Okta Identity Engine release notes (Production)

Version: 2024.07.0

July 2024

Generally Available

Okta Provisioning agent, version 2.1.0

This release of the Okta Provisioning agent contains vulnerability fixes. See Okta Provisioning agent and SDK version history.

Okta Active Directory agent, version 3.18.0

This release of the Okta Active Directory agent uses OAuth 2.0 for authorization and OAuth 2.0 Demonstrating Proof-of-Possession (DPoP) to securely communicate with Okta. Agents are now registered through the OAuth 2.0 device registration flow and operate independently from the account used to register them. This release also includes security enhancements and bug fixes. See Okta Active Directory agent version history.

Sign-In Widget, version 7.20.0

For details about this release, see the Sign-In Widget Release Notes.

For more information about the Widget, see the Okta Sign-In Widget Guide.

Identity Threat Protection with Okta AI

Identity Threat Protection with Okta AI is a powerful risk assessment and response solution that provides post-authentication security to your org. By continuously analyzing risk signals that are native to Okta, risk signals from integrated security partner vendors, and your policy conditions, it safeguards orgs against identity attacks that occur during and outside of a user’s session. When Identity Threat Protection discovers a risk, it can immediately end the user’s sessions, prompt an MFA challenge, or invoke a workflow to restore your org’s security posture. Using intuitive dashboard widgets and reports, you can easily monitor security threats as they happen. See Identity Threat Protection with Okta AI.

New maximum session lifetime for SAML apps

Users can now configure the maximum app session lifetime for SAML apps.

Customize branding for IdP authenticators

You can now add a custom name and logo to IdP authenticators. End users see this branding when signing in, which allows them to distinguish between different IdP authenticators. See Configure the IdP authenticator.

Improved JIT performance for directory integrations

JIT-enabled directory integrations now have improved response times for JIT requests.

New Manage API tokens admin role permission

The new Manage API tokens permission lets admins view, revoke, and update the principle rate limit for a token. This enhancement lets admins assign more granular permissions and reduce the risk of creating roles with too many privileges.

Enhanced sign-in experience for PIV/CAC

The Sign-in Widget has been updated to provide an improved user experience when signing in with a PIV/CAC card. The new experience allows users to select a different authenticator if the PIV/CAC authentication fails, instead of forcing them to restart the sign-in process. If your org uses default error pages for PIV/CAC sign-in, the new experience is automatically enabled for the org. If your org uses customized error pages for PIV/CAC sign-in, they are preserved. However, you need to contact Support to switch to the new experience.

Protected actions in the Admin Console

The protected actions feature provides an additional layer of security to your org. It prompts admins for authentication when they perform critical tasks in the Admin Console and helps ensure that only authorized admins can perform these tasks. Super admins can configure the authentication interval for their org. See Protected actions in the Admin Console and MFA for protected actions in the Admin Console. This feature will be gradually made available to all orgs.

Sign-In Widget account unlock flow

The account unlock flow on the Sign-In Widget now shows the Username field and authenticator selection separately.

MyAccount Management scopes

The MyAccount Management scopes are no longer added to custom authorization servers by default when an authorization server is created.

Enhanced System Log events table

The value of a client IP address, if present, is now shown below the actor in the events table.

Network Zones and API token restrictions

You can no longer update network zones so they're invalid for use with an API token. This applies only to network zones that are used as restrictions to API tokens. You can update network zones if you first remove them from the API token restriction. These zones can't be deactivated, deleted, blocklisted, or made anything other than an active IP zone.

Event hook limit increased

The limit on active event hooks per org has been increased from 10 to 25. See Create an event hook and Workflows System limits.

New System Log events for Workflows subfolder actions

Improved folder organization gives admins the flexibility to drag and drop folders into other folders or move them up to become a top-level folder. See Move a folder into another folder. When this action happens, the new workflows.user.folder.move event type appears in the System Log. See the Event Types API.

Additional System Log event information

The user.account.privilege.grant System Log event now includes information about the assigned role and target, and indicates if it was a group or individual role assignment.

Early Access

Entitlement Management with Okta Provisioning Agent with SCIM 2.0 support

This agent supports Entitlements Management for app integrations that have enabled Governance Engine. This allows the provisioning of entitlements between Okta and on-premises apps.

Certificate-based authentication for Office 365

Okta Identity Engine now supports certificate-based authentication for WS-Fed SSO requests. Users can authenticate using Smart/PIV cards to seamlessly access their Windows devices and Office 365 apps.

Fixes

  • When the Okta Identity Engine Upgrade Hub failed to load an org’s upgrade eligibility the maximum number of times, a blank page was displayed to users. (OKTA-670754)

  • System Log events for API token management didn't include the token's network restriction information in the debug context. (OKTA-724469)

  • When editing a user's assignments, roles with numeric values appeared in the wrong position in the Role dropdown menu. Selecting Not mapped set the role to 629. (OKTA-729800)

  • The enrollment instructions on the Google Authenticator page incorrectly mentioned barcode instead of QR code. (OKTA-735775)

  • Errors appeared on a token's page when a network zone that was used by a token was deleted. (OKTA-736539)

  • Push Group jobs that included deleting group memberships failed if their execution time exceed one minute. (OKTA-741405)

  • The Back to Settings button wasn't visible on the End User Settings page. This occurred when managing the user's authenticators if the user completed MFA using a Smart Card or IdP authenticator. (OKTA-743091)

  • The Okta logo was missing from email notifications for protected actions. (OKTA-743776)

  • The Generated Password Health report was incomplete. (OKTA-746008)

  • The number of group members returned from the /api/v1/groups/<group_id>/users API call was inconsistent with the database query count of the same group. (OKTA-747426)

Okta Integration Network

  • Aiven (SCIM) now has sync password support.
  • Lever by Aquera (SCIM) is now available. Learn more.
  • RICOH Smart Integration (SCIM) is now available. Learn more.

