method chain

With this feature, you can require users to verify with multiple authentication methods in a specified sequence. You can create multiple authentication method chains in an authentication policy rule to cater to different use cases and scenarios. This feature is now also supported in the Okta account management policy. See Authentication method chain.

Additional use case selection in the OIN Wizard

Independent software vendors (ISVs) can select the following additional use case categories when they submit their integration to the OIN:

  • Automation

  • Centralized Logging

  • Directory and HR Sync

  • Multifactor Authentication (MFA)

See Use case selection in the OIN Wizard.

New group.source.id key for group functions in Expression Language

You can now use the group.source.id key in Expression Language group functions to filter between groups that have the same name.

Early Access

MFA for Secure Partner Access admin portal

MFA is required for accessing the partner admin portal app. See Manage Secure Partner Access.

Entitlement claims

You can now enrich tokens with app entitlements that produce deeper integrations. After you configure this feature for your app integration, use the Okta Expression Language in Identity Engine to add entitlements at runtime as OIDC claims and SAML assertions. See Generate federated claims.

Block syncable passkeys

You can now block syncable passkeys during authentication. Previously, you could only block them during enrollment. This enhances the security of your org by preventing users from presenting such passkeys to attempt to enroll new, unmanaged devices. See Configure the FIDO2 (WebAuthn) authenticator.

Fixes

  • In some orgs, users were unlocked based on the settings of the default AD password policy rather than a higher priority password policy. (OKTA-755979)

  • The user counts weren't updated accurately when running Realm assignment jobs. (OKTA-790104)

  • Some text on the security methods page of the Sign-In Widget wasn't rendered correctly. (OKTA-803760)

  • Leaving the Custom character restriction field empty in the Profile Editor resulted in an error. (OKTA-811861)

  • The Manage Applications permission for Custom Admin roles unnecessarily allowed admins to mange the client credentials section for OAuth 2.0 Service apps. (OKTA-821119)

  • The MFA Enrollment by User report didn't include the security question authenticator in the list of authenticators in situations where it was enrolled in a Classic Engine org that was migrated to Identity Engine. (OKTA-823066)

  • In orgs using the Sign-In Widget (third generation), the Back to sign in link redirected users to the dashboard instead of the resource they intended to access. (OKTA-826892)

  • In orgs using the Sign-In Widget (third generation), self-service registration failed for users who provided an invalid attribute during their first registration attempt. (OKTA-834905)

  • Long group names were truncated on the Edit resources to a standard role page. (OKTA-839491)

  • Users who completed self-service registration saw unexpected behavior when they enrolled in authenticators from their Settings page. (OKTA-843223)

  • Viewing group members in the Admin Console sometimes displayed an error. (OKTA-844568)

  • In some orgs using the Okta account management policy, AD users received an error when they tried to edit their password. (OKTA-844675)

Weekly Updates

2025.1.1: Update 1 started deployment on January 21

Generally Available

Sign-In Widget, version 7.27.1

For details about this release, see the Sign-In Widget Release Notes.

For more information about the Widget, see the Okta Sign-In Widget Guide.

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

  • Android 12, 13, 14, 15 security patch 2025-01-05

  • iOS 18.2

  • macOS Ventura 13.7.2

  • macOS Sonoma 14.7.2

  • macOS Sequoia 15.2

  • Windows 10 (10.0.17763.6659, 10.0.19044.5247, 10.0.19045.5247)

  • Windows 11 (10.0.22621.4602, 10.0.22631.4602, 10.0.26100.2605)

New IP service categories

The NORDLAYER_VPN and PIA_VPN proxy services are now supported as IP service categories in enhanced dynamic zones. See Supported IP service categories.

