Okta Identity Governance Updates & Release Notes

Features and Enhancements

Access Requests decision justification

Okta Identity Governance now supports configurable justification controls for access request decisions, providing requesters more transparency into their approvals and denials. Admins can configure the approval sequence or request type settings to include the decision justification field for approval tasks, allowing approvers the option to provide a rationale for their decision. All submitted justification text is captured on the request ticket and made available to the requester, providing insight into access decisions. See Configure an approval sequence and Request type settings.

Fixes

• Warnings and errors weren't propagated to Slack for campaigns in the STAGING_FAILED state. (OKTA-1272033)

• On rare occasions, the start date of a staged campaign was blank in Slack when staging started shortly after the campaign was eligible. (OKTA-1273337)

Previous releases

Features and Enhancements

Stage certification campaigns before launch

Staging a campaign lets you preview target users, resources, and reviewer assignments in advance to ensure accurate scope, fix configuration errors, and guarantee that requests reach the correct reviewers from day one. See Stage a campaign.

This is an Early Access release. See Enable self-service features.

Requester timeline view

Requesters can now view a detailed status timeline of their request's tasks directly from the Okta Access Request app. This enhanced visibility allows requesters to easily track the progress of their requests, see who has approved individual tasks, and identify remaining tasks, helping users stay informed throughout the approval process and reducing unnecessary status inquiries. The timeline is available for requests built with access request conditions.

Automatic tasks and questions reassignment after a manager change …

Features and Enhancements

Configure access to the resource catalog is Generally Available in Preview environments

Previously, the ability to view resource catalog entry points, such as the Request Access button in the End-User Dashboard, was available to all users in an org by default. Now, admins can configure this visibility to allow all members of an org to view the entry points, no users to view them, or restrict entry point visibility to a specific set of Okta groups. For the Unified requester experience, this configuration also controls the Resource Catalog links and search options from the Okta Access Request app, Slack, and Microsoft Teams. See Configure resource catalog entry point visibility.

Certify AI agent resource connections is Generally Available in Production environments

You can review and certify AI agent resource connections using identity campaigns (formerly, user campaigns). This helps you maintain visibility and control as AI agents' access changes over time. See Create identity campaigns to certify resource connections.

Increased Access Request limits

The following Access Request limits have been increased:

• Users per task or question: 25 (previously 10)
• Entitlement bundles in an access level condition: 1,000 (previously 100) …

Features and Enhancements

Configure access to the resource catalog

Previously, the ability to view resource catalog entry points, such as the Request Access button in the End-User Dashboard, was available to all users in an org by default. Now, admins can configure this visibility to allow all members of an org to view the entry points, no users to view them, or restrict entry point visibility to a specific set of Okta groups. For the Unified requester experience, this configuration also controls the Resource Catalog links and search options from the Okta Access Request app, Slack, and Microsoft Teams. See Configure resource catalog entry point visibility.

Features and Enhancements

Access request admin action enhancements

Access request admins can now view and cancel requests, even if there are completed tasks associated with them.

Request Inbox updates in the Okta Access Requests app

Access request admins can now view all requests in the org from the Requests > Inbox page.

Fixes

• The following endpoints weren't visible in the Rate limit report:

  • /governance/api/v1/my/campaigns/{campaignId}/reviews
  • /governance/api/v1/my/campaigns/{campaignId}/reviews/actions
  • /governance/api/v1/my/campaigns/{campaignId}/reviews/bulk-decisions
  • /governance/api/v1/my/campaigns/{campaignId}/reviews/bulk-decisions/jobs/{jobId}

  (OKTA-1211609)

• The issuer URL value appeared in the Audience field of an AI agent connection campaign review instead of the resource indicator value. (OKTA-1239834)

Features and Enhancements

Certify AI agent resource connections is Generally Available in Preview environments

You can review and certify AI agent resource connections using identity campaigns (formerly, user campaigns). This helps you maintain visibility and control as AI agents' access changes over time. See Create identity campaigns to certify resource connections.

Governance Analyzer is Generally Available in Production environments

Governance Analyzer provides access certification campaign reviewers with insights and recommendations to make more informed decisions when approving or revoking user access. See Governance analyzer.

Certify service accounts is Generally Available in Production environments

You can now create resource campaigns to review and certify access for both SaaS application and Okta service accounts. This feature extends your governance strategy to non-human identities, helping you maintain visibility and control over critical service account access. See Certify service accounts.

Okta Workflows actions for request types is Generally Available in Production environments …

Features and Enhancements

Resource collections now support groups, push groups, and non-Entitlement Management apps

Resource collections can now be further customized for specific roles by allowing groups, push groups, and non-Entitlement Management apps to be included in a collection. This provides admins the ability to assign a wider set of resources required for a specific role to a collection, improving control over resources and reducing management overhead. See Resource collections.

This is an Early Access release. See Enable self-service features.

New filter in Active campaign details and Past campaign details reports

Use the Resource name filter in Active campaign details and Past campaign details reports to filter for all resources, including AI agents.

Fixes

• The Resource column was unavailable in the table of review items for active identity campaigns when the identity scope was users or groups. (OKTA-1226108)

• Users could make changes to Access Request integrations without the appropriate permissions. (OKTA-1218777)

Features and Enhancements

Self-review for Okta admin roles is Generally Available in Production environments

Allow or block campaign reviewers from approving or revoking their own access to Okta admin roles. While Okta prevents self-reviews in campaigns that govern Okta admin roles by default, this feature gives you the option to allow self-reviews. See Create campaigns to review admin roles.

Customize Justification Requirements is Generally Available in Production environments

Configure Justification Settings when you create or edit a campaign to get more granular control over when campaign reviewers must enter a justification for access decisions, including making it mandatory only for revoke decisions and optional for approve decisions. This helps you better align the reviewer experience with your org's specific compliance needs. See Create resource campaigns or Create identity campaign.

Okta Workflows actions for request types is Generally Available in Preview environments …