https://cybertoolchain.io/tools/okta-for-ai-agents New releases and features in Okta for AI Agents, tracked by The Cyber Toolchain. en Wed, 28 Oct 2026 07:54:05 GMT https://help.okta.com/oie/en-us/content/topics/releasenotes/production.htm https://help.okta.com/oie/en-us/content/topics/releasenotes/production.htm Wed, 28 Oct 2026 07:54:05 GMT Okta adds mTLS for OIDC apps, authenticator enrollment sets, Sumo Logic/Cloudflare provisioning, and DBSSO visibility for macOS⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds mTLS client authentication for OIDC apps, issuing access tokens cryptographically bound to a client certificate so stolen tokens cannot be reused without it — eliminating shared client secrets to store, share, or rotate.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds authenticator enrollment sets, letting admins define groups of authenticators and require a subset (e.g. two of three) or let end users choose which authenticator to enroll, replacing the flat required/optional/disabled model. • Adds a Device Bound SSO (DBSSO) card to the device details page for managed macOS devices, showing DBSSO session status per OS-level user account alongside existing Platform SSO and Okta FastPass enrollment status. • Adds new OIN integrations: `Sumo Logic` provisioning (by Actions, covering user create, update, deactivate/delete, and role assignment across Sumo Logic regional deployments), `Cloudflare` provisioning, `LeakData` Shared Signals (API Service Integration), `Ollet` (IDV), `Ready Room` (OIDC), `Crossbeam` (SAML), `Guru` (SAML) and `Guru` (SCIM), and `Brava Security` (SCIM). • Updates the MCP server registration UI to match the AI agent and Agent Gateway management experiences, providing a consistent workflow for registering and configuring MCP servers. Breaking changes: • The 'Managed connection' tab on the app instance page in the Admin Console has been removed. Existing Cross App Access configurations using Managed Connection will stop working soon — reconfigure connections using Cross App Access before the cutover to avoid disruptions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/okta-for-ai-agents https://help.okta.com/oie/en-us/content/topics/releasenotes/production.htm https://help.okta.com/oie/en-us/content/topics/releasenotes/production.htm Tue, 20 Oct 2026 07:55:24 GMT Okta 2026.41.0 adds NFC badge auth, AI agent imports from Snowflake/Workato/Cursor, PowerShell-on-AD, and self-service registration fraud controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds new System Log events: `system.sms.receive_status` and `system.voice.receive_status` when custom telephony providers report SMS/voice delivery status, and `certification.campaign.stage.start`/`certification.campaign.stage.end` for Access Certification campaign staging, with `outcome.result` reporting `SUCCESS` or `FAILURE`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enables PowerShell script execution in on-premises Active Directory environments via the Active Directory agent, invocable through Okta Workflows using the Okta public API. • Adds NFC authenticator support for orgs with Adaptive MFA, allowing frontline workers to tap an NFC badge and enter a PIN to sign in on shared Windows workstations. • Introduces app branding migration, letting eligible orgs stage, preview, and deploy Identity Engine on an app-by-app basis while preserving Classic Engine customizations — with per-app rollback instead of org-wide rollback. • Adds a self-service registration policy on the `User Profile Policies` page for Identity Threat Protection customers, enabling rules to automatically deny sign-ups from disposable email domains or specific network zones. • Introduces user identification policy rules so admins can control whether the `Sign in with Okta FastPass` button appears on an app-by-app basis instead of a single org-wide setting. • Introduces OIN Community Integrations (Early Access), publishing integrations built from public APIs to the Okta Integration Network as Community Preview, advancing to Community Verified once proven in production. • Adds support for importing and managing AI agents built in `Snowflake`, `Workato`, and `Cursor` directly through Okta. • Adds provisioning support for the `Fleet End User Enrollment` and `Pipedrive` integrations. • Adds a configurable passkey enrollment promotion nudge that prompts end users to enroll a passkey when signing in, with controls for re-prompt frequency and maximum skip count. Breaking changes: • RADIUS Agent 2.28 changes the default client access behavior — new installations no longer accept RADIUS connections without an explicitly configured client IP allowlist. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/okta-for-ai-agents https://help.okta.com/oie/en-us/content/topics/releasenotes/production.htm https://help.okta.com/oie/en-us/content/topics/releasenotes/production.htm Mon, 05 Oct 2026 07:56:50 GMT Full history on Cyber Toolchain: https://cybertoolchain.io/tools/okta-for-ai-agents https://help.okta.com/oie/en-us/content/topics/releasenotes/production.htm https://help.okta.com/oie/en-us/content/topics/releasenotes/production.htm Sun, 04 Oct 2026 07:50:19 GMT Okta for AI Agents adds Databricks import, CIMD registration, requester timeline view, and automatic manager-change reassignment⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Databricks AI agent import: import and manage AI agents built in Databricks directly through Okta.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds CIMD (Client ID Metadata Document) support for AI agents, letting agents identify themselves with a URL instead of a static client ID. • Adds a separate dialog for custom MCP server scopes when adding scopes to an MCP server. • Adds automatic reassignment of pending manager tasks and manager questions to an employee's new manager on a manager change, preventing access-request blockage — works for both request conditions and request types. • Adds a requester timeline view in the Okta Access Request app, showing task status, individual approvals, and remaining tasks for requests built with access request conditions. • Adds MongoDB Atlas to OIN with SCIM 2.0 Provisioning support, automating user lifecycle and access management between Okta and MongoDB Atlas. • Adds Atomicwork (SAML) as a new OIN integration. • Adds Entrust IDV (IDV) as a new OIN integration. • Adds StitchOps (OIDC) as a new OIN integration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/okta-for-ai-agents https://help.okta.com/oie/en-us/content/topics/releasenotes/production.htm https://help.okta.com/oie/en-us/content/topics/releasenotes/production.htm Sat, 26 Sep 2026 07:48:54 GMT Okta for AI Agents: Replaces Okta On-prem SCIM Server agent with Okta On-prem SCIM agent, reducing dependencies and enabling new features. Breaking changes: • Okta On-prem SCIM Server agent has been replaced by Okta On-prem SCIM agent — existing deployments relying on the old agent name or its dependencies will need to migrate to the new agent. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/okta-for-ai-agents https://help.okta.com/oie/en-us/content/topics/releasenotes/production.htm https://help.okta.com/oie/en-us/content/topics/releasenotes/production.htm Fri, 25 Sep 2026 07:51:59 GMT Okta 2026.09.0 adds AI agent identity management, MCP server DCR and OIN catalog, NFC authenticator, Linux Okta Verify, malware proxy detection, and a low-code sign-in customizer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a `REMOTE_DESKTOP` IP service category to Enhanced Dynamic Network Zones, letting admins include or exclude remote-desktop traffic in global session and app sign-in policies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a `MALWARE_PROXIES` IP service category to Enhanced Dynamic Network Zones, powered by Okta CyberDefense, covering proxy services tied to malware and botnet activity (911 S5, NSOCKS, iProxy, BHProxies, and others). • Supports Dynamic Client Registration (DCR) when manually registering an MCP server — Okta automatically registers a client with the provider and populates credentials. • Enables adding MCP servers directly from the Okta Integration Network (OIN) catalog entry, without entering connection details manually. • Logs failed WebAuthn (FIDO2) enrollment attempts in the System Log using the `user.mfa.factor.activate` event, with debug data including AAGUID, `isBackupEligible`, and matched authenticator groups. • Adds tool discovery for MCP server registration, letting admins test credentials and browse available tools at registration time. • Introduces the NFC authenticator for frontline workers on Windows shared workstations — users tap an NFC badge and enter a PIN to satisfy MFA without a phone, password, or shared account. • Adds unified identity management for AI agents: admins can now set an external identifier for uniqueness, configure creation and matching criteria for imported agents, and preview agents before registration. • Adds entitlement import safeguards per app, configurable with percentage-based or absolute count thresholds to prevent accidental role or license removal on user unassignment, with an optional block on imports that modify or delete entitlement schemas. • Introduces the Okta Integration Wizard (OIW) for creating and deploying custom app integrations with SSO, SCIM, Entitlement Management, Universal Logout, API service integration, and