Both the Customer Identity Solution built to support end users’ digital access needs, and the Workforce Identity Cloud, built to secure your internal workforce are OIE-eligible platforms.

Okta’s industry-leading Identity solutions are powered by the same underlying infrastructure. Okta Classic is Okta’s legacy engine and the Okta Identity Engine, or OIE, was introduced for all new customers effective March of 2022.

What is OIE?

Okta’s Identity Engine offers the most modern way to customize your Okta experience and implement flexible, customized Identity use cases. OIE is Okta’s newest improved platform engine, offering a security policy framework designed to align with NIST 80063B and an authentication pipeline that strengthens your identity posture while delivering a superior user experience (UX).

Okta Identity Engine grants Okta administrators increased control for administrators over how applications and resources are both protected and accessed, while maintaining a seamless experience for end users.

Why should you upgrade?

There are numerous security features to configure, customize and leverage in the Okta Identity Engine. Key benefits of upgrading your org include:

1. Accessibility

Upgrading an existing Okta org from Okta Classic’s engine to OIE is a free platform upgrade, meaning there is no additional investment required.

Most features and functionality are available immediately post-upgrade to OIE, and the majority of your existing org configurations will seamlessly migrate. Most upgrades only take a few minutes to complete, with no downtime for admins or end users.

Okta also offers exceptional flexibility for administrators looking to upgrade. Admins can use self-service tools to verify your org’s eligibility, resolve any pending action items, and schedule the upgrade at a time that best suits you. Even better, the upgrade from Okta Classic to OIE can be scheduled for any time during your Okta subscription term.

2. Enhanced authentication

Okta Identity Engine is designed to evaluate more granular context during user authentication, but also make authentication policies much easier to manage.

Application-level sign-on policies that were configured on a per-application basis in Okta Classic can instead be configured for multiple applications at once, or according to the assurance level you require from the user to sign-in, using Okta Identity Engine.

In addition, benefits of OIE authentication include the enabling of modern, true multi-factor authentication (MFA) with different factor types and abstraction through assurance level. MFA possession factor constraints are introduced to further secure your org, including phishing-resistant MFA such as Okta FastPass, hardware protected MFA, and the exclusion of any authentication method by name, if you choose. We recommend higher assurance factors, specifically phishing-resistant authentication.

3. Passwordless

In Okta Classic, the default method of sign-in for any policy required the end user to provide a password, unless avoided via factor sequencing which can pose both flexibility and management challenges. To contribute to a  Zero Trust security framework, OIE enables password-specific capabilities including no password or optional password authentication conditions. Please note that both Okta Classic and OIE support factor sequencing.

OIE global session policies, again configurable for an entire org and not only on a per-application basis, can be tailored to require any factor type(s) used to meet the minimum configured authentication policy requirements, which can exclude a password.

For higher assurance, Okta recommends a combination of multiple factor types, specifically biometrics alongside phishing-resistant MFA such as Okta FastPass or FIDO2. An alternative better suited to Customer Identity flows is a configured email magic link authentication sign-on policy, where end users will receive a URL via email for a click-to-login experience.

4. Device assurance

Okta’s Identity platforms both support native device assurance capabilities and seamlessly integrate with device management technologies to further secure your data, enforcing a Zero Trust security framework. Device trust contextual access management solutions enable orgs to protect sensitive corporate resources by only allowing end users with managed devices to access Okta-integrated applications. 

Benefits of device trust in OIE include advanced security authentication configurations factoring in conditions such as the below, among others in order to increase your device assurance posture:

• Device OS and/or type, 

• Device password protection and length,

• Registration status,

• Whether the device is jailbroken or rooted.

OIE requires the use of Okta Verify to secure your org’s mobile devices. For more on translating device trust from Okta Classic to OIE, visit our knowledge base.

5. Improved admin experience

Okta’s Identity solutions consider the user experience which includes both end users authenticating and technical administrators of the Okta org. Okta’s administrator console supports efficient, methodical Identity management.

In Okta Classic, the admin console boasts the legacy navigation pane with condensed configuration pages, whereas Okta Identity Engine’s navigation pane introduces additional configuration pages, refined more granularly for ease of administrator use. In addition to the new customizable settings in OIE, certain pages have changed which notably introduce an easy-to-navigate user interface.

As previously highlighted, a key benefit is that application authentication policies in OIE can be configured by administrators and assigned to multiple applications in an Okta org, rather than applications uniquely requiring individual policies.

Upgrade now

Ultimately, to best capitalize on Okta’s powerful Identity platforms and improve your security assurance posture, we strongly recommend upgrading your org from Okta Classic to Okta Identity Engine. The key benefits outlined here represent just a fraction of available functionality, ready for you to customize and leverage in your Okta org.

Visit our helpful resources to get started on the platform upgrade from Okta Classic to Okta Identity Engine, joining over 12,000 customers in taking advantage of the updated security features today. For additional support, register now for our free 1-on-1 OIE office hours.

For new or prospective customers interested in OIE, we invite you to check out Okta’s industry-leading Identity solutions by signing up for a free 30-day trial now! For more on OIE, visit our frequently asked questions.