Weekly Updates

2024.07.1: Update 1 started deployment on July 22

Generally Available

Sign-In Widget, version 7.20.1

For details about this release, see the Sign-In Widget Release Notes.

For more information about the Widget, see the Okta Sign-In Widget Guide.

New IP service categories added

Additional IP service categories have been added to the enhanced dynamic zones IP service category list. See Supported IP service categories.

Early Access

YubiKey preregistration

Customer admins were previously unable to enroll and ship YubiKeys as WebAuthn enrollments in a quick and automated way. The YubiKey preregistration feature enables admins to preregister YubiKey factors as WebAuthn enrollments for both staged and existing (active) users using a Workflows and Yubico integration to seamlessly handle the registration and shipment. See Require phishing-resistant authentication with pre-enrolled YubiKey.

Require MFA for accessing Identity Governance admin apps

If your org uses Okta Identity Governance, you can require MFA for admins who access these first-party apps:

  • Okta Access Certifications
  • Okta Entitlement Management
  • Okta Access Requests Admin

If you have auto-enabled Early Access features in your org, MFA is automatically enforced for those apps. See Enable MFA for the Admin Console.

Fixes

  • Authenticators that were disabled in the authenticator enrollment policy appeared on the new End-User Settings page. (OKTA-718177)

  • Some users were erroneously prompted to authenticate with Okta Verify on unenrolled devices instead of being redirected to a custom device posture IdP. (OKTA-732676)

  • Some text strings on the General Settings page for custom OIDC apps weren't translated. (OKTA-739262)

  • When an X509 authentication request originated from an Okta domain, but the org used a custom domain, the Smart Card IdP didn't redirect the request correctly. (OKTA-741570)

  • When an admin clicked Show more on the Administrator assignment by role page, additional admins with the super admin role didn’t appear. (OKTA-743378)

  • The app store download icons for Okta Verify have been replaced by download links on the Sign-In Widget. (OKTA-744565)

  • When a user tried to access OneDrive from the app on the Okta End-User Dashboard, an error occurred if there was an active Office 365 session. (OKTA-744748)

  • When the display language was set to Japanese, some text on the Deactivate People page wasn’t translated. (OKTA-745642)

  • The Okta Agent Registration App icon sometimes appeared on the Authentication policies page beside the current default policy. (OKTA-746639)

  • The Reset Password modal had a grammatical error. (OKTA-747866)

  • If an API request in Preview contained any malformed syntax within the query string, the request was still processed. (OKTA-748246)

Okta Integration Network

  • Call2Action (OIDC) is now available. Learn more.
  • ClickUp (SCIM) is now available. Learn more.
  • Clutch Security (API service) is now available. Learn more.
  • Cortex (SCIM) is now available. Learn more.
  • Exaforce (API service) is now available. Learn more.
  • LiveEdge Cloud (SAML) is now available. Learn more.
  • MangoApps (SAML) now has configurable domain support for endpoints.
  • MangoApps (SCIM) is now available. Learn more.
  • NinjaOne (SCIM) is now available. Learn more.
  • Pendo (SAML) has a new integration guide.
  • SGNL (CAEP Hub) (API service) is now available. Learn more.
  • Teamgo Visitor Sign-in (SAML) is now available. Learn more.
  • UKG Pro by Aquera (SCIM) is now available. Learn more.
  • Vanta (SCIM) is now available. Learn more.
  • Wundergraph Cosmo (SCIM) is now available. Learn more.

Version: 2024.06.0

June 2024

Generally Available

Sign-In Widget, version 7.19.2

For details about this release, see the Sign-In Widget Release Notes.

For more information about the Widget, see the Okta Sign-In Widget Guide.

Deprecated user profile attributes for Office 365

The following user profile attributes are no longer supported for Office 365:

  • AuthOrig
  • DLMemRejectPerms
  • DLMemSubmitPerms
  • IsTrackingChanges
  • UnauthOrig

See Supported user profile attributes for Office 365 provisioning.

Breached password protection

Protect your organization from the impact of passwords that have been compromised. If Okta determines that an Okta username and password combination has been compromised based on the data collected by our internal threat intelligence pipeline, Okta records a System Log event, expires the user's credentials, and requires the user to update their password before they can use their password to sign in again. See Breached password protection.

Rate limit update for using Okta fallback telephony provider

Orgs that use an active telephony inline hook now have a heavy rate limit for the Okta fallback mechanism.

Federation Broker Mode has been removed from OAuth Service Clients

The Federation Broker Mode option has been removed from OAuth Service Clients.

