Okta Identity Engine Preview release notes

Subscribe to RSS

Version 2026.44.0. Deployed on October 28, 2026.

Generally Available Features

Single audience claim for custom authorization servers

For orgs with the Multiple audiences for custom authorization servers feature enabled, access tokens now have a single aud claim value by default.

Cross App Access for MCP Servers

Cross App Access enables Okta admins to securely connect AI agents to third-party MCP servers. This gives admins full visibility and control over actions taken on behalf of users and eliminates user consent prompts at runtime.  See Configure Cross App Access for an MCP server.

Import AI agents from UiPath

You can now import and manage AI agents built in UiPath directly through Okta. See AI agent imports.

XAA token analytics report

The XAA token analytics report gives admins a clear view of their cross-app access (XAA) token usage in the Admin Console Reports tab. Admins can specify a date range and see which applications and users drive usage. Before, admins needed to build System Log queries by hand, which was slow and hard to repeat. Now admins can spot usage trends early and can make informed decisions about their XAA token usage. They can also export the filtered results to CSV. See Cross App Access Token Analytics report.

Connect MCP servers to downstream resources as OAuth clients

MCP servers registered in Okta can now act as OAuth clients, enabling them to connect to downstream MCP servers and other resources on behalf of users. The MCP servers can perform requests and gather data, returning one processed answer to the agent. Each system the MCP reaches is a connection that you grant and revoke in Okta with its own permitted scopes. See Allow an MCP server to access downstream resources.

Multiple actions in entity risk policy rules

In entity risk policy rules, admins can now combine one of the Logout and revoke tokens actions with Run a Workflow. See Add an entity risk policy rule.

Self-service registration policy for ITP

Self-service sign-up is an easy path for fraud, because bad actors using disposable email addresses or specific networks can slip through undetected. With the new self-service registration policy on the User Profile Policies page, Identity Threat Protection (ITP) customers can create rules that automatically deny sign-up attempts from disposable and throwaway email domains or specific network zones, working alongside Bot Protection as part of Okta's growing set of Attack Protection capabilities. This gives admins another way to cut down on fake accounts and keep self-registration flows cleaner. See Self-service registration.

Desktop MFA Factor Discovery for Windows

Desktop MFA for Windows now shows users only the MFA factors they've enrolled, instead of a fixed list of all available factors. New users without an enrolled factor can sign in during their grace period to set up MFA, while existing users signing in on a new device must verify with an existing factor. See Enable Desktop MFA Factor Discovery.

Import AI agents from Relevance AI

You can now import and manage AI agents built in Relevance AI directly through Okta. See AI agent imports.

Import AI agents from Boomi

You can now import and manage AI agents built in Boomi directly through Okta. See AI agent imports.

Updated endpoint integration label

The osquery option in the Endpoint integration dropdown menu is now called Advanced posture checks.

High Risk Proxy detection

Admins can now detect and control access from high-risk commercial proxy networks using a new HIGH_RISK_PROXIES service category in Enhanced Dynamic Network Zones. This category is powered by an Okta-curated list of proxy providers that Okta CyberDefense has identified as consistently high-risk, based on correlation with observed attacks such as credential stuffing and rate-limit abuse. Admins can include or exclude HIGH_RISK_PROXIES when configuring Enhanced Dynamic Network Zones, enabling more precise policies, for example, denying access through the global session policy or app sign-in policy for traffic originating from these proxy networks. See Supported IP service categories.

Updated retention period for incomplete app assignment tasks

The retention period for incomplete app assignment tasks is now six months. Okta automatically purges incomplete task records older than six months.

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

  • Windows 10 builds (10.0.17763.9376, 10.0.19044.7807, 10.0.19045.7807)
  • Windows 11 builds (10.0.22631.7652, 10.0.26100.9711, 10.0.26200.9711, 10.0.26200.9711)
Network zone page localization

Additional text on the Networks page is now translated to French and Japanese.

Okta On-Prem MFA agent version 1.8.8

This version includes security enhancements.

