Okta Workflows release notes (2023)

Important updates to monday.com connector

The monday.com connector has been updated to support the company's latest API version. The new API changes the type for all fields that specify an identifier, migrating from a number to a string type.

This is a breaking change that impacts all monday.com action cards and the CAPIA card. To maintain functionality, you must replace any existing monday.com cards in your workflows with the new versions of the cards. The underlying functionality of the cards remains unchanged.

See the monday.com connector.

Event cards added to Azure Active Directory connector

The Azure Active Directory connector has been updated with the addition of eight new event cards focused on group and user changes:

• Group Created

• Group Deleted

• Group Member Added

• Group Member Removed

• Group Updated

• User Created

• User Deleted

• User Updated

See Azure Active Directory connector.

Also note that Microsoft has rebranded Azure Active Directory as Microsoft Entra ID. This name change has no impact to the features or capabilities of this connector in Okta Workflows.

OpenAI connector now available

The OpenAI connector is now available in Okta Workflows with the following cards:

• Create Chat Completion
• Custom API Action

See OpenAI connector.

Updated Resource links for Workflows console

The Resources links on the home page of the Workflows console have been refreshed, and a new link for Online meetups has been added. Links are now separated into Documentation and Community sections to clarify the destination focus.

Scope enhancement

The Okta Workflows app now grants the okta.roles.read scope by default.

Authentication messages update

This release updates authentication messages to explicitly call out denial of access errors.

Updates to Save Data option in helper flows

Previously, helper flows inherited the Save Data setting of the root (top parent) flow that triggered the helper flow. This ignored any existing setting for the Save Data of the individual helper flow. The enhancement ensures that the Save Data setting for any helper flow is respected, regardless of the root flow setting.

Execution history enhancement for helper flows

The execution history view now shows a link to the relevant helper flow for any card that called a helper flow.

Streaming option added to the Jira List Issues card

The List Issues action card for the Jira connector now allows you to stream the output to a helper flow. This enhancement is useful for filtering results if the number of issues retrieved is more than the limit of 100 results returned by the Jira API.

The new design adds a Result Set option and Streaming and Search Criteria inputs.

This update also removes the Limit and Offset input fields. However, no change is required for existing flows that use these deprecated fields.

See Jira List Issues.

Updates to Jira Service Management connector

Several event and action cards in the Jira Service Management connector have been enhanced so you can manually enter the service desk and request type identifiers.

• New Request

• New Request in Queue

• Create Request

• Read Queue Requests

• Read Request

You can also specify the queue identifier as an input field in the Read Queue Requests card.

See the Jira Service Management connector.

Improvements to encryption function documentation

The help topics for the Okta Workflows encryption functions have been revised to improve technical accuracy and clarity. See Encryption.

Auth0 connector support for custom domains

The Auth0 connector now includes a Private Cloud option to support connections to tenants on a custom domain. See Authorization.

This change requires all customers to reauthenticate their Auth0 connections, even for existing connections that don't connect to a custom domain.

Name and description field limits

Flows, tables, and folders have a limit of 255 and 500 characters for the Name and Description fields, respectively.

Okta connector scopes updated

The list of scopes documented for the Okta connector has been updated to reflect all available scopes. See Guidance for Okta connector.

Yubico connector

The Yubico connector is now available in Okta Workflows with the following cards:

• Build Shipment Item

• Create Shipment Request

• Get Public Transport Keys and Signing Certificate

• Get Shipment Details

See Yubico connector.

Workflows templates

The Available Workflows templates page has been updated. Templates are now organized based on the connectors involved, and a link to the relevant GitHub page has been added for each template. You can submit your suggestions for new templates through the Okta Ideas website.

The following Okta Workflows templates are now available:

• Add Inactive Users to Marketo List for Remarketing

• Close Abandoned Accounts

• Create Contact in Salesforce

• Create Lead in Marketo

• Create ServiceNow Ticket for High Risk Login

• Link New Users to Existing Accounts Based on Email

See Available Workflows templates.

Workflows templates

Beginning November 1, 2023, Microsoft is removing support for the creation of new agent-based Windows Hybrid Runbook Workers for Azure Automation. The instructions for the Execute on-premises PowerShell with Okta Workflows template have been updated to reflect the change in the Azure configuration process.

