Okta Identity Engine

No entries match these filters. Clear filters

1. Version 2026.44.0 (2026-10-28) Oct 28, 2026 · issue 125

   Okta Identity Engine adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server OAuth client and Cross App Access support, High Risk Proxy detection, passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. AAGUIDAAGUIDA 128-bit identifier embedded in a FIDO2/WebAuthn authenticator that identifies the make and model of the device, letting relying parties enforce authenticator policy without tracking individual users.-only group matching, and new Privileged Access System Log events.

   • Match passkeyspasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. to authenticator groups on AAGUID alone with the new self-service EA setting in Preview, without requiring a full attestation match.
   • New integrationConnect MCP servers to downstream resources as OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. clients, now GA in Preview.
   • New integrationEnable Cross App Access for MCP servers, now GA in Preview.
   • New integrationEnable Cross App Access with an external identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems., now GA in Preview.
   • Actor claim support for OAuth 2.0 On-Behalf-OfOAuth 2.0 On-Behalf-OfAn OAuth 2.0 flow, defined in RFC 8693, where a service exchanges a token it received for a new token scoped to a downstream API, letting a tool act on a user's behalf across a chain of services. Token Exchange is now GA in Production.

   +4 more show less

   • OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0 client credentials grant reaches GA.
   • Self-service registration policy for ITP is now GA in Preview.
   • New detectionNew System Log event records updates to managed server attributes in Okta Privileged Access.
   • Single audience claim support added for custom authorization servers.

   9 details in Everything

   • New detection High Risk Proxy detection
   • New supported platform Anything-as-a-Source device import GA in Production
2. docs update Oct 9, 2026 · issue 098

   Okta IGAIGAIdentity Governance and Administration: a framework for managing user access rights, roles, and lifecycle across systems, giving cyber tools a structured data source for detecting privilege abuse or access anomalies. gains System Log events for Access CertificationAccess CertificationA periodic review process in which managers or system owners confirm or revoke which users should retain access to systems and data, reducing privilege creep over time. campaign staging and GA resource collections API with Okta groups and apps.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Monitor Access Certification campaign staging outcomes in real time by filtering System Log for the new staging events.
   copy

   $ curl -s -X GET 'https://<your-okta-domain>/api/v1/logs?filter=eventType+eq+"certification.campaign.stage.end"' -H 'Authorization: SSWS <api_token>' -H 'Accept: application/json'

   • Adds two new System Log event types for Access Certification campaign staging: certification.campaign.stage.start (logged when staging begins) and certification.campaign.stage.end (logged when staging ends, with outcome.result reporting SUCCESS or FAILURE).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Promotes resource collections API to GA in Preview, supporting Okta groups, Okta push groups, and non-Entitlement Management apps without requiring an opt-in to Entitlement Management, and enabling direct assignment of a collection to a principal user.
   • Adds two new System Log event types for Access Certification campaign staging: certification.campaign.stage.start (logged when staging begins) and certification.campaign.stage.end (logged when staging ends, with outcome.result reporting SUCCESS or FAILURE).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

3. docs update Oct 9, 2026 · issue 098

   Okta Identity Engine: Adds act actor claim stamping to access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. issued via OAuth 2.0 On-Behalf-OfOAuth 2.0 On-Behalf-OfAn OAuth 2.0 flow, defined in RFC 8693, where a service exchanges a token it received for a new token scoped to a downstream API, letting a tool act on a user's behalf across a chain of services. Token Exchange with nested act.act chaining.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Inspect the actor claim chain on an On-Behalf-Of access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. to verify which service apps participated in the delegation.
   📍Decode the issued access token JWT and look for the top-level act claim (identifying the immediate requesting service app) and the nested act.act claim (identifying the prior delegator in the chain).
   Disable automatic password provisioning when creating users via a SCIM 2.0SCIM 2.0A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. app integration.
   📍In the Okta Admin Console, navigate to the SCIM 2.0 app › Provisioning › To App › Create Users, then toggle off 'Set password when creating a new user'.
   Monitor Access CertificationAccess CertificationA periodic review process in which managers or system owners confirm or revoke which users should retain access to systems and data, reducing privilege creep over time. campaign staging outcomes in the System Log to detect snapshot failures before a campaign goes live.
   📍In the Okta Admin Console, go to Reports › System Log and filter for event types certification.campaign.stage.start and certification.campaign.stage.end, then check the outcome.result field for SUCCESS or FAILURE.
   • Adds Set password when creating a new user toggle under Provisioning > To App > Create Users in SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. 2.0 test app templates (OAuth Bearer TokenBearer TokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else., Basic Auth, and Header Auth) to enable or disable password provisioning at user creation.
   • Adds app branding migration capability allowing eligible orgs to stage, preview, and deploy Identity Engine on a per-app basis while preserving Classic Engine customizations, with per-app rollback if needed.
   • Adds app branding migration capability allowing eligible orgs to stage, preview, and deploy Identity Engine on a per-app basis while preserving Classic Engine customizations, with per-app rollback if needed.

   1 more in Everything

4. docs update Oct 9, 2026 · issue 098

   Okta Identity Engine: Introduces the Authenticator Groups API (self-service EA in Preview) to create and manage authenticator groups for enrollment policies.

   └──▷ USE IT
   Write an app sign-in policy expression that grants elevated access only when the user authenticated through your corporate IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems., identified by its Okta ID.
   env copy

   session.idp == "0oa1b2c3d4e5f6g7h8i9"

   Add a custom STRING attribute to the default AI Agent profile schema so every registered agent carries a team label.
   copy

   $ curl -X POST https://{yourOktaDomain}/workload-principals/api/v1/ai-agents/schema/default \
     -H 'Authorization: Bearer {token}' \
     -H 'Content-Type: application/json' \
     -d '{"definitions":{"custom":{"properties":{"team":{"title":"Team","description":"Owning team","type":"string","required":false}},"type":"object"}}}'

   Create a self-service registration policy for ITP that blocks disposable email domains and restricts sign-ups to your corporate network zone.
   copy

   $ curl -X POST https://{yourOktaDomain}/api/v1/policies \
     -H 'Authorization: Bearer {token}' \
     -H 'Content-Type: application/json' \
     -d '{"type":"SELF_SERVICE_REGISTRATION","name":"Block disposable domains","rules":[{"conditions":{"network":{"connection":"ZONE","include":["<zoneId>"]},"emailDomain":{"blockKnownSuspicious":true}},"actions":{"registration":{"access":"DENY"}}}]}'

   • Adds NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. authenticator support for Adaptive MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. orgs, enabling frontline workers to tap an NFC badge and enter a PIN to sign in on shared Windows workstations.
   • Adds POST /workload-principals/api/v1/ai-agents/schema/default and GET /workload-principals/api/v1/ai-agents/schema/default endpoints to extend Okta AI Agent profiles with custom schema attributes (STRING, INTEGER, BOOLEAN with optional enum constraints) (Beta).
   • Adds GET /ai-agents/provider-attributes/{providerName} to discover a provider's source attributes for AI agent profile mapping (Beta).
   • Adds GET and PUT /workload-principals/api/v1/ai-agent-providers/{providerId}/profile-mappings to view and update AI agent profile mappings (Beta).
   • Adds custom attribute key-value pairs to the AI agent profile object on POST /workload-principals/api/v1/ai-agents, PUT /workload-principals/api/v1/ai-agents/{agentId}, and PATCH /workload-principals/api/v1/ai-agents/{id} (Beta).

