Okta Identity Engine release notes (Production)

Version: 2024.08.0

August 2024

Generally Available

Sign-In Widget, version 7.21.0

For details about this release, see the Sign-In Widget Release Notes.

For more information about the Widget, see the Okta Sign-In Widget Guide.

Detect and block requests from anonymizing proxies

Orgs can now detect and block web requests that come from anonymizers. This helps improve the overall security of your org. See Enhanced dynamic zones.

New View client credentials admin role permission

The new View client credentials permission lets admins view OAuth client secrets. The View applications and their details permission no longer includes this privilege. This enhancement lets admins assign more granular permissions and reduce the risk of creating roles with too many privileges. This feature will be gradually made available to all orgs.

Network zone allowlists for SSWS API tokens

Admins can now specify a network zone allowlist for each static (SSWS) API token. These allowlists define the IP addresses or network ranges from where Okta API requests using SSWS API tokens can be made. This restricts attackers and malware from stealing SSWS tokens and replaying them outside of the specified IP range to gain unauthorized access.

ADSSO authentication parameters

When a state token is used, Okta removes the fromURI parameter from the ADSSO authentication POST request.

View System Logs for Office 365 authentication events

You can now view authentication events in the System Log when using WS-Fed to authenticate through Office 365 active (WS-Trust-1.2) and username13 (WS-Trust-1.3) endpoints.

Updates to the Suspicious Activity report

The Suspicious Activity report has been updated to a System Log report. Use the System Log query to search and filter for unusual activities in your org. The query allows you to filter events with more precision and provides more information about each event than what the previous report provided. This information can help you better determine the validity of user actions. See Suspicious activity events.

Updates to Deprovisioning Details report

The Deprovision Details report has been updated to a System Log report. Use the System Log query to search and filter for deprovisioned users with more context and precision than the previous report. See Deprovision Details report.

Deprecating Current Assignments report

The Current Assignment report has been deprecated. Use the User App Access report to identify users currently assigned to applications. See User App Access report. Use the System Log event application.user_membership.remove to identify users who have been unassigned from an application. See Recently unassigned users.

Prevent new single-factor access to the Admin Console

This feature prevents admins from configuring any new single-factor access to the Admin Console. This feature will be gradually made available to all orgs.

System Log enhancement

Certain system log events now contain a new property called changeDetails in the target. When this property is populated, it reflects new, changed, or removed attributes of the target resource that has been modified. See changeDetails property.

System Log event updates

The following System Log events are now available:

  • application.provision.group_push.deactivate_mapping
  • system.agent.register
  • security.attack_protection.settings.update
  • device.platform.secret_key.reset
  • system.self_service.configuration.update
  • user.behavior.profile.reset
  • security.events.transmitter.create
  • security.events.transmitter.update
  • security.events.transmitter.delete
  • security.events.provider.create
  • security.events.provider.update
  • security.events.provider.activate
  • security.events.provider.deactivate
  • security.events.provider.delete
  • system.identity_sources.bulk_upsert
  • system.identity_sources.bulk_delete
  • system.import.schedule
  • system.import.user_match.confirm
  • system.import.user_match.unignore
  • system.import.user_match.update
  • The application.lifecycle.update event now has the sessionIdleTimeoutMinutes and sessionMaxLifetimeMinutes fields. These fields add more session details to the event.

See Event types.

System Log event updates for Universal Directory

The following System Log events are now available:

  • Linked object created
  • Linked object deleted
  • User profile updated
  • Group owner updated
  • Group owner removed

Identity Provider external names

Okta now warns admins if an Identity Provider (IdP) with custom attributes has an empty externalName field. Admins must now update the custom attribute through the API or delete it from the Admin Console and re-add it with the externalName field defined. This ensures that Okta receives the custom attribute when users enroll through Just-In Time provisioning scenarios.

Request throttling for jwks_uri

Okta has decreased the frequency at which it reloads JWKs from a customer's jwks_uri.

Rate limit for telephony inline hook

Okta now enforces by default a rate limit for the telephony inline hook to protect your org from toll-fraud attacks. See Connect to an external telephony service provider.

Universal Logout supported apps

The Surf browser now supports Universal Logout. This enables admins to automatically sign users out of this app when Universal Logout is triggered.

Authorization server default access policy deprecation

The authorization server default access policy is no longer provided in child orgs that are generated from APIs. Users can click Add New Access Policy to add policies. See Create access policies.

Early Access

Require MFA for accessing Identity Governance admin apps

If your org uses Okta Identity Governance, you can require MFA for admins who access these first-party apps:

  • Okta Access Certifications
  • Okta Entitlement Management
  • Okta Access Requests Admin

If you have auto-enabled Early Access features in your org, MFA is automatically enforced for those apps. See Enable MFA for the Admin Console.

OAuth 2.0 security for invoking API endpoints

Okta Workflows users can now securely invoke API endpoints using OAuth 2.0 protocols and their Okta org authorization server. Compared with the existing token authorization option, this feature is more secure while also being easier to implement. Add the okta.workflows.invoke.manage scope to any new or existing app integration to make it eligible to invoke your API endpoint. See Invoke a flow with an API endpoint.

YubiKey preregistration

Customer admins were previously unable to enroll and ship YubiKeys as WebAuthn enrollments in a quick and automated way. The YubiKey preregistration feature enables admins to preregister YubiKey factors as WebAuthn enrollments for both staged and existing (active) users using a Workflows and Yubico integration to seamlessly handle the registration and shipment. See Require phishing-resistant authentication with pre-enrolled YubiKey.

Okta account management policy

The Okta account management policy helps admins easily build phishing resistance into actions such as account unlock, password recovery, and authenticator enrollment. Using the familiar rule-based framework of an authentication policy, admins can now customize which phishing-resistant authenticators are required when users attempt these common self-service actions. All of the configurations in the authentication policies can now be applied for authenticator management. See Okta account management policy.

