Okta Identity Engine release notes (Production)

Version: 2025.12.0

December 2025

Generally Available

New versions of Okta Provisioning agent and SDK

Okta Provisioning agent 3.0.6 and Okta Provisioning agent SDK 3.0.6 are now available. This release contains the following:

  • The maxItemsPerPage is now configurable to meet your specific requirements.
  • Memory optimizations and other minor improvements.

Sign-In Widget, version 7.38.0

For details about this release, see the Sign-In Widget Release Notes. For more information about the Widget, see the Okta Sign-In Widget.

Allow profile updates for deactivated users

Super admins can now choose to allow updates to profile attribute values for deactivated users, ensuring their profiles remain current. See Edit deactivated user profiles.

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

  • iOS 18.7.2, 26.1
  • macOS 14.8.2, 15.7.2, 26.1
  • Android 13, 14, 15, 16 security patch 2025-11-01

Okta LDAP agent, version 5.25.0

This version of the agent includes security enhancements.

Nonce rollout for Content Security Policy

Okta is removing unsafe-eval from the script-src directive of Content-Security-Policy for every endpoint that returns html content. These are endpoints that you can't customize and whose Content-Type response header is text/html. This is a two-stage process: first, unsafe-eval is removed from the Content-Security-Policy-Report-Only header's script-src directive; later, after any violations of unsafe-eval instances are fixed, unsafe-eval is removed from the Content-Security-Policy response header script-src directive.

This update will be gradually applied over several months, until all endpoints enforce the new Content-Security-Policy, which means this change will span several releases.

Changes to preview user functionality

On the User page of the campaign wizard, Preview user is now called Preview expression scope. When you preview a user, Okta only validates the user against the Okta Expression Language expression that you specified. A user who matches the expression but isn't assigned to a resource in the campaign won't be included in the campaign.

Enhanced policy tracking in the System Log

The System Log now includes the PolicyId and PolicyRulePriority fields in the Rule target for policy.evaluate_sign_on events.

Universal Directory map toggle

The new Universal Directory (UD) map toggle enables admins to link a user's email address to their identifier. This allows admins to enable the self-service registration feature. See General Security.

Smart Card enrollment and activation events

When a new user authenticates with a Smart Card through the Sign-in with PIV/CAC button, factor enrollment and activation events are now recorded in the System Log.

Local Network Access prompting for Okta FastPass

When signing in to Okta-protected apps, users should allow Local Network Access at the browser prompt. If access is blocked, the Sign-in Widget shows remediation instructions and a link to the help documentation so users can continue to use Okta FastPass.

Passkey and security key subdomain support

Okta now lets users authenticate with their passkeys or security keys in their Okta org or custom domain, and all subdomains below them. This helps you achieve phishing-resistant authentication and avoids the need to issue multiple passkeys or security keys to each user for each domain they access. See Configure the FIDO2 (WebAuthn) authenticator.

Enhanced import monitoring with real-time updates

You can now view real-time progress for imports from the Import Monitoring dashboard. This provides greater visibility into the current status of in-progress imports such as the number of data chunks currently being processed.

Passkeys from Android devices

Okta now accepts passkeys that are generated by Android devices. Okta associates these passkeys with trusted web domains to enable users to authenticate with them. This expands the number of device types that Okta supports for passkey use. See Configure the FIDO2 (WebAuthn) authenticator.

OAuth grant type options for custom apps

Now when you configure SCIM provisioning for a custom SWA or SAML app with OAuth 2, you can set the grant type to Authorization code or Client credentials. See Add SCIM provisioning to app integrations.

More Universal Directory attributes available for identity verification mapping

Admins can now map more Universal Directory attributes when sending verification claims to an identity verification (IDV) vendor. This improves the accuracy of verification and gives the admin control over which attributes are sent to the IDV vendor. See Map profile attributes from Okta to an identity verification vendor.

Improved realm picker access

The realm picker now automatically filters to display up to five realms that only an admin can access.

System Log updates for security.request.blocked events

When security.request.blocked events are triggered by dynamic or enhanced dynamic network zones, the System Log now populates the client.zone field.

Delegated flow updates

Delegated flows now include a Caller input field. This allows you to pass more information to a flow that was called from another Okta product. For example, the requestID from Access Requests is now passed to the delegated flow. See Build a delegated flow.

Early Access

SHA-256 digest algorithm support

Okta now supports the SHA-256 digest algorithm when hashing SAML AuthnRequests that are sent to external IdPs.

