Okta Identity Engine Production release notes

Version 2026.41.0. Deployed on October 12, 2026.

Generally Available features

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

  • macOS 27.0.1
  • macOS 26.7.1
  • macOS 15.8.1
  • iOS 27.0.1
  • iOS 26.7.1
Sign-In Widget, version 7.50.0

For details about this release, see Sign-In Widget Release Notes. For more information about the widget, see Okta Sign-In Widget.

NFC authenticator available with Adaptive MFA

The NFC authenticator is now available to orgs with Adaptive MFA. Frontline workers can tap their NFC badge on a reader and enter a PIN to sign in to Okta-protected apps on shared Windows workstations. See Configure the NFC authenticator.

Security key PIN support for user verification

Users who initially enrolled a security key (such as a YubiKey) without a PIN, but later configured a PIN externally, can now authenticate successfully when a policy rule requires a device passcode or biometric verification.

Import AI agents from Snowflake

You can now import and manage AI agents built in Snowflake directly through Okta. See AI agent imports.

Passkey (FIDO2 WebAuthn) authenticator enabled by default

The Passkey (FIDO2 WebAuthn) authenticator is now available by default in all newly created orgs to ensure protection by a phishing-resistant authenticator from the start. As a possession and biometric or knowledge-based factor, Passkey (FIDO2 WebAuthn) meets the requirements for phishing resistance and user presence. See Configure the Passkey (FIDO2 WebAuthn) authenticator.

Import AI agents from Workato

You can now import and manage AI agents built in Workato directly through Okta. See AI agent imports.

Radius Agent version 2.28

This version changes the default client access behavior. Starting with this version, you must configure a client IP allowlist for new installations to accept RADIUS connections. See Okta RADIUS Server agent version history.

Provisioning for Fleet End User Enrollment

Provisioning is now available for the Fleet End User Enrollment integration. See Integrate Fleet End User Enrollment with Okta.

Provisioning for Pipedrive

Provisioning is now available for the Pipedrive integration. See Integrate Pipedrive with Okta.

App branding migration

Currently, when you upgrade to Identity Engine, that upgrade happens for your entire org, at a global level. You must prepare all of your customizations and integrations for every app before upgrading your tenant and reconfigure your upgraded org. If anything goes wrong, the whole upgrade must be rolled back.

The app branding migration feature allows eligible orgs to stage, preview, and deploy Identity Engine on an app-by-app basis while preserving their Classic Engine customizations and brands. Upgrade your most important and high-traffic apps first and with confidence, while leaving less critical apps for a later time. If anything goes wrong, only the affected apps need to be rolled back. See App branding migration.

Support for SharePoint Server Subscription Edition

Okta now supports SharePoint Server Subscription Edition for user authentication.

Passkey enrollment promotion prompt

You can now configure a passkey enrollment promotion nudge that prompts end users to enroll a passkey authenticator when they sign in. The nudge applies only when the passkey authenticator is optional, and users who skip it can still sign in with another authenticator. You can control how often the prompt reappears and how many times a user can skip it before Okta stops showing it. See Create an authenticator enrollment policy.

Email notifications for disrupted AD and LDAP agents

System email notifications now include options for Active Directory and LDAP agent disruption and recovery. Admins can enable notifications in the Admin Console to receive email alerts when an agent disrupts and recovers.

User identification policy

Admins can now manage rules in the user identification policy to control whether the Sign in with Okta FastPass button appears on an app-by-app basis, instead of relying on a single org-wide setting. This makes it easier to manage pilot groups during Okta FastPass rollouts and to tailor the sign-in experience for individual apps. See Add a rule to a user identification policy.

Zendesk app integration update

Okta's Zendesk app integration now uses OAuth 2.0 instead of Basic Authentication for provisioning. If you use Zendesk provisioning, re-authenticate your API connection in the Admin Console by April 29, 2027 to prevent provisioning failures. New Zendesk app instances require OAuth 2.0 beginning October 26, 2026. This change doesn't affect SSO. See Integrate Zendesk with Okta.

SAP SuccessFactors OAuth 2.0 with SAML Assertion

The SAP SuccessFactors app integration now supports OAuth 2.0 with SAML Assertion for enhanced API security. To ensure your provisioning and sync processes continue without interruption, you must migrate to this new authentication method before the SAP Basic Authentication deletion deadline on November 20, 2026. See Configure OAuth 2.0 with SAML for SAP SuccessFactors.