Biometric user verification in authentication policies

You can now configure authentication policies to require biometric user verification (no passcode). With this feature you ensure that users confirm their biometrics when they authenticate with Okta FastPass or Okta Verify Push. See Biometric user verification in authentication policies.

JIT provisioning for Smart Card

This feature enables you to provision Just-In-Time (JIT) access to users. You can do this by configuring certificate attribute criteria so that PIV/CAC card holders of other orgs can gain access to the resources they need. See Add a Smart Card Identity Provider.

Fixes

  • When the display language was set to Japanese, some text on the Upgrade Okta Verify with Push window wasn’t translated. (OKTA-658461)

  • Some Identity Providers didn't share custom attributes with Okta when the externalName field was empty. (OKTA-713526)

  • The Sign-In Widget didn't display the correct client ID when a customized client ID was used. (OKTA-722623)

  • Users with a custom admin role that included the View Directory permission were unable to view the Directory Integration page in the Admin Console. (OKTA-733030)

  • In some cases, an Okta org edition couldn't be changed. (OKTA-741688)

  • Admins couldn't edit IP restrictions for tokens created by agents. (OKTA-745048)

  • Some Android, iOS, and iPadOS users couldn't enroll with Okta Verify when the Higher security methods enrollment option was enabled. (OKTA-745318)

  • In some instances, a rate limit was reached when assigning entitlements to a user. (OKTA-746095)

  • The Universal Logout endpoint (oauth2/v1/global-token-revocation) used the incorrect OAuth 2.0 scope. (OKTA-747477)

  • Some users couldn't sign in if the global session policy that applied to them was deleted. (OKTA-754352)

  • System Log events weren't produced when admins changed an app's Radius Authentication Protocol settings. (OKTA-755604)

  • Admins received report emails with links to empty CSV exports. (OKTA-756393)

Okta Integration Network

  • BRM (OIDC) is now available. Learn more.
  • Getty Images (SAML) now has additional ACS endpoints.
  • GitHub Enterprise Server is now called GitHub Enterprise Server (legacy).
  • Haystack (SAML) is now available. Learn more.
  • IBM AS/400 by Aquera (SCIM) is now available. Learn more.
  • INCRMNTAL (OIDC) is now available. Learn more.
  • Kuggar (OIDC) is now available. Learn more.
  • Pmovel (OIDC) is now available. Learn more.
  • Salesforce Social IdP was updated (OKTA-733640).
  • UKG Ready by Aquera (SCIM) is now available. Learn more.
  • Vinkey (OIDC) is now available. Learn more.
  • WebWork Time Tracker (SCIM) is now available. Learn more.
  • Wiz (API service) is now available. Learn more.

Weekly Updates

2024.08.1: Update 1 started deployment on August 19

Generally Available

Enforce MFA for Identity Governance admin apps update

The Enforce MFA for Identity Governance admin apps feature is available as a self-service Early Access feature only if the Enforce MFA to access the Admin Console feature is enabled.

Fixes

  • When admins viewed an OAuth client's secrets, Okta didn't trigger a System Log event. (OKTA-692600)

  • A System Log event wasn't always recorded when unlocked, Active Directory-sourced users tried to unlock their account from the Okta Sign-In Widget. (OKTA-724743)

  • The Identity Providers filter was missing from the Profile Editor page for some users in orgs that had the Enable Custom Admin Roles for Identity Providers feature turned on. (OKTA-724750)

  • Super admins who were assigned permissions through a group assignments couldn't see the Password Hash Export option even when it was enabled in the org. (OKTA-736079)

  • Some users couldn't sign in using a password and security question. (OKTA-740646)

  • Users to whom the Device Trust policy was applied received an error when signing in. (OKTA-745480)

  • The Allow Unknown Devices button wasn't visible on the user's profile page. (OKTA-746893)

  • Two Session timeout warning modals appeared when a user's session was about to expire. (OKTA-748766)

  • Admins couldn't search for AuthenticatorContext in the user.authentication.auth_via_mfa event in the System Log. (OKTA-750669)

  • The activation link in the Welcome email didn't always work. (OKTA-752981)

  • On the Roles, Resources, and Admins tabs on the Administrators page and in the Edit resources to a standard role dialog, admins couldn't use an ampersand (&) in their search. (OKTA-753904)

Okta Integration Network

  • Anzenna has a new icon.
  • Brainier LMS by Aquera (SCIM) is now available. Learn more.
  • Cezanne (SCIM) is now available. Learn more.
  • CloudAcademy has been rebranded as QA.
  • DeleteMe (SCIM) now supports creating and updating users.
  • dscout (SCIM) is now available. Learn more.
  • Floqast has a new icon.
  • IBM AS 400 by Aquera has been rebranded as IBM OS/400 on AS/400 (IBM i on Power Systems) by Aquera.
  • Jellyfish (SCIM) has two new default user roles for the roles attribute.

2024.08.2: Update 2 started deployment on August 26

Fixes

  • When two or more OIDC Identity Providers (IdPs) were configured in an org, one of the IdPs' authorization codes could be processed by another IdP. (OKTA-672676)

  • The user icon description on the Sign-In Widget wasn't read by some assistive technologies. (OKTA-684423)

  • A blank warning message appeared when a report was blocked by a browser's pop-up blocker. (OKTA-692566)

  • The Test Delegated Authentication option ran the test flow designed for Classic Engine orgs. (OKTA-714631)

  • In orgs with the Okta account management policy configured for recovery, admins couldn't save the password policy without an authenticator selected. (OKTA-738910)

  • Japanese text wasn't wrapped properly on the Set up Okta Verify page of the Sign-In Widget. (OKTA-745200)

  • Some admins couldn't view the Edit profile and mappings button on the Edit IdP page when the identity provider custom admin role was enabled. (OKTA-747255)