Device conditions in the Okta account management policy

With this feature, admins can now restrict account management activities such as self-service password resets or new authenticator enrollments with device conditions. Admins can configure Okta account management policy rules with registered and managed devices, or require devices to meet the requirements of a device assurance policy. See Add a rule for enrollment of your first phishing-resistant authenticator.

Governance for Workflows now available in EA

You can now use Okta Identity Governance to manage access to Workflows roles. This helps you ensure that access to Workflows is granted consistently and in compliance with your company's requirements. See Governance for Workflows.

Breached credentials protection

Protect your org from the impact of credentials that have been compromised. If Okta determines that a username and password combination has been compromised after being compared to a third-party curated dataset, the protection response is customizable through password policies, including resetting the user's password, forcing a logout, or calling a delegated Workflow. See Breached credentials protection.

Breached credentials protection is now available for Federal customers.

Enable custom admin roles for inline and event hooks

The inline hook and event hook framework now supports read and write permissions for custom admin roles. This enhancement gives fine-grained access to manage inline and event hooks that previously required the super admin role. See Role permissions.

Device Assurance for Windows: Virus and threat protection

Admins can now enforce a Device Assurance condition that requires Windows devices using the Chrome browser to have virus and threat protection enabled. This feature strengthens your org's security posture by ensuring that user devices are protected by active antivirus software before granting access.

Detection settings in session protection

Tailor ITP to your org's security priorities to gain control and balance security with a seamless user experience. With new detection settings, you can define which session context changes trigger policy re-evaluations, helping you focus only on what truly matters. See Session protection.

User enumeration prevention enhancement

Admins can now configure which authentication methods users are prompted for when they sign in from an unknown device or browser and trigger enumeration prevention. This enhances org security by adding more protection to sign-in attempts. See General Security.

Improved End-User Settings version 2.0 user interface

End-User Settings version 2.0 has new enhanced user interface elements.

Fixes

  • Group push sometimes failed during deployments. (OKTA-941489)

  • The SCIM 2.0 User update operation sent an empty object when multi-value roles were configured and one of the roles or attributes was undefined or null for the user. (OKTA-945579)

  • When admins created a linked group, no description was displayed. (OKTA-996729)

  • When an import exceeded the app unassignment limit, the Learn More link resulted in an error. Additionally, the App assignment removal limit link incorrectly redirected to the main Assignments tab instead of the Import Safeguard configuration settings. (OKTA-1010606)

  • A misleading error appeared in the System Log when admins selected Refresh Application Data for CSV Directory integrations. The system attempted to download unsupported custom objects, generating an error even though the import completed successfully. (OKTA-1011439)

  • Users who were locked out of their account, had an account in recovery, or had an expired password, saw an Internal Server Error message when they clicked Request activation email. (OKTA-1020121)

  • The MFA Enrollment by User report displayed an "Unexpected response" error when loading the Enrollment by Authenticator Type dynamic chart. (OKTA-1030846)

  • Users with a custom admin role were unable to confirm assignments in Active Directory. (OKTA-1034364)

  • When configuring OIDC identity providers in the Admin Console, admins couldn't set the issuerMode property because it was missing. (OKTA-1035016)

  • Users in Germany who were added to a new app sign-in policy that required biometrics saw an Internal Server Error when they tried to sign in. (OKTA-1036434)

  • Active Directory imports failed with an Incorrect result size error when DirSync was enabled. This occurred because creating a new group in Active Directory generated duplicate entries during the import process. (OKTA-1043592)

  • Sometimes, clicking Retry Selected to retry information tasks incorrectly resulted in a failure. (OKTA-1043901)

  • The expected text when Don't create Okta password was selected on the Finish campaign dialog wasn't displayed. (OKTA-1044068)

  • The Sign-In Widget (third generation) didn't show an error message if users clicked Verify without entering their SMS OTP in the Enter Code field. (OKTA-1056852)

  • DirSync jobs continued to be scheduled for Office 365 instances even after provisioning was disabled. (OKTA-1059506)

  • The state of the Include Groups in RADIUS response checkbox didn't update correctly when Radius agents were configured to send multiple group response attributes. (OKTA-1060165)

  • There were several alignment issues on the user profile > Admin roles tab and throughout the Administrators pages. (OKTA-1061753)

  • In the Actions menu on the App sign-in policy page, the description for the Delete action was missing when the action was unavailable. (OKTA-1061865)

  • Customized names for authenticators with multiple enrollments weren't displayed to anonymous users when user enumeration prevention was enabled. (OKTA-1063947)

