Okta Identity Engine Early Access features

Okta now supports an NFC authenticator as an authentication method for frontline workers signing in to Okta-protected apps on Windows desktop shared workstations. To authenticate, an end user taps their NFC badge on a reader and enters a PIN to meet MFA requirements, without needing a phone, password, or shared account. See NFC authenticator.

The removal of the ability to configure cross app access from the Managed connection tab located on the app's profile page is scheduled for an upcoming release. When it's removed, your existing configurations will stop working. Reconfigure your connections from the Resource Server tab to avoid disruptions. See Connect AI agents to resources.

You can no longer enable or disable the Cross App Access feature from the Early Access section of the Settings > Features page in the Admin Console. To change the availability of this feature for your org, contact Okta Support. If you have an Integrator Free Plan org, contact Developer Support instead. This change doesn't impact any existing configurations.

The System Log now logs the following events for staging Access Certification campaigns:

• certification.campaign.stage.start: This event is logged when the staging process starts for a campaign.

• certification.campaign.stage.end: This event is logged when the campaign staging process ends. The outcome.result field reports SUCCESS if the campaign snapshot is created successfully, or FAILURE if there were errors during the staging process.

See Event Types.

Authenticator enrollment sets let admins define groups of authenticators for end-user enrollment, instead of simply marking each one required, optional, or disabled. Admins can require a subset of the group (two of three, for example) or let end users choose which authenticator to enroll (Authenticator A or Authenticator B). This flexibility supports acceptable backup authenticators, gives end users more secure choices, and simplifies enrollment policy management. See Create an authenticator enrollment policy.

You can now import and manage AI agents built in Cursor directly through Okta. See AI agent imports.

You can now import and manage AI agents built in Databricks directly through Okta. See AI agent imports.

The Applications page now provides options to filter apps by type and status, search apps by name or client ID, and view apps by last modified date. You can also export apps to CSV to turn your filtered list into an audit-ready report. During Early Access, labelling uses IGA Governance Labels and is only available for OIG customers. See Search, filter, and export app integrations and Resource labels.

The following System Log events are now available for bulk device changes:

• system.identity_sources.bulk_device_upsert
• system.identity_sources.bulk_device_delete

You can now import and manage AI agents built in the Glean Agent Builder directly through Okta. See AI agent imports.

Okta Verify now supports Linux desktop devices, allowing admins to extend phishing-resistant hardware-backed Okta FastPass authentication to Linux users. This release provides official support for devices running Ubuntu 24.04 and 26.04. See Deploy Okta Verify to Linux devices.

A new Auditor (Read-Only) mode allows super admins to apply a read-only restriction to any individual or group admin assignment. This setting restricts admins to read-only access across the Admin Console and Okta APIs, except for Okta first-party apps. This feature provides auditors with system visibility while maintaining security transparency. See Auditor read-only mode.

You can now use Okta Identity Governance to manage access to Workflows roles. This helps you ensure that access to Workflows is granted consistently and in compliance with your company's requirements. See Governance for Workflows.

This feature provides a premium breached credentials detection feed for Okta Customer Identity (OCI) customers with Identity Threat Protection which identifies more compromised credentials sooner. See Breached credentials protection.

The Enforce MFA for Identity Governance admin apps feature is no longer available as a self-service Early Access feature. Admins must contact Okta Support to enable or disable this feature. See Enable MFA for the Admin Console.

The maximum number of realm assignments allowed per profile source has been increased from 30 to 100. This enables admins to scale user organization and management across a larger number of realms. See Realms.

Entitlement import safeguards prevent user imports from accidentally removing app roles or licenses when a user is unassigned from an app. Admins can configure safeguards per app using either percentage-based or absolute count thresholds, and optionally block imports that modify or delete entitlement schemas. See Import safeguards.

Orgs that are subscribed to Okta for AI Agents can now enable the product from the Features page. You can use Okta for AI Agents to register, secure, and govern AI agent identities directly within Okta. See Okta for AI Agents.

You can now configure custom email providers with OAuth 2.0 authentication. Choose between two OAuth 2.0 client configurations to fetch access tokens and use those access tokens to authenticate with your email provider's SMTP server. See Use your own email provider.