DPoP available when creating OIDC apps

You can now require the Demonstrating Proof of Possession (DPoP) condition when you create an OIDC app. Previously, this option was only available after you create the app. This streamlines the process of creating and securing OIDC apps.

Increase to Inline Hooks

The maximum number of inline hooks an org can create is now 100. The previous maximum was 50. See Add an inline hook .

Support for migration to Microsoft Graph

You can now migrate your existing Office 365 WS-Fed Manual app instances to Microsoft Graph by using the migration banner on the app dashboard.

New System Log Event

The user.authentication.universal_logout.scheduled System Log event is fired when an admin manually triggers Universal Logout against an app instance. It contains information about where and how Universal Logout was fired. This event is only fired once.

Event hook for session context changes

The user.session.context.change System Log event is now available for use in an event hook. See Event hooks.

Early Access

Enhanced dynamic zones

Use enhanced dynamic network zones to define IP service categories (proxies, VPNs), locations, and Autonomous System Numbers (ASNs) that are allowed or blocked in a zone. See Enhanced dynamic zones.

Same-device enrollment for Okta FastPass

On orgs with Okta FastPass, the Okta Verify enrollment process has been streamlined:

  • Users can initiate and complete enrollment on the device they’re currently using. Previously, two different devices were required to set up an account.

  • Users no longer need to enter their org URL during enrollment.

  • The enrollment flow has fewer steps.

This feature is supported on Android, iOS, and macOS devices. To enable it, go to Admin Console Settings and turn on Same-Device Enrollment for Okta FastPass.

Access request conditions and resource catalog

This feature provides a new method to streamline your access requests for apps, entitlements, and groups from the app’s profile page in the Admin Console.

As super admins and access request admins, you can set up app-specific access request conditions that define requester scope, access level, expiration for the access level, and the approval sequence. Based on your active conditions, requesters can request access to an app or app access level directly from their End-User Dashboard.

Compared to request types, this approach allows you to reuse existing relationships between users, groups, and apps defined in Okta to govern access instead of recreating these in Okta Access Requests. This feature also integrates the app catalog in the End-User Dashboard with Access Requests to make the process of requesting access intuitive and user-friendly. See Access Requests and Create requests.

You can also view and edit a user’s access duration for the app if the app has Governance Engine enabled. See Manage user entitlements.

Continuous Access is now Post Auth Session

The Continuous Access tab in Authentication Policies is renamed to Post Auth Session.

Continuous Access widget is now Post auth session violations widget

The Continuous Access widget in the Identity Threat Protection dashboard is renamed to the Post Auth Session Violations widget.

  • Continuous access violations are renamed to Session violations.
  • Continuous access evaluation is renamed to Post auth session evaluation.

Fixes

  • The list of languages in Customizations SMS wasn't translated. (OKTA-626381)

  • When an admin attempted to create a profile with a username that contained invalid characters, an unhelpful error message appeared in orgs using a custom character restriction for usernames. (OKTA-680557)

  • Users could bypass admin approval from the import screen to sign in to Okta when Active Directory Just-In-Time provisioning was disabled. (OKTA-706392)

  • The Disable Force Authentication option was ignored for org2org apps using the SAML sign-in mode and AMR claims mapping. (OKTA-711957)

  • The Country Code attribute was missing from the profile enrollment form when admins deleted a similar attribute from a SAML Identity Provider. (OKTA-712657)

  • Some policy evaluations in Identity Threat Protection weren't processed correctly. (OKTA-713378)

  • Some Sign-In Widget error messages weren't localized. (OKTA-721035)

  • For some orgs, the last used factor was still prompted when a user clicked Verify with something else. (OKTA-726023)

  • Active Directory incremental imports were converted to full imports when a new OrganizationUnit was added or an existing OrganizationUnit was renamed. (OKTA-729735)

  • The user.risk.change System Log event displayed incorrect actor values. (OKTA-731725)

  • New Dropbox Business instances were missing a profile attribute. (OKTA-733503)

  • The Provisioning tab wasn't saved when admins created Office 365 applications, and Japanese translations of the Session Lifetime for SAML apps feature didn't appear. (OKTA-735840)

  • Versions 7.18.1 to 7.19.1 of the Sign-In Widget weren't rendered when users accessed them from legacy browsers. (OKTA-736546)

Okta Integration Network

  • candidate.fyi (OIDC) is now available. Learn more.
  • Edify (OIDC) now has sign-in URLs.
  • KiteSuite (SAML) is now available. Learn more.
  • ParkZapp (W) (OIDC) is now available. Learn more.
  • ShareThis (SWA) was updated. (OKTA-723868)
  • Umbrella Faces (SCIM) is now available. Learn more.

Weekly Updates

2024.06.1: Update 1 started deployment on June 24

Generally Available

Sign-In Widget, version 7.19.4

For details about this release, see the Sign-In Widget Release Notes.

For more information about the Widget, see the Okta Sign-In Widget Guide.