Fixes

  • The Slack start date wasn't imported through schema discovery. (OKTA-826971)

  • User movement logs for Realm assignment jobs didn't display correctly. (OKTA-844398)

  • When an Okta group was deleted while an app group reconciliation job was in progress, the job to delete the downstream app group wasn't scheduled. (OKTA-826938)

  • Users on some orgs encountered an HTTP 500 error response when they tried to authenticate. (OKTA-802900)

  • In orgs with Same-Device Enrollment for Okta FastPass enabled, some usernames with special characters were incorrectly displayed during Okta Verify enrollment on Android devices. (OKTA-839304)

  • By using device-to-device bootstrap, users could enroll in Okta Verify despite policy rules configured to block enrollment for these users. (OKTA-814436)

Okta Integration Network

  • Airflow by Tech Prescient (SCIM) is now available. Learn more.
  • Asana by Aquera (SCIM) is now available. Learn more.
  • Avigilon Alta (SCIM) now supports user deactivation.
  • Corma (API Service) is now available. Learn more.
  • Dovetail (OIDC) has a new icon and integration guide.
  • ELMO (SCIM) is now available. Learn more.
  • FCTR Identity Support Portal (SAML) is now available. Learn more.
  • Jotform (SAML) is now available. Learn more.
  • Island (SAML) has updated endpoints.
  • Natoma (SAML) is now available. Learn more.
  • Posit Workbench (SAML) is now available. Learn more.
  • Posit Workbench (OIDC) is now available. Learn more.
  • PrimeDrive (SAML) is now available. Learn more.
  • Rocketlane (SCIM) is now available. Learn more.
  • SAP HANA Provisioning Connector by Aquera (SCIM) is now available. Learn more.
  • Udemy Business (SCIM) is now available. Learn more.
  • UKG Pro Workforce Management by Aquera (SCIM) is now available. Learn more.
  • VASTOnline (SCIM) is now available. Learn more.
  • Vbrick Rev Cloud (SCIM) is now available. Learn more.

2025.1.2: Update 1 started deployment on February 3

Generally Available

RADIUS Server Agent version 2.24.2

This version fixes a bug in the Password Authentication Protocol, where in some instances the authentication failed if the user password was greater than 16 characters. It also includes security enhancements.

Sign-In Widget, version 7.27.3

For details about this release, see the Sign-In Widget Release Notes.

For more information about the Widget, see the Okta Sign-In Widget.

Fixes

  • When a super admin updated a deactivated user to a different realm, admins received a Resource not found error. (OKTA-699778)

  • Searching a name with special characters in Realms failed. (OKTA-801220)

  • A permission wasn't checked for the MFA WebAuthn action. (OKTA-801809)

  • Some accounts that used custom admin roles were unable to create, delete, or unlink group push mappings. (OKTA-803378)

  • If an error occurred while an admin performed a protected action, the resulting error message was sometimes unclear. (OKTA-808668)

  • When a device name changed, the name displayed on the user profile page didn't match the the name shown on the Reset Authenticators page. (OKTA-811522)

  • Some users with the application administrator role weren't able to manage the apps they were assigned. (OKTA-814563)

  • The Manage Applications permission for custom admin roles unnecessarily allowed admins to manage the client credentials section of OAuth Service applications. (OKTA-821119)

  • The System Log sometimes displayed the org authorization server even though the error and the call were related to the custom authorization server. (OKTA-821988)

  • Users weren't signed out of Single Logout-enabled apps when they accessed Okta through a custom domain with iFrame embedding enabled. (OKTA-822650)

  • Users couldn't sign in to Okta after an app was deactivated and deleted. (OKTA-828955)

  • The Authentication Policy page sometimes displayed an error message instead of policies. (OKTA-832259)

  • Events for tokens revoked in bulk for a resource didn't appear in the System Log. (OKTA-834025)

  • Custom app instance icons weren't displayed in Profile Editor in the Admin Console. (OKTA-837626)

  • Some service account users received an error message despite successfully changing their passwords. (OKTA-841078)

  • Some admins received an error message when they clicked Admin on the End-User Dashboard. (OKTA-842573)

  • When admins updated an authentication policy rule, the previous and changed states didn't appear in the 'policy.rule.update' System Log event. (OKTA-843745)

  • The Atlassian Jira Cloud app didn't inject credentials when using SWA. (OKTA-843781)

  • Some users weren't prompted for multifactor authentication if another user was signed in to Okta with a different session on the same browser. (OKTA-846381)

  • Users received an error message when they enrolled a Personal Identity Verification card even though the System Log indicated that the enrollment was successful. (OKTA-846423)

  • Account unlock didn't work for some orgs using the Okta account management policy. (OKTA-848066)

  • The Username hint was inaccurate. (OKTA-851440)

  • Some users could enroll authenticators with self-attested passkeys even though the admin only allowed certificate-based attestation in their org. (OKTA-851468)