The Authentication Activity report provides detailed authentication insights including Okta FastPass usage, complementing the MFA Activity report. You can view activity filtered by device type (Android, iOS, macOS, Windows), management state (managed, unmanaged), registration status (registered, unregistered), and verification method (TOTP, Push, Okta FastPass). See Authentication Activity report.

The new On-prem Connector for Generic Databases allows admins to manage users and entitlements in on-premises databases using the Okta On-prem SCIM agent. This connector supports Oracle, MySQL, PostgreSQL, and Microsoft SQL Server. It enables orgs to apply governance features like Access Requests, Certifications, Lifecycle Management, and Entitlement Management to their database environments. See On-premises Connector for Generic Databases.

Mutual Transport Layer Security (mTLS) client authentication is now available for OIDC apps. Instead of a shared client secret, Okta issues access tokens that are cryptographically bound to that certificate, so a stolen token can't be used without it. This helps an org strengthen the security of their app and API connections, with no client secrets to store, share, or rotate. See Create OpenID Connect app integrations.

Okta Verify is bundled into a single authenticator with org-wide settings, preventing you from configuring individual verification methods (Okta FastPass, Push notification, or TOTP) per group. This feature separates Okta Verify into distinct, method-specific authenticators, allowing you to roll out Okta FastPass gradually.

Identity verification (IDV) vendors can now submit integrations through the Okta Integration Network. You can configure and apply these integrations to your authentication policies to verify user identities.

Admins can create branches of their app sign-in policies to review and monitor the impact of changes before enforcing the policy for end users. This allows admins to draft policy changes, test them against real user traffic, and roll them out with confidence. See Manage app sign-in policy branches.

Two new System Log events, pam.integration.create and pam.integration.delete, are now available for Okta Privileged Access database management. This enhancement allows admins to track when database integrations are created or deleted. See System Log.

The On-premises Connector for Generic Databases now supports IBM Db2 LUW. This enables admins to manage users and entitlements in IBM Db2 LUW environments. See On-prem connector for generic databases.

Optimize performance of AD DirSync-based imports by skipping unnecessary prechecks and downloading organizational units without using DirSync.

Use the Security Access Monitor browser plugin and Okta Identity Security Posture Management (ISPM) to get visibility into any new OAuth grants to apps and the consequent shadow AI agent usage for your org. The plugin monitors managed browsers for any new OAuth grants to apps and AI agents. ISPM captures OAuth grant telemetry, analyzes the data, and provides you with the visibility you need to identify every third-party app that your users authorize. This helps you mitigate risks related to shadow OAuth grants and AI agents. After you configure the plugin, you can find all new OAuth grants across your org by going to NHIs and AI agents > Browser OAuth Grants page in the ISPM console. See Discover and assess AI agents.

Protect your org from the impact of credentials that have been compromised. If Okta determines that a username and password combination has been compromised after being compared to a third-party curated dataset, the protection response is customizable through password policies, including resetting the user's password, forcing a logout, or calling a delegated Workflow. See Breached credentials protection.

Breached credentials protection is now available for Federal customers.

With this feature, admins can now restrict account management activities such as self-service password resets or new authenticator enrollments with device conditions. Admins can configure Okta account management policy rules with registered and managed devices, or require devices to meet the requirements of a device assurance policy. See Add a rule for enrollment of your first phishing-resistant authenticator.

Okta now lets you limit the number of consecutive repeating characters that users can put in their passwords. Password complexity requirements are now also applied to Active Directory and LDAP-sourced users. This change enhances the security of your org by expanding password complexity options, and applying this protection to more user profile types. See Configure the password authenticator.

The following events are fired when you create, delete, or update a Cross App Access connection:

• app.cross_app_access.connection.create
• app.cross_app_access.connection.delete
• app.cross_app_access.connection.update

This release enhances the Desktop MFA feature on Windows to include an admin-assisted recovery path. If a user is locked out of their Windows device, an admin can now issue a time-based recovery PIN. This grants the user temporary access to their computer without needing their primary MFA device, enabling them to resolve their authenticator issue and sign in successfully. See Enable Desktop MFA recovery for Windows.

