Okta for AI Agents

No entries match these filters. Clear filters

1. changelog Oct 28, 2026 · issue 123

   Okta adds mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. for OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. apps, authenticator enrollment sets, Sumo Logic/Cloudflare provisioning, and DBSSO visibility for macOS⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Verify that a managed macOS device's users have active device-bound sessions without switching between multiple admin screens.
   📍In the Admin Console, go to Devices, select a managed macOS device, and open the device details page. The new Device Bound SSO card shows the DBSSO session status for each OS-level user account on that device alongside their Platform SSO and Okta FastPass enrollment status.
   • Adds mTLS client authentication for OIDC apps, issuing access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. cryptographically bound to a client certificate so stolen tokens cannot be reused without it — eliminating shared client secrets to store, share, or rotate.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds authenticator enrollment sets, letting admins define groups of authenticators and require a subset (e.g. two of three) or let end users choose which authenticator to enroll, replacing the flat required/optional/disabled model.
   • Adds a Device Bound SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. (DBSSO) card to the device details page for managed macOS devices, showing DBSSO session status per OS-level user account alongside existing Platform SSOPlatform SSOA macOS framework from Apple that lets identity providers hook into the operating system login flow, enabling enterprise single sign-on at the platform level rather than per-app. and Okta FastPass enrollment status.
   • Adds new OINOINOpen Invention Network, a non-profit patent consortium that acquires patents and licenses them royalty-free to members, shielding Linux and related open-source software from patent litigation. integrations: Sumo Logic provisioning (by Actions, covering user create, update, deactivate/delete, and role assignment across Sumo Logic regional deployments), Cloudflare provisioning, LeakData Shared Signals (API Service Integration), Ollet (IDV), Ready Room (OIDC), Crossbeam (SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider.), Guru (SAML) and Guru (SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave.), and Brava Security (SCIM).
   • Updates the MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server registration UI to match the AI agent and Agent Gateway management experiences, providing a consistent workflow for registering and configuring MCP servers.
   • Adds mTLS client authentication for OIDC apps, issuing access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. cryptographically bound to a client certificate so stolen tokens cannot be reused without it — eliminating shared client secrets to store, share, or rotate.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds authenticator enrollment sets, letting admins define groups of authenticators and require a subset (e.g. two of three) or let end users choose which authenticator to enroll, replacing the flat required/optional/disabled model.
   • Adds a Device Bound SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. (DBSSO) card to the device details page for managed macOS devices, showing DBSSO session status per OS-level user account alongside existing Platform SSOPlatform SSOA macOS framework from Apple that lets identity providers hook into the operating system login flow, enabling enterprise single sign-on at the platform level rather than per-app. and Okta FastPass enrollment status.
   • Adds new OINOINOpen Invention Network, a non-profit patent consortium that acquires patents and licenses them royalty-free to members, shielding Linux and related open-source software from patent litigation. integrations: Sumo Logic provisioning (by Actions, covering user create, update, deactivate/delete, and role assignment across Sumo Logic regional deployments), Cloudflare provisioning, LeakData Shared Signals (API Service Integration), Ollet (IDV), Ready Room (OIDC), Crossbeam (SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider.), Guru (SAML) and Guru (SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave.), and Brava Security (SCIM).

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The Managed connection tab on the app instance page in the Admin Console has been removed. Existing Cross App Access configurations using Managed Connection will stop working soon — reconfigure connections using Cross App Access before the cutover to avoid disruptions.
2. changelog Oct 20, 2026 · issue 114

   Okta 2026.41.0 adds NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. badge auth, AI agent imports from Snowflake/Workato/Cursor, PowerShell-on-AD, and self-service registration fraud controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Block self-service sign-ups from disposable email domains under the ITP self-service registration policy to reduce fake account creation.
   📍In the Admin Console, go to Security › User Profile Policies, open the self-service registration policy, and add a rule targeting disposable/throwaway email domains or specific network zones to set the action to Deny.
   • Adds new System Log events: system.sms.receive_status and system.voice.receive_status when custom telephony providers report SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels./voice delivery status, and certification.campaign.stage.start/certification.campaign.stage.end for Access CertificationAccess CertificationA periodic review process in which managers or system owners confirm or revoke which users should retain access to systems and data, reducing privilege creep over time. campaign staging, with outcome.result reporting SUCCESS or FAILURE.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Enables PowerShell script execution in on-premises Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. environments via the Active Directory agent, invocable through Okta Workflows using the Okta public API.
   • Adds NFC authenticator support for orgs with Adaptive MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone., allowing frontline workers to tap an NFC badge and enter a PIN to sign in on shared Windows workstations.
   • Introduces app branding migration, letting eligible orgs stage, preview, and deploy Identity Engine on an app-by-app basis while preserving Classic Engine customizations — with per-app rollback instead of org-wide rollback.
   • Adds a self-service registration policy on the User Profile Policies page for Identity Threat Protection customers, enabling rules to automatically deny sign-ups from disposable email domains or specific network zones.