  • On the Admin Dashboard, the Tasks widget sometimes didn't load. (OKTA-851807)

  • When admins tried to customize the signing options of the SAML 1.1 app, their changes didn't appear. (OKTA-852911)

  • In orgs with Multiple Identifiers enabled, some users couldn't perform self-service registration. (OKTA-853911)

  • The Administrator assignment by role page displayed an error if an admin had duplicate assignments. (OKTA-854906)

  • The email notification for protected actions indicated that actions were taken instead of attempted. (OKTA-854973)

  • Users with passwords greater than 16 characters couldn't sign in when the Password Authentication Protocol with Message-Authenticator feature was enabled. (OKTA-856260)

Okta Integration Network

  • ADP Link by Aquera (SCIM) is now available. Learn more.
  • Cirro (OIDC) is now available. Learn more.
  • Concentric AI (SAML) is now available. Learn more.
  • Cyble Vision (SAML) is now available. Learn more.
  • Dayforce by Aquera (SCIM) is now available. Learn more.
  • Deel HR (SCIM) now supports profile sourcing.
  • FCTR Identity Support Portal (API Service) is now available. Learn more.
  • Gumband (OIDC) is now available. Learn more.
  • Island Management Console (SAML) has updated endpoints.
  • Microsoft SQL Server by Aquera (SCIM) is now available. Learn more.
  • Opensense (SAML) is now available. Learn more.
  • QuickBooks Online by Aquera (SCIM) is now available. Learn more.
  • Payflows (SAML) is now available. Learn more.
  • Redshift by Aquera (SCIM) is now available. Learn more.
  • Resonance by spiderSilk (SAML) is now available. Learn more.
  • SmartSite (OIDC) is now available. Learn more.
  • Speeda Sales Insights (OIDC) is now available. Learn more.
  • TrustWorks (SAML) is now available. Learn more.
  • XplicitTrust Network Access (API Service) is now available. Learn more.

Version: 2024.12.0

December 2024

Generally Available

Sign-In Widget, version 7.26.0

For details about this release, see the Sign-In Widget Release Notes.

For more information about the Widget, see the Okta Sign-In Widget Guide.

Okta MFA Provider for ADFS, version 1.8.2

This version includes bug fixes and security hardening.

Okta On-Prem MFA agent, version 1.8.0

This version includes security enhancements. See Okta On-Prem MFA agent version history.

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

  • Android 12, 13, 14, 15 security patch 2024-12-05
  • iOS 17.7.2, 18.1.1
  • macOS Sequoia 15.1.1

Allow or disallow an authenticator instance in an authentication policy rule

You can now specify a custom authenticator instance in the allow or disallow lists of an authentication policy rule. This provides more granular control over which authenticators are available to users. See Add an authentication policy rule.

Automatically assign the Okta Access Certifications app

When you assign the super admin role to a user, the Okta Access Certifications app is automatically assigned.

Industry term update in the OIN catalog

The NGO industry term has been updated to Nonprofit Organizations in the Okta Integration Network (OIN) catalog. All published integrations with the NGO designation now have the Nonprofit Organizations designation.

System Log event for emails added to the bounced email list

A System Log system.email.bounce.removal event is now triggered when an API request is made to remove bounced emails (POST /org/email/bounces/remove-list). This request sends a list of emails to a third-party email service to remove the emails from the bounce list. The event is triggered when the API request is made. The event doesn't indicate when the emails are actually removed by the third-party email service.

Haitian Creole translation for end users

On the End-User Settings page, users can now set their display language to Haitian Creole. See Supported display languages.

Filters for network zones

New filters in the network zones table help admins quickly distinguish between system-defined zones and those they have created. See Manage network zones.

Request access on behalf of another user

You can now allow users to request admin access for other users from their own dashboard. After you enable the option in the access requests conditions that manage admin role bundles, you can grant this permission to all users or limit it to managers only. See Create an access request condition.

Use case selection in the OIN Wizard

Independent software vendors (ISVs) can now select the following use case categories when they submit their integration to the Okta Integration Network (OIN):

  • Zero Trust
  • Identity Verification
  • Identity Governance and Administration (IGA)

See Use case guidelines for the OIN Wizard.

New task for orgs with one super admin

The Tasks dashboard widget and the HealthInsight page now indicate when an org has fewer than two super admins. This helps prevent orgs from losing access to the Admin Console.