  • App embed links that contained trailing slashes incorrectly redirected to the End-User Dashboard rather than the requested application. (OKTA-753261)

  • Some group admins couldn't use the CSV uploader. (OKTA-756654)

  • SSO IWA appeared on the Downloads page, which is unsupported for Identity Engine orgs. (OKTA-756656)

  • The policy.auth_reevaluate.fail System Log event didn't include a display message. (OKTA-790658)

  • When Authentication Method Reference (AMR) claims were sent as comma-separated values, AMR claims mapping for SAML failed. (OKTA-791512)

  • When the Authentication Method Chain feature was enabled, sometimes the Duo Security Authenticator couldn't be set as a step in the authentication chain. (OKTA-790533)

  • When the Authentication Method Chain feature was enabled with email and password as authenticators, SMS was incorrectly counted as a second factor. (OKTA-792089)

  • The link to the Session Violation Report on the Post auth session page didn't work correctly. (OKTA-793064)

Okta Integration Network

  • Acsense (API service) is now available. Learn more.
  • Backupta (OIDC) is now available. Learn more.
  • Cisco User Management Connector Gov (SCIM) is now available. Learn more.
  • Clutch Security (API service) now has the okta.oauthIntegrations.read scope.
  • Figma (SCIM) is now available. Learn more.
  • Greenhouse Onboarding by Aquera (SCIM) is now available. Learn more.
  • myComply (OIDC) is now available. Learn more.
  • Pendo (SAML) has a new integration guide.
  • Reftab Discovery (API service) now has the okta.logs.read scope.
  • Supernormal (SAML) is now available. Learn more.
  • Syncly, Inc (OIDC) is now available. Learn more.

2024.08.3: Update 3 started deployment on September 3

Generally Available

Sign-In Widget, version 7.21.2

For details about this release, see the Sign-In Widget Release Notes.

For more information about the Widget, see the Okta Sign-In Widget Guide.

Improved event reporting

The IP reputation data is now reported more frequently in System Log events. You can find this information in the DebugData or SecurityContext sections of the event.

Fixes

  • Admins couldn't create routing rules using the Policy API due to a cache issue. (OKTA-712397)

  • Group membership changes in Okta were sometimes incomplete in ServiceNow when Group Push was used. (OKTA-716692)

  • Policies with deny rules weren't considered duplicates and couldn't be merged. (OKTA-728707)

  • Some users that were running Apple macOS Ventura 13.6.7 couldn't authenticate. (OKTA-733975)

  • When the display language was set to Japanese, some text on the Create new resource set page wasn't translated. (OKTA-742653)

  • Okta didn't check whether operating system versions were greater than or equal to a required version. (OKTA-743658)

  • Provisioning of a user from a source to a target org failed in some Org2Org configurations because the user in the target org was still activating. (OKTA-747231)

  • When the Biometrics-only User Verification feature was disabled, activating or deactivating authentication policy rules with the biometrics-only constraint threw an error. (OKTA-755394)

  • When multiple PIV user identities were enabled, active identities with an expired password didn't show up as an option when a user signed in. (OKTA-791790)

  • The Sign-In Widget failed to prompt users with the last-used security method during the authentication flow. (OKTA-792783)

  • Some users couldn't sign in using a password and security question. (OKTA-793352)

  • When a user entered the wrong password to sign in to an org using delegated authentication to LDAP, the login cache was cleared.(OKTA-799642)

Okta Integration Network

  • Adyen by Aquera (SCIM) is now available. Learn more.
  • CloudAcademy (SAML) has a new logo, display name, support for additional endpoints.
  • Command Zero (API service) now has additional scopes.
  • Currents (SCIM) is now available. Learn more.
  • DeleteMe now has SCIM functionality.
  • Experience.com (OIDC) now has additional redirect URIs.
  • TerraTrue (SCIM) now supports group push.
  • Summize (SCIM) now has the openid scope.

Version: 2024.07.0

July 2024

Generally Available

Okta Provisioning agent, version 2.1.0

This release of the Okta Provisioning agent contains vulnerability fixes. See Okta Provisioning agent and SDK version history.

Okta Active Directory agent, version 3.18.0

This release of the Okta Active Directory agent uses OAuth 2.0 for authorization and OAuth 2.0 Demonstrating Proof-of-Possession (DPoP) to securely communicate with Okta. Agents are now registered through the OAuth 2.0 device registration flow and operate independently from the account used to register them. This release also includes security enhancements and bug fixes. See Okta Active Directory agent version history.

Sign-In Widget, version 7.20.0

For details about this release, see the Sign-In Widget Release Notes.

For more information about the Widget, see the Okta Sign-In Widget Guide.

Identity Threat Protection with Okta AI

Identity Threat Protection with Okta AI is a powerful risk assessment and response solution that provides post-authentication security to your org. By continuously analyzing risk signals that are native to Okta, risk signals from integrated security partner vendors, and your policy conditions, it safeguards orgs against identity attacks that occur during and outside of a user's session. When Identity Threat Protection discovers a risk, it can immediately end the user's sessions, prompt an MFA challenge, or invoke a workflow to restore your org's security posture. Using intuitive dashboard widgets and reports, you can easily monitor security threats as they happen. See Identity Threat Protection with Okta AI.

New maximum session lifetime for SAML apps

Users can now configure the maximum app session lifetime for SAML apps.

Customize branding for IdP authenticators

You can now add a custom name and logo to IdP authenticators. End users see this branding when signing in, which allows them to distinguish between different IdP authenticators. See Configure the IdP authenticator.

Improved JIT performance for directory integrations

JIT-enabled directory integrations now have improved response times for JIT requests.

New Manage API tokens admin role permission

The new Manage API tokens permission lets admins view, revoke, and update the principle rate limit for a token. This enhancement lets admins assign more granular permissions and reduce the risk of creating roles with too many privileges.

