Okta Workflows release notes (2025)

Jamf Pro API connector updated

The Jamf Pro API connector has been updated to include the Send MDM Command card. Also, the Refresh Bearer Token card now supports API Client Authorization.

Workflows onboarding for new users

Now when a user signs in to Workflows for the first time, they're presented with an onboarding questionnaire. The questionnaire allows users to indicate their automation goals and level of familiarity. This allows Workflows to tailor the onboarding experience to the user's needs.

Secondary row sorting for execution history

Now when two or more steps in a flow have the same start time, the Execution History pane sorts them according to the timestamp for the final event in the card. See Flow execution history.

Improvements to workflow metrics

On the Flows tab of Connector Builder, the Execution History pane now displays metrics for the flow. See Flow execution history.

Workflows templates

The following Okta Workflows template is now available:

• Identity Security Posture Management

New accent color modal for connections

In Connector Builder, the Settings page for a connector has a new Accent Color modal. The modal provides a better user experience for selecting an accent color. See Create and edit connector settings.

Fixes in Okta Workflows

• OKTA-933535
  

  Some flows could be saved with missing required fields.

• OKTA-913937
  

  In orgs with over 200 app integrations, the API Endpoint card returned an error when an admin selected integrations to trigger the flow.

• OKTA-914702
  

  In some orgs, if the key used for the JWT Verify card was a PS256 key, the card returned a The key is invalid or malformed error.

• OKTA-936586
  

  Execution logs wouldn't stream to Elastic.

• OKTA-927257
  

  On the Flows tab of Connector Builder, the flow history was sometimes incorrect.

• OKTA-740694
  

  When a user received an email from Okta and reported it as suspicious activity, the System Log didn't record the event.

Okta ITP connector

The Okta ITP connector is now available in Okta Workflows with the following cards:

Actions

• Custom API Action

• Global Token Revocation

• Retrieve User Risk

• Upsert User Risk

Events

• Policy Reevaluate Auth Failed

• Universal Logout

• User Risk Detected

See Okta ITP connector.

Fixes in Okta Workflows

• OKTA-928020
  

  Users could save folders, flows, or tables with only a space as the name, or with duplicate names.

• OKTA-917405
  

  In Connector Builder, sometimes the authorization request failed when the OAuth 2.0 server required the inclusion of an Authorization: Basic <credentials> header.

Oracle IAM connector

The Oracle IAM connector is now available in Okta Workflows with the following cards:

• Add user to group

• Create group

• Create user

• Custom API action

• Delete group

• Delete user

• Read group

• Read user

• Remove user from group

• Search groups

• Search users

• Update group

• Update user

See Oracle IAM connector

Splunk Enterprise Security connector

The Splunk Enterprise Security connector is now available in Okta Workflows with the following cards:

• Create User

• Custom API Action

• Delete User

• List Roles

• Read User

• Search Users

• Update User

See Splunk Enterprise Security connector

Fixes in Okta Workflows

• OKTA-920704
  

  Super admins couldn't always access Workflows with the role-based access control (RBAC) feature enable.

• OKTA-899768
  

  When using a Branching Lookup function card, result values starting with numbers and containing text weren't saved correctly.

• OKTA-892394
  

  Admins couldn't create multiple GitHub connections if they had different settings.

• OKTA-901766
  

  In Connector Builder, nested object output keys didn't display properly in the Groups pane.

• OKTA-899898
  

  When an admin added an app action to a Preview environment, the Coupa app was sometimes listed twice.

Connector Builder Terms of Service

The Connector Builder Terms of Service has been updated.

The following Okta Workflows templates are now available:

• OIG Access Request Conditions

• Entra ID Configuration Export and Migration to Okta

• Bookmark application management

See Available Workflows templates.

Fixes in Okta Workflows

• OKTA-913936
  

  Sometimes admins couldn't vertically scroll on a page.

• OKTA-901756
  

  Sometimes when switching between the Flow and History tabs of a flow, the navbar disappeared.

• OKTA-879937
  

  New SFTP connections couldn't be created using hostnames with certain characteristics.

• OKTA-911831
  

  Admins couldn't set the month interval for a scheduled flow.

Secure Identity Integrations

Secure Identity Integrations (SII) provides additional depth for the 50+ most-used enterprise SaaS applications with the inclusion of SSO, SCIM, entitlement management, Universal Logout, Connectors, and Identity Security Posture Management (ISPM).

Update to Slack connector for messages

The Send Slackbot Message card was removed as an option in 2020. It's fully deprecated as of April 16, 2025 for Preview cells and April 22, 2025 for Production cells. You must update any flows using this card to avoid errors. You can remove the action card from your flows or replace them with the Send Message to Channel card.

Disable execution log streaming by default

Previously, when you enabled and configured the Execution Log Streaming feature, all new flows had log streaming enabled by default. Now, you can set log streaming to be disabled by default for all new flows. You can enable or disable log streaming for individual flows from the Flow Builder interface. See Configure Execution Log Streaming and Manage Execution Log Streaming for individual flows.

