Okta Identity Engine Production release notes

Generally Available

CIMD for AI agents

You can now register AI agents with a CIMD so that they can identify themselves with a URL instead of a static client ID. See About Client ID Metadata Documents (CIMD).

UI update for MCP server scopes

Now when you add custom scopes to an MCP server, the list of scopes appears in a separate dialog. See Add an MCP server manually.

Automatic tasks and questions reassignment after a manager change

To prevent access requests from being blocked during organizational changes, Okta Access Requests now automatically reassigns pending manager tasks and manager questions to an employee's new manager whenever a manager change occurs. This automated reassignment ensures that approvals proceed without manual IT intervention or delays, even if the previous manager's account has already been deactivated. This is available for requests built with both request conditions and request types.

Requester timeline view

Requesters can now view a detailed status timeline of their request's tasks directly from the Okta Access Request app. This enhanced visibility allows requesters to easily track the progress of their requests, see who has approved individual tasks, and identify remaining tasks, helping users stay informed throughout the approval process and reducing unnecessary status inquiries. The timeline is available for requests built with access request conditions.

Fixes

• When users updated the Okta Verify app on iOS devices, the System Log recorded multiple user.mfa.factor.update events within a single day. (OKTA-1215063)

• Switching the Access Control option for a Password policy rule from Legacy to Authentication policy didn't override the legacy settings for additional authenticators. This caused users to be prompted to enroll in additional authenticators that weren't required. (OKTA-1220283)

• Users who signed in with Okta FastPass and selected Stay signed in couldn't update their password when they clicked Edit Profile in the End-User Dashboard. (OKTA-1224212)

• When users attempted to sign in with Okta FastPass on a shared device, no error message was shown to inform them that Okta FastPass wasn't available on shared devices. (OKTA-1237130)

• When creating or updating a user identification policy, you could select only the first 20 network zones for the user identification policy rule. (OKTA-1259477)

• After users signed out, clicking Sign in with NFC could become unresponsive while Okta Verify searched for an available instance, requiring users to try again. (OKTA-1265555)

• When an admin begin a user import for a single service account without an Okta user object, the profile sync process incorrectly updated all users in the Active Directory instance. (OKTA-1267422)

• When users with the Auditor (Read-Only) admin role attempted to authenticate using Okta Verify Push, approving the push prompt on their mobile device returned a "Failed to send push notification" error message. (OKTA-1268324)

• Admins could remove an authorization server with active managed connections from an MCP server. (OKTA-1273048)

• Admins experienced page performance errors and unexpected MFA prompts due to access tokens expiring during tasks. (OKTA-1281712)

• Admins on some custom-domain orgs were unable to access the Admin Console due to a token validation mismatch. (OKTA-1289991)

Okta Integration Network

• Atomicwork (SAML) is now available. Learn more.

• Cockroach Labs (SCIM) was updated with a new app logo.

• Entrust IDV (IDV) is now available. Learn more.

• MongoDB Atlas is now available in OIN with SCIM 2.0 Provisioning support, which automates user lifecycle and access management between Okta and MongoDB Atlas.

• StitchOps (OIDC) is now available. Learn more.