Fixes

  • Some text on the Reset Password for a user page in the Admin Console wasn't translated. (OKTA-613937)

  • WebEx replaced the API used to retrieve session types with a REST API, which requires the integration to use OAuth for authentication. (OKTA-701227)

  • The policy.entity_risk.evaluate and policy.entity_risk.action events incorrectly displayed the target user as the actor instead of the Okta system. (OKTA-703424)

  • The user.authentication.universal_logout System Log event didn't capture all of the client data. (OKTA-706046)

  • Previews of customized sign-in pages didn't show all registration details. (OKTA-712636)

  • Some locked users couldn't unlock their accounts because they hadn't validated their email addresses. (OKTA-717710)

  • Clicking Sync Entitlements on the Governance tab displayed an error. (OKTA-720049)

  • Sometimes, concurrent Agentless Desktop SSO JIT operations for a user broke app assignments, which required admin intervention to correct. (OKTA-722648)

  • The System Log reported incorrect OS values for the same request. (OKTA-724428)

  • When admins manually confirmed users imported from a SCIM app, they were assigned apps that they weren't authorized to access. (OKTA-724859)

  • The System Log event description for security.events.provider.receive_event was Third Party Vendor reported risk and was updated to Security Events Provider Reported Risk. (OKTA-725427)

  • Opening a profile in a new tab from the Profile Editor displayed a list of profiles instead. (OKTA-725640)

  • A System Log event wasn't present for provisioned users when the password-only sign-in flow failed. (OKTA-727271)

  • The System Log recorded multiple user.session.context.change events when the device management status was incorrectly reported for Windows devices enrolled in Okta Verify. (OKTA-727309)

  • Sometimes, when users who hadn't enrolled in On-Prem MFA attempted to sign in using an RSA SecurID passcode in the New PIN Mode, the passcode verification failed. (OKTA-727554)

  • Some requests failed because the session cookie size exceeded browser limitations. (OKTA-727786)

  • Processing GeneralizedTime attributes while confirming new users imported from LDAP to Okta resulted in an error. (OKTA-728398)

  • Users could reuse their temporary password. (OKTA-729189)

  • The Sign-In Widget was blank when some Okta FastPass users were prompted to authenticate. (OKTA-730317)

  • When the display language was set to Japanese, some role permissions weren’t translated on the Admin role assignments screen. (OKTA-730832)

  • When the display language was set to Japanese, some text on the Administrators pages wasn’t translated. (OKTA-730834)

  • Some customers signing in to Okta-hosted custom domains with the first or second-generation Sign-In Widget received communications from Monotype Imaging Inc. about licensing for the Proxima Nova font. (OKTA-731216)

  • When an admin clicked Show more on the Administrator assignment by role page, additional admins with the super admin role didn’t appear. (OKTA-731416)

  • Some Group Push operations for ServiceNow failed due to timing out. (OKTA-731707)

  • The UI header elements on the Authentication Policy page didn't render correctly. (OKTA-732300)

  • App filter in the Post Auth Session tab is removed for future configurations. This doesn't affect existing configurations. (OKTA-732394)

  • Workday writeback operations failed when area codes were included in the request. (OKTA-733361)

  • Authenticator names weren't translated in error messages. (OKTA-733417)

  • The End User Browser Plugins pane on the Downloads page used an outdated icon for Chromium Edge. (OKTA-733813)

  • Universal Logout didn't sign users out of Google Workspace for some app instances. (OKTA-734303)

  • Entity Risk Policy in the Admin Console didn't have a description. (OKTA-734527)

  • Some attributes weren't translated in the Profile Enrollment form. (OKTA-734938)

  • The policy.auth_reevaluate.fail System Log event wasn't recorded for customers who enabled Identity Threat Protection. (OKTA-735556)

  • The security.breached_credential.detected System Log event had a typo. (OKTA-736552)

  • Some users saw an error page after setting up their Okta account. (OKTA-737149)

  • The Okta RADIUS Server Agent was updated for a security fix. Upgrade to version 2.22.0. (OKTA-737441)

  • Widgets on the Identity Threat Protection dashboard are updated for style and design consistency. (OKTA-737798)

  • Sometimes, Group Assignments involving the Everyone group failed because of a non-performant query. (OKTA-742083)

  • Full imports for OIG-enabled apps sometimes caused users to be unexpectedly deprovisioned. (OKTA-742996)

