Okta Privileged Access Device Tools release notes

Subscribe to RSS

Version 1.117.2. Deployed on November 5, 2026.

Generally Available features

Workload identity for AWS IAM

Workloads running on AWS can now authenticate to Okta Privileged Access with their AWS IAM role instead of static access keys. The sft workload authenticate command supports the new --aws and --aws-profile options.

Windows 11 25H2 Enterprise support

Okta Privileged Access client now supports Windows 11 25H2 Enterprise.

Token Issuer as a systemd service

The oktapa-token-issuer DEB and RPM packages now install the Token Issuer, which issues tokens for workloads, as a systemd service. The configuration file location changed to /etc/oktapa/token-issuer/token-issuer.hcl. If you have an existing installation, move your configuration file to the new location.

Fixes

  • After repeated failures, the gateway service restart delay continued to increase and didn't reset after the gateway resumed normal operation, causing restart delays of up to 22 minutes.

  • RDP connections through gateways failed because a built-in TLS certificate had expired.