   +5 more show less

   • Introduces user identification policy rules so admins can control whether the Sign in with Okta FastPass button appears on an app-by-app basis instead of a single org-wide setting.
   • Introduces OINOINOpen Invention Network, a non-profit patent consortium that acquires patents and licenses them royalty-free to members, shielding Linux and related open-source software from patent litigation. Community Integrations (Early Access), publishing integrations built from public APIs to the Okta Integration Network as Community Preview, advancing to Community Verified once proven in production.
   • Adds support for importing and managing AI agents built in Snowflake, Workato, and Cursor directly through Okta.
   • Adds provisioning support for the Fleet End User Enrollment and Pipedrive integrations.
   • Adds a configurable passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. enrollment promotion nudge that prompts end users to enroll a passkey when signing in, with controls for re-prompt frequency and maximum skip count.
   • Adds new System Log events: system.sms.receive_status and system.voice.receive_status when custom telephony providers report SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels./voice delivery status, and certification.campaign.stage.start/certification.campaign.stage.end for Access CertificationAccess CertificationA periodic review process in which managers or system owners confirm or revoke which users should retain access to systems and data, reducing privilege creep over time. campaign staging, with outcome.result reporting SUCCESS or FAILURE.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Enables PowerShell script execution in on-premises Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. environments via the Active Directory agent, invocable through Okta Workflows using the Okta public API.
   • Adds NFC authenticator support for orgs with Adaptive MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone., allowing frontline workers to tap an NFC badge and enter a PIN to sign in on shared Windows workstations.
   • Introduces app branding migration, letting eligible orgs stage, preview, and deploy Identity Engine on an app-by-app basis while preserving Classic Engine customizations — with per-app rollback instead of org-wide rollback.
   • Adds a self-service registration policy on the User Profile Policies page for Identity Threat Protection customers, enabling rules to automatically deny sign-ups from disposable email domains or specific network zones.

   +4 more show less

   • Introduces OINOINOpen Invention Network, a non-profit patent consortium that acquires patents and licenses them royalty-free to members, shielding Linux and related open-source software from patent litigation. Community Integrations (Early Access), publishing integrations built from public APIs to the Okta Integration Network as Community Preview, advancing to Community Verified once proven in production.
   • Adds support for importing and managing AI agents built in Snowflake, Workato, and Cursor directly through Okta.
   • Adds provisioning support for the Fleet End User Enrollment and Pipedrive integrations.
   • Adds a configurable passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. enrollment promotion nudge that prompts end users to enroll a passkey when signing in, with controls for re-prompt frequency and maximum skip count.

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !RADIUSRADIUSA networking protocol for centralised authentication, authorisation, and accounting of users connecting to a network, maintained under IETF standards. Cyber tools use it to integrate with existing enterprise identity infrastructure. Agent 2.28 changes the default client access behavior — new installations no longer accept RADIUS connections without an explicitly configured client IP allowlist.
3. changelog Oct 5, 2026 · issue 095

   Adds CIMDCIMDA text-based Short Message Service protocol from Nokia for exchanging SMS messages between applications and SMS centers, used to build tools that send, receive, or test carrier messaging flows.-based AI agent identity, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server scope dialog, automatic manager-change reassignment in Access Requests, and a requester timeline view.

   • Enables AI agents to register with a Client ID Metadata Document (CIMD) so they can identify themselves with a URL instead of a static client ID.
   • Adds a separate dialog for listing custom scopes when adding scopes to an MCP server.
   • Automatically reassigns pending manager tasks and manager questions to an employee's new manager when a manager change occurs in Okta Access Requests, covering both request conditions and request types.
   • Adds a requester timeline view in the Okta Access Request app showing task progress, approvers, and remaining tasks for requests built with access request conditions.

   4 details in Everything

   • New integration Atomicwork SAML integration
   • New integration Entrust IDV integration
   • New integration MongoDB Atlas SCIM 2.0 Provisioning integration
   • New integration StitchOps OIDC integration
   • New integration Databricks AI agent import
4. changelog Oct 4, 2026 · issue 094

   Adds CIMDCIMDA text-based Short Message Service protocol from Nokia for exchanging SMS messages between applications and SMS centers, used to build tools that send, receive, or test carrier messaging flows. URL-based identity for AI agents, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server scope dialog, automatic manager-change reassignment for access requests, and a requester timeline view.

   • Adds CIMD (Client ID Metadata Document) support for AI agents, letting agents identify themselves with a URL instead of a static client ID.
   • Adds a separate dialog for custom MCP server scopes when adding scopes to an MCP server.
   • Adds automatic reassignment of pending manager tasks and manager questions to an employee's new manager on a manager change, preventing access-request blockage — works for both request conditions and request types.
   • Adds a requester timeline view in the Okta Access Request app, showing task status, individual approvals, and remaining tasks for requests built with access request conditions.