Download links for Okta Jira and Confluence Authenticators in Admin Console

The download links for Okta Jira and Confluence Authenticators are no longer available in the Admin Console.

IdP client secret System Log event update

The system.idp.lifecycle.read_client_secret System Log event now includes an API key. The System Log event is triggered when you make a GET api/v1/idps or api/v1/idps/{idpId} request that returns the client secret or API key. See Event types.

Updated translations

Translations of text on the Sign-In Widget have been updated.

Early Access

New skipping of entitlement sync during import of a user Systems Log event

The following System Log event has been added: Sync skipping of entitlement during import of a user.

Force rematching of imported users

This feature enforces a rematch for unconfirmed users imported from a profile source, whether through full or incremental imports. It attempts to match these imported users with existing Okta users. When this feature is enabled, every import re-evaluates matches for unconfirmed users.

Create dynamic resource sets with conditions

Resource set conditions help you limit the scope of a role by excluding an admin’s access to certain apps. This gives you more granular control over your custom admin roles and helps meet your org’s unique security needs. See Resource set conditions.

Granular account linking for certain Identity Providers

When admins link users from SAML and OIDC Identity Providers, they can now exclude specific users and admins. This improves security by allowing admins to configure granular access control scenarios.

Self-service toggle for Deactivate App Users

Admins can now use the self-service toggle to change what happens to an Okta user’s individual app assignments upon deactivation. If enabled, the user's individual app assignments deactivate instead of suspend. If a user is reactivated in Okta, the individual app assignments don't reactivate.

Restrict access to the Admin Console

By default, users and groups with assigned admin roles have access to the Admin Console app. With this feature, super admins can choose to manually assign the app to delegated admins instead. This is recommended for orgs with admins who don't need access, like business partners, third-party admins, or admins who only use the Okta API. See Configure administrator settings.

Fixes

  • When an admin clicked the Next button multiple times in succession while the table was loading, the number of Realm Assignments erroneously increased. (OKTA-725359)

  • Okta MFA for Active Directory Federation Services (ADFS) code wasn't signed. (OKTA-802958)

  • When using the Authenticator Method Chain feature with the Okta Admin Dashboard authentication policy, an error appeared if the chain didn't include the password authenticator. (OKTA-803569)

  • During self-service registration, the third-generation Sign-In Widget incorrectly validated some passwords that didn't meet the requirements. (OKTA-806543)

  • An authentication policy rule created with an authenticator instance couldn't be deactivated when the authenticator feature was disabled. (OKTA-806803)

  • When an API Service integration was assigned a custom admin role, it couldn't access certain OIDC apps. (OKTA-814731)

  • The MFA enforcement warning on the Admin Console Policy didn't appear in non-English locale settings. (OKTA-815246)

  • The description on the Entity Risk Policy page was incomplete for non-English locales. (OKTA-815370)

  • Some users couldn't sign in to Okta after an OIDC client was added to a new custom access policy. (OKTA-815668)

  • Some System Log events were displayed in Japanese instead of English. (OKTA-817904)

  • The Tasks dashboard widget had extra white space next to the Type column. (OKTA-818109)

  • Okta didn't check if generic and specific authenticator methods for the same authenticator were both present in a policy rule. (OKTA-818111)

  • The Sign-In Widget didn't correctly display warning text if the user entered an incorrect one-time passcode. (OKTA-819536)

  • The Application Usage report displayed an error message for Bookmark apps instead of usage data. (OKTA-819931)

  • Some users received an error message when they canceled the Sign in with Okta FastPass operation in the Sign-In Widget (second generation). (OKTA-820509)

  • Some users received an error message when they tried to delete the One factor access authentication policy if it contained mappings to deleted apps. (OKTA-822822)

  • System Log entries were created without information about changes made to Identity Provider discovery policy rules. (OKTA-824865)

  • An Authentication Method Chain rule was incorrectly flagged as not complying with the MFA requirements in the MFA Enforcement warning in the Admin Console. (OKTA-827219)

  • The Symantec Web Security Services app was timing out too quickly when doing a group push. (OKTA-829357)

  • Super admins who were assigned the role through a group couldn't view all support cases. (OKTA-831270)

  • An error occurred when admins attempted to deactivate some devices. (OKTA-835427)