Enhanced sign-in experience for PIV/CAC

The Sign-in Widget has been updated to provide an improved user experience when signing in with a PIV/CAC card. The new experience allows users to select a different authenticator if the PIV/CAC authentication fails, instead of forcing them to restart the sign-in process. If your org uses default error pages for PIV/CAC sign-in, the new experience is automatically enabled for the org. If your org uses customized error pages for PIV/CAC sign-in, they are preserved. However, you need to contact Support to switch to the new experience.

Protected actions in the Admin Console

The protected actions feature provides an additional layer of security to your org. It prompts admins for authentication when they perform critical tasks in the Admin Console and helps ensure that only authorized admins can perform these tasks. Super admins can configure the authentication interval for their org. See Protected actions in the Admin Console and MFA for protected actions in the Admin Console. This feature will be gradually made available to all orgs.

Active Directory Bidirectional Group Management

Bidirectional Group Management for Active Directory (AD) allows you to manage AD groups from within Okta. You can add or remove users from groups based on their identity and access requirements. This ensures that changes made to user access in Okta are reflected in AD. When you use Okta Access Certifications to revoke a user's membership to an AD group, the removal is reflected in AD. Okta can only manage group memberships for users and groups imported into Okta using the AD integration. It isn't possible to manage users and groups that weren't imported through AD integration. It's also not possible to manage users and groups that are outside the organizational unit's scope for the integration using this feature. See Bidirectional Group Management with Active Directory.

Sign-In Widget account unlock flow

The account unlock flow on the Sign-In Widget now shows the Username field and authenticator selection separately.

MyAccount Management scopes

The MyAccount Management scopes are no longer added to custom authorization servers by default when an authorization server is created.

Enhanced System Log events table

The value of a client IP address, if present, is now shown below the actor in the events table.

Network Zones and API token restrictions

You can no longer update network zones so they're invalid for use with an API token. This applies only to network zones that are used as restrictions to API tokens. You can update network zones if you first remove them from the API token restriction. These zones can't be deactivated, deleted, blocklisted, or made anything other than an active IP zone.

Event hook limit increased

The limit on active event hooks per org has been increased from 10 to 25. See Create an event hook and Workflows System limits.

New System Log events for Workflows subfolder actions

Improved folder organization gives admins the flexibility to drag and drop folders into other folders or move them up to become a top-level folder. See Move a folder into another folder. When this action happens, the new workflows.user.folder.move event type appears in the System Log. See the Event Types API.

Additional System Log event information

The user.account.privilege.grant System Log event now includes information about the assigned role and target, and indicates if it was a group or individual role assignment.

Early Access

Entitlement Management with Okta Provisioning Agent with SCIM 2.0 support

This agent supports Entitlements Management for app integrations that have enabled Governance Engine. This allows the provisioning of entitlements between Okta and on-premises apps.

Certificate-based authentication for Office 365

Okta Identity Engine now supports certificate-based authentication for WS-Fed SSO requests. Users can authenticate using Smart/PIV cards to seamlessly access their Windows devices and Office 365 apps.

Fixes

  • When the Okta Identity Engine Upgrade Hub failed to load an org's upgrade eligibility the maximum number of times, a blank page was displayed to users. (OKTA-670754)

  • System Log events for API token management didn't include the token's network restriction information in the debug context. (OKTA-724469)

  • When editing a user's assignments, roles with numeric values appeared in the wrong position in the Role dropdown menu. Selecting Not mapped set the role to 629. (OKTA-729800)

  • The enrollment instructions on the Google Authenticator page incorrectly mentioned barcode instead of QR code. (OKTA-735775)

  • Errors appeared on a token's page when a network zone that was used by a token was deleted. (OKTA-736539)

  • Push Group jobs that included deleting group memberships failed if their execution time exceed one minute. (OKTA-741405)

  • The Back to Settings button wasn't visible on the End User Settings page. This occurred when managing the user's authenticators if the user completed MFA using a Smart Card or IdP authenticator. (OKTA-743091)

  • The Okta logo was missing from email notifications for protected actions. (OKTA-743776)

  • The Generated Password Health report was incomplete. (OKTA-746008)

  • The number of group members returned from the /api/v1/groups/<group_id>/users API call was inconsistent with the database query count of the same group. (OKTA-747426)

Okta Integration Network

  • Aiven (SCIM) now has sync password support.
  • Lever by Aquera (SCIM) is now available. Learn more.
  • RICOH Smart Integration (SCIM) is now available. Learn more.

Weekly Updates

2024.07.1: Update 1 started deployment on July 22

Generally Available

Sign-In Widget, version 7.20.1

For details about this release, see the Sign-In Widget Release Notes.

For more information about the Widget, see the Okta Sign-In Widget Guide.

New IP service categories added

Additional IP service categories have been added to the enhanced dynamic zones IP service category list. See Supported IP service categories.

Fixes

  • Authenticators that were disabled in the authenticator enrollment policy appeared on the new End-User Settings page. (OKTA-718177)

  • Sessions were sometimes transferred from one user to another. (OKTA-719491)

  • Some users were erroneously prompted to authenticate with Okta Verify on unenrolled devices instead of being redirected to a custom device posture IdP. (OKTA-732676)

  • Some text strings on the General Settings page for custom OIDC apps weren't translated. (OKTA-739262)

  • When an X509 authentication request originated from an Okta domain, but the org used a custom domain, the Smart Card IdP didn't redirect the request correctly. (OKTA-741570)

  • When an admin clicked Show more on the Administrator assignment by role page, additional admins with the super admin role didn't appear. (OKTA-743378)

  • The app store download icons for Okta Verify have been replaced by download links on the Sign-In Widget. (OKTA-744565)

  • When a user tried to access OneDrive from the app on the Okta End-User Dashboard, an error occurred if there was an active Office 365 session. (OKTA-744748)

  • When the display language was set to Japanese, some text on the Deactivate People page wasn't translated. (OKTA-745642)