   4 details in Everything

   • New integration Atomicwork SAML OIN integration
   • New integration Entrust IDV OIN integration
   • New integration MongoDB Atlas SCIM 2.0 OIN integration
   • New integration StitchOps OIDC OIN integration
   • New integration Databricks AI agent import
5. changelog Sep 26, 2026 · issue 086

   Okta for AI Agents: Replaces Okta On-prem SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. Server agent with Okta On-prem SCIM agent, reducing dependencies and enabling new features.

   └──▷ HOW TO FIND IT
   Block access attempts originating from known malware proxy networks at the global session policy level.
   📍In the Admin Console, go to Security › Networks, open or create an Enhanced Dynamic Network Zone, add the MALWARE_PROXIES IP service category to the zone, then reference that zone in Security › Authentication Policies (or the Global Session Policy) with an Access denied action.
   Prevent analysts and contractors from authenticating through remote desktop sessions by excluding REMOTE_DESKTOP traffic in an app sign-in policy.
   📍In the Admin Console, go to Security › Networks, open or create an Enhanced Dynamic Network Zone, add the REMOTE_DESKTOP IP service category, then in Security › Authentication Policies select the relevant app policy and add a rule: 'If network zone is REMOTE_DESKTOP — Deny access'.
   └──▷ BREAKING ON UPGRADE

   • !Okta On-prem SCIM Server agent has been replaced by Okta On-prem SCIM agent — existing deployments relying on the old agent name or its dependencies will need to migrate to the new agent.
6. changelog Sep 25, 2026 · issue 085

   Okta 2026.09.0 adds AI agent identity management, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server DCR and OINOINOpen Invention Network, a non-profit patent consortium that acquires patents and licenses them royalty-free to members, shielding Linux and related open-source software from patent litigation. catalog, NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. authenticator, Linux Okta Verify, malware proxy detection, and a low-code sign-in customizer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Block access for sessions originating from known malware proxy networks by excluding MALWARE_PROXIES traffic in a global session policy.
   📍In the Admin Console, go to Security › Networks › Enhanced Dynamic Network Zones, create or edit a zone, add the MALWARE_PROXIES IP service category to the Exclude list, then reference that zone in your Global Session Policy rule to deny access.
   Block or step-up remote-desktop sessions by tagging REMOTE_DESKTOP traffic in an Enhanced Dynamic Network Zone and referencing it in an app sign-in policy.
   📍In the Admin Console, go to Security › Networks › Enhanced Dynamic Network Zones, create or edit a zone, add the REMOTE_DESKTOP IP service category to the Exclude list, then apply that zone to an app sign-in policy rule to deny or require step-up for remote desktop traffic.
   • Adds a REMOTE_DESKTOP IP service category to Enhanced Dynamic Network Zones, letting admins include or exclude remote-desktop traffic in global session and app sign-in policies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a MALWARE_PROXIES IP service category to Enhanced Dynamic Network Zones, powered by Okta CyberDefense, covering proxy services tied to malware and botnet activity (911 S5, NSOCKS, iProxy, BHProxies, and others).
   • Supports Dynamic Client Registration (DCR) when manually registering an MCP server — Okta automatically registers a client with the provider and populates credentials.
   • Enables adding MCP servers directly from the Okta Integration Network (OIN) catalog entry, without entering connection details manually.
   • Logs failed WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in. (FIDO2FIDO2The open standard behind passkeys and hardware security keys, where a website checks a signature from the user's device instead of a password. Because the key is bound to the site, phishing pages cannot use it.) enrollment attempts in the System Log using the user.mfa.factor.activate event, with debug data including AAGUIDAAGUIDA 128-bit identifier embedded in a FIDO2/WebAuthn authenticator that identifies the make and model of the device, letting relying parties enforce authenticator policy without tracking individual users., isBackupEligible, and matched authenticator groups.

