https://cybertoolchain.io/tools/okta-identity-engine New releases and features in Okta Identity Engine, tracked by The Cyber Toolchain. en Wed, 28 Oct 2026 12:00:00 GMT https://developer.okta.com/docs/release-notes/2026-okta-identity-engine/?utm_source=rss&utm_medium=feed#version-2026-44-0 https://developer.okta.com/docs/release-notes/2026-okta-identity-engine/?utm_source=rss&utm_medium=feed#version-2026-44-0 Wed, 28 Oct 2026 12:00:00 GMT Okta Identity Engine adds High Risk Proxy detection, MCP server OAuth client support, Cross App Access for MCP and external IdPs, and passkey AAGUID-only group matching⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Match passkeys to authenticator groups on AAGUID alone with the new self-service EA setting in Preview, without requiring a full attestation match.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Connecting MCP servers to downstream resources as OAuth 2.0 clients, enabling Cross App Access for MCP servers, and enabling Cross App Access with an external identity provider are all now GA in Preview. • Adds actor claim support for OAuth 2.0 On-Behalf-Of Token Exchange (now GA in Production) and audience claim support for custom authorization servers. • OAuth 2.0 client credentials grant reaches GA. • Anything-as-a-Source device import is now GA in Production. • Self-service registration policy for ITP is now GA in Preview. • Adds new System Log events: detecting the `Connect with Okta removal` event as an indicator of compromise (GA in Preview), recording updates to managed server attributes in Okta Privileged Access, and recording updated IoC protection status (GA in Preview). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/okta-identity-engine https://developer.okta.com/docs/release-notes/2026-okta-identity-engine/?utm_source=rss&utm_medium=feed#version-2026-41-0 https://developer.okta.com/docs/release-notes/2026-okta-identity-engine/?utm_source=rss&utm_medium=feed#version-2026-41-0 Wed, 07 Oct 2026 12:00:00 GMT Okta 2026.41.0 adds NFC authenticator support, OBO Token Exchange GA, passkey enrollment prompts GA, and new System Log events for Access Certification.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds NFC authenticator support for Adaptive MFA, enabling tap-based hardware token authentication flows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `session.idp` property to Okta Expression Language for policy and rule expressions referencing the session identity provider. • Actor claim support for OAuth 2.0 On-Behalf-Of Token Exchange is now GA in Preview. • Prompt users to enroll a passkey is now GA in Production. • Adds configurable password provisioning during user creation. • User identification policy is now GA in Production. • WebAuthn authenticator enrollments now include `transports` values, GA in Production. • PowerShell scripts for Active Directory are now GA in Production. • Adds new System Log events for staging Access Certification campaigns (EA). • Self-service registration policy for ITP is now self-service EA in Preview. • Email channel for Direct Authentication is now self-service EA in Preview. • Single Certificate Issuer is now GA in Preview. • App branding migration support added. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/okta-identity-engine https://developer.okta.com/docs/release-notes/2026-okta-identity-engine/?utm_source=rss&utm_medium=feed#weekly-release-2026-09-2 https://developer.okta.com/docs/release-notes/2026-okta-identity-engine/?utm_source=rss&utm_medium=feed#weekly-release-2026-09-2 Wed, 30 Sep 2026 12:00:00 GMT Okta Identity Engine 2026.09.2 adds MCP server authorization GA, Certificate Authorities API in EA, and AI Agent Profile Schema in Beta.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `Certificate Authorities API` (EA) for managing certificate authorities programmatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Promotes Cross App Access support for AI agents and apps to GA in Production for all customers. • Promotes Agent SSO support for third-party OIDC apps to GA in Preview. • Promotes Secure multiple MCP servers with Okta custom authorization servers to GA in Preview. • Introduces Extensible AI Agent Profile Schema and Custom Attributes in Beta, enabling customization of AI agent profiles. • Enables editable resource URL for MCP servers. • Enables automatic phishing resistance for FastPass in authentication chains. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/okta-identity-engine https://developer.okta.com/docs/release-notes/2026-okta-identity-engine/#weekly-release-2026-09-1 https://developer.okta.com/docs/release-notes/2026-okta-identity-engine/#weekly-release-2026-09-1 Wed, 16 Sep 2026 12:00:00 GMT Okta adds CIMD for AI Agents, Agent Gateway APIs, MCP server discovery, and token exchange scope support in 2026.09.1⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Token exchange requests now support scopes, enabling finer-grained access control when exchanging tokens.