  • Secure Partner Access app users were able to view and manage their own lifecycle actions. (OKTA-838254)

  • The Edit resource set page sometimes indicated that an unconditioned resource had conditions. (OKTA-838265)

  • The Create a resource set page was sometimes blank after an admin added an additional resource to a resource set. (OKTA-838266)

  • When the Authentication Method Chain was used, if a rule applied to registered and managed devices, the Are you trying to sign in? prompt didn't appear in the Okta Verify desktop app even though the Okta Verify FastPass authentication method required user interaction. (OKTA-838919)

  • Some text on the security methods page of the Sign-In Widget wasn't rendered correctly. (OKTA-839889)

  • The UI strings for the Secure Partner Portal app that were translated to Japanese were outdated. (OKTA-839956)

Okta Integration Network

  • Arxspan (SAML) has an updated ACS URL and Audience URI.
  • Avigilon Alta (SCIM) is now available. Learn more.
  • Brevity (SAML) is now available. Learn more.
  • Cisco User Management Connector (SCIM) has a new dynamic base URL.
  • DeepInfra (OIDC) is now available. Learn more.
  • Dext (OIDC) is now available. Learn more.
  • Kibana by Tech Prescient (SCIM) is now available. Learn more.
  • Smartsheet by Tech Prescient (SCIM) is now available. Learn more.
  • Speeda Customer Analytics (OIDC) is now available. Learn more.
  • XFA Discovery (API Service) is now available. Learn more.

Weekly Updates

2024.12.1: Update 1 started deployment on January 7

Fixes

  • In orgs with the Same-Device Enrollment for Okta FastPass Early Access feature enabled, some users were stuck on the enrollment setup screen. (OKTA-747278)

  • Users couldn't sign in because AD SSO didn't support the prompt=login parameter for OIDC apps. (OKTA-798545)

  • On the Tasks page, if an app assignment model contained an array type with CVD properties and the user clicked Retry selected, the properties were sent in the wrong format. (OKTA-802994)

  • Updating the label of an OIDC app sometimes resulted in an incorrect label appearing in System Log events. (OKTA-816204)

  • In orgs with Identity Threat Protection with Okta AI, some admins received a 500 Internal Server Error during authorization with a session token under certain authentication policy conditions. (OKTA-816476)

  • Importing between apps created duplicate groups, even if Import Groups was disabled. (OKTA-819677)

  • Policy mappings for deleted apps weren't removed. (OKTA-821039)

  • The Add nickname button sometimes didn't appear on the Settings page. (OKTA-821649)

  • The MFA Usage report didn't display the correct time for users' last enrollments. (OKTA-826975)

  • In orgs with the Same-Device Enrollment for Okta FastPass Early Access feature enabled, some users didn't receive the device-to-device setup instructions if the security was set to high. (OKTA-833402)

  • The Device platform condition in the Okta account management policy wasn't correctly evaluated for some orgs. (OKTA-834858)

  • If a user's phone authenticator enrollment had an extension, the telephony inline hook payload to the external web service didn't include it. (OKTA-835398)

  • Sometimes, users could access resources without providing biometrics, even though the authentication method chain required biometrics. (OKTA-838604)

  • The Add nickname button sometimes didn't appear on the Settings page. (OKTA-839607)

  • When navigating to resource catalog items using direct links, requesters were redirected to the Request Access page instead. (OKTA-841323)

  • An Invalid Phone Number error sometimes appeared during SMS factor enrollment. (OKTA-842270)

  • The Admin Created filter for network zones only showed a single page of results, and the Show More link didn't work. (OKTA-842468)

  • Admins couldn't click Edit for the Give Access to Okta Support option to control Okta Support team access to their org. (OKTA-843678)

  • The Application Usage report displayed an error message for bookmark apps instead of usage data. (OKTA-845343)

  • New device notification emails were sent if a request had an X-Device-Fingerprint header with an empty value. (OKTA-845617)

  • The Administrator assignment by role page for the super admin role displayed the internal first-party apps that were assigned to the role. (OKTA-846207)

Okta Integration Network

  • DeleteMe (SCIM) has a new DOB attribute and integration guide.
  • Dext (SAML) has a new logo.
  • dscout (SCIM) now supports group push.
  • Hyperproof (SAML) has a new logo.
  • Revolut People (SAML) is now available. Learn more.