   +16 more show less

   • Adds tool discovery for MCP server registration, letting admins test credentials and browse available tools at registration time.
   • Introduces the NFC authenticator for frontline workers on Windows shared workstations — users tap an NFC badge and enter a PIN to satisfy MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. without a phone, password, or shared account.
   • Adds unified identity management for AI agents: admins can now set an external identifier for uniqueness, configure creation and matching criteria for imported agents, and preview agents before registration.
   • Adds entitlement import safeguards per app, configurable with percentage-based or absolute count thresholds to prevent accidental role or license removal on user unassignment, with an optional block on imports that modify or delete entitlement schemas.
   • Introduces the Okta Integration Wizard (OIW) for creating and deploying custom app integrations with SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave., Entitlement Management, Universal Logout, API service integration, and custom API Integration Actions — usable as a template for multiple app instances.
   • Extends Okta Verify support to Linux desktop devices (Ubuntu 24.04 and 26.04) with phishing-resistant hardware-backed Okta FastPass authentication.
   • Adds Low-Code Sign In Customization, letting admins modify text, colors, and images in the Sign-In Widget and Interstitial authentication using a JSON templating language with syntax highlighting and suggestions, without editing code.
   • Adds Desktop MFA Factor Discovery for Windows, showing users only their enrolled MFA factors instead of all available factors.
   • Adds provisioning support for WordPress, Ivanti, Progress Chef, Vercel, and Sophos Cloud integrations.
   • Adds email notifications for Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. and LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. agent disruption and recovery, configurable in the Admin Console.
   • Adds On-prem Connector for Generic Databases support for high availability by assigning multiple Okta On-Premises SCIM Agents to a single app instance.
   • Adds incremental import support for the On-prem Connector for Generic Databases, retrieving only users and entitlement assignments changed since the last successful import.
   • Adds filtering by app type and status, search by name or client ID, last-modified-date view, and CSV export to the Applications page.
   • Increases Access Request limits: users per task or question to 25 (from 10), entitlement bundles in an access level condition to 1,000 (from 100), groups in an access level condition to 1,000 (from 500), request type configuration lists per org to 250 (from 100), and request types per org to 750 (from 500).
   • Increases the maximum realm assignments per profile source from 30 to 100.
   • Improves MCP server registration UI with updated scope handling and tool visibility.
   • Adds a REMOTE_DESKTOP IP service category to Enhanced Dynamic Network Zones, letting admins include or exclude remote-desktop traffic in global session and app sign-in policies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a MALWARE_PROXIES IP service category to Enhanced Dynamic Network Zones, powered by Okta CyberDefense, covering proxy services tied to malware and botnet activity (911 S5, NSOCKS, iProxy, BHProxies, and others).
   • Enables adding MCP servers directly from the Okta Integration Network (OIN) catalog entry, without entering connection details manually.
   • Adds tool discovery for MCP server registration, letting admins test credentials and browse available tools at registration time.
   • Introduces the NFC authenticator for frontline workers on Windows shared workstations — users tap an NFC badge and enter a PIN to satisfy MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. without a phone, password, or shared account.

   +8 more show less

   • Adds entitlement import safeguards per app, configurable with percentage-based or absolute count thresholds to prevent accidental role or license removal on user unassignment, with an optional block on imports that modify or delete entitlement schemas.
   • Introduces the Okta Integration Wizard (OIW) for creating and deploying custom app integrations with SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave., Entitlement Management, Universal Logout, API service integration, and custom API Integration Actions — usable as a template for multiple app instances.
   • Extends Okta Verify support to Linux desktop devices (Ubuntu 24.04 and 26.04) with phishing-resistant hardware-backed Okta FastPass authentication.
   • Adds Low-Code Sign In Customization, letting admins modify text, colors, and images in the Sign-In Widget and Interstitial authentication using a JSON templating language with syntax highlighting and suggestions, without editing code.
   • Adds provisioning support for WordPress, Ivanti, Progress Chef, Vercel, and Sophos Cloud integrations.
   • Adds email notifications for Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. and LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. agent disruption and recovery, configurable in the Admin Console.
   • Adds On-prem Connector for Generic Databases support for high availability by assigning multiple Okta On-Premises SCIM Agents to a single app instance.
   • Adds incremental import support for the On-prem Connector for Generic Databases, retrieving only users and entitlement assignments changed since the last successful import.

   8 more in Everything

7. changelog Sep 24, 2026 · issue 084
   └──▷ HOW TO FIND IT
   Block sign-ins originating from known malware proxy networks by adding MALWARE_PROXIES as an excluded category in an Enhanced Dynamic Network Zone, then referencing that zone in your global session policy.
   📍In the Admin Console, go to Security › Networks, open or create an Enhanced Dynamic Network Zone, add MALWARE_PROXIES to the excluded IP service categories, save the zone, then reference it in Security › Global Session Policy to deny access from those networks.
   Surface failed WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in. enrollment attempts — including authenticator model and backup-eligibility — so you can identify which hardware keys are failing rollout.
   📍In the Admin Console, go to Reports › System Log, filter by event type user.mfa.factor.activate, and inspect the debug context for fields AAGUID, isBackupEligible, and matched authenticator groups to pinpoint failing authenticator models.
   Add an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server from the OINOINOpen Invention Network, a non-profit patent consortium that acquires patents and licenses them royalty-free to members, shielding Linux and related open-source software from patent litigation. catalog without manually entering connection details, so new AI agent tool integrations can be onboarded quickly.
   📍In the Admin Console, go to Applications › AI Agents › MCP Servers, click Add MCP Server, choose Add from OIN catalog, search for the integration, and select it to auto-populate connection details.
8. changelog Sep 23, 2026 · issue 083
   └──▷ HOW TO FIND IT
   Block access attempts originating from known malware proxy networks at the global session policy level.
   📍In the Admin Console, go to Security › Networks, open or create an Enhanced Dynamic Network Zone, add the MALWARE_PROXIES IP service category to the zone, then reference that zone in Security › Global Session Policy to deny access for matching traffic.
   Prevent analysts connecting via remote desktop from accessing sensitive apps, without affecting direct corporate network logins.
   📍In the Admin Console, go to Security › Networks, open or create an Enhanced Dynamic Network Zone, add the REMOTE_DESKTOP IP service category, then add a deny rule for that zone in the relevant app sign-in policy under Security › Authentication Policies.
   └──▷ BREAKING ON UPGRADE

