Okta Identity Engine Early Access features

OIN Community Integrations

New apps often launch before Okta has an integration for them, forcing admins to delay rollout or run the app without single sign-on and automated provisioning. Community Integrations close that gap. Okta builds the integration from the application's public APIs and publishes it to the Okta Integration Network at no additional cost. A new integration starts as Community Preview, available to install and test in preview orgs. Once a customer has run it in their own production org, it becomes Community Verified and can be installed in any org. You get a missing integration to test within days, not months, and decide when it's ready for production based on your own testing. See Community integrations.

New System Log events for staging Access Certification campaigns

The System Log now logs the following events for staging Access Certification campaigns:

certification.campaign.stage.start: This event is logged when the staging process starts for a campaign.
certification.campaign.stage.end: This event is logged when the campaign staging process ends. The outcome.result field reports SUCCESS if the campaign snapshot is created successfully, or FAILURE if there were errors during the staging process.

See Event Types.

Okta On-prem SCIM Server agent is now Okta On-prem SCIM agent

Okta On-prem SCIM Server agent has been replaced by Okta On-prem SCIM agent. This change reduces the number of dependencies and allows for new features to be implemented. See On-prem Connector for Generic Databases.

Stage certification campaigns before launch

Staging a campaign lets you preview target users, resources, and reviewer assignments in advance to ensure accurate scope, fix configuration errors, and guarantee that requests reach the correct reviewers from day one. See Stage a campaign.

This is an Early Access release. See Enable self-service features.

Realm assignment limit increase

The maximum number of realm assignments allowed per profile source has been increased from 30 to 100. This enables admins to scale user organization and management across a larger number of realms. See Realms.

Import AI agents from Cursor

You can now import and manage AI agents built in Cursor directly through Okta. See AI agent imports.

Import AI agents from Databricks

You can now import and manage AI agents built in Databricks directly through Okta. See AI agent imports.

NFC authenticator

Okta now supports an NFC authenticator as an authentication method for frontline workers signing in to Okta-protected apps on Windows desktop shared workstations. To authenticate, an end user taps their NFC badge on a reader and enters a PIN to meet MFA requirements, without needing a phone, password, or shared account. See NFC authenticator.

Entitlement import safeguards

Entitlement import safeguards prevent user imports from accidentally removing app roles or licenses when a user is unassigned from an app. Admins can configure safeguards per app using either percentage-based or absolute count thresholds, and optionally block imports that modify or delete entitlement schemas. See Import safeguards.

On-premises connector for Generic Databases

The new on-premises connector for Generic Databases allows admins to manage users and entitlements in on-premises databases using the Okta On-Prem SCIM Server. This connector supports Oracle, MySQL, PostgreSQL, and Microsoft SQL Server. It enables orgs to apply governance features like Access Requests, Certifications, Lifecycle Management, and Entitlement Management to their database environments. See On-prem connector for generic databases.

Flexible Okta Verify authenticator configuration

Okta Verify is bundled into a single authenticator with org-wide settings, preventing you from configuring individual verification methods (Okta FastPass, Push notification, or TOTP) per group. This feature separates Okta Verify into distinct, method-specific authenticators, allowing you to roll out Okta FastPass gradually.

Applications page enhancements

The Applications page now provides options to filter apps by type and status, search apps by name or client ID, and view apps by last modified date. You can also export apps to CSV to turn your filtered list into an audit-ready report. During Early Access, labelling uses IGA Governance Labels and is only available for OIG customers. See Search, filter, and export app integrations and Resource labels.

Low-Code Sign In Customization

Customizations are a key concern for enterprises. Few things have as much impact on customer trust as the look and feel of their site branding. It's how users know to trust the site and learn about new offerings. With Low-Code Sign In Customization, admins can customize the text, colors, and images of their Sign-In Widget without the need for complicated or risky changes using the code editor. A JSON templating language with syntax highlighting and suggestions enable admins to make visual changes to the sign-in page and Interstitial authentication to match their desired experience without changing a line of code. See Customize your sign-in page.

Multiple audiences for custom authorization servers

Custom authorization servers now support multiple audiences in addition to a default audience. See Create an authorization server.

Removal of Cross App Access configuration using Managed Connection

The removal of the ability to configure cross app access from the Managed connection tab located on the app's profile page is scheduled for an upcoming release. When it's removed, your existing configurations will stop working. Reconfigure your connections from the Resource Server tab to avoid disruptions. See Connect AI agents to resources.

New System Log events for bulk device changes

The following System Log events are now available for bulk device changes:

system.identity_sources.bulk_device_upsert
system.identity_sources.bulk_device_delete

Synchronize device data with Anything-as-a-Source

In addition to users and groups, Custom Identity Source integrations can now synchronize device data from a source of truth. Devices use a fixed set of attributes: serialNumber, platform, and displayName. See Use Anything-as-a-Source.

Identity verification with vendor-submitted integrations

Identity verification (IDV) vendors can now submit integrations through the Okta Integration Network. You can configure and apply these integrations to your authentication policies to verify user identities.

