Okta Identity Engine Production release notes

Subscribe to RSS

Version 2026.45.1. Deployed on November 9, 2026.

Generally Available Features

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

  • Android 14-17 patch level 2026-10-01
  • Windows 10 26H2 10.0.26300.9550
Versioning for imported Salesforce AI agents

Now when you import an AI agent from Salesforce, it displays its latest active version. If no active version is available, it displays the latest published inactive version. See AI agent imports.

Okta Provisioning Agent, version 3.3.2

Okta Provisioning Agent 3.3.2 is now available. This release removes root certificate authorities (CAs) that Okta no longer trusts from the agent trust store and updates the bundled Amazon Corretto JRE to 17.0.21.0.10. The change applies to the RPM and the Windows installer. See Okta Provisioning Agent and SDK version history.

Import staged AI agents

You can now import AI agents that are in a staged or preview state.

Radius Agent version 2.29

This version includes updates and fixes. See Okta RADIUS Server agent version history.

Fixes

  • Users who skipped passkey enrollment during an authenticator enrollment grace period were redirected to the Okta End-User Dashboard instead of their configured app on subsequent sign-ins. (OKTA-1237318)

  • In orgs with app branding migration enabled, apps using the Classic Engine authentication pipeline appeared in the Access Testing Tool. (OKTA-1271513)

  • The Suspicious App Access detection could be fired again almost immediately after being triggered. (OKTA-1281669)

  • The System Log didn't record an event when per-app authentication pipeline settings in an org were removed in bulk, such as during an Identity Engine rollback. (OKTA-1281859)

  • For orgs that migrated from Classic Engine to Identity Engine and used WebAuthn, the Passkey settings page incorrectly displayed the authenticator name as Passkeys instead of Security Key or Biometric (what end users see during enrollment or authentication). (OKTA-1288588)

  • Authenticator enrollment policies that use authenticator sets didn't include the text explaining that the temporary access code (TAC) authenticator isn't available for user enrollment. (OKTA-1289777)

  • In Identity Engine orgs with a custom domain and custom sign-in page, opening a /signin/ URL with no dedicated route (such as /signin/okta) caused the Sign-In Widget to call the Classic Engine API instead of the Identity Engine API. (OKTA-1293866)

  • The Machine Assignments tab was unavailable in Okta Org2Org integrations, which prevented admins from configuring Cross App Access. (OKTA-1294022)

  • HERMIT_VPN wasn't supported as an IP service category in enhanced dynamic zones. (OKTA-1295010)

  • In orgs that use app branding migration, device platform conditions in app sign-on policy rules were migrated from Classic Engine to Identity Engine inconsistently depending on the selected platforms. (OKTA-1313619)

  • Users without the super admin role could modify the URL for a Secure Password Store app instance, such as one created from the SWA Template app. (OKTA-1314535)

  • In orgs with custom domains, signing out of the Admin Console didn't invalidate the Okta Dashboard session. (OKTA-1314683)

Okta Integration Network

  • ANSI Standards Connect (SAML) is now available. Learn more.

  • Datatrac Web (OIDC) is now available. Learn more.

  • Datatrac Web (Universal Logout) is now available. Learn more.

  • Dropbox Business now supports XAA.

  • Miro (formerly RealtimeBoard) now supports XAA.

  • Modal (SCIM) is now available. Learn more.

  • Monday.com (XAA) is now available.

  • Rogue Security (API Service) is now available. Learn more.

  • Rubrik Security Cloud now has the following scopes:

    • okta.deviceAssurance.manage
    • okta.deviceAssurance.read
    • okta.linkedObjects.manage
    • okta.linkedObjects.read
    • okta.threatInsights.manage
    • okta.threatInsights.read
    • okta.authenticators.manage
    • okta.authenticators.read
    • okta.behaviors.manage
    • okta.behaviors.read

  • StatusDrift.com (SAML) is now available. Learn more.

  • StatusDrift.com (Universal Logout) is now available. Learn more.

  • VeriKnox (OIDC) is now available. Learn more.

  • WOVN.io (SAML) updated its SSO URL.

  • X (Twitter) (SWA) was updated.

  • Zoom now supports XAA.