   • !Okta On-prem SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. Server agent is replaced by Okta On-prem SCIM agent; existing deployments referencing the old agent name must migrate to the new agent.
9. docs update Sep 22, 2026 · issue 082

   Okta for AI Agents adds Agent Gateway runtime enforcement, Agent SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., shadow AI discovery, ephemeral credentialing, HITLHITLHuman in the loop, involving a person in an otherwise automated workflow. The person can review, approve, correct or supply information before work continues. guardrails, and FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one./HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against. compliance tiers for non-human identitiesnon-human identitiesA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Introduces Agent Gateway to verify agent identity, broker credentials at runtime, and log every tool call without code changes to agents or tools.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Agent Single Sign-On (SSO) to manage Cross-App Access agents in core SSO with centralized policies and full lifecycle governance.
   • Adds multi-surface shadow AI discovery that continuously scans browsers, managed endpoints, and cloud environments to uncover unvetted agents and unauthorized OAuth consent grants.
   • Registers discovered agents into Universal Directory alongside workforce users, assigning explicit human ownership, business purpose, and cryptographic credentials.
   • Issues ephemeral, secretless tokens and dynamically vaults credentials to eliminate static API keys and standing administrative access.

   +8 more show less

   • Adds prompt-level tool scoping to filter unauthorized MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools based on the delegating user's identity before the model executes, reducing schema token overhead by over 90%.
   • Adds Human-in-the-Loop (HITL) guardrails requiring step-up human approval before high-risk actions such as financial transactions, bulk database exports, or permission changes.
   • Enforces a programmatic kill switch to immediately revoke an agent's access with a full audit trail when unexpected behavior is detected.
   • Adds Identity Security Posture Management (ISPMISPMIdentity Security Posture Management: a discipline for continuously discovering, assessing, and remediating identity-related risks across users, accounts, and entitlements, giving cyber tools a unified view of identity exposure.) to evaluate the security posture of each agent identity across users, apps, and permissions.
   • Supports FedRAMP ModerateFedRAMP ModerateA US government authorization tier requiring cloud services to meet a defined set of NIST 800-53 controls before federal agencies can use them, giving cyber tools a pre-vetted compliance baseline for government contracts./High and DoD Impact Level 5 environments via the Okta for AI Agents Core SKU, covering agent registration, cryptographic authentication, lifecycle provisioning, and SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents.-integrated audit logging.
   • Supports HIPAA environments via the full Okta for AI Agents SKU, including ISPM and Okta Privileged Access (OPAOPAOpen Policy Agent, a CNCF-graduated policy engine that evaluates rules written in the Rego language against JSON-structured data, letting tools enforce authorization and compliance decisions without hardcoding logic.) capabilities.
   • Schedules automated access certification campaigns to continuously validate and revoke stale agent permissions as projects evolve.
   • Governs access to model registries, code repositories, and development environments to secure the broader MLOps supply chain.

