Okta Identity Engine Production release notes

Subscribe to RSS

Version 2026.44.0. Deployed on November 3, 2026.

Generally Available Features

Single audience claim for custom authorization servers

For orgs with the Multiple audiences for custom authorization servers feature enabled, access tokens now have a single aud claim value by default.

Cross App Access for MCP Servers

Cross App Access enables Okta admins to securely connect AI agents to third-party MCP servers. This gives admins full visibility and control over actions taken on behalf of users and eliminates user consent prompts at runtime.  See Configure Cross App Access for an MCP server.

Import AI agents from UiPath

You can now import and manage AI agents built in UiPath directly through Okta. See AI agent imports.

XAA token analytics report

The XAA token analytics report gives admins a clear view of their cross-app access (XAA) token usage in the Admin Console Reports tab. Admins can specify a date range and see which applications and users drive usage. Before, admins needed to build System Log queries by hand, which was slow and hard to repeat. Now admins can spot usage trends early and can make informed decisions about their XAA token usage. They can also export the filtered results to CSV. See Cross App Access Token Analytics report.

Connect MCP servers to downstream resources as OAuth clients

MCP servers registered in Okta can now act as OAuth clients, enabling them to connect to downstream MCP servers and other resources on behalf of users. The MCP servers can perform requests and gather data, returning one processed answer to the agent. Each system the MCP reaches is a connection that you grant and revoke in Okta with its own permitted scopes. See Allow an MCP server to access downstream resources.

Gemini Enterprise Agent Platform import integration

Admins can now import AI agents, including A2A agents, from the Gemini Enterprise Agent Platform into Okta. When enabling the import in Okta, admins can scope the integration to specific regional locations or a global location. The import retrieves key agent attributes, providing rich visibility into AI agent inventories. See Configure Gemini Enterprise Agent Platform for AI agent imports.

Import AI agents from Relevance AI

You can now import and manage AI agents built in Relevance AI directly through Okta. See AI agent imports.

Import AI agents from Boomi

You can now import and manage AI agents built in Boomi directly through Okta. See AI agent imports.

Provisioning for Sourcegraph

Provisioning is now available for Sourcegraph. See Integrate Sourcegraph with Okta.

Device assurance OS version update

The following OS versions are now supported in device assurance policies:

  • Windows 10 builds (10.0.17763.9376, 10.0.19044.7807, 10.0.19045.7807)
  • Windows 11 builds (10.0.22631.7652, 10.0.26100.9711, 10.0.26200.9711, 10.0.26200.9711)
Okta On-Prem MFA agent version 1.8.8

This version includes security enhancements.

AI agent owners hidden for non-OIG orgs

On AI agent profiles, the Owners tab is now hidden for orgs that aren't subscribed to Okta Identity Governance (OIG).

Okta Provisioning Agent, version 3.3.2

Okta Provisioning Agent 3.3.2 is now available. This release removes root certificate authorities (CAs) that Okta no longer trusts from the agent trust store and updates the bundled Amazon Corretto JRE to 17.0.21.0.10. The change applies to the RPM and the Windows installer. See Okta Provisioning Agent and SDK version history.

Generally Available Enhancements

Client credentials OAuth2.0 grant type for SCIM or API Integration Actions-based app integrations

When you create app integrations using the Okta Integration Wizard, you can now use client credentials (tenant-specific client ID and secret) as an OAuth 2.0 grant type for SCIM or API Integration Actions-based app integrations. This helps you simplify and secure the setup and improves user experience by reducing the need for then to manually sign in.

Campaign notifications frequency

You can now configure reminders for reviewers on up to three separate days before a campaign's review period ends. Sending reminders on multiple days helps increase the number of reviews completed before the campaign closes.

Early Access Features

Incremental imports for Office 365

Admins can now schedule and run incremental imports for Microsoft Office 365 and Office 365 GCC High app integrations.

Okta Verify Device Posture Sensor Mode

Previously, enforcing device security posture created significant blind spots on shared devices because it required a single-user Okta FastPass enrollment. Okta Verify Sensor Mode resolves this issue by registering the app directly to the org, allowing context-aware Device Assurance policies to be instantly evaluated when the user signs in. This is especially valuable for frontline workers, as it guarantees comprehensive compliance for shared fleets and ensures that devices are healthy before access is ever granted. See Device Posture Sensor Mode.

Match on AAGUID alone for passkey authenticator groups

You can now select Match on AAGUID alone when you add or edit a Passkey (FIDO2 WebAuthn) authenticator group. Users can then enroll authenticators from the group that don't provide a trusted attestation certificate. See Configure the Passkey (FIDO2 WebAuthn) authenticator groups.