  • On the App sign-in policy page, the description under Actions > Clone didn't update based on whether or not the policy was shareable. (OKTA-1064678)

  • During a password migration, when a password capture was skipped, the wrong reason for skipping the capture was recorded in the System Log. (OKTA-1068361)

  • On the App sign-in policy page, admins who had custom policy permissions but lacked application permissions couldn't view the app sign-in policy rules. (OKTA-1069119)

  • When an Identity Verification IdP was created with openid, profile, identity_assurance, idv_flow scopes, only the default scopes were sent to the Pushed Authorization Request. (OKTA-1069299)

  • Updates to user entitlements in JDBC applications failed to sync to the remote profile. This occurred when a user was re-imported without any changes to their profile data. (OKTA-1070338)

Okta Integration Network

  • Svix (OIDC) is now available. Learn more.

  • OpenPolicy (SCIM) is now available. Learn more.

  • Coalition Control has a new integration guide.

  • Practising Law Institute (SWA) was updated. (OKTA-1063963)

  • Clearout.io (OIDC) has updated use cases and a new Initiate login URI. Learn more.

  • Svix now supports Universal Logout.

  • Harmony SASE (SCIM) has been updated with new regions.

Version: 2025.11.0

November 2025

Generally Available

Manage agents permission granted to certain roles

Custom admin roles with the View application and their details permission now have the View agents permission. This is a temporary change that helps Okta separate the two permissions in a future release. See Role permissions.

New System Log event for AD agent changes

The System Log event system.agent.ad.config.change.detected reports when Okta support modified an AD agent configuration.

Express Configuration supports Universal Logout

Admins can now quickly integrate Universal Logout-enabled apps using Express Configuration. When Universal Logout is available for an Express Configuration app, a Configure SSO & UL button appears on the configuration page. See Add an app with Express Configuration.

Custom domains and certificates

Okta now supports the use of SHA 384 and SHA 512 signed certificates for custom domains. See Configure a custom domain.

Sign-In Widget, version 7.36.3

For details about this release, see the Sign-In Widget Release Notes. For more information about the Widget, see the Okta Sign-In Widget.

Partner Admin Portal App Switcher

In the Partner Admin Portal, you can now use the App Switcher to navigate to your apps.

Okta Active Directory agent, version 3.22.0

This release includes LDAPS support and bug fixes. See Okta Active Directory agent version history.

Remember last-used authenticator: Okta FastPass

Okta now remembers FastPass as the last-used authenticator when users click "Sign in with Okta FastPass" on the Sign-In Widget.

Simplified Windows Autopilot integration

You can use Okta to secure and streamline the Windows Autopilot flow on end-user devices. You can add a sign-on policy rule in Okta that requires MFA when enrolling a device through Windows Autopilot. This increases security without compromising the user experience and ensures that every new device is provisioned by the right user. See Typical workflow for using Okta with Windows Autopilot.

ITP landing page

Previously, Identity Threat Protection with Okta AI (ITP) information and controls were nested across various pages of the Admin Console. All of your ITP insights and controls are now consolidated on the Security tab in the Admin Console. This unified view saves you time and enables faster action by allowing you to investigate data and configure a response, all in a single place. See Identity Threat Protection with Okta AI.

Inline FastPass enrollment on multiple devices

Users can complete inline enrollment of Okta Verify when they have already enrolled in Okta Verify on a different device platform using a different method.

Network restrictions for OIDC token endpoints is GA in Production

You can now apply network restrictions to OIDC token endpoints to enhance token security. See Create OpenID Connect app integrations.

Export Okta Identity Governance reports in PDF format

You can now export Okta Identity Governance reports to PDF. When exporting, you can also select specific columns to include in the report.

Changes to the Okta Sign-In Widget UI

The Okta Sign-In Widget (first and second generation) now uses the native Select component for dropdown elements. These UI elements have a new appearance, and the dropdown search functionality is no longer available.

Behavior Detections for new ASN

Admins have been able to create behavior detections for IP, Velocity, Location, or Device. This new functionality introduces behavior detection on a new ASN (Autonomous System Number), based on the IP found in the request tied to the event. See Add an ASN behavior.

Temporary Access Code authenticator

The Temporary Access Code (TAC) authenticator allows admins to generate temporary codes that let users authenticate in onboarding, account recovery, and other temporary access scenarios. This authenticator enhances security in these scenarios by granting users access to their orgs without having to use their usual authenticators. See Configure the temporary access code authenticator.

