Okta's November 3, 2026 Identity Engine production release 2026.44.0 makes MCP Cross App Access generally available. Configurations created under Early Access Connect with Okta stop working with this release; the old Manage Connections tab and associated API are retired. This retirement concerns that earlier XAA setup, not every MCP or XAA integration.
Follow the current configuration route
The migration guide describes three stages: configure the requesting AI agent, configure the resource application, then connect them. The flow requires an Okta organization with SSO and applications that support XAA.
The resource application must already exist in the organization. Supported types include XAA-capable custom OIDC and SAML applications and compatible catalog applications. Check the issuer, audience or tenant identifier, and available scopes before configuring the connection.
On the agent's Resource connections page, select the XAA-enabled application. Review its resource URLs, the agent's external client ID registered in that application, and permitted scopes. A specific scope allowlist must match scopes defined by the resource application.
For MCP connections, first register the server with an XAA-capable authorization server. For an external authorization server, check the expected user identifier, such as email versus user ID. Check whether a tenant identifier is needed. Then create the agent's resource connection.
Validate before expanding access
Our operational recommendation: inventory legacy connections and name an owner for each. Record intended users, resources and allowed operations. Test with an ordinary user, including a permitted request and an operation that should fail. Investigate unexpected success as carefully as failure. Keep the first migration small and retain a written acceptance record.
Okta says deactivating a resource connection blocks future access requests. Verify downstream token behavior separately; this documentation does not promise immediate cancellation of every previously issued token.