Webhook events now available in Connector Builder

Until now, Connector Builder only supported the creation of workflow action cards. With this release, users can now create event cards for services that support a webhook framework.

Three new flow types are available in Connector Builder: a webhook event card, and cards for programmatic registration and deregistration of a service.

These flow types allow Connector Builder users to create even deeper integrations than previously possible and enable third parties to use webhooks to trigger a workflow just like the built-in Okta connector.

See Webhook event cards and Build a webhook event flow.

Client Credentials authentication supported in Connector Builder

Okta Workflows offers several authentication types for connecting to external services. However, the OAuth 2.0 Client Credentials grant type was missing. Customers had to manually retrieve and manage tokens by creating flows with client ID and client secrets kept in plain text.

To alleviate this scenario, Connector Builder now supports the use of the Client Credentials grant. This is sent through the HTTP basic authentication scheme, either in the request header or body. Admins can securely store their credentials and no longer need to manually manage any tokens within flows.

This feature is only supported in Connector Builder and doesn't currently support using JSON Web Tokens (JWTs) for authentication. See Use OAuth 2.0 Client Credentials.

Updates to Workflows navigation interface

This release contains minor visual improvements to the new Workflows navigation bar and card headers, as well as updates to icons and colors for some cards.

Okta Workflows available for Free Trial Options

Okta Workflows is now available as part of the Workforce Identity Cloud Free Trial plan in both production and preview orgs. This offering includes five active flows, with up to 1,000 executions. See Workflows system limits.

Auth0 connector now available

The Auth0 connector is now available in Okta Workflows with the following cards:

• Create User

• Custom API Action

• Delete User

• Link Account

• Read User

• Search Users

• Update User

See Auth0 connector.

User interface improvements

The appearance of the API endpoint settings dialog that appears when you trigger a workflow through a Custom API event card has been updated.

Workflows templates

The following Okta Workflows templates are now available:

• Implementing Anything-as-a-Service (XaaS) with Personio

• Implementing Anything-as-a-Service (XaaS) with SmartHR

See Available Workflows templates.

Okta Workflows available for Free Trial Options

Okta Workflows is now available as part of the Workforce Identity Cloud Free Trial plan in both production and preview orgs. This offering includes five active flows, with up to 1,000 executions. See Workflows system limits.

Auth0 connector now available

The Auth0 connector is now available in Okta Workflows with the following cards:

• Create User

• Custom API Action

• Delete User

• Link Account

• Read User

• Search Users

• Update User

See Auth0 connector.

Workflow builder enhancements

On the Workflows navigation bar, the order of the Execution History and Flow Chart tabs has changed.

The Resources section of the Workflows console landing page now contains a link to the Workflows Builder community.

The Cancel Flow Execution button has been updated and the redundant notification message removed.

Google Docs connector updated

The connector has been updated to reflect the latest scopes available from Google Docs. Okta recommends that Workflows admins reauthenticate any Google Docs connections to ensure these connections are referencing the latest scopes.

See Google Docs connector.

Office 365 Admin connector is now Azure Active Directory

The Office 365 Admin connector has been rebranded as Azure Active Directory to reflect the new name for this Microsoft product. Connections and card names have been automatically updated. No admin action is required for existing cards.

See Azure Active Directory connector.

Cancel flow execution is now available

The new Cancel Flow Execution feature provides Workflow administrators the ability to stop any in-progress workflow executions. Previously, admins had to submit support tickets to cancel any long-running executions. Admins can now cancel a flow execution from within the Workflows console, greatly reducing unnecessary support calls and simplifying the testing and debugging of flows. See Cancel a flow execution.

Updated design for the Workflows console navigation bar

The navigation bars within the Workflows console are updated to simplify and improve the user interface. The updated interface is present in both the main Workflows console and in Connector Builder. See Workflows Console.

Relative URL field updated for CAPIA cards

The Custom API Action card for the following connectors changed to reflect that the Relative URL must begin with a / character.