Automatically select Okta Verify and custom push methods

Okta now automatically selects Okta Verify (OV) and custom push methods when they are the only options that meet assurance requirements. Previously, in some scenarios, users had to manually select these methods. This update eliminates that extra step.

Enrollment grace periods

Today, when admins define an enrollment policy for a group, the entire group must enroll immediately, which can be disruptive to their day-to-day tasks.

With Enrollment Grace Periods, end users can defer enrollment in new authenticators until an admin-defined deadline when enrollment becomes mandatory. This allows end users to enroll at a time convenient to them and allows for more graceful enrollment before enforcing new authenticator types in authentication policies. See Authenticator enrollment policies.

Enhanced security for Okta Access Requests web app

The Okta Access Requests web app now performs policy evaluations before granting new access tokens.

Early Access

Password complexity requirements

Okta now lets you limit the number of consecutive repeating characters that users can put in their passwords. Password complexity requirements are now also applied to Active Directory and LDAP-sourced users. This change enhances the security of your org by expanding password complexity options, and applying this protection to more user profile types. See Configure the password authenticator.

New custom admin permissions

New custom admin permissions let you read or read and write in app sign-in, global session, and Okta account management policies. This enhances the granularity of admin permissions in your org. See Create a resource set.

Submit entitlement management integrations

Independent Software Vendors (ISVs) can now submit SCIM 2.0-based entitlement management integrations to the Okta Integration Network (OIN). This enhancement enables customers and IT admins to discover, manage, and assign fine-grained entitlements such as roles and permissions directly from Okta. By standardizing entitlement management, organizations can automate access assignments and streamline Identity Governance, ensuring users receive the right access and roles without manual intervention. For more information, see Submit an integration with the OIN Wizard.

Device Assurance for Windows: Virus and threat protection

Admins can now enforce a Device Assurance condition that requires Windows devices using the Chrome browser to have virus and threat protection enabled. This self-service EA feature strengthens your org's security posture by ensuring that user devices are protected by active antivirus software before granting access.

User enumeration prevention enhancement

Admins can now configure which authentication methods users are prompted for when they sign in from an unknown device or browser and trigger enumeration prevention. This enhances org security by adding more protection to sign-in attempts. See General Security.

Inline step-up flow for User Verification with Okta Verify

End users can now easily satisfy authentication policies that require higher User Verification (UV) levels, even if their current enrollment is insufficient. This feature proactively guides users through the necessary UV enablement steps. As a result, administrators can confidently implement stricter biometric UV policies to eliminate the risk of user lockouts and reduce support inquiries related to UV mismatches. See User experience based on Okta Verify user verification settings.

Fixes

  • An Okta Verify error prevented some users from signing in to orgs that had the Advanced Posture Check feature enabled. The error wasn't recorded in the System Log. (OKTA-897459)

  • When an app sign-in policy included an authentication method chain, users who enrolled Okta Verify on another device couldn't complete inline enrollment into Okta Verify on a second device using a different authentication method. (OKTA-908311)

  • Some users could unlock their accounts even though this wasn't allowed in password policies. (OKTA-984362)

  • In orgs with the Send Application Context to an External IdP feature enabled, users couldn't access apps if the app names had trailing whitespaces. (OKTA-998869)

  • AD password resets sometimes failed with an exception. (OKTA-1004233)

  • When interacting with the Access Request web app using Safari browser, users couldn't tag another user with @ in the request's chat. (OKTA-1005685)

  • When a phishing attack was detected, the System Log didn't always record the event. (OKTA-1006043)

  • Deleted request types sometimes reappeared if the org had the Unified Requester Experience feature enabled. (OKTA-1040545)

  • When the LDAP agent installer successfully registered the agent but the installation failed, the agent incorrectly appeared as operational. (OKTA-1045661)

Okta Integration Network

  • Harmony now has the okta.users.manage, okta.groups.read, and okta.groups.manage scopes.

  • Valos (OIDC) has a new redirect URI. Learn more.

  • Chronicle of Higher Education (SWA) was updated.

  • 1VALET (SAML) has updated attribute statements.

  • Fabrix Smart Actions (API Service) now has the okta.groups.manage scope.

  • Boston Properties (SWA) was updated.

  • Holistiplan SSO (SAML) is now available. Learn more.

  • Mimecast Human Risk Integration (API Service) is now available. Learn more.

  • Aglide (SAML) is now available. Learn more.

  • Aglide (SCIM) is now available. Learn more.