Policy change management

Admins can create branches of their app sign-in policies to review and monitor the impact of changes before enforcing the policy for end users. This allows admins to draft policy changes, test them against real user traffic, and roll them out with confidence. See Manage app sign-in policy branches.

Self-service registration policy for ITP

Self-service sign-up is an easy path for fraud, because bad actors using disposable email addresses or specific networks can slip through undetected. With the new self-service registration policy on the User Profile Policies page, Identity Threat Protection (ITP) customers can create rules that automatically deny sign-up attempts from disposable and throwaway email domains or specific network zones, working alongside Bot Protection as part of Okta's growing set of Attack Protection capabilities. This gives admins another way to cut down on fake accounts and keep self-registration flows cleaner. See Self-service registration.

Removal of Cross App Access as a self-service feature

You can no longer enable or disable the Cross App Access feature from the Early Access section of the Settings > Features page in the Admin Console. To change the availability of this feature for your org, contact Okta Support. If you have an Integrator Free Plan org, contact Developer Support instead. This change doesn't impact any existing configurations.

Import AI agents from Glean

You can now import and manage AI agents built in the Glean Agent Builder directly through Okta. See AI agent imports.

Device Visibility feature for macOS and Windows

Device Visibility replaces the basic detail page for managed devices with a new four-tab view for macOS and Windows devices. It surfaces OS-level user accounts, Platform SSO and Okta FastPass enrollment status, Okta Verify version, and device security signals in one place. This makes it easier for IT and security admins to verify authenticator enrollment and assess device security posture without piecing together information from multiple screens. See View device details.

Okta Verify support for Linux

Okta Verify now supports Linux desktop devices, allowing admins to extend phishing-resistant hardware-backed Okta FastPass authentication to Linux users. This release provides official support for devices running Ubuntu 24.04 and 26.04. See Deploy Okta Verify to Linux devices.

Desktop MFA Factor Discovery for Windows

Desktop MFA for Windows now shows users only the MFA factors they've enrolled, instead of a fixed list of all available factors. New users without an enrolled factor can sign in during their grace period to set up MFA, while existing users signing in on a new device must verify with an existing factor. See Enable Desktop MFA Factor Discovery.

Redirect federated users to IdPs for reauthentication

Reauthentication to an IdP helps Okta admins secure federated identities by redirecting federated users to their source SAML, OIDC, or Org2Org IdP when a policy requires them to reauthenticate. By forcing reauthentication at the source IdP, admins can close security gaps from long-lived sessions and remove the need to configure duplicate MFA enrolment in Okta. See Redirect federated users to IdPs for re-authentication.

New System Log events for privileged access database integrations

Two new System Log events, pam.integration.create and pam.integration.delete, are now available for Okta Privileged Access database management. This enhancement allows admins to track when database integrations are created or deleted. See System Log.

Auditor mode for admin role assignments

A new Auditor (Read-Only) mode allows super admins to apply a read-only restriction to any individual or group admin assignment. This setting restricts admins to read-only access across the Admin Console and Okta APIs, except for Okta first-party apps. This feature provides auditors with system visibility while maintaining security transparency. See Auditor read-only mode.

Global Token Revocation for third-party and Org2Org IdPs

Okta now supports Global Token Revocation (GTR) for third-party and Org2Org identity providers (IdPs). This feature allows external IdPs to securely trigger Universal Logout, instantly revoking all user sessions and tokens across your entire app ecosystem. See Configure Universal Logout for supported apps.

Managed app assurance for Android

The new Device Profile Restriction condition in device assurance policies ensures that Android users can only access protected apps from the same managed work profile where Okta Verify is installed. This prevents access from personal profiles, which reduces the risk of data leaks and improves security posture. See Add a device assurance policy.

Incremental imports for Office 365 is EA in Preview

Admins can now schedule and run incremental imports for Microsoft Office 365 and Office 365 GCC High app integrations.

On-prem Connector for Generic Databases supports incremental imports

The On-prem Connector for Generic Databases now supports incremental imports, which retrieves only the users and entitlement assignments that have changed since the last successful import, rather than the full dataset. This reduces import duration and database load for large-scale deployments. The source database must use soft deletes and maintain an automatically updated timestamp column. See On-prem Connector for Generic Databases.

IBM Db2 LUW support for On-premises Connector for Generic Databases

The On-premises Connector for Generic Databases now supports IBM Db2 LUW. This enables admins to manage users and entitlements in IBM Db2 LUW environments. See On-prem connector for generic databases.

Okta for AI Agents is self-service EA

Orgs that are subscribed to Okta for AI Agents can now enable the product from the Features page. You can use Okta for AI Agents to register, secure, and govern AI agent identities directly within Okta. See Okta for AI Agents.

Improved DirSync-based imports

Optimize performance of AD DirSync-based imports by skipping unnecessary prechecks and downloading organizational units without using DirSync.

