Okta Identity Engine Preview release notes

Subscribe to RSS

Version 2026.46.0. Deployed on November 12, 2026.

Generally Available Features

Email auto-enroll note for authenticator sets

Authenticator enrollment policies that use authenticator sets now include a note that explains how automatic enrollment works to help you understand when email is enrolled automatically.

User email addresses in the Cross App Access Token Analytics report

The Cross App Access Token Analytics report now includes user email addresses. See the Cross App Access Token Analytics report.

Enhanced breached credentials protection for OWI

This feature provides a premium breached credentials detection feed for Okta Workforce Identity customers with Identity Threat Protection that identifies more compromised credentials sooner. See Breached credentials protection.

Multiple actions in entity risk policy rules

In entity risk policy rules, admins can now combine one of the Logout and revoke tokens actions with Run a Workflow. See Add an entity risk policy rule.

Increased Access Request task assignee limit

The maximum number of assigned users per task or question has been increased to 50 (previously 25).

Salesforce My Domain integration

Admins can now configure a custom Salesforce domain URL when setting up the Salesforce app. All requests go to the configured Salesforce web address (for example, company.my.salesforce.com) instead of the default Salesforce URL.

Generally Available Enhancements

Okta Active Directory agent, version 3.24.0

This release includes the following changes: Performance improvements and bug fixes. See Okta Active Directory agent version history.

Early Access Features

Device Visibility for Windows: Desktop MFA and Device-Bound SSO

The device details page for managed Windows devices now shows Desktop MFA (DMFA) enrollments and Device-Bound SSO (DBSSO) sessions. When a Windows device registered through Okta Device Access has a DMFA enrollment, the OS account is linked to the Okta user. The offline factors enrolled for that OS account appear in the account details alongside DBSSO session status and factors. This makes it easier for IT and security admins to confirm which users and offline factors are enrolled on a Windows device. See View Windows device details.

Attack protection policy

Bot protection currently uses one detection threshold and one action for every protected flow. Admins have to choose between letting more bots through on sign-up or adding friction to every sign-in. With the attack protection policy, admins create a rule for each sign-in, sign-up, and password reset flow, with its own bot likeliness threshold and action. This lets admins enforce Okta Challenge where bot traffic costs the most and monitor the rest. When you enable the feature, your existing bot protection settings migrate to the policy automatically. See Attack protection.

Automated Admin Console banner for paused imports

When an import safeguard pauses an import and triggers a system.import.roadblock System Log event, Okta now displays a notification banner. The banner alerts admins and links to the Import Monitoring page to review, resume, or cancel affected imports.

Fixes

  • After admins uploaded a signature certificate for a new custom SAML 2.0 app, the Signature Certificate field didn't appear on the General tab. (OKTA-1240578)

  • In some orgs, users on iOS devices got stuck in a loop when they tried to enroll in Okta Verify on a second device. (OKTA-1249225)

  • The Role column on the API Tokens page displayed "User" instead of the admin role for tokens created by custom admins. (OKTA-1255371)

  • In orgs that use the Okta Account Management Policy, legacy authenticators selected in a policy were still available for enrollment on the End-User Dashboard settings page, even though they were disabled in all policies. (OKTA-1271381)

  • For orgs with authenticator enrollment policies that use authenticator sets, the email authenticator wasn't automatically enrolled when the set required all of its authenticators. (OKTA-1289944)

  • In orgs with the Authenticator enrollment sets Early Access feature enabled, admins saw an error message when they edited a legacy authenticator enrollment policy. (OKTA-1304440)

  • Some MCP servers returned unvalidated token and registration endpoint URLs.  (OKTA-1317736)

  • For some orgs that used app branding migration to upgrade to Identity Engine, users who signed in to an app still on Classic Engine were prompted for a username instead of being redirected to the IdP specified in an IdP routing rule. (OKTA-1322407)

Okta Integration Network

  • Atomicwork API Service (API Service Integration) is now available. Learn more

  • Barndoor AI now supports XAA.

  • Ferentin (OIDC) is now available. Learn more.

  • Ferentin (XAA) is now available. Learn more.

  • NanoCo (OIDC) is now available. Learn more.

  • NanoCo (XAA) is now available.

  • Opal Security (XAA) is now available. Learn more.

  • Suppleo (OIDC) is now available. Learn more.

  • Suppleo (SCIM) is now available. Learn more.

  • Suppleo now supports Universal Logout.

  • Wiz (API Service) was updated. Learn more.