BeyondTrust

No entries match these filters. Clear filters

1. Remote Support 26.3.1 release notes (2026-11-03) Nov 3, 2026 · issue 130

   BeyondTrust Remote Support 26.3.1 adds end-user consent in RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. sessions, FIDO2FIDO2The open standard behind passkeys and hardware security keys, where a website checks a signature from the user's device instead of a password. Because the key is bound to the site, phishing pages cannot use it. on Pathfinder, Configuration API via MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. gateway, and AI Session Summaries for Atlas deployment⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢
   └──▷ HOW TO FIND IT
   Let an AI assistant or MCP-compatible automation tool read and update Remote Support configuration without building a custom REST integration.
   📍Steps: In /login, go to Management › MCP Gateway. Enable read and/or write access to the Configuration API at the organization level. Point your MCP-capable AI assistant or tool at the MCP gateway endpoint — it can now query and modify RS configuration settings directly.
   Roll out a Jump Client upgrade to a pilot Jump Group first to validate compatibility before pushing to all endpoints.
   📍Steps: In /login, go to Jump › Jump Clients. Select a Jump Group and open its upgrade settings. Choose the specific group to upgrade and set the maintenance window. Confirm; remaining Jump Groups are unaffected until you explicitly include them.
   Stop session recording for an Asset Group where recording is prohibited by policy, without disabling recording globally.
   📍Steps: In /login, go to Jump › Jump Policies and open or create a policy linked to the target Asset or Asset Group. Toggle the session recording override to off for that Asset or Asset Group and save. Only administrators can change this setting, and every change is logged.
   • Adds new APIs: access the Configuration API through the MCP gateway so AI assistants and automation tools can read and change RS configuration settings without a custom REST integration, with read and write access controlled at the organization level; assign attended and unattended session policies to a group policy through the API, removing the manual UI step from provisioning scripts; and retrieve AI Session Summaries through public APIs for use in reporting, storage, and analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds new session control policies: BeyondTrust Remote Support now requires end-user consent before a representative can share the screen, access files, or access the shell in an active RDP session, with consent re-requested on mid-connection session switches; and administrators can use a session policy to start screen sharing in view-only mode, requiring the representative to request end-user approval before taking control.
   • Turn session recording on or off for a single Asset or Asset Group, overriding the global recording policy, via Jump Policies settings.
   • Schedule Endpoint Automation jobs on a one-time or recurring basis for specific Jump Groups, tags, or endpoints, with run windows, concurrency limits, and automatic retries.
   • AI Session Summaries now writes summaries into matching ServiceNow incidents automatically, pulls ticket context from ServiceNow, covers the full session recording rather than only the first ten minutes, and is now available for Atlas deployments.

   +5 more show less

   • Remote Support on Pathfinder now supports FIDO2 authentication, allowing representatives and administrators to register and sign in with FIDO2 security keys or platform authenticators.
   • The Status page in /login now shows a Total Active Users count (users who signed in within the last 365 days and still exist) immediately after the Time Zone field.
   • Adds new Jump Client controls: set how many days a Gateway can go without connecting before it uninstalls itself via the Jump Client maintenance settings in /login (the default remains 30 days); and control Jump Client upgrades by Jump Group, allowing staged rollouts to test a subset of endpoints before upgrading all.
   • Adds new traffic-node routing controls: control whether the traffic node selector appears on the representative web login page via a new setting on the Cluster tab in /login (when hidden, RS connects representatives to the closest available traffic node automatically); and cloud administrators can now choose traffic-node routing — SRV Record Lookup (default), Random, or Timezone Offset — under Management > Cluster > Traffic Nodes.
   • Session reports in /login and the Reporting API now include the Comment and Tag values set on Jump Clients.
   • Adds new APIs: access the Configuration API through the MCP gateway so AI assistants and automation tools can read and change RS configuration settings without a custom REST integration, with read and write access controlled at the organization level; assign attended and unattended session policies to a group policy through the API, removing the manual UI step from provisioning scripts; and retrieve AI Session Summaries through public APIs for use in reporting, storage, and analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds new session control policies: BeyondTrust Remote Support now requires end-user consent before a representative can share the screen, access files, or access the shell in an active RDP session, with consent re-requested on mid-connection session switches; and administrators can use a session policy to start screen sharing in view-only mode, requiring the representative to request end-user approval before taking control.
   • Turn session recording on or off for a single Asset or Asset Group, overriding the global recording policy, via Jump Policies settings.
   • Schedule Endpoint Automation jobs on a one-time or recurring basis for specific Jump Groups, tags, or endpoints, with run windows, concurrency limits, and automatic retries.
   • Remote Support on Pathfinder now supports FIDO2 authentication, allowing representatives and administrators to register and sign in with FIDO2 security keys or platform authenticators.