  • SmarterSign Digital Signage (OIDC) is now available. Learn more.

  • SmarterSign Digital Signage (SCIM) is now available. Learn more.

Weekly Updates

2025.11.1: Update 1 started deployment on November 13

Generally Available

Partner Admin Portal App Switcher

In the Partner Admin Portal, you can now use the App Switcher to navigate to your apps.

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

  • iOS 18.7.2, 26.1
  • macOS 14.8.2, 15.7.2, 26.1
  • Android 13, 14, 15, 16 security patch 2025-11-01

Fixes

  • Okta authentication requests for some orgs resulted in high latency and database CPU spikes when a user's email address in the request started with a space. (OKTA-627502)

  • A validation error with trust certificates prevented admins from enrolling some specific security keys. (OKTA-963828)

  • Users @mentioned in an access request Slack thread didn't receive a notification unless they were already a follower of the request. (OKTA-1053390)

  • When a user belonged to multiple migration groups and their password was successfully migrated to Okta for one group, the count of migrated users for the other groups weren't updated. (OKTA-1005843)

  • The Edit resource set page didn't load if the resource set included a deleted resource. (OKTA-1030613)

  • When signing in to Okta, AD-sourced users with expired passwords weren't evaluated by the Okta account management policy's password expiry rule. (OKTA-1031443)

  • Some users were unable to enroll in Okta Verify on Android devices. (OKTA-1043465)

  • When an AD integration had DirSync enabled, the user's manager and Group owners didn't get updated during an incremental import. (OKTA-1047146)

  • When the Okta account management policy for expiring passwords feature was enabled, the Authentication policies page displayed incorrect strings. (OKTA-1048345)

  • Lifecycle changes for custom Simple Mail Transfer Protocol (SMTP) servers weren't recorded in the System Log. (OKTA-1053839)

Okta Integration Network

  • Ziflow has a new icon.

  • Valence (SAML) was updated.

  • Extreme Platform ONE Security API Service (API Service Integration) is now available. Learn more.

  • Clever (District Administrator Login) (SWA) was updated.

  • DynaMed (SAML) is now available. Learn more.

  • Intercom now supports Group Push.

2025.11.2: Update 2 started deployment on December 2

Generally Available

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

  • Windows 10 (10.0.17763.8027, 10.0.19044.6575, 10.0.19045.6575)
  • Windows 11 (10.0.22631.6199, 10.0.26100.7171, 10.0.26200.7171)

Sign-In Widget, version 7.37.1

For details about this release, see the Sign-In Widget Release Notes. For more information about the Widget, see the Okta Sign-In Widget.

Fixes

  • On the app page, read-only admins saw an Edit button in the User authentication section of the Authentication tab, even though they didn't have permission to edit the policy. (OKTA-1031617)

  • The user.session.start event wasn't recorded in the System Log when some users signed in to a custom push app with the okta.myAccount.authenticators.manage scope. (OKTA-1043867)

  • Some users weren't able to select the Keep me signed in checkbox in the Sign-In Widget (third generation). (OKTA-1047889)

  • Some users experienced localization errors in the Secure Partner Access portal because the app rendered before the localization utilities loaded. (OKTA-1068547)

Okta Integration Network

  • LegalOn (Japan) (SAML) was updated.

  • Lyster (OIDC) is now available. Learn more.

  • Canva (SWA) was updated.

  • Rubrik Security Cloud (API Service Integration) is now available. Learn more.

  • Veraproof SSO (OIDC) is now available. Learn more.

  • Lumen5 (SAML) is now available. Learn more.

  • Cloudflare One (OIDC) is now available. Learn more.

2025.11.3: Update 3 started deployment on December 8

Generally Available

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

  • Windows 10 (10.0.17763.8027, 10.0.19044.6575, 10.0.19045.6575)
  • Windows 11 (10.0.22631.6199, 10.0.26100.7171, 10.0.26200.7171)

Sign-In Widget, version 7.37.1

For details about this release, see the Sign-In Widget Release Notes. For more information about the Widget, see the Okta Sign-In Widget.

Fixes

  • On the app page, read-only admins saw an Edit button in the User authentication section of the Authentication tab, even though they didn't have permission to edit the policy. (OKTA-1031617)

  • The user.session.start event wasn't recorded in the System Log when some users signed in to a custom push app with the okta.myAccount.authenticators.manage scope. (OKTA-1043867)

  • Some users weren't able to select the Keep me signed in checkbox in the Sign-In Widget (third generation). (OKTA-1047889)

  • Some users experienced localization errors in the Secure Partner Access portal because the app rendered before the localization utilities loaded. (OKTA-1068547)

Okta Integration Network

  • LegalOn (Japan) (SAML) was updated.