  • The Okta Agent Registration App icon sometimes appeared on the Authentication policies page beside the current default policy. (OKTA-746639)

  • The Reset Password modal had a grammatical error. (OKTA-747866)

  • If an API request in Preview contained any malformed syntax within the query string, the request was still processed. (OKTA-748246)

  • The EAP-TTLS option wasn't available for all RADIUS app integrations. (OKTA-750253)

Okta Integration Network

  • Call2Action (OIDC) is now available. Learn more.
  • ClickUp (SCIM) is now available. Learn more.
  • Clutch Security (API service) is now available. Learn more.
  • Cortex (SCIM) is now available. Learn more.
  • Exaforce (API service) is now available. Learn more.
  • LiveEdge Cloud (SAML) is now available. Learn more.
  • MangoApps (SAML) now has configurable domain support for endpoints.
  • MangoApps (SCIM) is now available. Learn more.
  • NinjaOne (SCIM) is now available. Learn more.
  • Pendo (SAML) has a new integration guide.
  • SGNL (CAEP Hub) (API service) is now available. Learn more.
  • Teamgo Visitor Sign-in (SAML) is now available. Learn more.
  • UKG Pro by Aquera (SCIM) is now available. Learn more.
  • Vanta (SCIM) is now available. Learn more.
  • Wundergraph Cosmo (SCIM) is now available. Learn more.

2024.07.2: Update 2 started deployment on August 5

Fixes

  • When the display language was set to Japanese, some text on the Delegated Authentication page wasn’t translated. (OKTA-658397)

  • Some users received an error message when they clicked Reveal in the app settings of the Google Workspace Mail tile. (OKTA-684516)

  • The End-User Settings page (version 2) didn't display the correct logo and theme when multiple brands were configured in the org. (OKTA-717476)

  • Some customers signing in to Okta-hosted custom domains with the first or second-generation Sign-In Widget received communications from Monotype Imaging Inc. about licensing for the Proxima Nova font. (OKTA-731216)

  • When the Assign and revoke super admin role protected action was enabled and an admin revoked the super admin role from the Admins tab, they weren’t prompted for additional MFA. (OKTA-733379)

  • Access Testing Tool displayed incorrect data if the Identity Provider in the global session policy rule was set to either Okta or Specific IdP. (OKTA-733455)

  • The Sign-In Widget (third generation) showed Okta instead of the customized company name on the password reset page. (OKTA-737190)

  • Some policies couldn't be merged even though the source policies were identical. (OKTA-740953)

  • If API provisioning was enabled without enabling Update User Attributes, Docusign app usernames were set to the users' full names rather than email addresses. (OKTA-742584)

  • When the display language was set to Japanese, some text on the Sign on tab for the Google Apps instance wasn’t translated. (OKTA-742635)

  • When the display language was set to Japanese, some text on the Create new resource set page wasn’t translated. (OKTA-742653)

  • Some of the help links on the Downloads page weren’t correct. (OKTA-744866)

  • The SAML single logout URL wasn't embedded in the iFrame after the correct trusted origin was configured. (OKTA-744874)

  • When users tried to create SSWS tokens, Enhanced Dynamic Zones appeared in the list but users couldn't select them. (OKTA-745607)

  • The right-click menu didn't work in the Admin Console. (OKTA-745918)

  • Admins couldn't customize the Sign-In Widget (second and third generations) for accessing bookmark apps. (OKTA-747438)

  • Users without the Okta Access Requests Admin app couldn't view any app instance pages. (OKTA-748462)

  • The protected actions email notification sometimes contained a broken link. (OKTA-749232)

  • In orgs using delegated authentication with either AD or LDAP, attempting to sign in when the username contained a wildcard character (*) resulted in an HTTP 500 error. (OKTA-749548)

  • When the device context changed based on signals from Okta Verify, the post auth session evaluation didn't work as expected and didn't fire any System Log events. (OKTA-750405)

  • When the display language was set to Japanese, some text on Policy Simulation wasn’t translated. (OKTA-751021)

  • Users were incorrectly prompted for Okta FastPass when enrolling in Okta Verify. (OKTA-753062)

Okta Integration Network

  • Cisco User Management for Secure Access (SCIM) is now called Cisco User Management Connector.
  • Clockwise (SCIM) now has Bookmark mode.
  • CoderPad has new SAML and SCIM integration guides, and the SWA app was updated.
  • Databricks has a new icon.
  • Exaforce (API service) has updated scopes.
  • getregistered (SAML) is now available. Learn more.
  • Nulab Pass (Backlog Cacoo Typetalk) (SCIM) is now available. Learn more.
  • Opensurvey Dataspace (OIDC) now supports IdP-initiated SSO.
  • Pleo (SCIM) is now available. Learn more.
  • Prowler (SAML) has a new icon.
  • Retail Zipline (SAML) now supports Single Logout (SLO) and has a new integration guide and icon.
  • Staircase AI (SCIM) is now available. Learn more.
  • WebWork Time Tracker (SCIM) is now available. Learn more.
  • Wiz (API service) is now available. Learn more.
  • Zip has an updated API.

Version: 2024.06.0

June 2024

Generally Available

Sign-In Widget, version 7.19.2

For details about this release, see the Sign-In Widget Release Notes.

For more information about the Widget, see the Okta Sign-In Widget Guide.

Deprecated user profile attributes for Office 365

The following user profile attributes are no longer supported for Office 365:

  • AuthOrig
  • DLMemRejectPerms
  • DLMemSubmitPerms
  • IsTrackingChanges
  • UnauthOrig

See Supported user profile attributes for Office 365 provisioning.

Breached password protection

Protect your organization from the impact of passwords that have been compromised. If Okta determines that an Okta username and password combination has been compromised based on the data collected by our internal threat intelligence pipeline, Okta records a System Log event, expires the user's credentials, and requires the user to update their password before they can use their password to sign in again. See Breached password protection.