OAuth 2.0 support for custom email providers

You can now configure custom email providers with OAuth 2.0 authentication. Choose between two OAuth 2.0 client configurations to fetch access tokens and use those access tokens to authenticate with your email provider's SMTP server. See Use your own email provider.

Authentication Activity report

The Authentication Activity report provides detailed authentication insights including Okta FastPass usage, complementing the MFA Activity report. You can view activity filtered by device type (Android, iOS, macOS, Windows), management state (managed, unmanaged), registration status (registered, unregistered), and verification method (TOTP, Push, Okta FastPass). See Authentication Activity report.

Detect and discover AI agents

Use the Security Access Monitor browser plugin and Okta Identity Security Posture Management (ISPM) to get visibility into any new OAuth grants to apps and the consequent shadow AI agent usage for your org. The plugin monitors managed browsers for any new OAuth grants to apps and AI agents. ISPM captures OAuth grant telemetry, analyzes the data, and provides you with the visibility you need to identify every third-party app that your users authorize. This helps you mitigate risks related to shadow OAuth grants and AI agents. After you configure the plugin, you can find all new OAuth grants across your org by going to NHIs and AI agents > Browser OAuth Grants page in the ISPM console. See Discover and assess AI agents.

Okta FastPass using SSO extension now supports Chrome on macOS

You can now enable the SSO extension support for Chrome on macOS option to support use of the SSO extension on Chrome 146 or later. This ensures seamless authentication for users on the latest browser versions on macOS.

Okta as a fallback identity provider

This feature redirects users to Okta to authenticate if the primary identity provider can't establish their identity. This can happen because of explicit rejections, like invalid credentials and MFA failures, or if an existing user session can't be silently verified, such as during a prompt=none OIDC request or IsPassive=true SAML request. See Configure identity provider routing rules.

On-premises connector for Generic Databases

The new on-premises connector for Generic Databases allows admins to manage users and entitlements in on-premises databases using the Okta On-Prem SCIM Server. This connector supports Oracle, MySQL, PostgreSQL, and Microsoft SQL Server. It enables orgs to apply governance features like Access Requests, Certifications, Lifecycle Management, and Entitlement Management to their database environments. See On-prem connector for generic databases.

Breached credentials protection

Protect your org from the impact of credentials that have been compromised. If Okta determines that a username and password combination has been compromised after being compared to a third-party curated dataset, the protection response is customizable through password policies, including resetting the user's password, forcing a logout, or calling a delegated Workflow. See Breached credentials protection.

Breached credentials protection is now available for Federal customers.

Device conditions in the Okta account management policy

With this feature, admins can now restrict account management activities such as self-service password resets or new authenticator enrollments with device conditions. Admins can configure Okta account management policy rules with registered and managed devices, or require devices to meet the requirements of a device assurance policy. See Add a rule for enrollment of your first phishing-resistant authenticator.

Governance for Workflows now available in EA

You can now use Okta Identity Governance to manage access to Workflows roles. This helps you ensure that access to Workflows is granted consistently and in compliance with your company's requirements. See Governance for Workflows.

Password complexity requirements

Okta now lets you limit the number of consecutive repeating characters that users can put in their passwords. Password complexity requirements are now also applied to Active Directory and LDAP-sourced users. This change enhances the security of your org by expanding password complexity options, and applying this protection to more user profile types. See Configure the password authenticator.

Enhanced breached credentials protection

This feature provides a premium breached credentials detection feed for Okta Customer Identity (OCI) customers with Identity Threat Protection which identifies more compromised credentials sooner. See Breached credentials protection.

New System Log events for Cross App Access connections

The following events are fired when you create, delete, or update a Cross App Access connection:

app.cross_app_access.connection.create
app.cross_app_access.connection.delete
app.cross_app_access.connection.update

Desktop MFA recovery for Windows

This release enhances the Desktop MFA feature on Windows to include an admin-assisted recovery path. If a user is locked out of their Windows device, an admin can now issue a time-based recovery PIN. This grants the user temporary access to their computer without needing their primary MFA device, enabling them to resolve their authenticator issue and sign in successfully. See Enable Desktop MFA recovery for Windows.

Okta Verify Device Posture Sensor Mode

Previously, enforcing device security posture created significant blind spots on shared devices because it required a single-user Okta FastPass enrollment. Okta Verify Sensor Mode resolves this issue by registering the app directly to the org, allowing context-aware Device Assurance policies to be instantly evaluated when the user signs in. This is especially valuable for frontline workers, as it guarantees comprehensive compliance for shared fleets and ensures that devices are healthy before access is ever granted. See Device Posture Sensor Mode.

Multiple active IdP signing certificates

Okta now supports multiple active signing certificates for a single SAML identity provider (IdP), enabling seamless certificate rotation with zero downtime. Admins can upload up to two certificates per IdP connection. This improvement eliminates the need for tightly coordinated swaps with IdP partners and reduces the risk of authentication failures due to expired certificates. The feature is available for both the Admin Console and the IdP Certificates API.