Okta Classic Engine Updates & Release Notes

Access Requests decision justification

Okta Identity Governance now supports configurable justification controls for access request decisions, providing requesters more transparency into their approvals and denials. Admins can configure the approval sequence or request type settings to include the decision justification field for approval tasks, allowing approvers the option to provide a rationale for their decision. All submitted justification text is captured on the request ticket and made available to the requester, providing insight into access decisions. See Request type settings.

Provisioning for Kong AI

Provisioning is now available for the Kong AI integration. See Integrate Kong AI with Okta.

Fixes

• When an import job reconciled existing active admin users, Okta incorrectly logged false ROLE_ASSIGNED_USER_ACTIVATION audit events. This issue created misleading records when no role changes occurred. (OKTA-1274235)

• The User Sources page loaded slowly if there was a large number of profile sources. (OKTA-1265698)

• When generating the Out-of-the-Box Admin Role Assignment report, the third-party admin status appeared inconsistently for users with multiple admin roles assigned through group memberships. (OKTA-1278183) …

Automatic tasks and questions reassignment after a manager change

To prevent access requests from being blocked during organizational changes, Okta Access Requests now automatically reassigns pending manager tasks and manager questions to an employee's new manager whenever a manager change occurs. This automated reassignment ensures that approvals proceed without manual IT intervention or delays, even if the previous manager's account has already been deactivated. This is available for requests built with both request conditions and request types.

Requester timeline view

Requesters can now view a detailed status timeline of their request's tasks directly from the Okta Access Request app. This enhanced visibility allows requesters to easily track the progress of their requests, see who has approved individual tasks, and identify remaining tasks, helping users stay informed throughout the approval process and reducing unnecessary status inquiries. The timeline is available for requests built with access request conditions.

Fixes

• When users updated the Okta Verify app on iOS devices, the System Log recorded multiple user.mfa.factor.update events within a single day. (OKTA-1215063)

• When an admin begin a user import for a single service account without an Okta user object, the profile sync process incorrectly updated all users in the Active Directory instance. (OKTA-1267422) …

Version: 2026.09.0

New IP service categories for enhanced dynamic zones

Several new IP service categories are now supported as an individual VPN service category in enhanced dynamic zones. See Supported IP categories.

Okta On-Prem MFA agent version 1.8.7

This version includes security enhancements.

Radius Agent version 2.27

This version includes internal improvements and fixes.

JA4 TLS fingerprinting

Okta now captures JA4 TLS client fingerprints across Syslog event types (securityContext.tlsFingerprint.ja4 pr), instead of just a curated subset. This includes telephony events (for example, OTP/SMS delivery) along with sign-in, auth, and token events. This provides customers and Okta's security teams with fingerprint-level visibility to spot bot traffic, toll fraud, and other TLS-based attack patterns that IP/user-agent signals miss on their own.

This is not yet available for orgs on custom-hosted domains.

Enhanced import monitoring with real-time updates

You can now view real-time progress for imports from the Import Monitoring dashboard. This provides greater visibility into the current status of in-progress imports such as the number of data chunks currently being processed.

Copy email from-addresses to the default brand domain …