Sure, so in your particular case, it sounds like the agent will be installed on perhaps Windows Server 2019, but the Domain Controller itself may be 2008.

With that assumption out of the way, and assuming there are no compatibility issues that are associated with Microsoft's end of things, Okta does specify the following:

As Okta does specify that the domain must be operating at the functional level of 2003 or higher, Microsoft states the below OS support this:

Something to keep in mind. Furthermore, Okta states that to enforce the AD Password Policy history, your functional level must be Windows Server 2012 R2 or higher.

Microsoft states the following supports this:

Therefore assuming this is something you want, you need to keep Microsoft's requirements in mind as well.

At the end of the day, assuming you are on supported functional levels from Okta's perspective and you follow their requirements for the OS, and the OS is supported by Microsoft according to your functional level, you should be fine. Okta does recommend that you keep the same Okta agent version across all servers, but does not strictly speak to the requirement of those server OS's compared to the domain controller itself.

Finally, while Okta recommends the agent is installed on a member server in the domain, you can install it on the domain controller itself. This would alleviate any issues/concerns with different OS versions across the domain.

Thanks!