Okta Release Notes

Access Requests decision justification

Okta Identity Governance now supports configurable justification controls for access request decisions, providing requesters more transparency into their approvals and denials. Admins can configure the approval sequence or request type settings to include the decision justification field for approval tasks, allowing approvers the option to provide a rationale for their decision. All submitted justification text is captured on the request ticket and made available to the requester, providing insight into access decisions. See Request type settings.

Provisioning for Kong AI

Provisioning is now available for the Kong AI integration. See Integrate Kong AI with Okta.

Fixes

• When an import job reconciled existing active admin users, Okta incorrectly logged false ROLE_ASSIGNED_USER_ACTIVATION audit events. This issue created misleading records when no role changes occurred. (OKTA-1274235)

• The User Sources page loaded slowly if there was a large number of profile sources. (OKTA-1265698)

• When generating the Out-of-the-Box Admin Role Assignment report, the third-party admin status appeared inconsistently for users with multiple admin roles assigned through group memberships. (OKTA-1278183) …

Automatic tasks and questions reassignment after a manager change

To prevent access requests from being blocked during organizational changes, Okta Access Requests now automatically reassigns pending manager tasks and manager questions to an employee's new manager whenever a manager change occurs. This automated reassignment ensures that approvals proceed without manual IT intervention or delays, even if the previous manager's account has already been deactivated. This is available for requests built with both request conditions and request types.

Requester timeline view

Requesters can now view a detailed status timeline of their request's tasks directly from the Okta Access Request app. This enhanced visibility allows requesters to easily track the progress of their requests, see who has approved individual tasks, and identify remaining tasks, helping users stay informed throughout the approval process and reducing unnecessary status inquiries. The timeline is available for requests built with access request conditions.

Fixes

• When users updated the Okta Verify app on iOS devices, the System Log recorded multiple user.mfa.factor.update events within a single day. (OKTA-1215063)

• When an admin begin a user import for a single service account without an Okta user object, the profile sync process incorrectly updated all users in the Active Directory instance. (OKTA-1267422) …

Deployment date: August 31, 2026

Release summary

The following releases are now in Production:

Manual password configuration for resource credentials

You can now set passwords for Active Directory, SaaS, and Okta Universal Directory service accounts without triggering target system synchronization. This enhancement simplifies account migration and onboarding workflows while preserving continuous access to connected accounts.

The following releases are now in Preview:

Bulk password rotation for Active Directory accounts (EA)

Admins can now force password rotation for up to 100 Active Directory accounts simultaneously within a project. This enhancement streamlines daily administrative workflows by eliminating the need to rotate individual account passwords manually. See Bulk rotate Active Directory passwords.

Workload access control for secrets

Security admins can now extend least-privilege access controls to machine identities by assigning workload roles to secret policies. This allows workloads to perform operations on secrets while generating individual workload audit logs for tracking.

Deployment date: August 25, 2026

Release summary

The following releases are now in Production:

Static JWKS support for JWT Workload Connectors

Admins operating in private or air-gapped environments can now configure a JWT Workload Connector using static JWKS content. This enables secretless workload authentication for high-security on-premises systems without requiring public key discovery endpoints. See Workloads.

API key authentication for Okta Privileged Access workload identities

Security admins can now create and manage API key connectors and issued secrets for workload identities. This allows legacy and non-OIDC workloads to authenticate securely to Okta Privileged Access. See Workloads.

Deployment date: August 20, 2026

Release summary

The following releases are now in Preview:

Static JWKS support for JWT Workload Connectors

Admins operating in private or air-gapped environments can now configure a JWT Workload Connector using static JWKS content. This enables secretless workload authentication for high-security on-premises systems without requiring public key discovery endpoints. See Workloads.

API key authentication for Okta Privileged Access workload identities

Security admins can now create and manage API key connectors and issued secrets for workload identities. This allows legacy and non-OIDC workloads to authenticate securely to Okta Privileged Access. See Workloads.

Deployment date: August 12, 2026

Release summary

The following releases are now in Production:

Credential version history

Okta Privileged Access users can now reveal credential version history for secrets, Active Directory accounts, SaaS app accounts, and Okta Universal Directory accounts. See the Okta Privileged Access user guide.

New System Log events

New System Log events, pam.identity_key.create and pam.identity_key.rotate, are now available for Okta Privileged Access. These events allow admins to audit when per-team identity keys are created and rotated. See the Event Types.

Device assurance OS version update

The following OS versions are now supported in device assurance policies: Android 14, 15, 16, 17 (2026-08-01)

New IP service categories for enhanced dynamic zones

Several new IP service categories are now supported as an individual VPN service category in enhanced dynamic zones. See Supported IP categories.