Okta Integration Network

  • Accend (OIDC) has a new icon and description.
  • Actioner (OIDC) is now available. Learn more.
  • Aerofiler (SAML) is now available. Learn more.
  • Aerofiler (OIDC) has a new icon and OIDC endpoints.
  • Aiven (SAML) is now available. Learn more.
  • Aiven (SCIM) is now available. Learn more.
  • Amazon WorkDocs by Aquera (SCIM) has a new icon.
  • Amazon WorkMail by Aquera (SCIM) has a new icon.
  • Autotab (OIDC) is now available. Learn more.
  • Bright Breaks (SCIM) is now available. Learn more.
  • Brivo Identity Management (SCIM) has a new display name, base URL, integration guide, app profile, and mappings.
  • Codefresh by Aquera (SCIM) has a new icon.
  • Cyolo SRA (SAML) is now available. Learn more.
  • Descope (OIDC) is now available. Learn more.
  • Descope (SCIM) is now available. Learn more.
  • Detexian SSPM (API service) is now available. Learn more.
  • Docker (SAML) is now available. Learn more.
  • DOTS (SAML) is now available. Learn more.
  • Elastic Agent (API service) is now available. Learn more.
  • Favro (SCIM) is now available. Learn more.
  • Floqast (SAML) is now available. Learn more.
  • GitHub Enterprise Managed User - ghe.com (SAML) is now available. Learn more.
  • GitHub Enterprise Managed User - ghe.com (SCIM) is now available. Learn more.
  • goFLUENT (SAML) is now available. Learn more.
  • JazzHR by Aquera (SCIM) supports profile sourcing.
  • Lark (SCIM) is now available. Learn more.
  • Lattice HRIS (SCIM) is now available. Learn more.
  • Manopay (OIDC) has a new integration guide and supports IdP-initiated flows.
  • Obsidian Security (API service) is now available. Learn more.
  • PerimeterX (SCIM) is now available. Learn more.
  • Plumm (SCIM) has a new integration guide.
  • ProdPad by Aquera (SCIM) has a new icon and support URL.
  • Prowler (SAML) is now available. Learn more.
  • Rezonate Security (API service) can now read network zones data.
  • Scrut Automation (OIDC) is now available. Learn more.
  • Select Admin (OIDC) is now available. Learn more.
  • ShareCal (SAML) has a new ACS URL.
  • SmarterSends (SAML) is now available. Learn more.
  • SwaggerHub by Aquera (SCIM) has a new icon and support URL.
  • TriNet by Aquera (SCIM) supports profile sourcing.
  • Trotto Go Links (SAML) has a new icon and integration guide.
  • UKG HR Service Delivery by Aquera (SCIM) has a new icon.
  • WebWork Time Tracker (SAML) is now available. Learn more.
  • WonderProxy (SAML) is now available. Learn more.
  • Workable Recruiting by Aquera (SCIM) supports profile sourcing and has a new icon, description, and support URL.
  • Wundergraph Cosmo (SCIM) is now available. Learn more.
  • Xakia (SCIM) has a new icon and supports group push.
  • Xero by Aquera (SCIM) has a new icon and support URL.

2024.06.2: Update 2 started deployment on July 8

Generally Available

Sign-In Widget, version 7.19.6

For details about this release, see the Sign-In Widget Release Notes.

For more information about the Widget, see the Okta Sign-In Widget Guide.

Update to Universal Directory attribute limits

Universal Directory has increased the limit of the number of attributes per org.

Fixes

  • The help links on the Downloads page weren’t localized. (OKTA-614688)

  • Admins without the View agents permission could see the Agents page. (OKTA-651508)

  • Setting the locale to Japanese resulted in some issues when working with CSV directories. An error string appeared when scheduling weekly imports and there was insufficient space to enter which hour the import should be performed. (OKTA-656418)

  • Group Push failed for Samanage when group names contained spaces. (OKTA-668498)

  • Password reset token expiration time was not localized for some orgs. (OKTA-673386)

  • When the activation email was resent, it included an expired activation link. (OKTA-720605)

  • The notification email contained the modified IP address when X-Forwarded-For Header was modified. (OKTA-722815)

  • Some users received an error message when they tried to reset their password. (OKTA-725716)

  • The oauth2/instrospect endpoint hit rate limits without logging it in the System Log. (OKTA-726680)

  • Users who didn't enable the Multiple Identifiers feature could access the Identifiers page. (OKTA-727848)

  • During JIT reactivation through IdP, group app assignment reconciliation wasn't processed asynchronously, which caused an unexpected delay in the sign-in process. (OKTA-729103)

  • Access Testing Tool incorrectly reported that non-admin users had access to Okta Admin Console. (OKTA-729726)

  • Attempting to unassign a Google Workspace license from a user who didn't have that license resulted in an error message. (OKTA-731570)

  • A SAML app didn't open in an iFrame even when it was configured using Trusted Origins. (OKTA-734026)

  • If there was an error in the metrics for policy recommendation for an application, the recommendations didn't load properly. (OKTA-735657)

  • When an app was created by an API call with an existing clientId in the request payload, this didn't match the way an app was created in the UI. This resulted in the wrong app rate limit displayed in the rate limit dashboard. (OKTA-736117)

  • When an admin uploaded a file while configuring an app, the dates that appeared on the page weren't translated. (OKTA-736916)

  • The Okta provisioning API didn't accept user IDs that contained a backslash (\) character when users were provisioned to Org2Org instances. (OKTA-737258)

  • Admins couldn't delete existing Classic Engine Network Zones after upgrading to Identity Engine. (OKTA-737821)

  • NetSuite imports failed for new app instances that had Governance Engine enabled if users had an inactive department, location, or class. (OKTA-737844)

  • Unhandled routes for authentication policies rendered a blank page in the Admin Console. (OKTA-738033)

  • Sometimes a group owner wasn't resolved correctly and an invalid error was displayed on the Group Owner tab for the group. (OKTA-738426)

  • Some users received a Bad Gateway error when they tried to register their account. (OKTA-738828)

  • Gemini licenses for Google Workspace were unavailable. (OKTA-739005)

  • The Show More option in Trusted Origins didn't display all trusted origins when a filter was selected. (OKTA-740734)

  • The wrong font was used for text in the Sign-In Widget. (OKTA-742100)