• Adobe User Management

• Advanced Server Access

• Airtable

• Asana

• Atlassian Admin

• AWS S3

• Box

• DataGrail

• DocuSign

• Dropbox for Business

• Duo Security Admin

• Evident ID

• Excel Online

• Freshservice

• GitHub

• Gmail

• Google Calendar

• Google Cloud Functions

• Google Drive

• Google Sheets

• Google Workspace Admin

• HubSpot CRM

• Jamf Pro Classic API

• Jira

• Jira Service Management

• Marketo

• Microsoft Teams

• Mixpanel

• Office 365 Admin

• Office 365 Calendar

• Office 365 Mail

• OneDrive

• Opsgenie

• Proofpoint

• Salesforce

• SendGrid

• ServiceNow

• Shopify

• Slack

• Slack Admin

• SmartRecruiters

• Smartsheet

• Zendesk

• Zoom

See the individual Custom API Action card documentation for these connectors.

Jira Service Management connector updated

The Request Updated event card for the Jira Service Management connector has been updated. For the Service Desk Key and Request Type ID fields, the new design allows you to manually enter your choice in the Options section of the card, or use the existing dropdown selection options. See Request Updated.

Salesforce connector updated

The Current User action card for the Salesforce connector has been updated. The Options for the Profile and Role fields now give you the option to either manually enter a value or use the existing dropdown selections when choosing the corresponding Input values. See Create User.

Workflows templates

The following Okta Workflows templates are now available:

• Subscribe to Microsoft alerts to notify admins of potential security issues

• Detect and respond to MFA fatigue attacks

See Available Workflows templates.

Okta connector limits details

The Workflows system limits help page now explains the specific rate limits that apply to the Okta connector. See Okta Connector.

Airtable connector updated

Airtable is deprecating connections authorized using an API key in February 2024. The Airtable connector has been updated to allow for authentication using personal access tokens.

See Authorization.

Flow builder

Remote font loading removed

Fonts are now displayed more consistently across your Workflow cards.

Format URL function card updated

The protocol input on the Format URL function card now provides extra functionality.

monday.com connector now available

The monday.com connector is now available with the following cards:

• Add User to Board
• Archive Board
• Create Board
• Custom API Action
• Delete Board
• Delete User From Board
• List Boards
• Read Board
• Read User
• Search Users

See monday.com connector.

SFTP connector now available

The SFTP connector is now available with the following cards:

• Download File
• Upload File
• Write File

See SFTP connector.

Excel Online connector updated

The Excel Online connector has been updated to improve reliability.

Box connector updated

The Box connector has been updated on preview cells. Okta recommends that you reauthenticate your Box connection for all orgs on preview cells.

Submission details for Connector Builder

When you submit a version of your connector for publication through the OIN manager, the Connector Builder page now displays the submission date and its current status. See Submit your connector.

Subfolders are now available in Okta Workflows

Previously, Workflows users only have a single level of folders to organize their flows and tables. This leads to complex organizational methods for referencing folders using name or number conventions.

For more flexibility in structuring flow automations, users can now add up to four levels of nested subfolders inside each root-level folder. This allows users to organize their work by use case, application, or flow type, and create meaningful differentiation between various projects and automation relationships. See Folders and subfolders.

New System Log events for Workflows subfolders

Along with the new subfolders feature, the Okta System Log now displays the following subfolders events for Okta Workflows:

• workflows.user.folder.create

  

• workflows.user.folder.rename

  

• workflows.user.folder.export

  

• workflows.user.folder.import

  

• workflows.user.table.schema.import

  

• workflows.user.table.schema.export

  

Improved messaging in Flow History

This enhancement clarifies the message provided to users in the Flow History bar when no matches are found through the search field, or when no previous flow executions exist.

UI enhancements for Workflows Console

Several minor user interface improvements are incorporated into the Workflows Console.

Change to in-app search functionality on FL10

This update removes the search functionality for in-app help content for Workflow organizations on the FL10 cell.

monday.com connector now available

The monday.com connector is now available with the following cards:

• Add User to Board
• Archive Board
• Create Board
• Custom API Action
• Delete Board
• Delete User from Board
• List Boards
• Read Board
• Read User
• Search Users

See monday.com connector.

SFTP connector now available

The SFTP connector is now available with the following cards:

• Download File
• Upload File
• Write File

See SFTP connector.

Excel Online connector updated

The Excel Online connector has been updated to improve reliability.

Submission details for Connector Builder

When you submit a version of your connector for publication through the OIN Manager, the Connector Builder page displays the submission details including the date of submission and the current status. See Submit your connector.

Limit for Connector Builder test submissions

You can now submit up to 100 test deployments in Connector Builder every day for each Workflow org. See Workflows system limits.