   +8 more show less

   • Adds ?expand=profileMapping query parameter to GET /ai-agents/providers to embed mapping metadata; AIAgentProviderStats gains mappedAttributeCount field (Beta).
   • Adds PATCH support to update an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server's resourceUrl (triggering metadata re-discovery); MCP server read responses now include read-only resourceServerGlobalId for OINOINOpen Invention Network, a non-profit patent consortium that acquires patents and licenses them royalty-free to members, shielding Linux and related open-source software from patent litigation.-registered servers.
   • Enforces displayName uniqueness within an org in the MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. Registrations API.
   • Sets phishingResistant property to REQUIRED by default for the Okta FastPass authenticator in app sign-in policy rules that use authentication method chains.
   • Adds Cross App Access (XAA) support for securing multiple MCP servers with a single Okta custom authorization server, preserving chain-of-custody across agent hops (GA in Preview).
   • Adds Cross App Access (XAA) for OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. requesting agentic apps to OIDC or SAML SSOSAML SSOAn authentication protocol that lets a user log in once with an identity provider and access multiple services without re-entering credentials, by passing signed XML assertions between parties. resource apps, with the Resource Server tab renamed to Machine Assignments exposing Resources and Callers tiles (GA in Preview).
   • Adds new guide: Secure a Salesforce Agentforce agent — adding Okta authentication to an existing Salesforce Agentforce AI agent.
   • Adds new guide: Secure a Google Vertex AI agent — adding Okta authentication to an existing Google Vertex AI agent.
   • Adds NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. authenticator support for Adaptive MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. orgs, enabling frontline workers to tap an NFC badge and enter a PIN to sign in on shared Windows workstations.
   • Adds POST /workload-principals/api/v1/ai-agents/schema/default and GET /workload-principals/api/v1/ai-agents/schema/default endpoints to extend Okta AI Agent profiles with custom schema attributes (STRING, INTEGER, BOOLEAN with optional enum constraints) (Beta).
   • Adds GET /ai-agents/provider-attributes/{providerName} to discover a provider's source attributes for AI agent profile mapping (Beta).
   • Adds GET and PUT /workload-principals/api/v1/ai-agent-providers/{providerId}/profile-mappings to view and update AI agent profile mappings (Beta).
   • Adds new guide: Secure a Salesforce Agentforce agent — adding Okta authentication to an existing Salesforce Agentforce AI agent.

   +1 more show less

   • Adds new guide: Secure a Google Vertex AI agent — adding Okta authentication to an existing Google Vertex AI agent.

   7 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The Resource Server tab in OIDC requesting and resource apps is renamed to Machine Assignments for orgs using Cross App Access or subscribed to Okta for AI Agents — any documentation or runbooks referencing Resource Server must be updated.
   • !The phishingResistant property for the Okta FastPass authenticator is now REQUIRED by default in app sign-in policy rules using authentication method chains — existing rules that relied on a non-required default will enforce phishing resistance after upgrade.
   • !The MCP Server Registrations API now enforces displayName uniqueness within an org — existing duplicate display names will cause conflicts.
   • !Okta release version notation changes from year.month (e.g. 2026.10.0) to year.week (e.g. 2026.41.0) beginning in October — any automation or monitoring that parses version strings by month position must be updated.
5. Version 2026.41.0 (2026-10-07) Oct 7, 2026 · issue 098

   Okta 2026.41.0 adds NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. authenticator support, OBO Token ExchangeOBO Token ExchangeAn OAuth 2.0 flow, defined in RFC 8693, where a service exchanges a token it received for a new token scoped to a downstream service, letting a chain of services act on behalf of the original caller. GA, passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. enrollment prompts GA, and new System Log events for Access CertificationAccess CertificationA periodic review process in which managers or system owners confirm or revoke which users should retain access to systems and data, reducing privilege creep over time..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds NFC authenticator support for Adaptive MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone., enabling tap-based hardware token authentication flows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds session.idp property to Okta Expression Language for policy and rule expressions referencing the session identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..
   • Actor claim support for OAuth 2.0 On-Behalf-OfOAuth 2.0 On-Behalf-OfAn OAuth 2.0 flow, defined in RFC 8693, where a service exchanges a token it received for a new token scoped to a downstream API, letting a tool act on a user's behalf across a chain of services. Token Exchange is now GA in Preview.
   • Prompt users to enroll a passkey is now GA in Production.
   • Adds configurable password provisioning during user creation.

   +8 more show less

   • User identification policy is now GA in Production.
   • WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in. authenticator enrollments now include transports values, GA in Production.
   • PowerShell scripts for Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. are now GA in Production.
   • Adds new System Log events for staging Access Certification campaigns (EA).
   • Self-service registration policy for ITP is now self-service EA in Preview.
   • Email channel for Direct Authentication is now self-service EA in Preview.
   • Single Certificate Issuer is now GA in Preview.
   • App branding migration support added.
   • Adds NFC authenticator support for Adaptive MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone., enabling tap-based hardware token authentication flows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds session.idp property to Okta Expression Language for policy and rule expressions referencing the session identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..
   • Actor claim support for OAuth 2.0 On-Behalf-OfOAuth 2.0 On-Behalf-OfAn OAuth 2.0 flow, defined in RFC 8693, where a service exchanges a token it received for a new token scoped to a downstream API, letting a tool act on a user's behalf across a chain of services. Token Exchange is now GA in Preview.
   • Prompt users to enroll a passkey is now GA in Production.
   • User identification policy is now GA in Production.

   +6 more show less

   • PowerShell scripts for Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. are now GA in Production.
   • Adds new System Log events for staging Access Certification campaigns (EA).
   • Self-service registration policy for ITP is now self-service EA in Preview.
   • Email channel for Direct Authentication is now self-service EA in Preview.
   • Single Certificate Issuer is now GA in Preview.
   • App branding migration support added.

