timetobail
My stack

Okta · Forced move · Announced September 18, 2026 · Sources checked Oct 13

Time to bail on Okta Classic: registration, Desktop SSO, Device Trust?

Time to Bail · Boarding pass

FromOkta Classic: registration, Desktop SSO, Device Trust
ToYour pick

Act. You can stay.

These Classic Engine features turn off March 5, 2027. Upgrade to Okta Identity Engine to keep them.[1]

Act means: change a setting or plan before the date. You can stay.

Gate closes
Features turn off
Time left
140days
Status
Act

Okta Classic Engine loses three features on March 5, 2027

From March 5, 2027, Okta turns off Self-Service Registration, Desktop SSO and Device Trust on Classic Engine. To keep them, upgrade to Okta Identity Engine first. The upgrade is free.

How it is winding down

  1. Sep 18, 2026AnnouncedDone
  2. Mar 5Features turn offNext

What to do before March 5

Tick steps as you go. Your progress stays in this browser.

  1. Check which engine you use

    In the Okta Admin Console, check if your org runs Classic Engine.

  2. List the features you use

    Note if you use Self-Service Registration, Desktop SSO or Device Trust.

  3. Plan the Identity Engine upgrade

    Okta upgrades orgs in waves. Plan yours well before March 5, 2027.

Facts we checked

Facts and their sources
Features turn offMarch 5, 2027[1]
FeaturesSelf-Service Registration, Desktop Single Sign-On (IWA) and Device Trust[1]
If you do nothingYou lose access to them unless you upgrade to Okta Identity Engine first[1]
Cost of the upgradeFree[1]
Self-Service Registration becomesProfile Enrollment Policy[1]
Desktop SSO becomesAgentless Desktop SSO or Okta FastPass[1]
Device Trust becomesManagement attestation with Okta Verify[1]
AnnouncedSeptember 18, 2026[1]
Orgs still on Classic Engine using these featuresLose them on March 5, 2027[1]

Sources

Check it yourself. Every fact above links here.

  1. Okta Classic Engine deprecation Okta · primary · checked Oct 13
Read the published editorial report

What changed

Time to bail on Okta Classic: registration, Desktop SSO, Device Trust? Act. You can stay. These Classic Engine features turn off March 5, 2027. Upgrade to Okta Identity Engine to keep them.

On our scale this is Act: change a setting or plan before the date. You can stay.

From March 5, 2027, Okta turns off Self-Service Registration, Desktop SSO and Device Trust on Classic Engine. To keep them, upgrade to Okta Identity Engine first. The upgrade is free.

Here are the facts we checked:

  • Features turn off: March 5, 2027 (Okta)
  • Features: Self-Service Registration, Desktop Single Sign-On (IWA) and Device Trust (Okta)
  • If you do nothing: You lose access to them unless you upgrade to Okta Identity Engine first (Okta)
  • Cost of the upgrade: Free (Okta)
  • Self-Service Registration becomes: Profile Enrollment Policy (Okta)
  • Desktop SSO becomes: Agentless Desktop SSO or Okta FastPass (Okta)
  • Device Trust becomes: Management attestation with Okta Verify (Okta)
  • Announced: September 18, 2026 (Okta)
  • Orgs still on Classic Engine using these features: Lose them on March 5, 2027 (Okta)

You can stay on Okta. You have to change a setting or plan before the date.

Leaving is a choice here, not a must.

Okta is the main source for this page. Okta has not said more than what is listed here. If a fact is not on this page, we do not know it yet.

Who is affected

Orgs still on Classic Engine using these features: Lose them on March 5, 2027.

The date to remember is March 5, 2027. Make the change before then.

What to do before March 5

  1. Check which engine you use. In the Okta Admin Console, check if your org runs Classic Engine.
  2. List the features you use. Note if you use Self-Service Registration, Desktop SSO or Device Trust.
  3. Plan the Identity Engine upgrade. Okta upgrades orgs in waves. Plan yours well before March 5, 2027.

A few tips:

  • Make the change yourself before the date. Do not wait for the last reminder email.
  • Write down your current plan or settings first, so you can compare after the change.
  • After the change, open your settings again and check that it worked.

How to tell your users

If the change affects your members or team, send one short email. Say what changes for them and when. Put the most important line first.

If there is a date, send a short reminder a few days before it. Keep a copy of the list you sent it to.

Options people mention

Listed for convenience. Not ranked. Not paid. These names come up in threads and reviews; that does not show where people moved.

Before you pay, check the price page of each tool yourself. Prices change, and we only list what our sources say.

Questions people ask

No questions collected yet.

Sources

Thanks.

Did this answer your question?

Run SaaS spend at work? Get these changes before the invoice

Arrivals · for builders

Building where they land?

People on Okta Classic: registration, Desktop SSO, Device Trust can stay if they make the change. Some would rather leave. Get the playbook for this change, and list your product here.

Listing is free. An editor checks it. Not ranked. Not paid.

Open the playbookList your product