Okta Identity Governance release notes

Generally Available features

Certify resource collections - Resource campaigns is Generally Available in Production environments

Use access certification resource campaigns to certify user access to resource collections. Rather than reviewing individual apps, entitlements, or bundles separately, running resource campaigns for resource collections helps you reduce the volume of review items for reviewers and provide them with the necessary context to make informed decisions. See Create resource campaigns.

Certify resource collections - User campaigns is Generally Available in Production environments

Run access certification identity campaigns (previously called user campaigns) to certify user access to resource collections. Running identity campaigns that include collections helps you reduce the volume of review items for reviewers and accelerate campaign completion. Using the Contextual Information settings, you can also provide reviewers with the necessary context to help them make informed and more accurate decisions. See Create identity campaigns.

Resource collections now support groups, push groups, and non-EM apps

Resource collections can now be further customized for specific roles by allowing groups, push groups, and non-EM apps to be included in a collection. This provides admins the ability to assign a wider set of resources required for a specific role to a collection, improving control over resources and reducing management overhead. See Resource collections.

Additional information in System Log events

The System Log events for creating, canceling, and resolving requests now contain the following information in the DebugData field:

• accessRequestMatchedConditionId

• accessRequestApprovalSequenceId

• requestedForId

This is only applicable for requests managed by access request conditions.

New System Log event

The governance.settings.update System Log event is fired when super admins update the delegate settings to allow or block users from assigning their own delegate.

Increased Access Request task assignee limit

The maximum number of assigned users per task or question has been increased to 50 (previously 25).

Early Access features

Automatically assign resource collections with collection policies

Use collection policies to automatically assign resource collections to users based on user attributes defined in Universal Directory. When a user's attributes match or no longer match a policy's assignment rule, Okta Identity Governance assigns or unassigns the collection for them. This helps you manage access when users join or leave the org or there are changes to their role and assignments. Collection policies work alongside direct assignments, which policies don't affect. See Manage resource collection assignments.

If you disable this feature, Okta removes all collection policy rules and any user assignments that those rules made. Direct assignments to collections aren't affected.

This is an Early Access release. See Enable self-service features.

Fixes

• No events were recorded in the System Log when a user profile attribute was changed in Access Certification Settings. (OKTA-730538)

• Users with custom admin roles were unable to view or manage org settings for Identity Governance because the resource set didn't include Governance settings permissions. (OKTA-1294338)

• Sometimes user entitlement assignments were incorrectly revoked after an import. (OKTA-1318686)