   13 details in Everything

10. changelog Sep 22, 2026 · issue 082

    Okta 2026.09.0 adds AI agent identity management, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server DCR and OINOINOpen Invention Network, a non-profit patent consortium that acquires patents and licenses them royalty-free to members, shielding Linux and related open-source software from patent litigation. catalog support, NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. authenticator, Okta Verify for Linux, and malware proxy detection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Block access from known malware proxy networks by adding the MALWARE_PROXIES category to an Enhanced Dynamic Network Zone and denying it in the global session policy.
    📍In the Admin Console, go to Security › Networks, open or create an Enhanced Dynamic Network Zone, add MALWARE_PROXIES to the excluded IP service categories, then go to Security › Global Session Policy and add a rule that denies access when the network zone matches.
    Block remote-desktop originating traffic at the app sign-in policy level using the new REMOTE_DESKTOP IP service category.
    📍In the Admin Console, go to Security › Networks, open or create an Enhanced Dynamic Network Zone, add REMOTE_DESKTOP to the excluded IP service categories, then open the target app's Sign-on Policy and add a rule denying access when the zone matches.
    Register an MCP server from the OIN catalog to avoid manually entering connection details and immediately discover its available tools.
    📍In the Admin Console, go to Applications › MCP Servers, click Add MCP Server, select Add from OIN catalog, locate the provider entry, choose Dynamic Client Registration (DCR) as the registration method, and click Test credentials and discover tools to verify the connection.
    • Adds REMOTE_DESKTOP IP service category to Enhanced Dynamic Network Zones, letting admins include or exclude remote-desktop traffic in global session and app sign-in policies for precise access control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds MALWARE_PROXIES IP service category to Enhanced Dynamic Network Zones, powered by Okta CyberDefense, covering proxy services tied to malware and botnet activity (including 911 S5, NSOCKS, iProxy, and BHProxies).
    • Supports Dynamic Client Registration (DCR) when manually registering an MCP server — Okta automatically registers a client with the provider and populates credentials.
    • Enables adding MCP servers directly from an Okta Integration Network catalog entry, eliminating the need to enter connection details manually.
    • Adds tool discovery for MCP servers at registration time, letting admins test credentials and view available tools before completing setup.

    +19 more show less

    • Adds NFC authenticator support for frontline workers on Windows shared workstations — users tap an NFC badge and enter a PIN to meet MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. requirements without a phone, password, or shared account.
    • Extends Okta Verify with official Linux desktop support (Ubuntu 24.04 and 26.04), enabling phishing-resistant, hardware-backed Okta FastPass for Linux users.
    • Introduces the Okta Integration Wizard (OIW) to create and deploy custom app integrations configuring SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. provisioning, Entitlement Management, Universal Logout, API service integration, and custom API Integration Actions — reusable as a template across multiple app instances.
    • Adds unified identity for AI agents: admins can set an external identifier to enforce uniqueness, configure creation and matching criteria for imported AI agents, and preview imports before registration.
    • Adds Desktop MFA Factor Discovery for Windows, showing users only their enrolled MFA factors instead of a fixed list of all available factors.
    • Adds Low-Code Sign In Customization, letting admins modify text, colors, and images in the Sign-In Widget and Interstitial authentication using a JSON templating language with syntax highlighting and suggestions — no code editor required.
    • Logs failed WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in. (FIDO2FIDO2The open standard behind passkeys and hardware security keys, where a website checks a signature from the user's device instead of a password. Because the key is bound to the site, phishing pages cannot use it.) enrollment attempts in the System Log under the user.mfa.factor.activate event with debug data including AAGUIDAAGUIDA 128-bit identifier embedded in a FIDO2/WebAuthn authenticator that identifies the make and model of the device, letting relying parties enforce authenticator policy without tracking individual users., isBackupEligible, and matched authenticator groups.
    • Supports high availability for the On-prem Connector for Generic Databases by allowing multiple Okta On-Premises SCIM Agents to be assigned to a single app instance.
    • Adds incremental imports for the On-prem Connector for Generic Databases, retrieving only users and entitlement assignments changed since the last successful import.
    • Adds entitlement import safeguards configurable per app using percentage-based or absolute count thresholds to prevent accidental removal of app roles or licenses on user unassignment, with an option to block imports that modify or delete entitlement schemas.
    • Enhances the Applications page with filtering by type and status, search by name or client ID, last-modified-date view, and CSV export for audit-ready reports.
    • Adds email notifications for Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. and LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. agent disruption and recovery, configurable in the Admin Console.
    • Increases Access Request limits: users per task or question to 25 (from 10), entitlement bundles in an access level condition to 1,000 (from 100), groups in an access level condition to 1,000 (from 500), request type configuration lists per org to 250 (from 100), and request types per org to 750 (from 500).
    • Increases the maximum realm assignments per profile source from 30 to 100.
    • Adds provisioning support for WordPress, Ivanti, Progress Chef, Vercel, and Sophos Cloud integrations.
    • Updates MCP server registration UI with improved scope handling and tool visibility.
    • Updates the AI agent Client Registration tab to display authentication methods vertically with a Configure button linking to per-method configuration pages.
    • Replaces Okta On-prem SCIM Server agent with Okta On-prem SCIM agent, reducing dependencies and enabling new features.
    • Improves DBSSO device probing to use device-registered conditions from an app's sign-on policy instead of org-wide probing methods.
    • Adds REMOTE_DESKTOP IP service category to Enhanced Dynamic Network Zones, letting admins include or exclude remote-desktop traffic in global session and app sign-in policies for precise access control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds MALWARE_PROXIES IP service category to Enhanced Dynamic Network Zones, powered by Okta CyberDefense, covering proxy services tied to malware and botnet activity (including 911 S5, NSOCKS, iProxy, and BHProxies).
    • Enables adding MCP servers directly from an Okta Integration Network catalog entry, eliminating the need to enter connection details manually.
    • Adds tool discovery for MCP servers at registration time, letting admins test credentials and view available tools before completing setup.
    • Adds NFC authenticator support for frontline workers on Windows shared workstations — users tap an NFC badge and enter a PIN to meet MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. requirements without a phone, password, or shared account.

