What’s changing?

Starting May 1, 2026, Okta will no longer sell or renew the Advanced Server Access SKU. 

Why can I no longer renew this SKU?

Okta Advanced Server Access (ASA) provides just-in-time access to servers. Okta Privileged Access (OPA) is the designated product successor to ASA, offering a fully featured, modern approach to PAM that extends privileged access capabilities beyond servers to include additional resource types, privileged account vaulting, and secrets management. Okta has decided to no longer invest in ASA and encourages customers to migrate to Privileged Access for an enhanced PAM solution. 

What will happen when my ASA SKU is up for renewal?

Your Okta teams will work with you on a new contract, which will include ASA and Okta Privileged Access SKUs to give your teams time to migrate your deployment. After one year from your renewal date, you will no longer have access to ASA.

How long do I have to migrate off ASA?

You will have one year from your renewal date to migrate from ASA to Okta Privileged Access. 

Can I migrate before my renewal date?

Yes, you can request a contract amendment to add OPA ahead of your scheduled renewal to start your migration. 

Is there a specific date when the ASA service will be decommissioned? 

No specific date for the service is being communicated at this time. However, customers must be off ASA within one year of their first renewal after this policy starts. 

What level of support is available for the migration?

Okta is committed to making this as easy as possible for customers. Please review the Migration Guide and contact your account team to learn more about available resources.

How long does a migration take?

The level of effort is approximately less than 20 hours.