  • The Post Auth Session Violation widget displayed incorrect UI and data when the policy was in the monitoring mode. (OKTA-742525)

  • When running an import from Active Directory into Okta, the DirSync stopped working, which resulted in users being removed from multiple groups within the Office 365 app. (OKTA-742905)

  • Full imports for OIG-enabled apps sometimes caused users to be unexpectedly deprovisioned. (OKTA-742996)

  • When trying to access OneDrive using the app on the Okta Dashboard, an error occurred if there was an active Office 365 session. (OKTA-744748)

  • In Groups API queries, some users who weren't in the "Everyone" group were missing group memberships.(OKTA-747426)

Okta Integration Network

  • Authomize Identity Security (API service) has a new icon, display name, description, website, integration guide, and okta.policies.read scope.
  • Cisco Identity Intelligence - Read-Write Management (API service) is now available. Learn more.
  • Feishu (SCIM) is now available. Learn more.
  • Forethought Dashboard (SCIM) is now available. Learn more.
  • Funnel.io (SAML) has a new icon and integration guide.
  • Klue (SAML) is now available. Learn more.
  • Klue (SCIM) is now available. Learn more.
  • KSOC (OIDC) is now available. Learn more.
  • Medicat One (OIDC) is now available. Learn more.
  • Okta Identity Security Posture Management (API service) is now available. Learn more.
  • Own (SAML) is now available. Learn more.
  • Rewind Backups (API service) is now available. Learn more.
  • Seculio (SAML) is now available. Learn more.
  • Thoropass (SAML) is now available. Learn more.
  • TriNet Zenefits by Aquera (SCIM) is now available. Learn more.
  • WINN.AI (OIDC) is now available. Learn more.
  • Workshop (SAML) is now available. Learn more.
  • Zip (SCIM) now has the approvalLevel attribute.

Version: 2024.05.0

May 2024

Generally Available

Sign-In Widget, version 7.18.0

For details about this release, see the Sign-In Widget Release Notes.

For more information about the Widget, see the Okta Sign-In Widget Guide.

Option to enforce profile source priority for Desktop Single Sign On

Enforcing profile source priority for DSSO requires end users to authenticate using their identity from the top prioritized profile source. See Enable delegated authentication for LDAP.

Microsoft Graph commands for Office 365 Manual Domain Federation

The Manual Domain Federation configuration guide for Microsoft Office 365 now uses Microsoft Graph commands.

Support for Active Directory password complexity requirements

This feature creates an option in the password policy to match the same complexity options as Active Directory (AD). Until now, admins couldn't exactly match Okta password complexity requirements to those of their AD instances. Historically, the password complexity requirements in Okta and AD had different granularities, and the requirements displayed in the Sign-In Widget didn't always reflect the AD requirements. As a result, users were locked out without proper error messages. This feature bridges that gap. See Configure the password authenticator.

Permissions for custom admins to manage agents

Custom admins can now view, register, and manage agents. See Agent permissions.

Improved password reset process for Active Directory-sourced users

The password reset process sends password update and verification requests to the same Active Directory agent to avoid replication delay.

IME support for international characters

Admins can now use an Input Method Editor (IME) to type international characters into the Admin Console.

Support for multiple Okta Verify enrollments

Multiple Okta Verify enrollments are now supported on the Authentication and Factors APIs.

Allow multiple identities on one Smart Card

When you use this feature, you enable your end users to use one Smart Card to identify as different identities and authenticate into corresponding accounts. See Configure the Smart Card authenticator.

Deprecated user profile attributes for Office 365

The following user profile attributes are no longer supported for Office 365:

  • AuthOrig
  • DLMemRejectPerms
  • DLMemSubmitPerms
  • IsTrackingChanges
  • UnauthOrig

See Supported user profile attributes for Office 365 provisioning.

OIN connector support for Entitlement Management

The GitHub Team connector has been updated to support Entitlement Management. See Provisioning-enabled apps.

Universal Logout support for Zoom

Universal Logout in Identity Threat Protection with Okta AI (ITP) now clears Zoom sessions and tokens when triggered by the entity risk policy, Continuous Access, and the Clear user session function. This enhances the security of orgs that use ITP.

Sign-In Widget (third generation) version pinning

You can now pin the Sign-In Widget third generation (SIW3) version when updating a customized or preview sign-in page. You can pin version 7.8 or later. This ensures that orgs that use custom branding can't pin SIW3 to an incompatible version. See Customize your sign-in page and Sign-In Widget (third generation).

Granular controls for authentication policies

Admins can now disallow or allow individual authentication methods for an authentication policy. This gives admins more granular control over access to apps. This feature is made available to all orgs.

System Log events for Workflows execution history

Three new event types have been added to the System Log for logging Workflows execution history events:

  • workflows.user.flow.execution_history.activate
  • workflows.user.flow.execution_history.deactivate
  • workflows.user.flow.execution_history.delete

See the Event Types API.

System Log event update for global session policies

The policy.lifecycle.update and policy.rule.update events are updated to include more debug data and change details about the updated policy and rule.

System Log event update for Trusted Origins

If a Trusted Origin is updated using an Event Hook, the event hook ID is now displayed in the System Log event.