    +6 more show less

    • Extends Okta Verify with official Linux desktop support (Ubuntu 24.04 and 26.04), enabling phishing-resistant, hardware-backed Okta FastPass for Linux users.
    • Introduces the Okta Integration Wizard (OIW) to create and deploy custom app integrations configuring SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. provisioning, Entitlement Management, Universal Logout, API service integration, and custom API Integration Actions — reusable as a template across multiple app instances.
    • Adds Low-Code Sign In Customization, letting admins modify text, colors, and images in the Sign-In Widget and Interstitial authentication using a JSON templating language with syntax highlighting and suggestions — no code editor required.
    • Adds entitlement import safeguards configurable per app using percentage-based or absolute count thresholds to prevent accidental removal of app roles or licenses on user unassignment, with an option to block imports that modify or delete entitlement schemas.
    • Adds email notifications for Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. and LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. agent disruption and recovery, configurable in the Admin Console.
    • Adds provisioning support for WordPress, Ivanti, Progress Chef, Vercel, and Sophos Cloud integrations.

    13 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !Okta On-prem SCIM Server agent has been replaced by Okta On-prem SCIM agent — existing deployments referencing the old agent name must migrate to the new Okta On-prem SCIM agent.
11. changelog Sep 14, 2026 · issue 074

    Okta for AI Agents: Adds Marker.io by Redblock (SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave.) as a new integration in the Okta integration catalog.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

12. changelog Sep 12, 2026 · issue 072

    SAP Connector migrated to SCIM 2.0SCIM 2.0A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. API; Marker.io (SCIM) and Square OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. IdP-initiated SSOIdP-initiated SSOA single sign-on flow where the identity provider redirects an already-authenticated user directly to a service provider without the service provider first requesting authentication, removing the need for a separate login prompt. added.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • SAP integration has been migrated to use the SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. 2.0 API, with the connector's internal HTTP helper updated to support this standard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Marker.io by Redblock (SCIM) integration is now available.
    • Square (OIDC) now supports IdP-initiatedIdP-initiatedA SAML or OIDC login flow where the identity provider starts the session and pushes an assertion to the service provider without the user first requesting access, removing the SP-side redirect step. SSO flow.
    • SAP integration has been migrated to use the SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. 2.0 API, with the connector's internal HTTP helper updated to support this standard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Marker.io by Redblock (SCIM) integration is now available.

    1 more in Everything

13. changelog Sep 11, 2026 · issue 071

    Okta for AI Agents: Enables IdP-initiated SSOIdP-initiated SSOA single sign-on flow where the identity provider redirects an already-authenticated user directly to a service provider without the service provider first requesting authentication, removing the need for a separate login prompt. flow for the Square (OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.) integration.

14. changelog Sep 11, 2026 · issue 071

    Okta adds Marker.io (SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave.) and Square OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. IdP-initiated SSOIdP-initiated SSOA single sign-on flow where the identity provider redirects an already-authenticated user directly to a service provider without the service provider first requesting authentication, removing the need for a separate login prompt., plus migrates SAP connector to SCIM 2.0SCIM 2.0A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Migrates the SAP connector to use the SCIM 2.0 API, updating the connector's internal HTTP helper to support the standard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Marker.io by Redblock (SCIM) as a new app integration.
    • Adds IdP-initiatedIdP-initiatedA SAML or OIDC login flow where the identity provider starts the session and pushes an assertion to the service provider without the user first requesting access, removing the SP-side redirect step. SSO flow support for Square (OIDC).
    • Migrates the SAP connector to use the SCIM 2.0 API, updating the connector's internal HTTP helper to support the standard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Marker.io by Redblock (SCIM) as a new app integration.

    1 more in Everything

15. changelog Sep 2, 2026 · issue 062

    Okta adds JA4JA4A network fingerprinting method that hashes observable TLS handshake fields into a short, readable tag, giving cyber tools a stable, version-agnostic way to classify clients and detect anomalies. TLS fingerprinting across all Syslog events, manual MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server registration, and a new suspicious authenticator enrollment detection.