  • Lyster (OIDC) is now available. Learn more.

  • Canva (SWA) was updated.

  • Rubrik Security Cloud (API Service Integration) is now available. Learn more.

  • Veraproof SSO (OIDC) is now available. Learn more.

  • Lumen5 (SAML) is now available. Learn more.

  • Cloudflare One (OIDC) is now available. Learn more.

Version: 2025.10.0

October 2025

Generally Available

Changes to access request notifications

To ensure conversations are displayed consistently across platforms, messages sent within an access request from the web app now automatically appear for the message sender in the corresponding Slack or Microsoft Teams thread. This reduces confusion for the message sender around the messages associated that are with a request.

Okta Provisioning agent, version 3.0.4

Okta Provisioning agent 3.0.4 is now available. This release contains bug fixes and minor improvements.

Simplified Windows Installer for Okta Provisioning agent

The Windows Installer UI for the Okta Provisioning agent has been simplified. The environment selection dropdown list has been removed to support a wider range of Okta environments.

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

  • iOS 18.7.1
  • iOS 26.0.1
  • macOS Sonoma 14.8.1
  • macOS Sequoia 15.7.1
  • macOS Tahoe 26.0.1

Detections added to entity risk policy

New detections have been added to the entity risk policy.

  • Suspicious Login From An IP Flagged By FastPass: Indicates a sign-in event occurred from an IP address that Okta FastPass flagged in a phishing event.

  • Suspicious Login From An IP Flagged In A Credential Based Attack: Indicates a successful sign-in event occurred from an IP address where multiple sign-in failures also occurred.

  • Breached Credentials Detected: Indicates that a username-password combination in your org appears in a third-party list of public data breaches.

See Detection settings for entity risk policy.

Okta Active Directory Password Sync agent, version 1.7.0

This version of the agent includes security enhancements.

Trace ID added to event

A traceId has been added to the security.breached_credential.detected System Log event so that you can easily query and link ITP events like user.risk.detect and ERP events in system logs.

New look and feel for delegated flows

On the Delegated flows page, the buttons, modals, and input fields have been redesigned for a better user experience. See Delegated flows.

Euskara (Basque) language translations for end users

In the End-User Dashboard, users can now set the display language to Euskara (Basque). When they select a language, the end-user experience, including when a user signs in, is translated accordingly. See Supported display languages.

New VPN service for enhanced dynamic zones

The SURF_EASY_VPN is now supported as an individual VPN service category in enhanced dynamic zones. See Supported IP service categories.

Error message update

The error message text that appears when activating a group rule that has an invalid expression has been updated to include the reason for the failure, making it easier to troubleshoot.

Create user permission conditions

You can now add conditions to the Create user permission for custom admin roles, applicable to both realm-enabled orgs and those without realms. This update strictly enforces that admins must have explicit Create user permissions for a specific group to perform this action. See Permission conditions.

User status in Okta Expression Language

You can now reference User Status in the Okta expression language. Group Rules can leverage user statuses to drive group membership.

SharePoint On-Premises integration supports SHA-256

SharePoint integrations (WS-Fed) now use SHA-256 for signing the authentication token.

Group Push Linking for Microsoft Office 365

The Group Push feature in the Microsoft Office 365 integration has been enhanced to link existing Okta groups with existing Entra groups.

This change establishes Okta as the single source of truth for group membership. Once linked, the membership changes made in Okta are pushed automatically, ensuring consistency and seamless access control.

Supporting additional attributes in O365's Universal Sync provisioning

To enable seamless access to Kerberos resources through Windows Hello for Business and to help you manage data based on geographies, Okta now supports four additional attributes in O365's Universal Sync provisioning.

  • onPremisesSamAccountName
  • onPremisesDomainName
  • onPremisesUserPrincipalName
  • PreferredDataLocation

Changes to the Session Protection Violation report

A filter has been added to the Session Protection Violation report that allows filtering on risk level (LOW, MEDIUM, HIGH). Also, the Session Context Change count has been removed from the report.

Okta Integration IdP type

The Okta Integration IdP allows you to use an Okta org as an external IdP, simplifying configuration and providing secure defaults. See Add an Okta Integration identity provider.

