Prepare to upgrade to Okta Identity Engine

Get your setup ready so that you can complete the Production upgrade with confidence.

Introduction

Your organization is preparing to upgrade from Classic Engine to Identity Engine for enhanced security, policy control, and modern authentication. This journey guides you through understanding feature changes, such as sign-in flows, policies, MFA, APIs, and legacy functionality. Then, you plan and validate your upgrade through a checklist-driven approach.

As you work through each section, complete the following tasks:

• Document your current setup.
• Complete action items in the Upgrade Hub.
• Test in a Preview environment.
• Use the results to schedule and execute your Production upgrade.

You can go directly to the Okta Upgrade Hub in the Admin Console to review your open action items and schedule your upgrade. Learn more about the Identity Engine Upgrade Hub (opens new window).

You can also review the Identity Engine upgrade FAQ (opens new window) to get answers to common questions before you begin.

Learn

Review how Identity Engine affects your apps, configurations, and user experiences. Examine differences in sign-in flows, policies, MFA, APIs, and deprecated features to identify what may break, require updates, or continue to work as expected. This enables you to plan your changes.

Overview videos

Before you begin, watch these videos to understand the Identity Engine upgrade and how to identify Okta integration points in your org:

User experience changes

• Identity Engine sign-in flow behavior (opens new window)
• App intent links in Identity Engine (opens new window)
• Sign-in flow changes with federation and SSO (opens new window)

Policy changes

• App sign-on policy (opens new window)
• Okta sign-on policies (opens new window)
• Sign-on policy task differences (opens new window)
• Multifactor authentication (MFA) enrollment policy (opens new window)

Multifactor Authentication (MFA) changes

• MFA (opens new window)
• Okta Verify (opens new window)
• Email as an optional authenticator (opens new window)
• Phone authenticator capabilities (opens new window)
• Secondary email address setup (opens new window)
• Security Question (opens new window)

Other product and feature changes

• Sign-In Widget (opens new window)
• Email templates (opens new window)
• End-User Settings (opens new window)
• Global redirect (opens new window)
• Password reset feature (opens new window)
• Registration inline hooks (opens new window)
• Self-service registration process (opens new window)
• Suspicious activity reporting (opens new window)
• Sessions

Okta API changes

• Okta APIs
• Authenticator enrollment policy API

Legacy features with limited support

Custom app login (opens new window) is available only to Classic Engine orgs that used it before upgrading.

Discontinued features

Some features are end of life and won't work after the upgrade. These are identified in the Upgrade Hub if your org is impacted.

Plan

Prepare your upgrade strategy by identifying integration points and defining your rollout approach:

Identify integration points and customizations

Identify all of your Okta integration points including apps, SDKs, API tokens, and hooks. This helps your team triage what to test, update, replace, or retire before upgrading.

Handle unsupported features

• Prepare to remove Okta Mobile (opens new window).
• Update your policies for Office 365 MFA pass claim (opens new window).
• Prepare to replace your Device Trust setup (opens new window).

Define your rollout approach

Plan (opens new window) how you want to sequence changes across orgs, roll out to user segments, and replace unsupported or deprecated features. Okta recommends a gradual, iterative approach over a single cutover.

Plan your rollback strategy

• When you should roll back (opens new window)
• Initiate a rollback request (opens new window).

Build

Update your environment and code, then test everything in your Preview environment:

Record your classic setup and ready your test environment

• Record your Classic Engine experience (opens new window).
• Set up your test environment (opens new window).

Complete Identity Engine Upgrade Hub action items

Before you can schedule your upgrade from Classic Engine to Identity Engine, complete all action items listed in the Identity Engine Upgrade Hub (opens new window).

Update your org settings and environment

• Turn off Device Trust before upgrading to Okta Identity Engine (opens new window).
• Remove support for Integrated Windows Authentication (IWA) (opens new window).
• Rename Duo Security custom IdP (opens new window).

Update your Sign-In Widget

• Upgrade the Okta Sign-In Widget version.
• Deprecated JavaScript methods in the widget

Update your custom code

• Update your event hooks for Identity Engine.
• Update your inline hooks for Identity Engine.
• Upgrade the Terraform provider (opens new window).

Test your changes in a test environment

• Test user flows, custom code, and third-party tools (opens new window).
• Run through your post upgrade checklist (opens new window).
• Test your widget's existing customizations in a test environment.

Validate readiness and schedule your upgrade

• Confirm that all required changes are complete and your testing validates readiness.
• Schedule and execute your Production upgrade.

Related topics

• Find troubleshooting docs at the Okta Knowledge base center (opens new window).
• Check out the video resources on the Okta Support Center's Identity Engine upgrade page (opens new window).
• Get an overview of the Identity Engine upgrade process.