   2 more in Everything

6. docs update Oct 3, 2026 · issue 093

   Okta Identity Engine: Adds GET and POST /workload-principals/api/v1/ai-agents/schema/default endpoints to retrieve and add custom schema attributes (STRING, INTEGER, BOOLEAN with optional enum constraints) to AI Agent profiles.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Discover which source attributes an AI agent provider exposes before configuring profile mappings.
   copy

   $ curl -X GET https://<yourOktaDomain>/ai-agents/provider-attributes/<providerName> \
     -H 'Authorization: Bearer <token>'

   • Adds GET /ai-agents/provider-attributes/{providerName} to discover a provider's source attributes, and GET/PUT /workload-principals/api/v1/ai-agent-providers/{providerId}/profile-mappings to view and update profile mappings between AI agent providers and Okta.
   • Adds ?expand=profileMapping query parameter to GET /ai-agents/providers; AIAgentProviderStats now includes mappedAttributeCount.
   • Introduces the Certificate Authorities API (EA) to view CA certificates Okta hosts, download them, activate replacement CAs, and migrate SCEPSCEPSimple Certificate Enrollment Protocol, an IETF-standardized protocol for automating X.509 certificate issuance and renewal over HTTP, letting cyber tools request PKI certificates from a CA without manual intervention. configurations via rollover or parallel configuration.
   • Adds PATCH support for updating an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server's resourceUrl, triggering re-discovery of server metadata; MCP server read responses now include the read-only resourceServerGlobalId field for OINOINOpen Invention Network, a non-profit patent consortium that acquires patents and licenses them royalty-free to members, shielding Linux and related open-source software from patent litigation.-registered servers.
   • Enforces displayName uniqueness within an org via the MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. Registrations API.

   +3 more show less

   • Sets the phishingResistant property for the Okta FastPass authenticator to REQUIRED by default in app sign-in policy rules that use authentication method chains.
   • Renames the Resource Server tab to Machine Assignments in requesting and resource apps, introducing Resources and Callers tiles for managing non-human identitynon-human identityA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. connections.
   • Cross App Access (XAA) for AI agents and apps — allowing agentic apps to act on behalf of enterprise users across OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. and SAML SSOSAML SSOAn authentication protocol that lets a user log in once with an identity provider and access multiple services without re-entering credentials, by passing signed XML assertions between parties. resource apps without runtime user consent — is now GA in Production.
   • Adds GET /ai-agents/provider-attributes/{providerName} to discover a provider's source attributes, and GET/PUT /workload-principals/api/v1/ai-agent-providers/{providerId}/profile-mappings to view and update profile mappings between AI agent providers and Okta.
   • Introduces the Certificate Authorities API (EA) to view CA certificates Okta hosts, download them, activate replacement CAs, and migrate SCEPSCEPSimple Certificate Enrollment Protocol, an IETF-standardized protocol for automating X.509 certificate issuance and renewal over HTTP, letting cyber tools request PKI certificates from a CA without manual intervention. configurations via rollover or parallel configuration.
   • Cross App Access (XAA) for AI agents and apps — allowing agentic apps to act on behalf of enterprise users across OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. and SAML SSOSAML SSOAn authentication protocol that lets a user log in once with an identity provider and access multiple services without re-entering credentials, by passing signed XML assertions between parties. resource apps without runtime user consent — is now GA in Production.

   5 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The Resource Server tab in requesting and resource apps is renamed to Machine Assignments; any documentation, runbooks, or training referencing that tab name must be updated.
   • !The MCP Server Registrations API now enforces displayName uniqueness within an org; attempts to register a duplicate display name will fail.
7. Weekly release 2026.09.2 (2026-09-30) Sep 30, 2026 · issue 093

   Adds Certificate Authorities API (EA), Extensible AI Agent Profile Schema (Beta), editable MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server resource URLs, unique MCP server name enforcement, and automatic phishing resistance for FastPass.

   • Adds Certificate Authorities API (EA) for managing certificate authorities programmatically.
   • Introduces Extensible AI Agent Profile Schema and Custom Attributes in Beta, enabling customization of AI agent profiles.
   • Updated integrationEnables editable resource URL for MCP servers.
   • Enforces unique MCP server names to prevent naming conflicts.
   • Enables automatic phishing resistance for FastPass in authentication chains.

   5 details in Everything

   • Updated integration Agent SSO support for third-party OIDC apps
   • Updated integration Cross App Access support for AI agents and apps
8. docs update Sep 25, 2026 · issue 085

   Cross App Access (XAA) integrations can now be configured, tested, and submitted to the OINOINOpen Invention Network, a non-profit patent consortium that acquires patents and licenses them royalty-free to members, shielding Linux and related open-source software from patent litigation. directly through the OIN Wizard (GA in Production).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   When onboarding an AI agent or app-to-app integration into the OIN, use the OIN Wizard to define client and resource app roles and submit the XAA integration for enterprise discovery and governance.
   📍In the OIN Wizard, go to Cross App Access (XAA) › define client and resource app roles › test the integration › submit to the OIN catalog.
9. announced Sep 22, 2026 · issue 082

   Okta for AI Agents adds shadow endpoint discovery, Agent Gateway runtime enforcement, agent-to-agent connection rules, and visual Configuration Designer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   • Adds Shadow AI Agent Discovery for Endpoints, which surfaces unmanaged AI agents running on employee devices so they can be discovered and registered before becoming governance blind spots.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Agent Gateway, a runtime enforcement point that sits in the execution path between an agent and its tool calls, enforcing policy and logging every interaction.
   • Adds Agent-to-AgentAgent-to-AgentAgent2Agent, an open protocol started by Google for AI agents from different vendors to discover each other, delegate tasks and exchange results. It complements MCP, which connects an agent to tools. Connections, which sets rules for which agents can call other agents, scopes what each agent can access, and captures the handoff in an auditable chain.
   • Adds Configuration Designer, a visual interface for mapping agent-to-resource connections so that each handoff is governed, scoped, and auditable.
   • Expands the Kill Switch to the Agent Gateway runtime layer, enabling revocation of every active token held by a compromised agent and termination of every session in flight at the moment of deactivation.

   +2 more show less

   • Adds Agent SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., extending Cross App Access to all SSO customers and allowing non-expiring keys to be swapped for short-lived, identity-governed tokens to reduce user consent fatigue.
   • Adds Resource Access Certifications, which periodically reviews agent resource connections over time to help prevent standing and excessive permissions.
   • Adds Shadow AI Agent Discovery for Endpoints, which surfaces unmanaged AI agents running on employee devices so they can be discovered and registered before becoming governance blind spots.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Agent Gateway, a runtime enforcement point that sits in the execution path between an agent and its tool calls, enforcing policy and logging every interaction.
   • Adds Agent-to-AgentAgent-to-AgentAgent2Agent, an open protocol started by Google for AI agents from different vendors to discover each other, delegate tasks and exchange results. It complements MCP, which connects an agent to tools. Connections, which sets rules for which agents can call other agents, scopes what each agent can access, and captures the handoff in an auditable chain.
   • Adds Configuration Designer, a visual interface for mapping agent-to-resource connections so that each handoff is governed, scoped, and auditable.
   • Adds Agent SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., extending Cross App Access to all SSO customers and allowing non-expiring keys to be swapped for short-lived, identity-governed tokens to reduce user consent fatigue.

