Okta Identity Engine release notes (Production)

Okta Active Directory Password Sync agent, version 1.6.0

This version of the agent includes security enhancements.

Sign-In Widget, version 7.23.0

Okta LDAP Agent automatic update support

Admins can now initiate or schedule automatic updates to Okta LDAP agents from the Admin Console. With agent auto-update functionality, admins no longer need to manually uninstall and then reinstall Okta LDAP agents when a new agent version is released. Agent auto-updates keep your agents up to date and compliant with the Okta support policy, and help ensure your org has the latest Okta features and functionality. Single or multiple agents can be updated on demand, or updates can be scheduled to occur outside of business hours to reduce downtime and disruption to users. See Automatically update Okta LDAP agents.

Trusted App filters

Trusted App filters allow orgs to block applications from invoking Okta FastPass in Windows, and in Google Chrome and Firefox browsers for macOS. See Trusted app filters .

Admin Console Japanese translation

When this feature is enabled, all admin users in the org who use Japanese as their display language will see the Admin Console in Japanese. See Supported display languages.

System Log event updates

In the System Log, the user.risk.detect event now appears instead of the user.risk.change event when Okta detects an entity that's associated with a risk level.

Continuous Access has been renamed to Post auth session. As a part of the change, the following System Log events have been renamed as well:

• policy.continuous_access.evaluate has been renamed to policy.auth_reevaluate.enforce
• policy.continuous_access.action has been renamed to policy.auth_reevaluate.action

See System Log events for Identity Threat Protection.

Deprecating App Password Health report

The App Password Health report has been deprecated. Use the Sign On Mode filter in the User App Access report to view SWA application password reset dates. The capability to ask users to reset SWA passwords has been removed.

Deprecating Recent Unassignments report

The Recent Unassignments report has been deprecated.

• Use the System Log event application.user_membership.remove to identify users who have been unassigned from an application. See Recently unassigned users.
• Use the User App Access report to identify users currently assigned to applications. See User App Access report.

Updates to App Usage report

The Application Usage report has been updated.

• The maximum number of rows in a CSV is increased to five million.
• The date range field uses the user's local time zone when determining results.
• The report downloads automatically when possible.

Improved JIT performance for directory integrations

JIT-enabled directory integrations now have improved response times for JIT requests.

Require MFA for Admin Console access

You can require multifactor authentication to access the Okta Admin Console. When you enable this feature, all Admin Console authentication policy rules that allow single factor access are updated to require multifactor authentication. See Enable MFA for the Admin Console. This feature will be gradually made available to all orgs.

Okta Personal for Workforce

Okta Personal for Workforce is a set of features that allows admins to separate their users' work data from non-work data. Admins can now offer their end users a free Okta Personal account to store personal data, allow them to switch between accounts, and migrate personal apps from an Okta enterprise tenant to Okta Personal. When Okta Personal for Workforce is enabled, personalized communications are sent to the end users encouraging them to use Okta Personal for personal data and Okta enterprise for work data. See Okta Personal for Workforce.

IP session restrictions for Okta Workflows

Okta super admins can now enable IP session restrictions for Okta Workflows. This feature ensures that all Workflows requests in a session use the same IP address that was logged when the session was created. If the IP address doesn't match any request, the session is terminated and the Workflows admin must sign in again.

Improved security for Microsoft Office 365

Microsoft Office 365 provisioning now eliminates the need for admin credentials by using a secure and modern OAuth-based authentication flow. This update will be gradually made available to all orgs.

Partial Universal Logout indicator in the OIN

The OIN catalog now indicates which apps support partial Universal Logout.

Changes to role permissions that handle API tokens

The following changes have been made to the permissions that handle API tokens:

• The View users and their details permission now includes the View API tokens permission.
• The Edit users' lifecycle states, Suspend users, and Clear users' sessions permissions now include the Manage API tokens permission.
• To view or manage tokens, use the Manage API tokens permission.

See Role permissions.

OIN connector support for Entitlement Management

The Dropbox Business, ServiceNow, SmartRecruiters, and Tableau connectors have been updated to support Entitlement Management. See Provisioning-enabled apps

New System Log events for Device Assurance Policy

New System Log events are generated when a device assurance policy is created, updated, or deleted:

• device.assurance.policy.add
• device.assurance.policy.update
• device.assurance.policy.delete

New System Log events for flow and table changes

The workflows.user.flow.move and workflows.user.table.move Okta Workflows events have been added to the System Log to record the changes that occur due to reorganization of folder-level resources.

New System Log entries for sign-in events

The user.authentication.auth_via_IDP System Log event has been created. This event records occurrences of unknown users attempting to sign in through an Identity Provider.

