Notifications
Clear all
Topic starter
10/06/2026 12:19 am
TL;DR: Okta’s planned retirement of its Mobile app on May 31, 2026 raises a governance problem for organisations that still depend on secure web authentication for credential-based, non-federated mobile apps, where end-user-managed passwords, shared secrets, and incomplete auditability remain common, according to Cerby. The real issue is not migration convenience but whether identity teams can bring disconnected apps under centrally managed lifecycle and credential controls without preserving standing risk.
NHIMG editorial — what this means for NHI practitioners
Questions worth separating out
Q: How should teams govern mobile apps that still depend on shared credentials?
A: Treat them as a credential lifecycle problem, not just an access experience problem.
Q: Why do non-federated mobile apps create more governance risk than federated ones?
A: Because the password becomes the real control point.
Q: What breaks when lifecycle workflows do not reach disconnected applications?
A: Joiner, mover, and leaver processes stop at the identity provider and never change the app state.
Practitioner guidance
- Inventory every mobile SWA dependency Identify all apps that still rely on credential replay rather than SAML or OIDC, then classify them by owner, business criticality, and shared versus personal credential use.
- Move secrets into a single managed vault Remove passwords from spreadsheets, personal managers, and ad hoc sharing paths, and make the vault the only approved source for credential-based mobile access.
- Extend lifecycle events to disconnected apps Bind joiner, mover, and leaver changes to provisioning, deprovisioning, and rotation actions for every non-federated application, including shared and admin-managed accounts.
What's in the full announcement
Cerby's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step migration options for organizations that need to move off Okta Mobile without breaking access for disconnected apps.
- Specific ways Cerby handles credential replay, vaulting, and tile-based access across desktop and mobile environments.
- Details on automated password rotation, MFA handling, and audit logging for shared or admin-managed credentials.
- Lifecycle automation examples for provisioning and deprovisioning disconnected apps through Okta events.
👉 Read Cerby’s analysis of Okta Mobile end of life and SWA migration →
Okta Mobile end of life: what changes for mobile SWA access?
Explore further
11/06/2026 2:02 am
Mobile SWA retirement exposes a governance gap, not just an application migration task. When a large population of business apps still relies on credentials rather than federation, the identity team inherits the burden of securing the secret itself. That shifts the control problem from sign-in flow design to credential lifecycle, sharing, and revocation discipline. Practitioners should treat the retirement as a signal that disconnected-app governance still needs an explicit operating model.
A few things that frame the scale:
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts, according to The 2024 Non-Human Identity Security Report.
- Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities.
A question worth separating out:
Q: How can security teams reduce risk during a mobile SWA migration?
A: Separate the app estate into federated and credential-governed groups, then migrate the latter through a control layer that can rotate secrets, log changes, and revoke access centrally. This avoids forcing users back into unmanaged passwords while preserving continuity for apps that cannot support modern federation.
👉 Read our full editorial: Okta Mobile retirement exposes the gap in mobile SWA governance
12/06/2026 3:37 am
Mobile SWA retirement exposes a governance gap, not just an application migration task. When a large population of business apps still relies on credentials rather than federation, the identity team inherits the burden of securing the secret itself. That shifts the control problem from sign-in flow design to credential lifecycle, sharing, and revocation discipline. Practitioners should treat the retirement as a signal that disconnected-app governance still needs an explicit operating model.
A few things that frame the scale:
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts, according to The 2024 Non-Human Identity Security Report.
- Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities.
A question worth separating out:
Q: How can security teams reduce risk during a mobile SWA migration?
A: Separate the app estate into federated and credential-governed groups, then migrate the latter through a control layer that can rotate secrets, log changes, and revoke access centrally. This avoids forcing users back into unmanaged passwords while preserving continuity for apps that cannot support modern federation.
👉 Read our full editorial: Okta Mobile retirement exposes the gap in mobile SWA governance