PowerShell scripts for Active Directory

Admins can now execute custom PowerShell scripts in on-premises Active Directory environments using the Active Directory agent to support custom lifecycle management functionalities. After configuration, admins can invoke scripts through Okta Workflows using the Okta public API. See Enable and configure PowerShell script in Active Directory and Invoke a remote script on the AD agent.

Telephony status callbacks for custom providers

Okta now records delivery status updates from custom telephony providers in the System Log. When admins configure a custom provider through the Admin Console, Okta logs system.sms.receive_status and system.voice.receive_status events. Admins can use these events to verify whether SMS messages and voice calls reach users and to troubleshoot provider credential issues. See Configure telephony providers.

Early Access features

OIN Community Integrations

New apps often launch before Okta has an integration for them, forcing admins to delay rollout or run the app without single sign-on and automated provisioning. Community Integrations close that gap. Okta builds the integration from the application's public APIs and publishes it to the Okta Integration Network at no additional cost. A new integration starts as Community Preview, available to install and test in preview orgs. Once a customer has run it in their own production org, it becomes Community Verified and can be installed in any org. You get a missing integration to test within days, not months, and decide when it's ready for production based on your own testing. See Community integrations.

New System Log events for staging Access Certification campaigns

The System Log now logs the following events for staging Access Certification campaigns:

  • certification.campaign.stage.start: This event is logged when the staging process starts for a campaign.

  • certification.campaign.stage.end: This event is logged when the campaign staging process ends. The outcome.result field reports SUCCESS if the campaign snapshot is created successfully, or FAILURE if there were errors during the staging process.

See Event Types.

Import AI agents from Cursor

You can now import and manage AI agents built in Cursor directly through Okta. See AI agent imports.

Self-service registration policy for ITP

Self-service sign-up is an easy path for fraud, because bad actors using disposable email addresses or specific networks can slip through undetected. With the new self-service registration policy on the User Profile Policies page, Identity Threat Protection (ITP) customers can create rules that automatically deny sign-up attempts from disposable and throwaway email domains or specific network zones, working alongside Bot Protection as part of Okta's growing set of Attack Protection capabilities. This gives admins another way to cut down on fake accounts and keep self-registration flows cleaner. See Self-service registration.

Incremental imports for Office 365 is EA in Preview

Admins can now schedule and run incremental imports for Microsoft Office 365 and Office 365 GCC High app integrations.

Fixes

  • Users attempting to sign in through an embedded Sign-In Widget in Safari on macOS were prevented from completing authentication. (OKTA-1199687)

  • Users on managed ChromeOS devices got an internal server error when they tried to enroll authenticators or reset their password from the Account Settings page. (OKTA-1199888)

  • When user verification through Okta Verify failed at sign-in, the error message indicated that biometrics were required, even if the org's policy also allowed a device passcode. (OKTA-1250688)

  • Developers using the Device Posture Checks OAuth scopes received an authorization error if their org had the base Device Posture Checks feature enabled without the related release flag. (OKTA-1265907)

  • The certification.campaign.launch System Log was triggered in error when the staging process started for an Access Certification campaign. (OKTA-1268484)

  • When an import resumed after an entitlement unassignment interruption, the import matrix incorrectly displayed the updated user count as 0 instead of reflecting the actual processed users. (OKTA-1272163)

  • Some policy.rule.update events weren't displayed in the System Log. (OKTA-1273973)

  • Some error messages on the Sign-In Widget weren't correctly translated to French. (OKTA-1277043)

  • Admins who added a certificate authority for device management while the Single Certificate feature was enabled received a validation error. (OKTA-1287408)

  • When an admin removed an entitlement locally, role or resource set updates failed to sync. (OKTA-1289782)

Okta Integration Network

  • Aembit (OIDC) is now available. Learn more.

  • Carta (SWA) was updated.

  • Holistics (SAML) is now available. Learn more.

  • Holistics (SCIM) is now available. Learn more.

  • Mailzzy (OIDC) is now available. Learn more.

  • Mailzzy (SAML) is now available. Learn more.

  • Spacent (OIDC) is now available. Learn more.

  • YakChat (OIDC) has a new redirect URI.

  • Your360 AI Directory Lookup (API Service Integration) is now available. Learn more.

Documentation updates

Changes to Okta release version notation

Beginning in October, Okta release version notations are changing from year.month to year.week. For example, 2026.10.0 will become 2026.41.0, where 41 indicates the week of the year that the deployment occurs. More information is available in this knowledge base article.