Jamf Pro API connector now available

The Jamf Pro API connector is now available in Okta Workflows with the following cards:

• Custom API Action

• Deploy macOS Package Using MDM

• Generate Bearer Token

• List Automated Device Enrollment Instances

• List Available Devices by Device Enrollment Instance ID

• List Available macOS and iOS Managed Software Updates

• List Computer Inventories

• List Jamf Pro Notifications

• List Managed Software Update Statuses by Device or Group

• List Managed Software Update Statuses

• List Mobile Device Inventories

• List Volume Purchasing Locations

• Read Computer Compliance Status

• Read Computer FileVault Recovery Key

• Read Computer Inventory

• Read Computer Recovery Lock Password

• Read Jamf Pro Device Statistics

• Read Mobile Device Compliance Status

• Read Mobile Device Inventory

• Redeploy Jamf Application

• Redeploy Jamf Management Framework

• Refresh Bearer Token

• Rename Mobile Device

• Restart Device

• Update Computer Inventory

• Update Mobile Device Inventory

See Jamf Pro API connector.

Jira Service Desk connector

The Jira Service Desk connector is now called the Jira Service Management connector to reflect the changed name for this product. There are no changes in functionality for existing Jira Service Desk cards.

Freshservice connector update

Freshservice announced the deprecation of username and password authentication as of May 31, 2023. After this date, any connections created using the Authorize By Credentials option on the Freshservice connector will stop working. To avoid errors in their Freshservice workflows, users should migrate their connections to use the Authorize By API Key option. See Deprecation of username and password-based basic authentication for API v2.

Workflows templates

The following Okta Workflows templates are now available:

• Invalidate anomalous Slack sessions

• Sync Okta group membership with Office 365 unified groups

• Encourage stronger MFA adoption

• Activate and deactivate accounts with notifications in Microsoft Teams

The following Okta Workflows templates have been updated:

• Generate unique Okta username with user import inline hooks: updates the template description.

• Manage Okta group membership based on profile attributes: updates the Pluck function card to use Profile.Name as the key name, instead of Name.

The following Okta Workflows templates are no longer available:

• Generate unique Okta usernames

• Modernize your access request management with Okta and Slack

See Available Workflows templates.

Personio connector now available

The Personio connector is now available in Okta Workflows with the following cards:

• List Employees
• Read Employee
• Update Employee

See Personio connector.

SmartHR

The SmartHR connector is now available in Okta Workflows with the following cards:

• List Business Establishments
• List Custom Field Groups
• List Custom Fields
• List Departments
• List Employment Types
• List Job Titles
• Read Employee
• Search Employees
• Update Employee

See SmartHR connector.

Workflows templates

The following Okta Workflows templates are now available:

• Invalidate anomalous Slack sessions

• Sync Okta group membership with Office 365 unified groups

• Encourage stronger MFA adoption

• Activate and deactivate accounts with notifications in Microsoft Teams

• Use Okta Workflows for Pendo metadata sync

The following Okta Workflows templates have been updated:

• Generate unique Okta username with user import inline hooks: update the template description.

• Manage Okta group membership based on profile attributes: update the Pluck function card to use Profile.Name as the key name, instead of Name.

The following Okta Workflows templates are no longer available:

• Generate unique Okta usernames

• Modernize your access request management with Okta and Slack

See Available Workflows templates.

UI enhancement for low-latency mode

In the Flow History view, cards now display an icon indicating whether the card ran in low-latency mode, along with the execution time for the card.

Admins can hover over the icon to see the reason why a card was removed from low-latency mode.

Kandji connector update

The Kandji connector for Okta Workflows has been updated with the following new cards:

• Get ADE Integration
• List ADE Integrations
• List ADE Devices
• Play Lost Mode Sound
• Set Device Name
• Turn Off Lost Mode
• Turn On Lost Mode
• Update Lost Mode Location

The List Devices card has been deprecated and replaced by a new card with the same name.

See Kandji connector.

OIN Manager supports Connector Builder submissions

You can now publish Okta Workflows connectors that you create with the Connector Builder into the Okta Integration Network (OIN) catalog. Publishing a Workflows connector allows your customers to deeply integrate your product with all other connectors in the catalog. Submit your connector using the OIN Manager. See Submit an integration for Workflows connectors.

Okta connector update

The Okta connector for Workflows has been updated with the following new cards:

• Group Push Failed

• Activate Application

• Deactivate Application

• Delete Application

See Okta connector.