custom API Integration Actions — usable as a template for multiple app instances. • Extends Okta Verify support to Linux desktop devices (Ubuntu 24.04 and 26.04) with phishing-resistant hardware-backed Okta FastPass authentication. • Adds Low-Code Sign In Customization, letting admins modify text, colors, and images in the Sign-In Widget and Interstitial authentication using a JSON templating language with syntax highlighting and suggestions, without editing code. • Adds Desktop MFA Factor Discovery for Windows, showing users only their enrolled MFA factors instead of all available factors. • Adds provisioning support for WordPress, Ivanti, Progress Chef, Vercel, and Sophos Cloud integrations. • Adds email notifications for Active Directory and LDAP agent disruption and recovery, configurable in the Admin Console. • Adds On-prem Connector for Generic Databases support for high availability by assigning multiple Okta On-Premises SCIM Agents to a single app instance. • Adds incremental import support for the On-prem Connector for Generic Databases, retrieving only users and entitlement assignments changed since the last successful import. • Adds filtering by app type and status, search by name or client ID, last-modified-date view, and CSV export to the Applications page. • Increases Access Request limits: users per task or question to 25 (from 10), entitlement bundles in an access level condition to 1,000 (from 100), groups in an access level condition to 1,000 (from 500), request type configuration lists per org to 250 (from 100), and request types per org to 750 (from 500). • Increases the maximum realm assignments per profile source from 30 to 100. • Improves MCP server registration UI with updated scope handling and tool visibility. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/okta-for-ai-agents https://help.okta.com/oie/en-us/content/topics/releasenotes/production.htm https://help.okta.com/oie/en-us/content/topics/releasenotes/production.htm Thu, 24 Sep 2026 07:52:42 GMT Full history on Cyber Toolchain: https://cybertoolchain.io/tools/okta-for-ai-agents https://help.okta.com/oie/en-us/content/topics/releasenotes/production.htm https://help.okta.com/oie/en-us/content/topics/releasenotes/production.htm Wed, 23 Sep 2026 07:44:07 GMT Breaking changes: • Okta On-prem SCIM Server agent is replaced by Okta On-prem SCIM agent; existing deployments referencing the old agent name must migrate to the new agent. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/okta-for-ai-agents https://help.okta.com/oie/en-us/content/topics/releasenotes/production.htm https://help.okta.com/oie/en-us/content/topics/releasenotes/production.htm Tue, 22 Sep 2026 07:45:07 GMT Okta 2026.09.0 adds AI agent identity management, MCP server DCR and OIN catalog support, NFC authenticator, Okta Verify for Linux, and malware proxy detection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `REMOTE_DESKTOP` IP service category to Enhanced Dynamic Network Zones, letting admins include or exclude remote-desktop traffic in global session and app sign-in policies for precise access control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `MALWARE_PROXIES` IP service category to Enhanced Dynamic Network Zones, powered by Okta CyberDefense, covering proxy services tied to malware and botnet activity (including 911 S5, NSOCKS, iProxy, and BHProxies). • Supports Dynamic Client Registration (DCR) when manually registering an MCP server — Okta automatically registers a client with the provider and populates credentials. • Enables adding MCP servers directly from an Okta Integration Network catalog entry, eliminating the need to enter connection details manually. • Adds tool discovery for MCP servers at registration time, letting admins test credentials and view available tools before completing setup. • Adds NFC authenticator support for frontline workers on Windows shared workstations — users tap an NFC badge and enter a PIN to meet MFA requirements without a phone, password, or shared account. • Extends Okta Verify with official Linux desktop support (Ubuntu 24.04 and 26.04), enabling phishing-resistant, hardware-backed Okta FastPass for Linux users. • Introduces the Okta Integration Wizard (OIW) to create and deploy custom app integrations configuring SSO, SCIM provisioning, Entitlement Management, Universal Logout, API service integration, and custom API Integration Actions — reusable as a template across multiple app instances. • Adds unified identity for AI agents: admins can set an external identifier to enforce uniqueness, configure creation and matching criteria for imported AI agents, and preview imports before registration. • Adds Desktop MFA Factor Discovery