   +1 more show less

   • Adds Resource Access Certifications, which periodically reviews agent resource connections over time to help prevent standing and excessive permissions.

   1 more in Everything

10. docs update Sep 18, 2026 · issue 078

    Okta Identity Governance adds Early Access ability to stage certification campaigns before launch for preview and validation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds EA support for staging certification campaigns before launch, letting you preview target users, resources, and reviewer assignments to validate scope and fix configuration errors prior to go-live.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

11. docs update Sep 18, 2026 · issue 078

    Okta adds AI agent identity (CIMDCIMDA text-based Short Message Service protocol from Nokia for exchanging SMS messages between applications and SMS centers, used to build tools that send, receive, or test carrier messaging flows.), Agent Gateway proxy, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server discovery APIs in Beta⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds cimdClient and cimdUrl fields on an app's OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. client to register a custom OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. app integration with a Client ID Metadata Document (CIMD), replacing manual redirect URI, grant type, and client secret configuration (GA in Preview).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Agent Gateway APIs (Beta): an identity-native proxy that aggregates multiple remote MCP servers behind a single Okta-secured endpoint, enforces identity and policy on every tool call, and produces a unified audit trail — accessible via the Virtual MCP Servers API.
    • Adds MCP server discovery APIs (Beta) to test credentials and discover available tools, toolsets, and metadata on a registered third-party MCP server.
    • Adds CIMD for AI Agents (Beta): AI agents can now be registered with a CIMD so they identify themselves with a URL instead of a static client ID, via new Update an AI agent and Register AI agents with a Client ID Metadata Document APIs.
    • Token exchangeToken exchangeAn OAuth 2.0 protocol extension (RFC 8693) that lets a service trade one token for another with different scopes, audience, or type, enabling delegation and impersonation across service boundaries without re-authenticating the user. requests that include scopes are now allowed when an AI agent exchanges an ID-JAG for an access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions., provided the requested scopes match those in the ID-JAG.

    +1 more show less

    • User identification policy is now GA in Preview.
    • Adds cimdClient and cimdUrl fields on an app's OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. client to register a custom OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. app integration with a Client ID Metadata Document (CIMD), replacing manual redirect URI, grant type, and client secret configuration (GA in Preview).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Agent Gateway APIs (Beta): an identity-native proxy that aggregates multiple remote MCP servers behind a single Okta-secured endpoint, enforces identity and policy on every tool call, and produces a unified audit trail — accessible via the Virtual MCP Servers API.
    • Adds MCP server discovery APIs (Beta) to test credentials and discover available tools, toolsets, and metadata on a registered third-party MCP server.
    • Adds CIMD for AI Agents (Beta): AI agents can now be registered with a CIMD so they identify themselves with a URL instead of a static client ID, via new Update an AI agent and Register AI agents with a Client ID Metadata Document APIs.

    2 more in Everything

12. Weekly release 2026.09.1 (2026-09-16) Sep 16, 2026 · issue 078

    Okta adds CIMDCIMDA text-based Short Message Service protocol from Nokia for exchanging SMS messages between applications and SMS centers, used to build tools that send, receive, or test carrier messaging flows. for AI Agents, Agent Gateway APIs, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server discovery, and token exchangetoken exchangeAn OAuth 2.0 protocol extension (RFC 8693) that lets a service trade one token for another with different scopes, audience, or type, enabling delegation and impersonation across service boundaries without re-authenticating the user. scope support in 2026.09.1⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Token exchange requests now support scopes, enabling finer-grained access control when exchanging tokens.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces CIMD for AI Agents (Beta), extending Continuous Identity and Metadata Delivery to agent-based workflows.
    • Introduces Agent Gateway APIs (Beta) for managing AI agent traffic through Okta.
    • Introduces MCP server discovery APIs (Beta) to locate and integrate Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers.
    • CIMD for OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. apps is now GA in Preview, making Continuous Identity and Metadata Delivery generally available for OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. applications.

    +1 more show less

    • User identification policy is now GA in Preview, providing a dedicated policy layer for identifying users during authentication flows.
    • Token exchange requests now support scopes, enabling finer-grained access control when exchanging tokens.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces CIMD for AI Agents (Beta), extending Continuous Identity and Metadata Delivery to agent-based workflows.
    • Introduces Agent Gateway APIs (Beta) for managing AI agent traffic through Okta.
    • Introduces MCP server discovery APIs (Beta) to locate and integrate Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers.
    • User identification policy is now GA in Preview, providing a dedicated policy layer for identifying users during authentication flows.

    1 more in Everything

13. Weekly release 2026.09.1 (2026-09-16) Sep 16, 2026 · release notes

    Okta Identity Engine adds AI agent support (CIMDCIMDA text-based Short Message Service protocol from Nokia for exchanging SMS messages between applications and SMS centers, used to build tools that send, receive, or test carrier messaging flows./MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) and scope handling for token exchangetoken exchangeAn OAuth 2.0 protocol extension (RFC 8693) that lets a service trade one token for another with different scopes, audience, or type, enabling delegation and impersonation across service boundaries without re-authenticating the user..

    • Agent Gateway APIs are now Beta
    • New MCP server discovery APIs in Beta
    • Token exchange requests now support scopes
    • CIMD for OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. apps is GA in Preview
    • User identification policy is GA in Preview

    5 details in Everything

14. docs update Sep 12, 2026 · issue 072

    OIG adds cancel-request APIs (Beta), higher Access Request limits, and GA certifications for campaign decisions and AI agent resources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds three new cancel-request API endpoints (Update a request for Access Request V1, Update a request for Requests V2, and Update my request for My Requests) in Beta, enabling programmatic cancellation of active and pending access requests from custom portals, ITSMITSMIT Service Management: a framework of practices for delivering and supporting IT services, covering ticketing, change control, and incident response. Cyber tools integrate with it to automate alert-to-ticket workflows. tools, CLIs, or chatbots.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Increases Access Request limits: users per task or question raised to 25 (from 10), entitlement bundles in an access level condition to 1,000 (from 100), groups in an access level condition to 1,000 (from 500), request type configuration lists per org to 250 (from 100), and request types per org to 750 (from 500).
    • API support for Access CertificationAccess CertificationA periodic review process in which managers or system owners confirm or revoke which users should retain access to systems and data, reducing privilege creep over time. campaign decisions is now GA in Production.
    • Certify AI agent resource connections is now GA in Production.
    • Adds three new cancel-request API endpoints (Update a request for Access Request V1, Update a request for Requests V2, and Update my request for My Requests) in Beta, enabling programmatic cancellation of active and pending access requests from custom portals, ITSMITSMIT Service Management: a framework of practices for delivering and supporting IT services, covering ticketing, change control, and incident response. Cyber tools integrate with it to automate alert-to-ticket workflows. tools, CLIs, or chatbots.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    3 more in Everything