System Log event update

The user.authentication.auth_unconfigured_identifier System Log event now appears when a user signs in without an admin-configured identifier.

Support for migrating Office 365 apps to Microsoft Graph

You can now migrate your Office 365 Single Sign-On app (WS-Fed Auto) instances to a secure OAuth-based consent flow using Microsoft Graph. See Configure Single Sign-On for Office 365.

Improved API documentation

Our API documentation has a new look and feel! API content in the References section of the Developer Documentation website will be moved after September 30, 2024.

Sign-In Widget, version 7.21.0

Detect and block requests from anonymizing proxies

Orgs can now detect and block web requests that come from anonymizers. This helps improve the overall security of your org. See Enhanced dynamic zones.

New View client credentials admin role permission

The new View client credentials permission lets admins view OAuth client secrets. The View applications and their details permission no longer includes this privilege. This enhancement lets admins assign more granular permissions and reduce the risk of creating roles with too many privileges. This feature will be gradually made available to all orgs.

Network zone allowlists for SSWS API tokens

Admins can now specify a network zone allowlist for each static (SSWS) API token. These allowlists define the IP addresses or network ranges from where Okta API requests using SSWS API tokens can be made. This restricts attackers and malware from stealing SSWS tokens and replaying them outside of the specified IP range to gain unauthorized access.

ADSSO authentication parameters

When a state token is used, Okta removes the fromURI parameter from the ADSSO authentication POST request.

View System Logs for Office 365 authentication events

You can now view authentication events in the System Log when using WS-Fed to authenticate through Office 365 active (WS-Trust-1.2) and username13 (WS-Trust-1.3) endpoints.

Updates to the Suspicious Activity report

The Suspicious Activity report has been updated to a System Log report. Use the System Log query to search and filter for unusual activities in your org. The query allows you to filter events with more precision and provides more information about each event than what the previous report provided. This information can help you better determine the validity of user actions. See Suspicious activity events.

Updates to Deprovisioning Details report

The Deprovision Details report has been updated to a System Log report. Use the System Log query to search and filter for deprovisioned users with more context and precision than the previous report. See Deprovision Details report.

Deprecating Current Assignments report

The Current Assignment report has been deprecated. Use the User App Access report to identify users currently assigned to applications. See User App Access report. Use the System Log event application.user_membership.remove to identify users who have been unassigned from an application. See Recently unassigned users.

Prevent new single-factor access to the Admin Console

This feature prevents admins from configuring any new single-factor access to the Admin Console. This feature will be gradually made available to all orgs.

System Log enhancement

Certain system log events now contain a new property called changeDetails in the target. When this property is populated, it reflects new, changed, or removed attributes of the target resource that has been modified. See changeDetails property.

System Log event updates

The following System Log events are now available:

• application.provision.group_push.deactivate_mapping
• system.agent.register
• security.attack_protection.settings.update
• device.platform.secret_key.reset
• system.self_service.configuration.update
• user.behavior.profile.reset
• security.events.transmitter.create
• security.events.transmitter.update
• security.events.transmitter.delete
• security.events.provider.create
• security.events.provider.update
• security.events.provider.activate
• security.events.provider.deactivate
• security.events.provider.delete
• system.identity_sources.bulk_upsert
• system.identity_sources.bulk_delete
• system.import.schedule
• system.import.user_match.confirm
• system.import.user_match.unignore
• system.import.user_match.update
• The application.lifecycle.update event now has the sessionIdleTimeoutMinutes and sessionMaxLifetimeMinutes fields. These fields add more session details to the event.

See Event types.

System Log event updates for Universal Directory

The following System Log events are now available:

• Linked object created
• Linked object deleted
• User profile updated
• Group owner updated
• Group owner removed

Identity Provider external names

Okta now warns admins if an Identity Provider (IdP) with custom attributes has an empty externalName field. Admins must now update the custom attribute through the API or delete it from the Admin Console and re-add it with the externalName field defined. This ensures that Okta receives the custom attribute when users enroll through Just-In Time provisioning scenarios.

Request throttling for jwks_uri

Okta has decreased the frequency at which it reloads JWKs from a customer's jwks_uri.

Rate limit for telephony inline hook

Okta now enforces by default a rate limit for the telephony inline hook to protect your org from toll-fraud attacks. See Connect to an external telephony service provider.

Universal Logout supported apps

The Surf browser now supports Universal Logout. This enables admins to automatically sign users out of this app when Universal Logout is triggered.

Authorization server default access policy deprecation

The authorization server default access policy is no longer provided in child orgs that are generated from APIs. Users can click Add New Access Policy to add policies. See Create access policies.