01We set up Cross App Access with Connect with Okta. Why did it stop working?
Okta retired that Early Access feature in Identity Engine 2026.44.0, along with the Manage Connections tab and the cwo/connections API. Anything built with it no longer functions. Reconfigure each integration with an AI agent-to-app resource connection in the Admin Console, and find any script that still calls the old API, because Okta has retired that too.
02We're on Classic Engine. When do Desktop SSO, self-service registration and Device Trust stop being supported?
On 5 March 2027. Okta wants those orgs on Identity Engine by then. Someone on your side still has to rebuild registration as a Profile Enrollment policy and replace IWA with Agentless Desktop SSO or FastPass. Start with the Desktop SSO users, because they notice first.
03We run Okta Access Gateway. Which version fixes the October 2026 advisories?
2026.10.2 fixes the two OAG advisories from 22 October, and 2026.44.0 carries the patched PHP runtime for the PHP2Shell flaws. Okta says the default configuration mitigates known exploitation of the PHP flaws, but don't count on your appliance still being default. Upgrade, then trim the list of people with admin console access, because the 9.1 flaw needs an admin login.
04We already pay for Okta SSO. Is Agent SSO included, or do we need Okta for AI Agents?
Agent SSO puts each agent in Okta's directory and gives it short-lived tokens for apps that support Cross App Access, so nobody pastes a personal API token into it. It's part of core Okta SSO plans. Okta for AI Agents is a separate subscription. You'd buy it to find shadow agents, reach service accounts and custom authorization servers, and put agents through access reviews with a kill switch. One catch: the AI Agent Admin role can't manage Agent SSO, so registration still takes a super admin.
05How long does an AD FS to Okta migration take?
It depends on how many relying-party trusts you have and how many use custom claim rules. We inventory them first, move simple SAML apps in the early waves, and leave the complex ones for later once the pattern is proven.
06Should we use Okta Identity Governance or a separate IGA platform?
Okta Identity Governance suits companies with apps already in Okta and moderate audit needs. Heavy ERP separation-of-duties rules or lots of on-premises systems usually point to SailPoint or Saviynt. We compare against your audit scope before we recommend either.
07Someone else set up our Okta tenant. Can you clean it up?
Yes. We start with a health check of policies, groups and rules, admin roles and API tokens. Fixes get ranked by risk. Nothing changes in production until we've agreed the order with your team.