Early Access

Multiple Identifiers

Today, end users must sign in to Okta with a username or email address only. With the Multiple Identifiers feature, admins can configure identifiers, or user attributes from Universal Directory, that an end user can enter to authenticate. Multiplier identifiers work in sign-on, recovery, self-service registration, and unlock flows. Admins can configure up to three identifiers, including email (which is still a required identifier). See Multiple identifiers.

Skip the verify page and redirect to the IdP authenticator

This feature allows users to skip the verify step in the Sign-In Widget. They are instead redirected to the IdP authenticator for verification. When you enable this feature, end users see the option to skip the Sign-In Widget verification. If your org is configured to remember the last authenticator the user used, then the user is auto-redirected to the IdP authenticator for future sign-in attempts.

Require MFA for Admin Console access

You can require multifactor authentication to access the Okta Admin Console. When you enable this feature, all Admin Console authentication policy rules that allow single factor access are updated to require multifactor authentication. See Enable MFA for the Admin Console.

SSF Transmitter API

Okta uses CAEP to send security-related events and other data-subject signals to Apple, known as the Shared Signal Framework (SSF) receiver. After an SSF stream is configured, Okta sends signals as Security Event Tokens (SETs) to Apple. Use the SSF Transmitter API to manage SSF stream configurations between the SSF receiver and Okta.

Enhancement to protected access to Admin Console

As part of the Require MFA for Protected Actions in the Admin Console feature, step-up authentication is required to modify authentication policies applicable to Admin Console.

Fixes

  • Failed Group Push operations to ServiceNow weren't displayed on the Tasks page. (OKTA-677484)

  • Provisioning to UKG Pro sometimes failed due to WorkCountryCode. (OKTA-681623)

  • Performing a Push Now operation on an empty push group in Okta failed to reconcile the group in Zendesk. (OKTA-701099)

  • Stuck XaaS executions weren't marked as failed jobs. (OKTA-712091)

  • Users who entered an invalid username into a password-first sign-in flow saw a misleading error message. This behavior occurred only in orgs that enabled the Multiple Identifiers feature and disabled User Enumeration Prevention. (OKTA-713096)

  • Admins who were supposed to have access to the MFA Activity report couldn't access it. (OKTA-714995)

  • When Okta detected a change in an admin’s IP, the caep_session_revoked signal wasn't sent to the SSF receiver. This occurred when the IP binding for admin console setting was enabled. (OKTA-717305)

  • Active Directory incremental imports were converted to full imports when a new OrganizationUnit was added or an existing OrganizationUnit was renamed. (OKTA-718186)

  • The Back to sign in link appeared on the Sign-In Widget (third generation) session expired page. (OKTA-718969)

  • Read-only admins couldn't access the Identity Threat Protection widgets and reports. (OKTA-719582)

  • Super admins with roles assigned through group assignment couldn't enable Direct Authentication grant types in an OIDC app. (OKTA-719756)

  • Some users had to click Sign in with Okta FastPass twice to initiate the enrollment. (OKTA-720029)

  • When running delegated flows from the Okta Admin Console, the event metadata wasn't recorded by the System Log. (OKTA-722302)

  • The error displayed when deleting a realm that had associated realm assignments wasn't translated to match the locale. (OKTA-722814)

  • Smart Card IdP username transformation didn't allow the space characters within the username string. This functionality is only available with custom UD attributes. (OKTA-723152)

  • The Edit button for modifying an SSWS API token's rate limit was disabled instead of hidden for admins who didn't have permission to update the rate limit. (OKTA-724333)

Okta Integration Network

  • DigiCert (SWA) was updated. (OKTA-722381)
  • Foqal Agent (SAML) is now available. Learn more.
  • Kantega SSO (OIDC) is now available. Learn more.
  • Kantega SSO (SAML) is now available. Learn more.
  • Kantega SSO (SCIM) is now available. Learn more.
  • LimbleCMMS (OIDC) now has additional redirect URIs.
  • Netdata (OIDC) is now available. Learn more.
  • Obsidian Security (SAML) now has an option to select the region for the ACS URL.
  • SCIM 1.1 Test App (OAuth Bearer Token) now has SWA and SAML functionality.
  • SCIM 2.0 Test App (OAuth Bearer Token) now has SWA and SAML functionality.
  • SCIM 2.0 with Entitlements Management (Basic Auth) now has SWA and SAML functionality.
  • SCIM 2.0 with Entitlements Management (Header Auth) now has SWA and SAML functionality.
  • SCIM 2.0 with Entitlements Management (OAuth Header Auth) now has SWA and SAML functionality.
  • Vansec (SCIM) now has updated application profile and mappings.