   +3 more show less

   • The Status page in /login now shows a Total Active Users count (users who signed in within the last 365 days and still exist) immediately after the Time Zone field.
   • Adds new Jump Client controls: set how many days a Gateway can go without connecting before it uninstalls itself via the Jump Client maintenance settings in /login (the default remains 30 days); and control Jump Client upgrades by Jump Group, allowing staged rollouts to test a subset of endpoints before upgrading all.
   • Adds new traffic-node routing controls: control whether the traffic node selector appears on the representative web login page via a new setting on the Cluster tab in /login (when hidden, RS connects representatives to the closest available traffic node automatically); and cloud administrators can now choose traffic-node routing — SRV Record Lookup (default), Random, or Timezone Offset — under Management > Cluster > Traffic Nodes.

   2 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !RADIUSRADIUSA networking protocol for centralised authentication, authorisation, and accounting of users connecting to a network, maintained under IETF standards. Cyber tools use it to integrate with existing enterprise identity infrastructure. authentication will be removed in the 27.1 release; migrate to SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider., LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory., or another supported authentication method before upgrading to 27.1.
2. Base 8.4.0 release notes (2026-11-03) Nov 3, 2026 · issue 130

   BeyondTrust Base 8.4.0 adds coordinated cluster updates and Canadian French language support for the appliance admin interface⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Clustered and failover deployments now update as a unit — the primary schedules both base and product updates and every node installs them in the same maintenance window, with per-node status visible on the cluster Updates page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • The appliance administrative interface is now available in Canadian French.
   • Rate limiting now limits burst and sustained request rates independently, so short legitimate traffic bursts are no longer throttled as sustained abuse.
   • Clustered and failover deployments now update as a unit — the primary schedules both base and product updates and every node installs them in the same maintenance window, with per-node status visible on the cluster Updates page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • The appliance administrative interface is now available in Canadian French.

   1 more in Everything

3. docs update Oct 10, 2026 · issue 100

   BeyondTrust Pathfinder adds regional data residency for PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. authentication data, with org-level, user-level, and IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.-level region controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Move your entire organization's PII authentication data to Germany to satisfy EU data-residency obligations.
   📍In Pathfinder, go to Organization Settings › Data Residency, select Europe (Frankfurt) in the New PII region list, read the migration warning, check the acknowledgment checkbox, then click Start Migration. Monitor progress in Audit Logs.
   Pin a single remote employee's PII data to a specific region without affecting the rest of the organization.
   📍In Pathfinder, go to Administration › User Management, open the ⋮ menu for the user and select Edit User, then under User Details set Data residency region to the desired region and click Save.
   Ensure SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider.-provisioned users are stored in Canada at first sign-in rather than defaulting to US East.
   📍In Pathfinder, go to Identity & Authentication Providers › Edit Identity Provider, set the identity provider region to Canada Central, and save. New users auto-provisioned through this provider on first sign-in will have their PII stored in Canada.
   • Adds Data Residency section under Organization Settings letting organization administrators select a PII storage region (US East, Canada, Brazil, UK, Germany, India, Singapore, or Australia) for all users, triggering a background migration of existing user records.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Data residency region field in Administration > User Management > Edit User to place a single user's PII authentication data in a region that overrides the organization region.
   • Adds identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. region setting in Identity & Authentication Providers > Edit Identity Provider (and Directory Authentication > Edit Directory Provider) to control which region newly auto-provisioned SAML or directory users are stored in at first sign-in.
   • Supports per-region dedicated encryption keys and point-in-time recovery for all regional PII stores.

