Okta Identity Engine Preview release notes

Version 2026.42.1. Deployed on October 14, 2026.

Generally Available features

Improved MCP server registration experience

The Add an MCP Server UI has been updated to match the AI agent and Agent Gateway management experiences. These changes provide a consistent, streamlined workflow for admins when registering and configuring MCP servers.

Provisioning for Sumo Logic

The Sumo Logic Provisioning integration (by Actions) has been added to the OIN. This integration covers user create, update, deactivate/delete, and role assignment across Sumo Logic regional deployments. See Integrate Sumo Logic with Okta.

Provisioning for Cloudfare

Provisioning is now available for Cloudfare. See Integrate Cloudfare with Okta.

Gemini Enterprise Agent Platform import integration

Admins can now import AI agents, including A2A agents, from the Gemini Enterprise Agent Platform into Okta. When enabling the import in Okta, admins can scope the integration to specific regional locations or a global location. The import retrieves key agent attributes, providing rich visibility into AI agent inventories. See Configure Gemini Enterprise Agent Platform for AI agent imports.

Early Access features

mTLS client authentication for OIDC apps

Mutual Transport Layer Security (mTLS) client authentication is now available for OIDC apps. Instead of a shared client secret, Okta issues access tokens that are cryptographically bound to that certificate, so a stolen token can't be used without it. This helps org strengthen the security of their app and API connections, with no client secrets to store, share, or rotate. See Create OpenID Connect app integrations.

Authenticator enrollment sets

Authenticator enrollment sets let admins define groups of authenticators for end-user enrollment, instead of simply marking each one required, optional, or disabled. Admins can require a subset of the group (two of three, for example) or let end users choose which authenticator to enroll (Authenticator A or Authenticator B). This flexibility supports acceptable backup authenticators, gives end users more secure choices, and simplifies enrollment policy management. See Create an authenticator enrollment policy.

Device Visibility for macOS: Device Bound SSO sessions

The device details page for managed macOS devices now includes a Device Bound SSO (DBSSO) card. Admins can see the DBSSO session status for each OS-level user account on the device, alongside the Platform SSO and Okta FastPass enrollment status already shown for that account. This makes it easier for IT and security admins to verify that macOS users have an active, device-bound session without piecing together information from multiple screens. See View macOS device details.

Fixes

  • Users couldn't sign-in through JIT provisioning flows that used IdP routing rules if they failed authentication at a third-party IdP and were redirected to Okta. (OKTA-1016779)

  • When Okta sent email notifications for entitlement schema change interruptions, the email subject line displayed the app instance name twice. (OKTA-1253044)

  • When an authentication policy used an authentication method chain that included Okta FastPass, the previously used authentication method wasn't retained. On subsequent sign-in attempts, users had to select an authentication method again instead of being prompted with their previously used method. (OKTA-1262367)

  • Admins saw an Internal Server Error when they edited the embedded widget sign-in support in Settings > Account and selected Allow admins to configure the Interaction Code grant type. (OKTA-1269769)

  • When admins selected a SAML app for AI Agent user access, the dropdown menu results contained some apps that were ineligible for agent delegation. (OKTA-1281415)

  • When certain features registered a device, the device displayed its serial number instead of the assigned device name in the Display Name field. (OKTA-1283648)

  • App admins couldn't delete app sign-in policies. (OKTA-1284157)

  • Issues occurred when an admin created or updated a resource server that shared an issuer URL with an existing external authorization server. Configurations were overwritten, subject mappings cleared, and cross-resource side effects were introduced across unrelated integrations. (OKTA-1285509)

  • Admins on some custom-domain orgs were unable to access the Admin Console due to a token validation mismatch. (OKTA-1289991)

Okta Integration Network

  • Adweek (SWA) was updated.

  • Bing Ads (SWA) was updated.

  • CarFax (SWA) was updated.

  • Crossbeam (SAML) is now available. Learn more.

  • Dataloader.io (SWA) was updated.

  • Guru (SAML) is now available. Learn more.

  • Guru (SCIM) is available. Learn more.

  • LeakData Shared Signals (API Service Integration) is now available. Learn more.

  • LinkedIn (SWA) was updated.

  • Ollet (IDV) is now available. Learn more.

  • Ready Room (OIDC) is now available. Learn more.