15. docs update Sep 12, 2026 · issue 072

    Okta adds malware proxy detection, PowerShell ADPowerShell ADMicrosoft's Active Directory module for PowerShell, letting scripts query and manage AD objects—users, groups, computers—via cmdlets, which cyber tools use to automate enumeration or administration of Windows domain environments. script execution, and richer telephony hook payloads in September 2026⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Detect whether an OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. was resent in the same session inside a telephony inline hook handler, so you can apply rate-limiting or alerting logic.
    json copy

    {
      "data": {
        "context": {
          "app": {
            "clientId": "0oabc123def456"
          }
        },
        "messageProfile": {
          "isResend": true
        }
      }
    }

    Block traffic from malware-associated proxy networks by adding the MALWARE_PROXIES service to a dynamic network zone.
    📍In the Admin Console, go to Security › Networks, open or create an Enhanced Dynamic Zone, expand IP Services, and enable MALWARE_PROXIES to block proxy IPs linked to botnets and malware (including 911 S5, NSOCKS, iProxy, BHProxies).
    • Adds data.context.app.clientId and data.messageProfile.isResend fields to the telephony inline hook request payload, identifying the signing-in app and whether an OTP is a resend within the same session.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds MALWARE_PROXIES IP service category to enhanced dynamic network zones, powered by Okta CyberDefense and covering proxy services linked to malware and botnet activity (including 911 S5, NSOCKS, iProxy, and BHProxies).
    • Enables admins to execute custom PowerShell scripts in on-premises Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. environments via the Active Directory agent, invokable through Okta Workflows and the Okta public API (Invoke a remote script on the AD agent).
    • Adds search by name or client ID, filter by type and status, last-modified-date view, and CSV export to the Applications page, with programmatic access via the List all applications that match search filters API.
    • Adds data.context.app.clientId and data.messageProfile.isResend fields to the telephony inline hook request payload, identifying the signing-in app and whether an OTP is a resend within the same session.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Enables admins to execute custom PowerShell scripts in on-premises Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. environments via the Active Directory agent, invokable through Okta Workflows and the Okta public API (Invoke a remote script on the AD agent).

    2 more in Everything

16. docs update Sep 12, 2026 · issue 072

    Okta Identity Engine: Adds GET /api/v1/proximity-providers and GET /api/v1/proximity-providers/{proximityProviderType} endpoints via the Proximity Providers API to list NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. authenticator types and retrieve available NFC tags.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds registrationEndpoint property to the MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. Registrations API, exposing the URL of the OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. Dynamic Client Registration endpoint.
    • Adds registrationMethod property to the Client Authentication Settings API to define how OAuth client credentials for a resource connection are registered.
    • Adds registrationType property to the Okta Integration Network to register an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server from an OINOINOpen Invention Network, a non-profit patent consortium that acquires patents and licenses them royalty-free to members, shielding Linux and related open-source software from patent litigation. catalog entry.
    • Supports a new NFC authenticator (authenticator type proximity, key nfc_pin) for frontline workers on shared Windows workstations, allowing MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. via NFC badge tap and PIN without a phone or password.
    • Adds search, filter by type and status, sort by last modified date, and CSV export to the Applications page, plus a List all applications that match search filters API for programmatic access.

    +1 more show less

    • Refresh tokensRefresh tokensA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. issued in Native to Web SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. flows (when offline_access scope is requested) now follow the authorization server access policy lifetime rather than expiring with the org's global session.
    • Adds registrationType property to the Okta Integration Network to register an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server from an OINOINOpen Invention Network, a non-profit patent consortium that acquires patents and licenses them royalty-free to members, shielding Linux and related open-source software from patent litigation. catalog entry.
    • Supports a new NFC authenticator (authenticator type proximity, key nfc_pin) for frontline workers on shared Windows workstations, allowing MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. via NFC badge tap and PIN without a phone or password.

    4 more in Everything

17. Monthly release 2026.09.0 (2026-09-10) Sep 10, 2026 · issue 072

    Okta 2026.09.0 adds NFCNFCNear Field Communication, a short-range (≤4 cm) wireless standard maintained by the NFC Forum, enabling data exchange between devices; cyber tools use it to probe, emulate, or intercept contactless card and tag transactions. authenticator, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server registration, malware proxy IP service, and PowerShell scripts for AD⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Enable the Malware Proxies IP Service on a dynamic network zone to automatically deny sign-in attempts routed through known malware proxy infrastructure.
    📍In the Admin Console, go to Security › Networks, open or create a Dynamic Zone, and under IP Services enable Malware Proxies, then save the zone policy.
    Export the full application catalog from the Applications page for an access review or audit, without scripting an API call.
    📍In the Admin Console, go to Applications › Applications, use the search and filter controls to scope the list, then click Export to download the results.
    • Adds NFC authenticator support (self-service Early Access in Preview), enabling NFC-based hardware tokens as an authentication factor.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds additional telephony inline hook payload fields (self-service Early Access in Preview), giving hook handlers richer context for SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels./voice flows.
    • Adds API support for Dynamic Client Registration (Beta), allowing OAuth clients to register programmatically without manual admin configuration.
    • Adds Okta Integration Network MCP server registration (Beta), enabling MCP servers to be registered and managed within the Okta Integration Network.
    • Adds a new IP Service for enhanced dynamic network zones, allowing zone policies to reference dynamically updated IP reputation feeds.