AI agent owners hidden for non-OIG orgs

On AI agent profiles, the Owners tab is now hidden for orgs that aren't subscribed to Okta Identity Governance (OIG).

OIN Community Integrations

New apps often launch before Okta has an integration for them, forcing admins to delay rollout or run the app without single sign-on and automated provisioning. Community Integrations close that gap. Okta builds the integration from the application's public APIs and publishes it to the Okta Integration Network at no additional cost. A new integration starts as Community Preview, available to install and test in preview orgs. Once a customer has run it in their own production org, it becomes Community Verified and can be installed in any org. You get a missing integration to test within days, not months, and decide when it's ready for production based on your own testing. See Community integrations.

Low-Code Sign In Customization

Customizations are a key concern for enterprises. Few things have as much impact on customer trust as the look and feel of their site branding. It's how users know to trust the site and learn about new offerings. With Low-Code Sign In Customization, admins can customize the text, colors, and images of their Sign-In Widget without the need for complicated or risky changes using the code editor. A JSON templating language with syntax highlighting and suggestions enable admins to make visual changes to the sign-in page and Interstitial authentication to match their desired experience without changing a line of code. See Customize your sign-in page.

Cross App Access with an external identity provider

Cross App Access (XAA) now supports an Identity Assertion JWT Authorization Grant (ID-JAG) issued directly by an external OpenID Connect (OIDC) identity provider (IdP) or by another Okta org. Until now, an AI agent could use XAA with your custom authorization server only if Okta issued its identity assertion. Agents that signed in through another IdP, or through another Okta org, needed a separate Okta credential. Now your custom authorization server can accept an ID-JAG directly from a trusted OIDC IdP or another Okta org that supports XAA. See Configure Cross App Access with an external identity provider.

Stage certification campaigns before launch

Staging a campaign lets you preview target users, resources, and reviewer assignments in advance to ensure accurate scope, fix configuration errors, and guarantee that requests reach the correct reviewers from day one. See Stage a campaign.

Generally Available Enhancements

Client credentials OAuth2.0 grant type for SCIM or API Integration Actions-based app integrations

When you create app integrations using the Okta Integration Wizard, you can now use client credentials (tenant-specific client ID and secret) as an OAuth 2.0 grant type for SCIM or API Integration Actions-based app integrations. This helps you simplify and secure the setup and improves user experience by reducing the need for then to manually sign in.

Campaign notifications frequency

You can now configure reminders for reviewers on up to three separate days before a campaign's review period ends. Sending reminders on multiple days helps increase the number of reviews completed before the campaign closes.

Early Access Features

Incremental imports for Office 365

Admins can now schedule and run incremental imports for Microsoft Office 365 and Office 365 GCC High app integrations.

Okta Verify Device Posture Sensor Mode

Previously, enforcing device security posture created significant blind spots on shared devices because it required a single-user Okta FastPass enrollment. Okta Verify Sensor Mode resolves this issue by registering the app directly to the org, allowing context-aware Device Assurance policies to be instantly evaluated when the user signs in. This is especially valuable for frontline workers, as it guarantees comprehensive compliance for shared fleets and ensures that devices are healthy before access is ever granted. See Device Posture Sensor Mode.

Multiple entitlement support for On-prem Connector for Generic Databases

The On-prem Connector for Generic Databases now supports importing multiple entitlements within a single app instance. This allows admins to assign users to multiple database-level entitlements without creating separate app instances.

Match on AAGUID alone for passkey authenticator groups

You can now select Match on AAGUID alone when you add or edit a Passkey (FIDO2 WebAuthn) authenticator group. Users can then enroll authenticators from the group that don't provide a trusted attestation certificate. See Configure the Passkey (FIDO2 WebAuthn) authenticator groups.

Early Access Enhancements

Configurable time to live (TTL) for device posture provider claims

Admins can now set the time to live (TTL) duration for device posture provider claims from 5 minutes to 24 hours. This org-wide setting provides greater control over how frequently devices are re-evaluated for compliance See Integrate Okta with Device Posture Provider.