Custom admin roles for ITP

Through this feature, customers can use granular ITP permissions and resources to create custom roles to right-size authorization for ITP configuration and monitoring. See Configure custom admin roles for ITP.

Behavior Detections for new ASN

Admins have been able to create behavior detections for IP, Velocity, Location, or Device. This new functionality introduces behavior detection on a new ASN (Autonomous System Number), based on the IP found in the request tied to the event. See Add an ASN behavior.

Early Access

User password migration from AD to Okta

Seamlessly migrate user passwords from AD to Okta without disrupting your users or operations. This establishes Okta as the source of truth for user passwords, enabling it to handle user authentication and eliminating the need for delegated authentication. See Password migration from AD to Okta

Protected action support for device signal collection policies

Okta prompts for step-up authentication when admins make changes to device signal collection policies in the Admin Console. The changes are only allowed after the admin authenticates successfully. This feature enhances org security by allowing admins to require MFA before performing protected actions. See Protected actions in the Admin Console.

Fixes

  • Users found accessibility issues in the Sign-In Widget (third generation) error messages, SVG icons, and the show/hide password toggle. (OKTA-867363)

  • Sometimes, inactive apps that had provisioning enabled sent deprovisioning calls to downstream apps. (OKTA-930436)

  • Sometimes, users who were assigned an app were unable to view or access the app on their End-User Dashboard. (OKTA-985663)

  • Users in orgs with app sign-on policies that required Okta Verify Push were able to sign in after enrolling in Okta Verify on desktop, but then saw an error message the next time they tried to sign in. (OKTA-984361)

  • Some users saw a Conflicting App User IDs specified on state token error message when they tried to sign in to an OIDC app using the embedded Okta Sign-In Widget. (OKTA-992348)

  • SAML assertions were encrypted if they included the oktaAuthPayload parameter even though encryption wasn't enabled on the app. (OKTA-998820)

  • If the "End-user remediation for management attestation" feature was enabled and an admin had also configured a custom access denied error message, users were shown the custom error message instead of the remediation steps in the Okta Sign-In Widget. (OKTA-1008850)

  • In some orgs with the Unified claims generation for Okta-protected SAML and OIDC custom app integrations early access feature enabled, users were unable to use the dropdown menus in the Attribute Statements > Show legacy configuration section of the app page. (OKTA-1010898)

  • When an OIDC app had an authentication policy with a rule that includes device assurance through a Chrome device trust connector, users received an error when accessing the app through a sign-in URL configured with prompt=none. (OKTA-1016620)

  • In orgs with the Custom Password Policy Restrictions early access feature enabled, some admins saw an incorrect error message when they selected Use an OEL statement to block restricted content and entered an expression. (OKTA-1027968)

  • In orgs with Japanese translations, untranslated text appeared on the Active Directory Policy page. (OKTA-1029000)

  • In orgs with the Custom Password Policy Restrictions early access feature enabled, some admins saw an Internal Server Error message when they tried to reset a user's password using a temporary password. (OKTA-1030190)

Okta Integration Network

  • Paychex Online was updated.

  • Ravenna is now available (API Service Integration). Learn more.

  • zkipster was updated.

Doc Updates

Okta Aerial documentation

Documentation for Okta Aerial has been added to help.okta.com with the following updates:

  • Aerial card added to the home page.
  • Aerial option added to Documentation dropdown list.
  • Aerial release notes added to Release notes dropdown list.

Okta Aerial allows you to manage multiple Okta orgs from a single, centralized account. The Aerial account lives outside of your other orgs and can manage any Production or Preview org that's linked to the Aerial account. Each Aerial account has a dedicated Aerial org where you can invite Aerial admins who can request and be granted access to connected orgs in your environment. See Okta Aerial.

Weekly Updates

2025.10.1: Update 1 started deployment on October 13

Generally Available

Recent searches displayed in search field

Now when you select the Admin Console search field, a list of your recent searches appears. This helps you quickly find the users, apps, and groups that you frequently search for.

Custom IDV vendors

Okta now supports using custom identity verification (IDV) vendors as identity verification providers. This enhances the security of account onboarding or recovery and mitigates the risk of identity fraud by adding additional verifications of the person setting up or recovering the account. See Add a custom identity verification vendor.

New IP service categories supported

There are new IP service categories for network zones supported by Okta. See Supported IP service categories for a complete list.