   4 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Changing the organization region migrates every user — including those with existing user region overrides — to the new region, silently replacing all deliberate per-user placements. Record user region overrides before starting an organization migration and re-apply them afterward.
4. docs update Oct 10, 2026 · issue 100

   BeyondTrust Pathfinder adds a PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. Region selector on identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. registration to control where user authentication data is stored.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢
   • Adds a PII Region field to the identity provider Manual Entry tab in BeyondTrust Pathfinder, letting admins choose which data-residency region stores the PII authentication data for users created via that IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

5. docs update Oct 10, 2026 · issue 100
   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Set a PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. region on an existing identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. so that newly authenticating users have their PII data stored in your chosen region, not the default US region.
   📍1. Sign into login.beyondtrust.io — the BeyondTrust Home page displays. 2. At the top right, click your site name to open the drop-down menu. 3. From the ≡ menu, select Identity & Authentication Providers. 4. Locate your configured identity provider and click Edit. 5. Select the desired PII region from the region selector and save.
   └──▷ BREAKING ON UPGRADE

   • !If a PII region is not set on an identity provider, new users are placed in the default US region rather than the organization region, even when the organization region is configured elsewhere.
6. docs update Oct 10, 2026 · issue 100

   BeyondTrust adds Pathfinder Authentication API for managing IP allowlists and auth settings via REST.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • New https://api.beyondtrust.io/platform/auth base URL exposes the Pathfinder Authentication API for managing organization-level authentication settings via REST.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds IP allowlist API under https://api.beyondtrust.io/platform/auth to manage allowed IP addresses and ranges and toggle enforcement on or off.
   • Authenticates API requests via Authorization: Bearer <token> using a personal access tokenpersonal access tokenA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. (PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.) scoped to an organization administrator.
   • Returns structured JSON error bodies with title, status, and detail fields, where detail includes remediation guidance when available.

   4 details in Everything

7. docs update Oct 8, 2026 · issue 097

   BeyondTrust Pathfinder adds regional PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. data residency, letting admins place user auth data in eight regions worldwide.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Move your entire organization's PII auth data to a non-US region to satisfy a regulatory obligation — for example, storing EU staff credentials in Germany.
   📍1. Sign in to Pathfinder as an organization administrator. 2. Go to Organization Settings. 3. In the Data Residency section, select Europe (Frankfurt) in the New PII region list. 4. Read the migration warning and select the acknowledgment checkbox. 5. Click Start Migration — a background job migrates all users' PII authentication data to Frankfurt.
   Place a single remote employee's PII auth data in a region closer to them without affecting the rest of the organization.
   📍1. Go to Administration › User Management. 2. Select the ⋮ menu for the user, then select Edit User. 3. Under User Details, select Asia Pacific (Sydney) in the Data residency region list. 4. Click Save — the user's PII auth data is written to Sydney and removed from the previous region immediately.
   Ensure SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider.-federated users are placed in the correct region automatically on their very first sign-in, before an admin can set a per-user override.
   📍1. Go to Identity & Authentication Providers › Edit Identity Provider (or Directory Authentication › Edit Directory Provider for LDAP/AD). 2. Set the identity provider region to the desired region, e.g. Canada Central. 3. Save — new users authenticating through this provider for the first time will have their PII stored in Canada.
   • Adds Organization Settings > Data Residency to let organization administrators set a regional PII store for all users, with a background migration to US East (Virginia), Canada, Brazil, Germany, the UK, India, Singapore, or Australia.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Data residency region field under Administration > User Management > Edit User for per-user region overrides that move PII auth data in a single operation without downtime.
   • Adds identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. region setting on SAML and directory providers (Identity & Authentication Providers > Edit Identity Provider and Directory Authentication > Edit Directory Provider) to control where new users are first stored at sign-in.
   • Supports eight PII storage regions: US East (Virginia), Canada Central, South America (São Paulo), Europe (Frankfurt), Europe (London), Asia Pacific (Mumbai), Asia Pacific (Singapore), and Asia Pacific (Sydney).
   • Scopes regional storage to specific PII fields — email address, first and last name, display name, password hash, account activation token, and invitation email address — while non-identifying data and the anonymized lookup key always remain in US East.