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Introduces CIMD for AI Agents (Beta), extending Continuous Identity and Metadata Delivery to agent-based workflows. • Introduces Agent Gateway APIs (Beta) for managing AI agent traffic through Okta. • Introduces MCP server discovery APIs (Beta) to locate and integrate Model Context Protocol servers. • CIMD for OIDC apps is now GA in Preview, making Continuous Identity and Metadata Delivery generally available for OpenID Connect applications. • User identification policy is now GA in Preview, providing a dedicated policy layer for identifying users during authentication flows. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/okta-identity-engine https://developer.okta.com/docs/release-notes/2026-okta-identity-engine/#monthly-release-2026-09-0 https://developer.okta.com/docs/release-notes/2026-okta-identity-engine/#monthly-release-2026-09-0 Thu, 10 Sep 2026 12:00:00 GMT Okta 2026.09.0 adds NFC authenticator, MCP server registration, malware proxy IP service, and PowerShell scripts for AD⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds NFC authenticator support (self-service Early Access in Preview), enabling NFC-based hardware tokens as an authentication factor.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds additional telephony inline hook payload fields (self-service Early Access in Preview), giving hook handlers richer context for SMS/voice flows. • Adds API support for Dynamic Client Registration (Beta), allowing OAuth clients to register programmatically without manual admin configuration. • Adds Okta Integration Network MCP server registration (Beta), enabling MCP servers to be registered and managed within the Okta Integration Network. • Adds a new IP Service for enhanced dynamic network zones, allowing zone policies to reference dynamically updated IP reputation feeds. • Adds Malware Proxies IP Service for enhanced dynamic network zones (GA in Production), enabling zone policies to block or flag traffic from known malware proxy IPs. • Adds PowerShell scripts for Active Directory (GA in Preview), enabling automated AD management tasks directly from Okta. • Adds search, filter, and export capabilities to the Applications page (Early Access), making it easier to audit and manage large app catalogs. • Adds `transports` values to WebAuthn authenticator enrollments (GA in Preview), exposing the physical transport (USB, NFC, BLE, internal) used during passkey registration. • Supports prompting users to enroll a passkey during sign-in flows (GA in Preview), increasing passkey adoption without requiring admin-forced enrollment. • Refresh token lifetimes in Native to Web SSO flows are now configurable and GA in Production, giving admins control over session continuity across native and web app handoffs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/okta-identity-engine https://developer.okta.com/docs/release-notes/2026-okta-identity-engine/#weekly-release-2026-08-2 https://developer.okta.com/docs/release-notes/2026-okta-identity-engine/#weekly-release-2026-08-2 Wed, 19 Aug 2026 12:00:00 GMT Okta Identity Engine 2026.08.2 makes unified identity for AI agents generally available in Production. • Unified identity for AI agents is now generally available (GA) in Production, enabling identity lifecycle management for non-human AI agent principals. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/okta-identity-engine https://developer.okta.com/docs/release-notes/2026-okta-identity-engine/#weekly-release-2026-08-1 https://developer.okta.com/docs/release-notes/2026-okta-identity-engine/#weekly-release-2026-08-1 Wed, 12 Aug 2026 12:00:00 GMT Okta Identity Engine 2026.08.1 adds new IP service categories for enhanced dynamic zones. • Adds new IP service categories for enhanced dynamic zones, expanding the criteria available when defining dynamic network zones. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/okta-identity-engine https://developer.okta.com/docs/release-notes/2026-okta-identity-engine/#weekly-release-2026-07-3 https://developer.okta.com/docs/release-notes/2026-okta-identity-engine/#weekly-release-2026-07-3 Wed, 29 Jul 2026 12:00:00 GMT Okta Identity Engine adds editable issuer URLs for AI agent resource connections and resilient AI agent import. • Supports editing the issuer URL for AI agent resource connections. • AI agent import now skips failed entries instead of halting, improving resilience during bulk operations. Breaking changes: • The Application Cross App Access Connections API has been removed. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/okta-identity-engine https://developer.okta.com/docs/release-notes/2026-okta-identity-engine/#weekly-release-2026-07-2 https://developer.okta.com/docs/release-notes/2026-okta-identity-engine/#weekly-release-2026-07-2 Wed, 15 Jul 2026 12:00:00 GMT Okta adds cross-app access for AI agents, GA agent-to-agent connections, and new device OS account endpoints. • Enables cross-app access for AI agents and applications. • Agent-to-agent connections reaches General Availability in Production. • New endpoints for device OS accounts now available in Early Access (Preview). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/okta-identity-engine https://developer.okta.com/docs/release-notes/2026-okta-identity-engine/#monthly-release-2026-07-0 https://developer.okta.com/docs/release-notes/2026-okta-identity-engine/#monthly-release-2026-07-0 Wed, 01 Jul 2026 12:00:00 GMT Okta July 2026 brings bot protection GA, AI agent token improvements, native-to-web SSO, and advanced device posture checks. • Bot protection is now generally available in Production. • New `fields` query parameter for Groups, Realms, and Devices list endpoints is now GA in Production, enabling selective field retrieval. • New IP Service available for enhanced dynamic network zones. • Improved group member search functionality is now GA in Production. • Customizable emails for Passkey (FIDO2 WebAuthn) authenticator is GA in Preview. • Email authenticator auto-enrollment and recovery management is GA in Preview. • Advanced device posture checks is GA in Preview. • Clear Managed Chrome Profile Browsing Data is now GA in Production. • Group push support added in API Integration Actions apps. • Supports deletion of group push mappings in ERROR state. • Replace a Group Rule API can now update already-assigned groups. • Native to Web SSO is now GA in Production. • Removal of Cross App Access as a self-service feature (breaking change practitioners must account for). • Spec-compliant client ID claims now issued for AI agent tokens. • SCIM filter use added to endpoints. • Agent-to-agent connections is now available in Early Access (EA) in Preview. • New Register an AI agent API introduced (`appId` parameter deprecated in favor of new registration flow). Breaking changes: • The `appId` parameter in the Register an AI agent API is deprecated • Cross App Access is removed as a self-service feature Full history on Cyber Toolchain: https://cybertoolchain.io/tools/okta-identity-engine https://developer.okta.com/docs/release-notes/2026-okta-identity-engine/#weekly-release-2026-06-2 https://developer.okta.com/docs/release-notes/2026-okta-identity-engine/#weekly-release-2026-06-2 Wed, 17 Jun 2026 12:00:00 GMT Okta Identity Engine adds agent-to-agent connections as Early Access in Preview environments. • Enables agent-to-agent connections (Early Access, Preview) for AI agent API integration scenarios. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/okta-identity-engine https://developer.okta.com/docs/release-notes/2026-okta-identity-engine/?utm_source=rss&utm_medium=feed#monthly-release-2026-06-0 https://developer.okta.com/docs/release-notes/2026-okta-identity-engine/?utm_source=rss&utm_medium=feed#monthly-release-2026-06-0 Wed, 03 Jun 2026 12:00:00 GMT Okta Identity Engine adds extended AD group attributes via API, system log event for privileged access management, and Search/filtering for AI agents. • `/directories` integration endpoints now expose extended Active Directory group attributes. • New System Log event type for database privileged access management. • Search, filtering, and configurable views are available for AI agents. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/okta-identity-engine https://developer.okta.com/docs/release-notes/2026-okta-identity-engine/?utm_source=rss&utm_medium=feed#monthly-release-2026-05-0 https://developer.okta.com/docs/release-notes/2026-okta-identity-engine/?utm_source=rss&utm_medium=feed#monthly-release-2026-05-0 Wed, 06 May 2026 12:00:00 GMT Okta Identity Engine 2026.05 adds GA attribute sync, self-service EA for recovery, and SHA-256 PIV support • `PIV Identity Provider` now supports dynamic user matching using the SHA-256 digest algorithm, which is GA in Preview. • `Managed connections` are renamed to `resource connections` in Production with GA status, impacting existing configuration references. Breaking changes: • The term "managed connections" has been renamed to "resource connections" in the general release; existing documentation or scripts referencing the old term may need updates. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/okta-identity-engine