Fixes

  • When users accessed the Microsoft ADFS app and authenticated with Okta Verify, the System Log didn't show the app name in the Targets column. (OKTA-906244)

  • Admins couldn't delete their custom IdP authenticator if the IdP that the authenticator was being used in had already been deleted. (OKTA-987328)

  • The authentication policy UI was missing a clarifying message for the generic "Custom OTP" authenticator label. (OKTA-1003291)

  • The System Log didn't display failed authentication attempts when they were initiated from SAML apps with external IdPs. (OKTA-1014150)

  • In orgs with JIT enabled, staged Active Directory (AD) users were prompted to change their password even it wasn't required by their org's AD password policy. (OKTA-1020693)

  • Some admins couldn't use Single Logout for generic OIDC IdPs because the Okta IDX cookie exceeded browser size limits. (OKTA-1024848)

  • Users saw an error message when they tried to use their passkey to sign in to their Okta domain and a custom domain. (OKTA-1025465)

  • Sometimes multiple duplicate group.user_membership.remove System Log events were fired when a user was removed from a group. (OKTA-1031604)

  • When a user signed in or out of an org with Single Logout enabled, the loading screen had the wrong background color. (OKTA-1036274)

  • When the AD DirSync feature was enabled but not configured, AD group membership removals weren't reflected in Okta following an incremental import. (OKTA-1040614)

Okta Integration Network

  • Exaforce has a new integration guide and additional use cases.

  • Ravenna is now available (API Service Integration). Learn more.

  • Grafana Labs is now available. Learn more.

  • Realty.com Portal (OIDC) is now available. Learn more.

  • Realty.com Portal (SCIM) is now available. Learn more.

2025.10.2: Update 2 started deployment on November 3

Generally Available

Okta Provisioning agent, version 3.0.5

Okta Provisioning agent 3.0.5 is available. The httpConnectionTimeoutInMs and httpSocketTimeoutInMs properties are now configurable to meet your specific requirements.

New IP service categories

PLAINPROXIES_PROXY, FINE_VPN and URBAN_VPN are now supported as IP service categories in enhanced dynamic zones. See Supported IP service categories for a complete list.

Improved LDAP Interface UI

The client ID is no longer displayed on the LDAP Interface app.

Sign-In Widget, version 7.36.3

For details about this release, see the Sign-In Widget Release Notes. For more information about the Widget, see the Okta Sign-In Widget.

Sign-In Widget, version 7.36.2

For details about this release, see the Sign-In Widget Release Notes. For more information about the Widget, see the Okta Sign-In Widget.

Fixes

  • When token encryption was enabled for an app or authorization server, the System Log didn't record when a token was successfully minted. (OKTA-954232)

  • The authentication policy UI was missing a clarifying message for the generic "Custom OTP" authenticator label. (OKTA-1003291)

  • User sync to O365 failed if the Usage location was updated after the license was assigned. (OKTA-1017269)

  • Users' metadata wasn't updated after they authenticated through AD delegated authentication. (OKTA-1031477)

  • The LegacyIPZone wasn't saved if gateway IPs and trusted proxy IPs were empty. (OKTA-1032603)

  • Users' cursors were placed in the Username field of the Sign-In Widget by default, instead of the Password field. (OKTA-711623)

  • Some UI elements on the Identity Providers page weren't in the correct location. (OKTA-904304)

  • In Workflows, the Okta Connector app didn't display a list of available connector actions. (OKTA-946866)

  • When the Trust Claims from IdP setting was enabled for an identity provider and used with a custom Okta Account Management Policy rule, users received an internal server error when they tried to enroll a new authenticator. (OKTA-962495)

  • Admins couldn't clone authentication policies that used disabled authenticators. (OKTA-967255)

  • The session protection policy evaluation failed for some unregistered devices. (OKTA-1013026)

  • Okta incorrectly presented user verification challenges to users who weren't allowed to reset their passwords after they clicked Forgot password?. (OKTA-1020725)

  • The Add Resource dialog didn't display resources that had three or fewer characters. (OKTA-1030065)

  • When admins tried to add new values to the attributes in a user profile, the system failed to save the changes. (OKTA-1037440)

Okta Integration Network

  • IdentiGuard (API Service Integration) is now available. Learn more.

  • ChatFin (OIDC) is now available. Learn more.

  • Rowan Security (OIDC) is now available. Learn more.

  • Biome SCIM (SCIM) is now available. Learn more.

  • Qualified.io (SCIM) is now available. Learn more.

  • Meraki was updated.

  • Qualified.io (SAML) has a new icon and integration guide. Learn more.

  • Exaforce has a new integration guide and additional use cases.

  • Ariba Network (SWA) was updated.