Workflows templates

The following Okta Workflows templates are now available:

Bulk convert users to lite-users

Governance for Okta Privileged Access server resource examples

The following Okta Workflows templates have been updated:

Temporarily exempt users from MFA - updates instructions for Okta Identity Engine.

Fixes in Okta Workflows

• OKTA-897273
  

  In some cases, the default scope selection wasn't retained when reauthorizing an existing connection.

• OKTA-857273
  

  Users couldn't save flows with an API Endpoint card if they were configured to use OAuth 2.0.

File size limit error message

Users received a "Not a valid import file" error when attempting to import folders over 10MB. Now a file size limit error displays when the limit is exceeded.

Fixes in Okta Workflows

• OKTA-847253
  

  The file size limit for a folder import has increased from 10MB to 27MB.

• OKTA-891681
  

  Users could select a polling frequency exceeding the 30-day limit.

• OKTA-847320
  

  Not all execution history results were shown when searching by User ID.

OAuth scope customization enabled for the Gmail connector

You can now specify custom scopes for OAuth connections to the Gmail connector in Okta Workflows.

When you create or reauthorize a connection, go to the Permissions tab in the connection window to specify the scopes. If you want to use the connector as previously configured, select Use Default Scopes. To use the customized scopes feature, specify the desired scopes in Customize scopes (advanced).

See Authorization.

Connector card retry policy improvements

The Okta, Okta Devices, and Okta Realms connector cards have been updated with a more precise retry policy. This reduces the number of API calls when the card encounters rate limit errors. See Workflows - Resilient Flow Design Practices.

Fixes in Okta Workflows

• OKTA-887114
  

  Users couldn't successfully execute the Run this card action in an If/ElseIf or Try/IfError function card.

• OKTA-876227
  

  When attempting to view the column properties of a Workflows table in certain scenarios, admins received continuous warnings to refresh the table.

New look and feel in Okta Workflows

The Workflows Console now provides a new look and feel, including redesigned side and top navigation menus and the addition of a gray background.

Coupa connector

The Coupa connector is now available in Okta Workflows with the following cards:

• Create Group

• Create Membership

• Create User

• Custom API Action

• List User Memberships

• Read Group

• Read User

• Search Groups

• Search Users

• Update Group

• Update Membership

• Update User

See the Coupa connector.

Updates to Cisco Identity Intelligence connector

The output of the Identity Intelligence Webhook card has been updated with the addition and removal of several fields. Review the Identity Intelligence Webhook documentation for details on the changed output fields. Update any flows that contain this card.

OAuth scope customization enabled for the Google Calendar connector

You can now specify custom scopes for OAuth connections to the Google Calendar connector in Okta Workflows.

When you create or reauthorize a connection, go to the Permissions tab in the connection window to specify the scopes. If you want to use the connector as previously configured, select Use Default Scopes. To use the customized scopes feature, specify the desired scopes in Customize scopes (advanced).

See Authorization.

Type Of function card now generally available in Workflows

The Type Of card identifies the data type of an API response value: Text, Number, True/False, Object, File, or Date & Time. This function is useful if you don't know what data type might be returned to your workflow. The Type Of card also detects List types, making it easier to handle dynamic data structures in your connector flows.

See the Type Of function card.

Connector Builder Base URL updates

For authorization of connectors in Connector Builder, the Base URL is no longer included. Also, the Token Path and Authorization Path fields must be fully qualified URLs instead of path values. See Use OAuth 2.0 Authorization Code.

Improvements to Okta Read User card

The Okta Read User card has been updated with a reduced retry period. This reduces execution times when the card encounters rate limit errors.

Accessibility improvements to Workflows

This release provides several improvements that increase adherence to accessibility standards in the Okta Workflows Console.

Fixes in Okta Workflows

• OKTA-874512
  

  The Record Limit field on the List Users card for the Zoho Mail connector didn't correctly return the number of streamed records if the limit was set to a value less than the number of available records.

Fixes in Okta Workflows

• OKTA-797353

  When viewing an Okta Workflows table, if you moved the horizontal scroll bar to the far right side, then the column headers became misaligned with their columns.

• OKTA-849781

  For polling monitors, when the remote service returned the fields defined in the Selected Outputs section, the objects were empty.

• OKTA-851430

  The Encode Component function card didn't support the | special character. Okta connector cards that searched for an attribute containing the | character returned a 400 Bad Request error.

• OKTA-864937

  In a new Okta Workflows table, the cell boundaries for a manually added row were misaligned.

• OKTA-867709

  In the Add app action dialog, the button to clear the Search apps input field or the Search actions input field didn't remove the search text.

Fixes in Okta Workflows

• OKTA-744284

  If an admin edited the column name of a table in two separate browser windows, this caused a 400 Bad Request error. The dialog for editing the column name showed a wait icon that never completed.