for Windows, showing users only their enrolled MFA factors instead of a fixed list of all available factors. • Adds Low-Code Sign In Customization, letting admins modify text, colors, and images in the Sign-In Widget and Interstitial authentication using a JSON templating language with syntax highlighting and suggestions — no code editor required. • Logs failed WebAuthn (FIDO2) enrollment attempts in the System Log under the `user.mfa.factor.activate` event with debug data including AAGUID, `isBackupEligible`, and matched authenticator groups. • Supports high availability for the On-prem Connector for Generic Databases by allowing multiple Okta On-Premises SCIM Agents to be assigned to a single app instance. • Adds incremental imports for the On-prem Connector for Generic Databases, retrieving only users and entitlement assignments changed since the last successful import. • Adds entitlement import safeguards configurable per app using percentage-based or absolute count thresholds to prevent accidental removal of app roles or licenses on user unassignment, with an option to block imports that modify or delete entitlement schemas. • Enhances the Applications page with filtering by type and status, search by name or client ID, last-modified-date view, and CSV export for audit-ready reports. • Adds email notifications for Active Directory and LDAP agent disruption and recovery, configurable in the Admin Console. • Increases Access Request limits: users per task or question to 25 (from 10), entitlement bundles in an access level condition to 1,000 (from 100), groups in an access level condition to 1,000 (from 500), request type configuration lists per org to 250 (from 100), and request types per org to 750 (from 500). • Increases the maximum realm assignments per profile source from 30 to 100. • Adds provisioning support for WordPress, Ivanti, Progress Chef, Vercel, and Sophos Cloud integrations. • Updates MCP server registration UI with improved scope handling and tool visibility. • Updates the AI agent Client Registration tab to display authentication methods vertically with a `Configure` button linking to per-method configuration pages. • Replaces Okta On-prem SCIM Server agent with Okta On-prem SCIM agent, reducing dependencies and enabling new features. • Improves DBSSO device probing to use device-registered conditions from an app's sign-on policy instead of org-wide probing methods. Breaking changes: • Okta On-prem SCIM Server agent has been replaced by Okta On-prem SCIM agent — existing deployments referencing the old agent name must migrate to the new Okta On-prem SCIM agent. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/okta-for-ai-agents https://help.okta.com/oie/en-us/content/topics/releasenotes/production.htm https://help.okta.com/oie/en-us/content/topics/releasenotes/production.htm Mon, 14 Sep 2026 07:43:42 GMT Okta for AI Agents: Adds Marker.io by Redblock (SCIM) as a new integration in the Okta integration catalog.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/okta-for-ai-agents https://help.okta.com/oie/en-us/content/topics/releasenotes/production.htm https://help.okta.com/oie/en-us/content/topics/releasenotes/production.htm Sat, 12 Sep 2026 07:43:23 GMT SAP Connector migrated to SCIM 2.0 API; Marker.io (SCIM) and Square OIDC IdP-initiated SSO added.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • SAP integration has been migrated to use the SCIM 2.0 API, with the connector's internal HTTP helper updated to support this standard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Marker.io by Redblock (SCIM) integration is now available. • Square (OIDC) now supports IdP-initiated SSO flow. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/okta-for-ai-agents https://help.okta.com/oie/en-us/content/topics/releasenotes/production.htm https://help.okta.com/oie/en-us/content/topics/releasenotes/production.htm Fri, 11 Sep 2026 14:43:49 GMT Okta for AI Agents: Enables IdP-initiated SSO flow for the Square (OIDC) integration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/okta-for-ai-agents https://help.okta.com/oie/en-us/content/topics/releasenotes/production.htm https://help.okta.com/oie/en-us/content/topics/releasenotes/production.htm Fri, 11 Sep 2026 07:38:55 GMT Okta adds Marker.io (SCIM) and Square OIDC IdP-initiated SSO, plus migrates SAP connector to SCIM 2.0⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Migrates the SAP connector to use the SCIM 2.0 API, updating the connector's internal HTTP helper to support the standard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Marker.io by Redblock (SCIM) as a new app integration. • Adds IdP-initiated SSO flow support for Square (OIDC). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/okta-for-ai-agents https://help.okta.com/oie/en-us/content/topics/releasenotes/production.htm https://help.okta.com/oie/en-us/content/topics/releasenotes/production.htm Wed, 02 Sep 2026 10:38:08 GMT Okta adds JA4 TLS fingerprinting across all Syslog events, manual MCP server registration, and a new suspicious authenticator enrollment detection. • Captures JA4 TLS client fingerprints in `securityContext.tlsFingerprint.ja4` across all Syslog event types — including telephony (OTP/SMS), sign-in, auth, and token events — enabling bot traffic, toll fraud, and TLS-based attack pattern detection beyond IP/user-agent signals alone. Not yet available for orgs on custom-hosted domains. • Adds 'Suspicious authenticator enrollment' detection to Okta Identity Threat Protection (ITP), flagging suspicious activity during authenticator enrollment with details recorded in the System Log for investigation. • Adds manual MCP server registration, allowing admins to configure authorization server details and client credentials directly for internal or legacy MCP servers that don't support automated metadata discovery endpoints. • Adds `interclient_access` scope to the scope list for authorization servers. • Displays the authentication requirement for an app on the AI agent binding tab, with a direct link to the app's 'Sign On' tab to configure an authentication policy. • Adds new OIN integrations: Flexopus (SAML), Paminga (OIDC), Paminga (SCIM), Upwave Lifecycle Management by Redblock (SCIM), Velantix Axiom (OIDC), and Velantix Axiom (SCIM). • Adds `Application username format` field to the Jamf Pro integration in the Admin Console by default, enabling custom mappings for the SCIM `userName` attribute. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/okta-for-ai-agents https://help.okta.com/oie/en-us/content/topics/releasenotes/production.htm https://help.okta.com/oie/en-us/content/topics/releasenotes/production.htm Wed, 26 Aug 2026 09:09:25 GMT Okta for AI Agents gains Cross-App Access for agentic OIDC/SAML apps, real-time import monitoring, and brand email copy-to-default. • Adds Cross-App Access (XAA) support for AI agents and apps: admins can connect SSO-agentic requesting apps to SSO resource apps over OIDC and SAML without requiring user consent at runtime, with full admin visibility and control over which actions an AI agent can take on behalf of a user. • Adds `User access` tab configuration for AI agent access, replacing the previous `Delegation` tab delegation-link workflow; existing delegation links must be reconfigured using the `User access` tab. • Enables binding an AI agent with an OIDC SSO app so they share the same credentials, and allows admins to configure direct user authentication for the AI agent from that binding. • Adds real-time progress display on the Import Monitoring dashboard, showing the number of data chunks currently being processed for in-progress imports. • Adds new IP service categories supported as individual VPN service categories in enhanced dynamic zones. • Adds new OIN integrations: Airwallex (OIDC), Bold Group Stages (SAML), Gateco (SCIM), Orca Security (SAML), Orca Security (SCIM), Square (OIDC), Statsig Lifecycle Management Connector by Redblock (SCIM), Vimeo Lifecycle Management Connector by Redblock (SCIM), Briefly (OIDC), Briefly (SCIM), MicroWest Software Systems - AMMSWEB (SAML), MintMCP (SAML), Orchestra (OIDC), Orchestra (SCIM), Petual (SCIM), RansomLeak (SAML), RansomLeak (SCIM), Remote.com (SCIM). • Adds `okta.schemas.read` scope to Harmony (API Service Integration). • Adds `okta.roles.read`, `okta.userTypes.read`, `okta.logs.read`, and `okta.groups.read` scopes to Hero Integration. • Adds three new redirect URIs to OCCAM Razor (OIDC). • Adds Express Configuration support for Petual. Breaking changes: • Orgs that previously used the `Delegation` tab to configure AI agent access through delegation links must reconfigure them using the `User access` tab. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/okta-for-ai-agents https://help.okta.com/en/programs/ai-agents/content/topics/ai-agents/ai-agents-beta.htm https://help.okta.com/en/programs/ai-agents/content/topics/ai-agents/ai-agents-beta.htm Mon, 10 Aug 2026 09:50:05 GMT Okta for AI Agents beta adds AI agent discovery for Microsoft Copilot Studio and an Agent Gateway • Enables Identity Security Posture Management (ISPM) to discover AI agents for Microsoft Copilot Studio • Introduces Endpoint AI agent discovery for identifying AI agents across endpoints • Adds Agent Gateway as a new beta capability within the Okta for AI Agents platform Full history on Cyber Toolchain: https://cybertoolchain.io/tools/okta-for-ai-agents