    +6 more show less

    • Adds Malware Proxies IP Service for enhanced dynamic network zones (GA in Production), enabling zone policies to block or flag traffic from known malware proxy IPs.
    • Adds PowerShell scripts for Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. (GA in Preview), enabling automated AD management tasks directly from Okta.
    • Adds search, filter, and export capabilities to the Applications page (Early Access), making it easier to audit and manage large app catalogs.
    • Adds transports values to WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in. authenticator enrollments (GA in Preview), exposing the physical transport (USB, NFC, BLEBLEBluetooth Low Energy, a wireless protocol maintained by the Bluetooth SIG for short-range communication at minimal power draw, making it useful for cyber tools that interact with IoT devices or proximity-based systems., internal) used during passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. registration.
    • Supports prompting users to enroll a passkey during sign-in flows (GA in Preview), increasing passkey adoption without requiring admin-forced enrollment.
    • Refresh tokenRefresh tokenA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. lifetimes in Native to Web SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. flows are now configurable and GA in Production, giving admins control over session continuity across native and web app handoffs.
    • Adds NFC authenticator support (self-service Early Access in Preview), enabling NFC-based hardware tokens as an authentication factor.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds API support for Dynamic Client Registration (Beta), allowing OAuth clients to register programmatically without manual admin configuration.
    • Adds Okta Integration Network MCP server registration (Beta), enabling MCP servers to be registered and managed within the Okta Integration Network.
    • Adds a new IP Service for enhanced dynamic network zones, allowing zone policies to reference dynamically updated IP reputation feeds.
    • Adds Malware Proxies IP Service for enhanced dynamic network zones (GA in Production), enabling zone policies to block or flag traffic from known malware proxy IPs.

    +2 more show less

    • Adds PowerShell scripts for Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. (GA in Preview), enabling automated AD management tasks directly from Okta.
    • Supports prompting users to enroll a passkey during sign-in flows (GA in Preview), increasing passkey adoption without requiring admin-forced enrollment.

    4 more in Everything

18. Monthly release 2026.09.0 (2026-09-10) Sep 10, 2026 · release notes

    Okta adds IP Service for dynamic zones, Dynamic Client Registration API support, and apps page export to the 2026.09.0 release.

    • New IP Service available for enhanced dynamic network zones is GA in Production
    • API support for Dynamic Client Registration is Beta
    • Okta Integration Network MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server registration is Beta
    • Search, filter, and export apps for Applications page is EA
    • Cross App Access submission through the OINOINOpen Invention Network, a non-profit patent consortium that acquires patents and licenses them royalty-free to members, shielding Linux and related open-source software from patent litigation. Wizard is GA in Production

    5 details in Everything

19. docs update Sep 5, 2026 · issue 065

    Okta Identity Governance adds configurable resource catalog visibility, controllable per-group or org-wide via resourceCatalogVisibility API.

    • Adds resourceCatalogVisibility API setting to control who can see resource catalog entry points — all org members, no users, or a specific set of Okta groups — covering the End-User Dashboard Request Access button, the Okta Access Request app, Slack, and Microsoft Teams integrations.

    1 more in Everything

20. announced Aug 24, 2026 · issue 057

    Okta GA's Agent SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., registering Cross App Access AI agents as first-class identities in Universal Directory with short-lived tokens

    └──▷ HOW TO FIND IT
    Govern an Anthropic Claude deployment's enterprise access through the Okta Admin Console without sharing static credentials or managing per-app OAuth grants.
    📍In the Okta Admin Console, go to Applications › Okta Integration Network, search for Anthropic Claude, add the integration, then navigate to the agent's profile in Universal Directory to assign access policies and monitor issued tokens.
    • Agent SSO (generally available, included in core Okta SSO plans at no additional cost) registers AI agents that support the Cross App Access protocol as first-class identities in Universal Directory alongside human employees, replacing static API keys and one-off OAuth grants with short-lived, identity-governed tokens.
    • Administrators manage agent access policy through the same Okta Admin Console and workflows used for human employees — enabling assignment, monitoring, and policy updates for agents such as Anthropic Claude without separate tooling.
    • Okta Integration Network now includes out-of-the-box Cross App Access integrations for Anthropic (Claude), Archestra.AI, Asana, Atlassian, Canva, Datadog, Figma, Glean, Granola, Linear, MintMCP, Notion, Slack, and Supabase, removing the need for custom integration work.
    • Okta for AI Agents (separate subscription, GA since May 2026) extends coverage beyond Cross App Access to discover shadow AI agents via browser, endpoint, and network detection; assigns named human owners; connects agents to custom authorization servers, service accounts, secrets, and other agents; and enforces end-to-end governance through access certification reviews, approval workflows, and a kill-switch (agent deactivation).
    • Agents onboarded through Agent SSO carry over automatically when upgrading to Okta for AI Agents — no re-registration required.

    5 details in Everything

21. docs update Aug 22, 2026 · issue 053

    Okta adds unified AI agent identity across registration paths and Cross App Access (XAA) for AI agents and apps.

    • Adds unified identity for AI agents (GA in Production): Okta now resolves AI agent identities across every registration path into a single authoritative record per org, with each agent carrying an externalId and platform value for uniqueness.
    • New endpoints for listing, reviewing, resolving staged identity conflicts, and managing provider priority for AI agents — see AI Agent Providers documentation.
    • Adds Cross App Access (XAA) support for AI agents and apps: enables connections between custom SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.-agentic requesting apps and SSO resource apps across OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. and SAML SSOSAML SSOAn authentication protocol that lets a user log in once with an identity provider and access multiple services without re-entering credentials, by passing signed XML assertions between parties. protocols, removing the need for user consent at runtime.
    • Enables binding an AI agent with an OIDC SSO app so they share the same credentials, with admin-controlled visibility over which actions an agent can take on behalf of a user.
    • Adds User access tab for configuring direct user authentication for AI agents (replaces the Delegation tab workflow for Okta for AI Agent orgs).

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Okta for AI Agent orgs that previously used the Delegation tab to configure AI agent access through delegation links must reconfigure them using the User access tab.
22. Weekly release 2026.08.2 (2026-08-19) Aug 19, 2026 · issue 053

    Okta Identity Engine 2026.08.2 makes unified identity for AI agents generally available in Production.

23. docs update Aug 14, 2026 · issue 045

    Okta adds new IP service categories for dynamic zones and three granular user behavior admin permissions.

    • Adds okta.users.behaviors.manage, okta.users.behaviors.read, and okta.users.behaviors.reset custom admin permissions for fine-grained control over user behavior detection.
    • Adds new IP service categories for enhanced dynamic zones, expanding the criteria available when building network-based policies.

    2 details in Everything

24. docs update Aug 14, 2026 · issue 045

    Okta Identity Engine adds multi-resource refresh tokensrefresh tokensA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API., new IP service categories, and custom user behavior admin permissions.