Okta now supports multiple active signing certificates for a single SAML identity provider (IdP), enabling seamless certificate rotation with zero downtime. Admins can upload up to two certificates per IdP connection. This improvement eliminates the need for tightly coordinated swaps with IdP partners and reduces the risk of authentication failures due to expired certificates. The feature is available for both the Admin Console and the IdP Certificates API.

With the new device signal collection policy, admins can override Okta default behavior and specify how Okta must collect device data, which is then used to evaluate authentication policies. See Create device signal collection rules.

You can now encrypt OIDC ID tokens for Okta-protected custom app integrations using JSON Web Encryption. See Encrypt OIDC ID tokens for app integrations.

You can now export Okta Identity Governance reports to PDF. When exporting, you can also select specific columns to include in the report.

This enhancement improves Okta's custom error remediation by extending it to management attestation across all OS platforms. Admins can now create specific remediation messages for devices that fail a management check (for example, their device is not MDM-managed). Users receive clear, actionable remediation instructions during the sign-in flow, and can troubleshoot problems independently. This leads to fewer IT helpdesk tickets, faster secure access, and a better user experience. See Remediation messages for device assurance.

The On-prem Connector for Generic Databases now supports importing multiple entitlements within a single app instance. This allows admins to assign users to multiple database-level entitlements without creating separate app instances.

You can now select Match on AAGUID alone when you add or edit a Passkey (FIDO2 WebAuthn) authenticator group. Users can then enroll authenticators from the group that don't provide a trusted attestation certificate. See Configure the Passkey (FIDO2 WebAuthn) authenticator groups.

Okta On-prem SCIM Server agent has been replaced by Okta On-prem SCIM agent. This change reduces the number of dependencies and allows for new features to be implemented. See On-prem Connector for Generic Databases.

The new on-premises connector for Generic Databases allows admins to manage users and entitlements in on-premises databases using the Okta On-Prem SCIM Server. This connector supports Oracle, MySQL, PostgreSQL, and Microsoft SQL Server. It enables orgs to apply governance features like Access Requests, Certifications, Lifecycle Management, and Entitlement Management to their database environments. See On-prem connector for generic databases.

Custom authorization servers now support multiple audiences in addition to a default audience. See Create an authorization server.

The On-prem Connector for Generic Databases now supports importing multiple entitlements within a single app instance. This allows admins to assign users to multiple database-level entitlements without creating separate app instances.

Device Visibility replaces the basic detail page for managed devices with a new four-tab view for macOS and Windows devices. It surfaces OS-level user accounts, Platform SSO and Okta FastPass enrollment status, Okta Verify version, and device security signals in one place. This makes it easier for IT and security admins to verify authenticator enrollment and assess device security posture without piecing together information from multiple screens. See View device details.

Reauthentication to an IdP helps Okta admins secure federated identities by redirecting federated users to their source SAML, OIDC, or Org2Org IdP when a policy requires them to reauthenticate. By forcing reauthentication at the source IdP, admins can close security gaps from long-lived sessions and remove the need to configure duplicate MFA enrolment in Okta. See Redirect federated users to IdPs for re-authentication.

Okta now supports Global Token Revocation (GTR) for third-party and Org2Org identity providers (IdPs). This feature allows external IdPs to securely trigger Universal Logout, instantly revoking all user sessions and tokens across your entire app ecosystem. See Configure Universal Logout for supported apps.

The new Device Profile Restriction condition in device assurance policies ensures that Android users can only access protected apps from the same managed work profile where Okta Verify is installed. This prevents access from personal profiles, which reduces the risk of data leaks and improves security posture. See Add a device assurance policy.

The On-prem Connector for Generic Databases now supports incremental imports, which retrieves only the users and entitlement assignments that have changed since the last successful import, rather than the full dataset. This reduces import duration and database load for large-scale deployments. The source database must use soft deletes and maintain an automatically updated timestamp column. See On-prem Connector for Generic Databases.

You can now enable the SSO extension support for Chrome on macOS option to support use of the SSO extension on Chrome 146 or later. This ensures seamless authentication for users on the latest browser versions on macOS.

This feature redirects users to Okta to authenticate if the primary identity provider can't establish their identity. This can happen because of explicit rejections, like invalid credentials and MFA failures, or if an existing user session can't be silently verified, such as during a prompt=none OIDC request or IsPassive=true SAML request. See Configure identity provider routing rules.