Rate limit update for using Okta fallback telephony provider

Orgs that use an active telephony inline hook now have a heavy rate limit for the Okta fallback mechanism.

Federation Broker Mode has been removed from OAuth Service Clients

The Federation Broker Mode option has been removed from OAuth Service Clients.

DPoP available when creating OIDC apps

You can now require the Demonstrating Proof of Possession (DPoP) condition when you create an OIDC app. Previously, this option was only available after you create the app. This streamlines the process of creating and securing OIDC apps.

Increase to Inline Hooks

The maximum number of inline hooks an org can create is now 100. The previous maximum was 50. See Add an inline hook .

Support for migration to Microsoft Graph

You can now migrate your existing Office 365 WS-Fed Manual app instances to Microsoft Graph by using the migration banner on the app dashboard.

New System Log Event

The user.authentication.universal_logout.scheduled System Log event is fired when an admin manually triggers Universal Logout against an app instance. It contains information about where and how Universal Logout was fired. This event is only fired once.

Event hook for session context changes

The user.session.context.change System Log event is now available for use in an event hook. See Event hooks.

Early Access

Enhanced dynamic zones

Use enhanced dynamic network zones to define IP service categories (proxies, VPNs), locations, and Autonomous System Numbers (ASNs) that are allowed or blocked in a zone. See Enhanced dynamic zones.

Same-device enrollment for Okta FastPass

On orgs with Okta FastPass, the Okta Verify enrollment process has been streamlined:

  • Users can initiate and complete enrollment on the device they're currently using. Previously, two different devices were required to set up an account.

  • Users no longer need to enter their org URL during enrollment.

  • The enrollment flow has fewer steps.

This feature is supported on Android, iOS, and macOS devices. To enable it, go to Admin Console Settings and turn on Same-Device Enrollment for Okta FastPass.

Access request conditions and resource catalog

This feature provides a new method to streamline your access requests for apps, entitlements, and groups from the app's profile page in the Admin Console.

As super admins and access request admins, you can set up app-specific access request conditions that define requester scope, access level, expiration for the access level, and the approval sequence. Based on your active conditions, requesters can request access to an app or app access level directly from their End-User Dashboard.

Compared to request types, this approach allows you to reuse existing relationships between users, groups, and apps defined in Okta to govern access instead of recreating these in Okta Access Requests. This feature also integrates the app catalog in the End-User Dashboard with Access Requests to make the process of requesting access intuitive and user-friendly. See Access Requests and Create requests.

You can also view and edit a user's access duration for the app if the app has Governance Engine enabled. See Manage user entitlements.

Continuous Access is now Post Auth Session

The Continuous Access tab in Authentication Policies is renamed to Post Auth Session.

Continuous Access widget is now Post auth session violations widget

The Continuous Access widget in the Identity Threat Protection dashboard is renamed to the Post Auth Session Violations widget.

  • Continuous access violations are renamed to Session violations.
  • Continuous access evaluation is renamed to Post auth session evaluation.

Fixes

  • The list of languages in Customizations SMS wasn't translated. (OKTA-626381)

  • When an admin attempted to create a profile with a username that contained invalid characters, an unhelpful error message appeared in orgs using a custom character restriction for usernames. (OKTA-680557)

  • Users could bypass admin approval from the import screen to sign in to Okta when Active Directory Just-In-Time provisioning was disabled. (OKTA-706392)

  • The Disable Force Authentication option was ignored for org2org apps using the SAML sign-in mode and AMR claims mapping. (OKTA-711957)

  • The Country Code attribute was missing from the profile enrollment form when admins deleted a similar attribute from a SAML Identity Provider. (OKTA-712657)

  • Some policy evaluations in Identity Threat Protection weren't processed correctly. (OKTA-713378)

  • Some Sign-In Widget error messages weren't localized. (OKTA-721035)

  • For some orgs, the last used factor was still prompted when a user clicked Verify with something else. (OKTA-726023)

  • Active Directory incremental imports were converted to full imports when a new OrganizationUnit was added or an existing OrganizationUnit was renamed. (OKTA-729735)

  • The user.risk.change System Log event displayed incorrect actor values. (OKTA-731725)

  • New Dropbox Business instances were missing a profile attribute. (OKTA-733503)

  • The Provisioning tab wasn't saved when admins created Office 365 applications, and Japanese translations of the Session Lifetime for SAML apps feature didn't appear. (OKTA-735840)

  • Versions 7.18.1 to 7.19.1 of the Sign-In Widget weren't rendered when users accessed them from legacy browsers. (OKTA-736546)

Okta Integration Network

  • candidate.fyi (OIDC) is now available. Learn more.
  • Edify (OIDC) now has sign-in URLs.
  • KiteSuite (SAML) is now available. Learn more.
  • ParkZapp (W) (OIDC) is now available. Learn more.
  • ShareThis (SWA) was updated. (OKTA-723868)
  • Umbrella Faces (SCIM) is now available. Learn more.

Weekly Updates

2024.06.1: Update 1 started deployment on June 24

Generally Available

Sign-In Widget, version 7.19.4

For details about this release, see the Sign-In Widget Release Notes.

For more information about the Widget, see the Okta Sign-In Widget Guide.