Cross App Access support for AI agents and apps for all customers

Use XAA to secure access between custom SSO-agentic requesting apps and SSO resource apps. XAA enables customers to connect AI agents and apps to take action on behalf of a user, and removes the need for user consent at runtime. The XAA connection is managed by Okta admins, providing them with visibility and control over which actions an AI agent can take on behalf of a user across the supported OIDC and SAML SSO protocols.

• For the agentic requesting app configuration, see Add AI agents manually, and select your SSO agentic app in User access > App used for access configuration.
• For the XAA resource app configuration, see Configure resource server connectors. If you're configuring an OIN resource app, it must already have XAA enabled. …

Version: 2026.09.0

New IP service categories for enhanced dynamic zones

Several new IP service categories are now supported as an individual VPN service category in enhanced dynamic zones. See Supported IP categories.

Okta On-Prem MFA agent version 1.8.7

This version includes security enhancements.

Radius Agent version 2.27

This version includes internal improvements and fixes.

JA4 TLS fingerprinting

Okta now captures JA4 TLS client fingerprints across Syslog event types (securityContext.tlsFingerprint.ja4 pr), instead of just a curated subset. This includes telephony events (for example, OTP/SMS delivery) along with sign-in, auth, and token events. This provides customers and Okta's security teams with fingerprint-level visibility to spot bot traffic, toll fraud, and other TLS-based attack patterns that IP/user-agent signals miss on their own.

This is not yet available for orgs on custom-hosted domains.

Enhanced import monitoring with real-time updates

You can now view real-time progress for imports from the Import Monitoring dashboard. This provides greater visibility into the current status of in-progress imports such as the number of data chunks currently being processed.

Copy email from-addresses to the default brand domain …

CIMD for AI agents

You can now register AI agents with a CIMD so that they can identify themselves with a URL instead of a static client ID. See About Client ID Metadata Documents (CIMD).

UI update for MCP server scopes

Now when you add custom scopes to an MCP server, the list of scopes appears in a separate dialog. See Add an MCP server manually.

Automatic tasks and questions reassignment after a manager change

To prevent access requests from being blocked during organizational changes, Okta Access Requests now automatically reassigns pending manager tasks and manager questions to an employee's new manager whenever a manager change occurs. This automated reassignment ensures that approvals proceed without manual IT intervention or delays, even if the previous manager's account has already been deactivated. This is available for requests built with both request conditions and request types.

Requester timeline view …

Unique MCP server names

When you register an MCP server, it must now have a unique display name. 

Sign-In Widget, version 7.49.1

For details about this release, see Sign-In Widget Release Notes. For more information about the widget, see Okta Sign-In Widget.

Automatic phishing resistance for FastPass in authentication chains

When you include Okta FastPass in an authentication method chain, the Phishing resistant characteristic is now selected by default. 

Access Requests decision justification

Okta Identity Governance now supports configurable justification controls for access request decisions, providing requesters more transparency into their approvals and denials. Admins can configure the approval sequence or request type settings to include the decision justification field for approval tasks, allowing approvers the option to provide a rationale for their decision. All submitted justification text is captured on the request ticket and made available to the requester, providing insight into access decisions. See Request type settings.

Provisioning for Kong AI

Provisioning is now available for the Kong AI integration. See Integrate Kong AI with Okta.

Editable resource URL for MCP servers …

Features and Enhancements

Access Requests decision justification

Okta Identity Governance now supports configurable justification controls for access request decisions, providing requesters more transparency into their approvals and denials. Admins can configure the approval sequence or request type settings to include the decision justification field for approval tasks, allowing approvers the option to provide a rationale for their decision. All submitted justification text is captured on the request ticket and made available to the requester, providing insight into access decisions. See Configure an approval sequence and Request type settings.

Fixes

• Warnings and errors weren't propagated to Slack for campaigns in the STAGING_FAILED state. (OKTA-1272033)

• On rare occasions, the start date of a staged campaign was blank in Slack when staging started shortly after the campaign was eligible. (OKTA-1273337)

Previous releases

Features and Enhancements

Stage certification campaigns before launch

Staging a campaign lets you preview target users, resources, and reviewer assignments in advance to ensure accurate scope, fix configuration errors, and guarantee that requests reach the correct reviewers from day one. See Stage a campaign.

This is an Early Access release. See Enable self-service features.

Requester timeline view

Requesters can now view a detailed status timeline of their request's tasks directly from the Okta Access Request app. This enhanced visibility allows requesters to easily track the progress of their requests, see who has approved individual tasks, and identify remaining tasks, helping users stay informed throughout the approval process and reducing unnecessary status inquiries. The timeline is available for requests built with access request conditions.

Automatic tasks and questions reassignment after a manager change …