    └──▷ TRY IT
    Query the System Log to surface JA4 TLS fingerprints across all event types and identify bot or toll-fraud patterns that IP/user-agent signals miss.
    copy

    $ curl -s -H 'Authorization: SSWS <api_token>' \
      'https://<okta_domain>/api/v1/logs?filter=securityContext.tlsFingerprint.ja4+pr+"JA4:..."&limit=100'

    Register an internal MCP server that lacks automated metadata discovery by supplying authorization server details and client credentials manually.
    📍In the Admin Console, go to AI Agents › MCP Servers › Add MCP Server, select Manual registration, then enter the authorization server URL, client ID, and client secret for the internal or legacy MCP server.
    • Captures JA4 TLS client fingerprints in securityContext.tlsFingerprint.ja4 across all Syslog event types — including telephony (OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets./SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels.), sign-in, auth, and token events — enabling bot traffic, toll fraud, and TLS-based attack pattern detection beyond IP/user-agent signals alone. Not yet available for orgs on custom-hosted domains.
    • Adds Suspicious authenticator enrollment detection to Okta Identity Threat Protection (ITP), flagging suspicious activity during authenticator enrollment with details recorded in the System Log for investigation.
    • Adds manual MCP server registration, allowing admins to configure authorization server details and client credentials directly for internal or legacy MCP servers that don't support automated metadata discovery endpoints.
    • Adds interclient_access scope to the scope list for authorization servers.
    • Displays the authentication requirement for an app on the AI agent binding tab, with a direct link to the app's Sign On tab to configure an authentication policy.

    +2 more show less

    • Adds new OINOINOpen Invention Network, a non-profit patent consortium that acquires patents and licenses them royalty-free to members, shielding Linux and related open-source software from patent litigation. integrations: Flexopus (SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider.), Paminga (OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.), Paminga (SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave.), Upwave Lifecycle Management by Redblock (SCIM), Velantix Axiom (OIDC), and Velantix Axiom (SCIM).
    • Adds Application username format field to the Jamf Pro integration in the Admin Console by default, enabling custom mappings for the SCIM userName attribute.

    7 details in Everything

16. changelog Aug 26, 2026 · issue 057

    Okta for AI Agents gains Cross-App Access for agentic OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user./SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. apps, real-time import monitoring, and brand email copy-to-default.

    └──▷ HOW TO FIND IT
    Connect an AI agent to a resource app via XAA so the agent can act on behalf of users without runtime consent prompts.
    📍In the Admin Console, go to AI agents › select your agent › User access › App used for access configuration, choose Application as the resource type, then select your XAA-enabled resource app.
    • Adds Cross-App Access (XAA) support for AI agents and apps: admins can connect SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.-agentic requesting apps to SSO resource apps over OIDC and SAML without requiring user consent at runtime, with full admin visibility and control over which actions an AI agent can take on behalf of a user.
    • Adds User access tab configuration for AI agent access, replacing the previous Delegation tab delegation-link workflow; existing delegation links must be reconfigured using the User access tab.
    • Enables binding an AI agent with an OIDC SSO app so they share the same credentials, and allows admins to configure direct user authentication for the AI agent from that binding.
    • Adds real-time progress display on the Import Monitoring dashboard, showing the number of data chunks currently being processed for in-progress imports.
    • Adds new IP service categories supported as individual VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. service categories in enhanced dynamic zones.

    +5 more show less

    • Adds new OINOINOpen Invention Network, a non-profit patent consortium that acquires patents and licenses them royalty-free to members, shielding Linux and related open-source software from patent litigation. integrations: Airwallex (OIDC), Bold Group Stages (SAML), Gateco (SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave.), Orca Security (SAML), Orca Security (SCIM), Square (OIDC), Statsig Lifecycle Management Connector by Redblock (SCIM), Vimeo Lifecycle Management Connector by Redblock (SCIM), Briefly (OIDC), Briefly (SCIM), MicroWest Software Systems - AMMSWEB (SAML), MintMCP (SAML), Orchestra (OIDC), Orchestra (SCIM), Petual (SCIM), RansomLeak (SAML), RansomLeak (SCIM), Remote.com (SCIM).
    • Adds okta.schemas.read scope to Harmony (API Service Integration).
    • Adds okta.roles.read, okta.userTypes.read, okta.logs.read, and okta.groups.read scopes to Hero Integration.
    • Adds three new redirect URIs to OCCAM Razor (OIDC).
    • Adds Express Configuration support for Petual.

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Orgs that previously used the Delegation tab to configure AI agent access through delegation links must reconfigure them using the User access tab.
17. updated seen Aug 10, 2026 · issue 041

    Okta for AI Agents beta adds AI agent discovery for Microsoft Copilot Studio and an Agent Gateway

    • Enables Identity Security Posture Management (ISPMISPMIdentity Security Posture Management: a discipline for continuously discovering, assessing, and remediating identity-related risks across users, accounts, and entitlements, giving cyber tools a unified view of identity exposure.) to discover AI agents for Microsoft Copilot Studio
    • Introduces Endpoint AI agent discovery for identifying AI agents across endpoints
    • Adds Agent Gateway as a new beta capability within the Okta for AI Agents platform

    3 details in Everything