Fixes

  • Some text on the Reset Password for a user page in the Admin Console wasn't translated. (OKTA-613937)

  • WebEx replaced the API used to retrieve session types with a REST API, which requires the integration to use OAuth for authentication. (OKTA-701227)

  • The policy.entity_risk.evaluate and policy.entity_risk.action events incorrectly displayed the target user as the actor instead of the Okta system. (OKTA-703424)

  • The user.authentication.universal_logout System Log event didn't capture all of the client data. (OKTA-706046)

  • Previews of customized sign-in pages didn't show all registration details. (OKTA-712636)

  • Some locked users couldn't unlock their accounts because they hadn't validated their email addresses. (OKTA-717710)

  • Clicking Sync Entitlements on the Governance tab displayed an error. (OKTA-720049)

  • Sometimes, concurrent Agentless Desktop SSO JIT operations for a user broke app assignments, which required admin intervention to correct. (OKTA-722648)

  • The System Log reported incorrect OS values for the same request. (OKTA-724428)

  • When admins manually confirmed users imported from a SCIM app, they were assigned apps that they weren't authorized to access. (OKTA-724859)

  • The System Log event description for security.events.provider.receive_event was Third Party Vendor reported risk and was updated to Security Events Provider Reported Risk. (OKTA-725427)

  • Opening a profile in a new tab from the Profile Editor displayed a list of profiles instead. (OKTA-725640)

  • A System Log event wasn't present for provisioned users when the password-only sign-in flow failed. (OKTA-727271)

  • The System Log recorded multiple user.session.context.change events when the device management status was incorrectly reported for Windows devices enrolled in Okta Verify. (OKTA-727309)

  • Sometimes, when users who hadn't enrolled in On-Prem MFA attempted to sign in using an RSA SecurID passcode in the New PIN Mode, the passcode verification failed. (OKTA-727554)

  • Some requests failed because the session cookie size exceeded browser limitations. (OKTA-727786)

  • Processing GeneralizedTime attributes while confirming new users imported from LDAP to Okta resulted in an error. (OKTA-728398)

  • Users could reuse their temporary password. (OKTA-729189)

  • The Sign-In Widget was blank when some Okta FastPass users were prompted to authenticate. (OKTA-730317)

  • When the display language was set to Japanese, some role permissions weren't translated on the Admin role assignments screen. (OKTA-730832)

  • When the display language was set to Japanese, some text on the Administrators pages wasn't translated. (OKTA-730834)

  • Some customers signing in to Okta-hosted custom domains with the first or second-generation Sign-In Widget received communications from Monotype Imaging Inc. about licensing for the Proxima Nova font. (OKTA-731216)

  • When an admin clicked Show more on the Administrator assignment by role page, additional admins with the super admin role didn't appear. (OKTA-731416)

  • Some Group Push operations for ServiceNow failed due to timing out. (OKTA-731707)

  • The UI header elements on the Authentication Policy page didn't render correctly. (OKTA-732300)

  • App filter in the Post Auth Session tab is removed for future configurations. This doesn't affect existing configurations. (OKTA-732394)

  • Workday writeback operations failed when area codes were included in the request. (OKTA-733361)

  • Authenticator names weren't translated in error messages. (OKTA-733417)

  • The End User Browser Plugins pane on the Downloads page used an outdated icon for Chromium Edge. (OKTA-733813)

  • Universal Logout didn't sign users out of Google Workspace for some app instances. (OKTA-734303)

  • Entity Risk Policy in the Admin Console didn't have a description. (OKTA-734527)

  • Some attributes weren't translated in the Profile Enrollment form. (OKTA-734938)

  • The policy.auth_reevaluate.fail System Log event wasn't recorded for customers who enabled Identity Threat Protection. (OKTA-735556)

  • The security.breached_credential.detected System Log event had a typo. (OKTA-736552)

  • Some users saw an error page after setting up their Okta account. (OKTA-737149)

  • The Okta RADIUS Server Agent was updated for a security fix. Upgrade to version 2.22.0. (OKTA-737441)

  • Widgets on the Identity Threat Protection dashboard are updated for style and design consistency. (OKTA-737798)

  • Sometimes, Group Assignments involving the Everyone group failed because of a non-performant query. (OKTA-742083)

  • Full imports for OIG-enabled apps sometimes caused users to be unexpectedly deprovisioned. (OKTA-742996)

Okta Integration Network

  • Accend (OIDC) has a new icon and description.
  • Actioner (OIDC) is now available. Learn more.
  • Aerofiler (SAML) is now available. Learn more.
  • Aerofiler (OIDC) has a new icon and OIDC endpoints.
  • Aiven (SAML) is now available. Learn more.
  • Aiven (SCIM) is now available. Learn more.
  • Amazon WorkDocs by Aquera (SCIM) has a new icon.
  • Amazon WorkMail by Aquera (SCIM) has a new icon.
  • Autotab (OIDC) is now available. Learn more.
  • Bright Breaks (SCIM) is now available. Learn more.
  • Brivo Identity Management (SCIM) has a new display name, base URL, integration guide, app profile, and mappings.
  • Codefresh by Aquera (SCIM) has a new icon.
  • Cyolo SRA (SAML) is now available. Learn more.
  • Descope (OIDC) is now available. Learn more.
  • Descope (SCIM) is now available. Learn more.
  • Detexian SSPM (API service) is now available. Learn more.
  • Docker (SAML) is now available. Learn more.
  • DOTS (SAML) is now available. Learn more.
  • Elastic Agent (API service) is now available. Learn more.
  • Favro (SCIM) is now available. Learn more.
  • Floqast (SAML) is now available. Learn more.
  • GitHub Enterprise Managed User - ghe.com (SAML) is now available. Learn more.
  • GitHub Enterprise Managed User - ghe.com (SCIM) is now available. Learn more.
  • goFLUENT (SAML) is now available. Learn more.
  • JazzHR by Aquera (SCIM) supports profile sourcing.
  • Lark (SCIM) is now available. Learn more.
  • Lattice HRIS (SCIM) is now available. Learn more.
  • Manopay (OIDC) has a new integration guide and supports IdP-initiated flows.
  • Obsidian Security (API service) is now available. Learn more.
  • PerimeterX (SCIM) is now available. Learn more.
  • Plumm (SCIM) has a new integration guide.
  • ProdPad by Aquera (SCIM) has a new icon and support URL.
  • Prowler (SAML) is now available. Learn more.
  • Rezonate Security (API service) can now read network zones data.
  • Scrut Automation (OIDC) is now available. Learn more.
  • Select Admin (OIDC) is now available. Learn more.
  • ShareCal (SAML) has a new ACS URL.
  • SmarterSends (SAML) is now available. Learn more.
  • SwaggerHub by Aquera (SCIM) has a new icon and support URL.
  • TriNet by Aquera (SCIM) supports profile sourcing.
  • Trotto Go Links (SAML) has a new icon and integration guide.
  • UKG HR Service Delivery by Aquera (SCIM) has a new icon.
  • WebWork Time Tracker (SAML) is now available. Learn more.
  • WonderProxy (SAML) is now available. Learn more.
  • Workable Recruiting by Aquera (SCIM) supports profile sourcing and has a new icon, description, and support URL.
  • Wundergraph Cosmo (SCIM) is now available. Learn more.
  • Xakia (SCIM) has a new icon and supports group push.
  • Xero by Aquera (SCIM) has a new icon and support URL.