Fixes

  • When admins with custom roles attempted to view or manage device posture checks, the checks weren't available (OKTA-1157414)

  • Some global session policy rules weren't evaluated if a user signed in shortly after being added to a group that was recently added to the global session policy. (OKTA-1265480)

  • In orgs with the early access feature "Support for re-authentication with an external IdP" enabled, users who tried to sign in to an app through an IdP saw an error message if they already had an active session on the upstream IdP. (OKTA-1276837)

  • In orgs that used authenticator sets with a grace period, required authenticators appeared as optional when users selected Remind me later during enrollment. (OKTA-1290198)

  • When an admin configured Cross App Access (XAA) for an app integration, they couldn't use an issuer URL that resolved to private a IP address or non-public DNS. (OKTA-1299275)

  • In orgs with app branding migration enabled, some OIDC apps were incorrectly labelled as Classic Engine-only. (OKTA-1299341)

  • When a CSV user import containing entitlement columns included an unparseable cell, the Admin Console displayed a raw code exception instead of a helpful error message. (OKTA-1299822)

  • Some users weren't able to sign in after they entered their PIN for their NFC authenticator. (OKTA-1300647)

  • When unauthenticated users tried to access their End-User Dashboard in preview orgs, a session expiration message was displayed before the Sign-In Widget loaded. (OKTA-1303219)

  • Users were prompted to enroll a required authenticator again after skipping the grace period. This happened when an admin modified a different authenticator in the authenticator enrollment policy. (OKTA-1235656)

  • When requests to the /api/v1/groups API returned more than 1000 users, pagination looped back to the first page instead of advancing to the next. (OKTA-1265598)

  • When users attempted to enroll an additional Okta Verify device by clicking Set up another in the End-User Dashboard settings, an error occurred. (OKTA-1267878)

  • The Early Access Connect with Okta feature is no longer available. The legacy Manage Connections tab on the Admin Console app profile pages and the associated Application Cross App Access Connections APIs (/api/v1/apps/{appId}/cwo/connections) have been retired. Configurations created under this feature will no longer function as of release 2026.44.0. Reconfigure Cross App Access (XAA) integrations using the current AI agent-to-app resource connections in the Admin Console to avoid disruptions. (OKTA-1268002)

  • In orgs that require FIPS-compliant devices and that enabled the Flexible Okta Verify authenticator configuration feature, some Android users received an error when enrolling in Okta Verify, even though their device was compliant. (OKTA-1274993)

  • The System Log displayed multiple Evaluation of Sign-On Policy events when users signed in with Okta Verify push for Desktop MFA. (OKTA-1278196)

  • In orgs with authenticator enrollment policies that use authenticator sets, the passkey promotion prompt continued to appear after users reached the skip limit. (OKTA-1294256)

  • After upgrading to Okta Identity Engine, users were sometimes signed out when they tried to access their account settings or saw an extra MFA prompt when accessing apps. (OKTA-1294281)

  • During provisioning tasks, Office 365 app instances logged misleading customRoles attribute errors in the System Log. (OKTA-1297976)

  • When users selected Phone during enrollment in an authenticator set, the Sign-In Widget didn't show enrollment progress. (OKTA-1298664)

  • Group rules didn’t automatically assign imported users to target groups based on their app group membership. (OKTA-1300676)

Okta Integration Network

  • Cockroach Labs (SCIM) was updated with a new app logo.

  • Cust (OIDC) is now available. Learn more.

  • Cust (SCIM) is now available. Learn more.

  • Init (API Service) is now available. Learn more.

  • Juno Journey (SAML, SCIM) has a new app name and logo.

  • Provisioning is now available for dbt Cloud. See Integrate dbt Cloud with Okta.

  • Semperis Lightning (API Service) is now available. Learn more.

  • STLabs (API Service) is now available. Learn more.

  • Sumsub IDV (IDV) is now available. Learn more.

  • Thomson Reuters Account (SAML) is now available. Learn more.

  • Tungsten (OIDC) is now available. Learn more.

Documentation updates

RSS feeds for release notes

RSS feeds are now available for Preview and Production release notes so that you can track and receive automated updates on new capabilities and fixes. Click the RSS icon to subscribe.