Okta introduces production-traffic testing for sign-in policy changes

Okta describes Policy Branches as a Git-style change-management feature for application sign-in policies. Administrators can create a separate draft from a live policy and evaluate proposed rules against production sign-in activity. The monitoring period can last up to 28 days, and the draft does not challenge or block users while it is being evaluated. The aim is to let teams review how a rule behaves before deciding whether to put it into effect.

During monitoring, Okta records what the branch would have done, including denials, added authentication challenges and the rule that matched. The company says these evaluations use real sign-in activity rather than a staging environment or spreadsheet estimates. In Policy Insights, monitored branches are represented with dashed trend lines. Their evaluation events are also marked with an AlternateId authentication policy branch value in the policy.evaluate_sign_on event.

The feature is intended to help administrators assess proposed security controls against actual traffic. Examples include estimating how many people might be blocked by a phishing-resistant multi-factor authentication requirement, identifying devices that do not meet new posture rules, and checking who signs in from outside specified network zones. Teams can also examine whether a risk-score rule would trigger on real activity. These are examples of questions Policy Branches can help answer, rather than a guarantee that any particular rule will produce a specific result.

Okta’s workflow covers creating a branch, monitoring it and promoting it to live. If the live policy changes after a branch is created, the administrator receives a warning about possible drift from the branch’s source. When a branch is promoted, the previous live configuration is saved in its history. The comparison in Okta’s article says administrators can restore any of the last five live configurations with one click.

The feature also applies to organizations using Okta for AI Agents: Okta says administrators can preview how application sign-in policy changes affect both user and agent authentication flows. This puts agent access within the same policy review process described for other sign-ins, using production activity before a change goes live. For builders managing AI agents through Okta, the relevant capability is the chance to inspect potential authentication effects before enforcement, without the monitored branch itself changing access.