2024.06.2: Update 2 started deployment on July 8

Generally Available

Sign-In Widget, version 7.19.6

For details about this release, see the Sign-In Widget Release Notes.

For more information about the Widget, see the Okta Sign-In Widget Guide.

Update to Universal Directory attribute limits

Universal Directory has increased the limit of the number of attributes per org.

Fixes

  • The help links on the Downloads page weren't localized. (OKTA-614688)

  • Admins without the View agents permission could see the Agents page. (OKTA-651508)

  • Setting the locale to Japanese resulted in some issues when working with CSV directories. An error string appeared when scheduling weekly imports and there was insufficient space to enter which hour the import should be performed. (OKTA-656418)

  • Group Push failed for Samanage when group names contained spaces. (OKTA-668498)

  • Password reset token expiration time was not localized for some orgs. (OKTA-673386)

  • When the activation email was resent, it included an expired activation link. (OKTA-720605)

  • The notification email contained the modified IP address when X-Forwarded-For Header was modified. (OKTA-722815)

  • Some users received an error message when they tried to reset their password. (OKTA-725716)

  • The oauth2/instrospect endpoint hit rate limits without logging it in the System Log. (OKTA-726680)

  • Users who didn't enable the Multiple Identifiers feature could access the Identifiers page. (OKTA-727848)

  • During JIT reactivation through IdP, group app assignment reconciliation wasn't processed asynchronously, which caused an unexpected delay in the sign-in process. (OKTA-729103)

  • Access Testing Tool incorrectly reported that non-admin users had access to Okta Admin Console. (OKTA-729726)

  • Attempting to unassign a Google Workspace license from a user who didn't have that license resulted in an error message. (OKTA-731570)

  • A SAML app didn't open in an iFrame even when it was configured using Trusted Origins. (OKTA-734026)

  • If there was an error in the metrics for policy recommendation for an application, the recommendations didn't load properly. (OKTA-735657)

  • When an app was created by an API call with an existing clientId in the request payload, this didn't match the way an app was created in the UI. This resulted in the wrong app rate limit displayed in the rate limit dashboard. (OKTA-736117)

  • When an admin uploaded a file while configuring an app, the dates that appeared on the page weren't translated. (OKTA-736916)

  • The Okta provisioning API didn't accept user IDs that contained a backslash (\) character when users were provisioned to Org2Org instances. (OKTA-737258)

  • Admins couldn't delete existing Classic Engine Network Zones after upgrading to Identity Engine. (OKTA-737821)

  • NetSuite imports failed for new app instances that had Governance Engine enabled if users had an inactive department, location, or class. (OKTA-737844)

  • Unhandled routes for authentication policies rendered a blank page in the Admin Console. (OKTA-738033)

  • Sometimes a group owner wasn't resolved correctly and an invalid error was displayed on the Group Owner tab for the group. (OKTA-738426)

  • Some users received a Bad Gateway error when they tried to register their account. (OKTA-738828)

  • Gemini licenses for Google Workspace were unavailable. (OKTA-739005)

  • The Show More option in Trusted Origins didn't display all trusted origins when a filter was selected. (OKTA-740734)

  • The wrong font was used for text in the Sign-In Widget. (OKTA-742100)

  • The Post Auth Session Violation widget displayed incorrect UI and data when the policy was in the monitoring mode. (OKTA-742525)

  • When running an import from Active Directory into Okta, the DirSync stopped working, which resulted in users being removed from multiple groups within the Office 365 app. (OKTA-742905)

  • Full imports for OIG-enabled apps sometimes caused users to be unexpectedly deprovisioned. (OKTA-742996)

  • When trying to access OneDrive using the app on the Okta Dashboard, an error occurred if there was an active Office 365 session. (OKTA-744748)

  • In Groups API queries, some users who weren't in the "Everyone" group were missing group memberships.(OKTA-747426)

Okta Integration Network

  • Authomize Identity Security (API service) has a new icon, display name, description, website, integration guide, and okta.policies.read scope.
  • Cisco Identity Intelligence - Read-Write Management (API service) is now available. Learn more.
  • Feishu (SCIM) is now available. Learn more.
  • Forethought Dashboard (SCIM) is now available. Learn more.
  • Funnel.io (SAML) has a new icon and integration guide.
  • Klue (SAML) is now available. Learn more.
  • Klue (SCIM) is now available. Learn more.
  • KSOC (OIDC) is now available. Learn more.
  • Medicat One (OIDC) is now available. Learn more.
  • Okta Identity Security Posture Management (API service) is now available. Learn more.
  • Own (SAML) is now available. Learn more.
  • Rewind Backups (API service) is now available. Learn more.
  • Seculio (SAML) is now available. Learn more.
  • Thoropass (SAML) is now available. Learn more.
  • TriNet Zenefits by Aquera (SCIM) is now available. Learn more.
  • WINN.AI (OIDC) is now available. Learn more.
  • Workshop (SAML) is now available. Learn more.
  • Zip (SCIM) now has the approvalLevel attribute.