Weekly Updates

2024.05.1: Update 1 started deployment on May 20

Fixes

  • Inactive app users weren't included in group pushes for AWS Account Federation. (OKTA-678930)

  • Group queries in authentication policy rules didn't display more than 10 group names. (OKTA-699003)

  • Users with a custom admin role that allows them to manage a realm couldn't import users. (OKTA-709746)

  • Groups IDs were sent as part of PATCH operations. (OKTA-711633)

  • Users in China couldn't authenticate or enroll in authenticators on sign-in pages that required CAPTCHA verification. (OKTA-718806)

  • The logOnly attribute incorrectly appeared in the System Log. (OKTA-725287)

  • Sometimes actions that were taken on role assignments from entitlement bundles timed out. (OKTA-727294)

  • Some UI elements in the Identity Threat Protection dashboard didn't render correctly. (OKTA-727820)

  • Orgs that had Auto-enroll in all future EA features enabled in Features didn't get the Enforce MFA For Admin Console feature. (OKTA-729278)

Okta Integration Network

  • Amazon WorkDocs by Aquera (SCIM) description was updated.
  • Amazon WorkMail by Aquera (SCIM) description was updated.
  • Asana (SWA) was updated. (OKTA-721354)
  • Codefresh by Aquera (SCIM) description was updated.
  • Costimize (OIDC) is now available. Learn more.
  • Genian NAC (SAML) is now available. Learn more.
  • Grafana by Tech Prescient (SCIM) is now available. Learn more.
  • Highway (OIDC) is now available. Learn more.
  • JazzHR by Aquera (SCIM) is now available. Learn more.
  • NinjaOne (SAML) is now available. Learn more.
  • NordLayer (SCIM) description was updated.
  • Nudge Security (OIDC) description was updated.
  • Pando HR (OIDC) is now available. Learn more.
  • ProdPad by Aquera (SCIM) description was updated.
  • Proton VPN (SAML) is now available. Learn more.
  • Smartsheet SCIM (SAML) was updated to remove ACS URL and audience requirements.
  • SwaggerHub by Aquera (SCIM) description was updated.
  • TriNet by Aquera (SCIM) description was updated.

2024.05.2: Update 2 started deployment on June 3

Generally Available

System Log event update for telephony

The system.sms.send event is updated to include the telephony inline hook failover information.

Fixes

  • When the Identity Threat Protection feature was enabled and an admin deleted the only group in a continuous access policy rule, the policy was still enforced. (OKTA-650636)

  • Admin email notifications for user lockouts weren't translated to the org's default language. (OKTA-657967)

  • The display name of the user was missing from the analytics.feedback.provide event in the System Log. (OKTA-679669)

  • Some users received an error message when they clicked Reveal in the app settings of the Google Workspace Mail tile. (OKTA-684516)

  • Sometimes viewing group details resulted in slow page loads or timeouts if the group was assigned a Zendesk app integration that had a large number of ZendeskOrganization objects in the downstream app. (OKTA-688756)

  • The Administrator role report contained admins without active resource sets. (OKTA-698967)

  • In some cases, the Realms pages in Chrome erroneously displayed horizontal scroll tabs. (OKTA-702758)

  • When choosing push groups by name, after selecting the first group and clicking Save and Add Another, choosing the next group caused the Push group immediately option to be cleared but the group was still automatically pushed. (OKTA-704497)

  • In Okta Identity Governance orgs where AD groups were owned by deactivated Okta users, some failed imports appeared as complete. (OKTA-713146)

  • When the last standard admin role was unassigned from a user who also had a custom admin role, the System Log didn’t record the event. (OKTA-715487)

  • Read-only admins couldn't use the Access Testing tool. (OKTA-716165)

  • When the Okta session and re-authentication times were set to four hours, they expired after one hour. (OKTA-716829)

  • For some types of internal errors, the LDAP interface incorrectly returned a successful result code (0) and empty results instead of an error code (80). (OKTA-716937)

  • Authenticator enrollment emails that users received when they enrolled in Okta Verify contained a Report suspicious activity link with the org's regular domain, even if the enrollment occurred on a custom domain. (OKTA-723812)

  • When a user search included the & symbol, only the first page of results was viewable. (OKTA-724819)

  • The Okta RADIUS agent was updated for a security fix. Upgrade to version 2.21.0. (OKTA-724891)

  • When viewing realm assignments where over 20 entries were listed per page, either or both of the assigned realm values and profile sources weren’t displayed. (OKTA-724913)

  • Some users received an error message and couldn't view Okta pages when they signed in from an IP address that Okta identified as risky. (OKTA-726837)

Okta Integration Network

  • Clinical Maestro (SAML) has a new integration guide.
  • Elba SSO (OIDC) now has IdP SSO support, region AIP and ENUM, and a ternary operator for the initiate login URI.
  • Glimmer (SAML) is now available. Learn more.
  • Grafana by Tech Prescient (SCIM) is now available. Learn more.
  • Navit (OIDC) is now available. Learn more.
  • Oncall Scheduler (OIDC) is now available. Learn more.
  • OpenEye Web Service (SAML) has a new logo and integration guide.
  • Orca Security (SAML) has a new integration guide.
  • Planyear - Insurance Brokerage (SAML) is now available. Learn more.
  • Postman (SCIM) now has group push, a configurable base URL, and a new logo.
  • Spendesk (SAML) has a new integration guide, logo, and description.
  • Surf Security (SAML) is now available. Learn more.
  • Surf Security (SCIM) is now available. Learn more.
  • UKG HR Service Delivery (SCIM) has a new description and display name.
  • Waldo (OIDC) is now available. Learn more.
  • Workable Recruiting by Aquera (SCIM) is now available. Learn more.
  • Zerotek Lab (SCIM) is now available. Learn more.