Secure Code Warrior

The Secure Code Warrior connector has been updated with the following card:

• Disable User

See Secure Code Warrior connector.

New templates

The following Okta Workflows templates are now available:

• Detect suspicious MFA push notifications

• Monitor unsuccessful phishing attempts

See Available Workflows templates.

Shopify connector update

The Shopify connector has been updated to accommodate recent changes in the Shopify API. This connector change includes functional changes to Shopify action cards and means you must replace existing cards in your flows. See the Shopify Connector Migration Guide.

This change impacts the following cards:

• Create Customer

• Read Customer

• Search Customers

• Update Customer

• Custom API Action

See Shopify connector.

New feedback mechanism for Flow Designer

The mechanism for submitting suggestions in the Flow Designer now follows a more streamlined process. If you want to suggest a new function, template, app connection, or app action, Flow Designer points you directly into the Okta Ideas site. Through the Ideas site, you can provide all the relevant details and it routes your suggestion to the appropriate Okta product team for evaluation.

As part of this enhancement, the Send Feedback option in the Help dropdown menu is now Send product feedback.

Dropbox for Business

The Dropbox for Business connector has been enhanced with the addition of the following cards:

• Add User to Group
• Create Group
• Delete Group
• Read Group
• Remove User from Group
• List Group Members
• List Groups
• List Users
• Update Group

Other enhancements to this connector:

• The Get User card has been renamed as Read User. The Get User card remains functional in existing flows. However, when adding an instance of this card from within the Dropbox for Business connector, it appears as Read User.
• The User ID field has been relabeled as ID for the following cards:

  • Read User

  • Remove User

  • Suspend User

  • Unsuspend User

  • Update User

See Dropbox for Business connector.

Connector Builder is GA in Production

Customers want more out-of-the-box connectors for the Okta Workflows platform that support their identity use cases and improve their overall time-to-value.

Okta WorkflowsConnector Builder is a no-code development tool for third parties and customers to create connectors using the same drag-and-drop functionality they use when building flows.

The following features are available to build a connector:

• Add connector branding

• Define authentication

• Build action cards, including a Custom API Action card

• Deploy a new connector locally for internal use

• Submit to Okta Integration Network for review and publication

Connector Builder gives customers faster access to more local connectors. Submitting new connectors helps the Okta Integration Network ecosystem to deliver more value to all Workflows users. See Connector Builder.

Improved connector deployment and submission interface

The user interface for deploying a connector created with the Okta Workflows Connector Builder has been streamlined for simplicity and ease of use. The submission process for submitting connectors to the Okta Integration Network has also been improved. See Connector Builder submissions.

Workflows folder enhancements

The usability of Workflows folders has been improved through the following changes:

• You can now perform folder operations from an Actions menu inside the folder page.

• You can add an optional description for a folder.

• Additional usability improvements to both the sidebar menu and to folder operations dialogs.

Connector authentication enhancement

When creating a connection, the Base URL field for authentication is now optional. If the Base URL field is empty, the Authorize Path and Token Path fields need to be fully qualified URLs. However, if the Base URL is included, those two paths only need to be relative URLs. See Build OAuth 2.0 authentication.

Sidebar usability improvements

The Workflows console has been enhanced to improve usability and functionality. You can now click and drag the folder panel width to improve visibility of folder names.

Improvement to flow search history

When searching flow history, Workflows users can now access beyond the first 150 execution results. See View flow execution history.

Zoom connector updated

As of February 14, 2023, Zoom no longer accepts the access token, refresh token, or revoke token in the URL query parameters of an API request. The Zoom connector has been updated to version 1.0.60 to support these API changes. Replace any existing Zoom cards in your flows with the newer versions and re-authenticate your Zoom connection. See the Zoom release notes regarding this change.

Okta connector update

For the Okta connector, the following webhook event cards are now available:

• Access Request Created
• Access Request Resolved

See Okta connector event cards.

Google Workspace Admin connector update

For the Google Workspace Admin connector, the following action cards are now available:

• Read Group Settings
• Update Group Settings

When you launch the Google Workspace Admin connector, the OAuth consent page shows an "unverified app" warning because of the new apps.groups.settings scope. This warning disappears after Google approves the app and is only seen for new connections.

See Google Workspace Admin connector.