    └──▷ TRY IT
    Request a refresh tokenrefresh tokenA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. scoped to multiple resources at authorization time, then exchange it for a precisely scoped access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. for one resource — eliminating the need for one refresh token per resource.
    copy

    $ # Step 1: Authorize with multiple resource parameters
    GET /oauth2/{authorizationServerId}/v1/authorize?client_id=<client_id>&response_type=code&scope=openid offline_access&resource=https://api.example.com/service-a&resource=https://api.example.com/service-b&redirect_uri=<redirect_uri>
    
    # Step 2: Exchange the refresh token for a single-audience access token
    POST /oauth2/{authorizationServerId}/v1/token
      grant_type=refresh_token
      &refresh_token=<refresh_token>
      &resource=https://api.example.com/service-a
      &client_id=<client_id>

    • Adds okta.users.behaviors.manage, okta.users.behaviors.read, and okta.users.behaviors.reset custom admin permissions for granular control over user behavior detection.
    • /authorize endpoints on custom authorization servers now accept multiple resource parameters, allowing a single refresh token to cover multiple resources; each grant_type=refresh_token exchange mints a precisely scoped, single-aud access token (GA in Preview; requires Okta for AI Agents subscription with agent-to-agent connections enabled).
    • Adds new IP service categories for enhanced dynamic zones, expanding the classification options available for zone configuration.
    • New fields query parameter for Groups, Realms, and Devices list endpoints is GA in Production.
    • Submit Identity Verification integration is GA in Production.

    5 details in Everything

25. Weekly release 2026.08.1 (2026-08-12) Aug 12, 2026 · issue 045

    Okta Identity Engine 2026.08.1 adds new IP service categories for enhanced dynamic zones.

26. Weekly release 2026.08.1 (2026-08-12) Aug 12, 2026 · release notes

    Okta Identity Engine v2026.08.1 adds Cross App Access for AI agents and supports multiple resources per refresh tokenrefresh tokenA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. in Preview.

    • Adds Cross App Access support for AI agents and apps to all customers
    • Adds new IP service categories for enhanced dynamic zones
    • Generalizes authorization and token endpoints to support multiple resources per refresh token, moving from Preview to GA

    3 details in Everything

27. Monthly release 2026.08.0 (2026-08-05) Aug 5, 2026 · release notes

    Okta Identity Engine 2026.08 adds GA features for device posture, breach protection, and provisioning logs, plus EAs for flexible auth configs and user identification.

    • Adds Advanced device posture checks as a generally available feature in Production
    • Provides the Breached credentials protection configuration API now in Production
    • Introduces new Minimum character length configuration for AI agent names
    • Releases Proxy service for enhanced dynamic zones to GA in Production
    • Adds new System Log events for Office 365 app-based provisioning in Production

    +11 more show less

    • Enables Customizable emails for Passkey (FIDO2 WebAuthn) authenticator in Production
    • Makes Email authenticator auto-enrollment and recovery management available in Production
    • Allows the Replace a Group Rule API to update assigned groups in Production
    • Introduces new user behavior permissions for fine-grained access control
    • Supports Anything-as-a-Source device import as an Early Access feature
    • Adds a new fields query parameter for Groups, Realms, and Devices list endpoints in Production
    • Makes Submit Identity Verification integration generally available in Production
    • Starts self-service Early Access for Flexible Okta Verify authenticator configuration
    • Starts self-service Early Access for Prompt users to enroll a passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices.
    • Starts Early Access for User identification policy
    • Includes WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in. authenticator enrollments with transports values in self-service EA

    16 details in Everything

28. docs update Jul 31, 2026 · issue 031

    Okta Identity Governance adds V2 resource collections API (Beta) and entitlement IDs in history responses.

    └──▷ HOW TO FIND IT
    Enable the Beta Collections V2 capability in the Admin Console to start managing resource collections with Okta groups and apps without Entitlement Management.
    📍In the Admin Console, go to Settings › Features, find 'Extend resource collections with Okta groups, Okta push groups, and non-Entitlement Management apps', and enable it.
    • New Collections V2 API supports resource collections that include Okta groups, push groups, and apps without requiring an Entitlement Management opt-in, enabling direct principal assignment, access certification campaigns, and access request conditions.
    • Adds entitlementHistory[].entitlements[].id property to the Retrieve an entitlement history operation, exposing the entitlement ID for each item in history.

    2 details in Everything

29. docs update Jul 31, 2026 · issue 031

    Okta AI Agents API gains editable issuer URL for resource connections and resilient import that skips failed entries.

    └──▷ TRY IT
    Update the issuer URL on an existing AI agent resource connection without recreating it.
    copy

    $ curl -X PATCH "https://<okta-domain>/workload-principals/api/v1/ai-agents/{agentId}/connections/{connectionId}" \
      -H "Authorization: Bearer <token>" \
      -H "Content-Type: application/json" \
      -d '{"issuerUrl": "https://new-issuer.example.com"}'

    • Adds issuerUrl field to the PATCH /workload-principals/api/v1/ai-agents/{agentId}/connections/{connectionId} request body, allowing the issuer URL of an AI agent resource connection to be updated after creation.
    • AI agent provider import now skips failed entries and continues creating or updating successful ones, rather than failing the entire import batch.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Application Cross App Access Connections API is scheduled for removal in an upcoming release; existing managed connection configurations will stop working and must be reconfigured using the Okta for AI Agents API with IDENTITY_ASSERTION_APP_INSTANCE.
30. Weekly release 2026.07.3 (2026-07-29) Jul 29, 2026 · issue 031

    Okta Identity Engine adds editable issuer URLs for AI agent resource connections and resilient AI agent import.

    • Supports editing the issuer URL for AI agent resource connections.
    • AI agent import now skips failed entries instead of halting, improving resilience during bulk operations.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Application Cross App Access Connections API has been removed.
31. docs update Jul 27, 2026 · issue 027

    Okta Open Source MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. GA: AI agents can now manage identity, brands, and device policies via natural language with least-privilege OAuth scoping

    • Introduces the Okta Open Source Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) Server, a secure abstraction layer enabling AI agents and LLMsLLMsA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. to interact with Okta org management APIs using natural language.
    • Adds customization tools for AI clients to manage Okta brands, custom domains, sign-in pages, email templates, and themes without using the Admin Console.
    • Adds scope-based tool loading that exposes only the tools permitted by the authenticated user's OAuth scopes, enforcing least privilege and reducing LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. token usage.
    • Adds Device Assurance Policy tools enabling AI agents to programmatically retrieve, configure, and evaluate device posture requirements (e.g. OS version prerequisites) within agent-led workflows.
    • Integrates the MCP Elicitation API to require explicit human confirmation before destructive actions (such as deleting apps or deactivating users), surfacing a chat UI dialog in supported clients or a JSON confirmation payload for others.