Early Access Enhancements

Configurable time to live (TTL) for device posture provider claims

Admins can now set the time to live (TTL) duration for device posture provider claims from 5 minutes to 24 hours. This org-wide setting provides greater control over how frequently devices are re-evaluated for compliance See Integrate Okta with Device Posture Provider.

Fixes

  • When admins with custom roles attempted to view or manage device posture checks, the checks weren't available (OKTA-1157414)

  • Some global session policy rules weren't evaluated if a user signed in shortly after being added to a group that was recently added to the global session policy. (OKTA-1265480)

  • In orgs with the early access feature "Support for re-authentication with an external IdP" enabled, users who tried to sign in to an app through an IdP saw an error message if they already had an active session on the upstream IdP. (OKTA-1276837)

  • In orgs that used authenticator sets with a grace period, required authenticators appeared as optional when users selected Remind me later during enrollment. (OKTA-1290198)

  • When an admin configured Cross App Access (XAA) for an app integration, they couldn't use an issuer URL that resolved to private a IP address or non-public DNS. (OKTA-1299275)

  • In orgs with app branding migration enabled, some OIDC apps were incorrectly labelled as Classic Engine-only. (OKTA-1299341)

  • When a CSV user import containing entitlement columns included an unparseable cell, the Admin Console displayed a raw code exception instead of a helpful error message. (OKTA-1299822)

  • Some users weren't able to sign in after they entered their PIN for their NFC authenticator. (OKTA-1300647)

  • Group rules didn't automatically assign imported users to target groups based on their app group membership. (OKTA-1300676)

  • When unauthenticated users tried to access their End-User Dashboard in preview orgs, a session expiration message was displayed before the Sign-In Widget loaded. (OKTA-1303219)

  • Users were prompted to enroll a required authenticator again after skipping the grace period. This happened when an admin modified a different authenticator in the authenticator enrollment policy. (OKTA-1235656)

  • When requests to the /api/v1/groups API returned more than 1000 users, pagination looped back to the first page instead of advancing to the next. (OKTA-1265598)

  • When users attempted to enroll an additional Okta Verify device by clicking Set up another in the End-User Dashboard settings, an error occurred. (OKTA-1267878)

  • The Early Access Connect with Okta feature is no longer available. The legacy Manage Connections tab on the Admin Console app profile pages and the associated Application Cross App Access Connections APIs (/api/v1/apps/{appId}/cwo/connections) have been retired. Configurations created under this feature will no longer function as of release 2026.44.0. Reconfigure Cross App Access (XAA) integrations using the current AI agent-to-app resource connections in the Admin Console to avoid disruptions. (OKTA-1268002)

  • In orgs that require FIPS-compliant devices and that enabled the Flexible Okta Verify authenticator configuration feature, some Android users received an error when enrolling in Okta Verify, even though their device was compliant. (OKTA-1274993)

  • The System Log displayed multiple Evaluation of Sign-On Policy events when users signed in with Okta Verify push for Desktop MFA. (OKTA-1278196)

  • In orgs with authenticator enrollment policies that use authenticator sets, the passkey promotion prompt continued to appear after users reached the skip limit. (OKTA-1294256)

  • After upgrading to Okta Identity Engine, users were sometimes signed out when they tried to access their account settings or saw an extra MFA prompt when accessing apps. (OKTA-1294281)

  • During provisioning tasks, Office 365 app instances logged misleading customRoles attribute errors in the System Log. (OKTA-1297976)

  • When users selected Phone during enrollment in an authenticator set, the Sign-In Widget didn't show enrollment progress. (OKTA-1298664)

Okta Integration Network

  • Cockroach Labs (SCIM) was updated with a new app logo.

  • Cust (OIDC) is now available. Learn more.

  • Cust (SCIM) is now available. Learn more.

  • Init (API Service) is now available. Learn more.

  • Juno Journey (SAML, SCIM) has a new app name and logo.

  • Provisioning is now available for dbt Cloud. See Integrate dbt Cloud with Okta.

  • Semperis Lightning (API Service) is now available. Learn more.

  • STLabs (API Service) is now available. Learn more.

  • Sumsub IDV (IDV) is now available. Learn more.

  • Thomson Reuters Account (SAML) is now available. Learn more.

  • Tungsten (OIDC) is now available. Learn more.

Documentation updates

RSS feeds for release notes

RSS feeds are now available for Preview and Production release notes so that you can track and receive automated updates on new capabilities and fixes. Click the RSS icon to subscribe.