    5 details in Everything

32. docs update Jul 27, 2026 · docs issue 004

    Okta Open Source MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. GA: AI agents can now manage identity, brands, and device policies via natural language with least-privilege OAuth scoping

    • Introduces the Okta Open Source Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) Server, a secure abstraction layer enabling AI agents and LLMsLLMsA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. to interact with Okta org management APIs using natural language.
    • Adds customization tools for AI clients to manage Okta brands, custom domains, sign-in pages, email templates, and themes without using the Admin Console.
    • Adds scope-based tool loading that exposes only the tools permitted by the authenticated user's OAuth scopes, enforcing least privilege and reducing LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. token usage.
    • Adds Device Assurance Policy tools enabling AI agents to programmatically retrieve, configure, and evaluate device posture requirements (e.g. OS version prerequisites) within agent-led workflows.
    • Integrates the MCP Elicitation API to require explicit human confirmation before destructive actions (such as deleting apps or deactivating users), surfacing a chat UI dialog in supported clients or a JSON confirmation payload for others.

    5 details in Everything

33. docs update Jul 27, 2026 · issue 027

    Okta adds OINOINOpen Invention Network, a non-profit patent consortium that acquires patents and licenses them royalty-free to members, shielding Linux and related open-source software from patent litigation. Wizard support for Identity Verification integrations and an open-source MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server for AI agent access to Okta APIs.

    • ISVs can now build, test, and submit Identity Verification (IDV) integrations to the Okta Integration Network via the OIN Wizard, letting admins discover and configure IDV providers directly from the OIN app catalog.
    • New open-source Okta MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. acts as a secure protocol abstraction layer enabling AI agents and LLMsLLMsA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. to interact with Okta scoped management APIs using natural language, supporting least-privilege access control for AI workflows.

    2 details in Everything

34. docs update Jul 27, 2026 · docs issue 004

    Okta adds OINOINOpen Invention Network, a non-profit patent consortium that acquires patents and licenses them royalty-free to members, shielding Linux and related open-source software from patent litigation. Wizard support for Identity Verification integrations and an open-source MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server for AI agent access to Okta APIs.

    • ISVs can now build, test, and submit Identity Verification (IDV) integrations to the Okta Integration Network via the OIN Wizard, letting admins discover and configure IDV providers directly from the OIN app catalog.
    • New open-source Okta MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. acts as a secure protocol abstraction layer enabling AI agents and LLMsLLMsA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. to interact with Okta scoped management APIs using natural language, supporting least-privilege access control for AI workflows.

    2 details in Everything

35. Weekly release 2026.07.2 (2026-07-15) Jul 15, 2026 · issue 018

    Okta adds cross-app access for AI agents, GA agent-to-agent connections, and new device OS account endpoints.

    • Enables cross-app access for AI agents and applications.
    • Agent-to-agent connections reaches General Availability in Production.
    • New endpoints for device OS accounts now available in Early Access (Preview).

    3 details in Everything

36. Weekly release 2026.07.2 (2026-07-15) Jul 15, 2026 · release notes

    Okta introduces new endpoints for device OS accounts in EA and GA agent-to-agent connections

    • Makes agent-to-agent connections generally available for cross-app access between AI agents and apps

    1 detail in Everything

37. Monthly release 2026.07.0 (2026-07-01) Jul 1, 2026 · issue 014

    Okta July 2026 brings bot protection GA, AI agent token improvements, native-to-web SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., and advanced device posture checks.

    └──▷ TRY IT
    Retrieve only specific fields from the Groups list endpoint to reduce payload size in automated pipelines.
    copy

    $ GET /api/v1/groups?fields=id,profile.name,profile.description

    Delete a group push mapping stuck in ERROR state to unblock sync without manual console intervention.
    copy

    $ DELETE /api/v1/apps/{appId}/groups/{groupId}/pushGroups/{pushGroupId}

    Enable bot protection for a sign-on policy to block automated credential attacks on your org.
    📍In the Admin Console, go to Security › Sign-On Policies › select a policy › Edit › enable Bot Protection under the Authentication settings.
    • Bot protection is now generally available in Production.
    • New fields query parameter for Groups, Realms, and Devices list endpoints is now GA in Production, enabling selective field retrieval.
    • New IP Service available for enhanced dynamic network zones.
    • Improved group member search functionality is now GA in Production.
    • Customizable emails for PasskeyPasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. (FIDO2FIDO2The open standard behind passkeys and hardware security keys, where a website checks a signature from the user's device instead of a password. Because the key is bound to the site, phishing pages cannot use it. WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in.) authenticator is GA in Preview.

    +12 more show less

    • Email authenticator auto-enrollment and recovery management is GA in Preview.
    • Advanced device posture checks is GA in Preview.
    • Clear Managed Chrome Profile Browsing Data is now GA in Production.
    • Group push support added in API Integration Actions apps.
    • Supports deletion of group push mappings in ERROR state.
    • Replace a Group Rule API can now update already-assigned groups.
    • Native to Web SSO is now GA in Production.
    • Removal of Cross App Access as a self-service feature (breaking change practitioners must account for).
    • Spec-compliant client ID claims now issued for AI agent tokens.
    • SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. filter use added to endpoints.
    • Agent-to-agent connections is now available in Early Access (EA) in Preview.
    • New Register an AI agent API introduced (appId parameter deprecated in favor of new registration flow).

    17 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The appId parameter in the Register an AI agent API is deprecated
    • !Cross App Access is removed as a self-service feature
38. Monthly release 2026.07.0 (2026-07-01) Jul 1, 2026 · release notes

    Okta Identity Engine 2026.07 adds GA IP Service for dynamic zones, EA agent-to-agent connections, and SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. filter support on endpoints.

    • IP Service is available for enhanced dynamic network zones
    • Agent-to-agent connections is EA in Preview
    • SCIM filter use added to endpoints

    3 details in Everything

39. Weekly release 2026.06.2 (2026-06-17) Jun 17, 2026 · issue 014

    Okta Identity Engine adds agent-to-agent connections as Early Access in Preview environments.

    • Enables agent-to-agent connections (Early Access, Preview) for AI agent API integration scenarios.

    1 detail in Everything

40. Monthly release 2026.06.0 (2026-06-03) Jun 3, 2026 · release notes

    Okta Identity Engine adds extended AD group attributes via API, system log event for privileged access managementprivileged access managementBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded., and Search/filtering for AI agents.

    • /directories integration endpoints now expose extended Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. group attributes.
    • New System Log event type for database privileged access management.
    • Search, filtering, and configurable views are available for AI agents.

    3 details in Everything

41. Monthly release 2026.05.0 (2026-05-06) May 6, 2026 · release notes

    Okta Identity Engine 2026.05 adds GA attribute sync, self-service EA for recovery, and SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. PIV support

    • PIV Identity Provider now supports dynamic user matching using the SHA-256 digest algorithm, which is GA in Preview.
    • Managed connections are renamed to resource connections in Production with GA status, impacting existing configuration references.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The term managed connections has been renamed to resource connections in the general release; existing documentation or scripts referencing the old term may need updates.