   5 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Changing the organization region via Organization Settings > Data Residency replaces all existing user region overrides — every user, including those with deliberate per-user placements, is migrated to the new organization region. Record overrides before starting a migration and reapply them afterward.
8. docs update Oct 8, 2026 · issue 097

   BeyondTrust Pathfinder adds org-level IP allowlisting for the console, REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services., and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. endpoints, with CSV bulk import and up to 900 entries.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Bulk-load your corporate egress ranges before enabling enforcement, so all office NATs, VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. egress points, and CI/CD runner IPs are covered in one shot.
   📍In the Pathfinder console, go to Administration › IP Allowlist, select Add IP Address, choose the Import IP Addresses tab, then upload a CSV whose first column lists each public IP/CIDR (e.g. 203.0.113.0/24) and whose optional second column provides a description (e.g. HQ Office NAT). After validation passes, click Add Entry to Allowlist.
   Lock down the Pathfinder console and REST API to approved corporate egress ranges and then turn on enforcement once all entries are verified.
   📍In the Pathfinder console, go to Administration › IP Allowlist, confirm your current public egress IP appears in the list, then turn on the Enforcement setting and click Turn on when prompted. Allow up to five minutes for all edge instances to apply the new policy.
   • Adds Administration > IP Allowlist in the Pathfinder console to define a per-organization allowlist of trusted public IPv4/IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. addresses and CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. ranges (up to 900 entries) that gate access to the Pathfinder web console (app.beyondtrust.io), Platform REST API requests, and supported Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCP) endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports CSV bulk import of allowlist entries via the Import IP Addresses tab, where the first column is the IP address or CIDR range and an optional second column supplies descriptions.
   • Supports per-entry formats including single IPv4/IPv6 addresses, CIDR blocks (e.g. 203.0.113.0/24, 2001:db8::/48), and IPv4 start-end ranges (e.g. 203.0.113.14-203.0.113.58), each with an optional description up to 140 characters.
   • Enforcement is toggled via the Enforcement setting on the IP Allowlist page; changes propagate to edge instances within up to five minutes, and Pathfinder blocks the save if the change would exclude the administrator's own current public IP.
   • Enables programmatic management of the allowlist through the platform REST APIsREST APIsA convention for building HTTP-based interfaces where resources are addressed by URL and manipulated with standard verbs like GET, POST, and DELETE, giving cyber tools a predictable way to integrate with external services. for change-control and large-scale administration.

   5 details in Everything

9. docs update Oct 8, 2026 · issue 097

   BeyondTrust Pathfinder adds a PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. Region field to identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. registration for data residency control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   When registering a new IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. for a non-US organization, set the PII Region to keep user authentication data in the correct jurisdiction from first sign-in.
   📍In BeyondTrust Pathfinder, open the ≡ menu › Identity Providers panel › Manual Entry tab, then set the PII Region field to your desired region before saving the provider.
   └──▷ BREAKING ON UPGRADE

   • !If an identity provider's PII Region is not set, users are placed in the default US region, not the organization region — even when the organization region is configured elsewhere. Existing users are not migrated if the provider's region is changed after first sign-in.
10. docs update Oct 8, 2026 · issue 097

    BeyondTrust identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. gain a PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. region selector to control where user authentication data is stored.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Set a non-US PII region on an identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. so that newly authenticating users have their PII stored in the correct regional data store from first sign-in.
    📍1. Sign into login.beyondtrust.io — the BeyondTrust Home page displays. 2. At the top right, click your site name to open the drop-down menu. 3. From the ≡ menu, select Identity & Authentication Providers. 4. Open an existing identity provider and click Edit. 5. Locate the PII Region field and select your desired region. 6. Save the configuration. Note: region assignment only applies on a user's first sign-in; existing users are not migrated automatically.
    • Adds a PII region setting to identity provider configuration, letting admins choose the data-residency region where personally identifiable information from IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.-authenticated users is stored; defaults to the US region if unset.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

11. docs update Oct 8, 2026 · issue 097

    BeyondTrust Pathfinder adds multi-language UI support: English, French, German, and Spanish.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Switch Pathfinder's UI language to match your team's locale without changing your browser settings.
    📍In Pathfinder, open Account Settings and Preferences, open the Language dropdown, and select your preferred language (English, French, German, or Spanish) or choose Browser Default to follow your browser's language automatically.
12. docs update Oct 8, 2026 · issue 097

    BeyondTrust adds the Pathfinder Authentication API for managing IP allowlists and auth settings via REST.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds the Pathfinder Authentication API at base URL https://api.beyondtrust.io/platform/auth, authenticated via Authorization: Bearer <token> (personal access tokenpersonal access tokenA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.), with requests and responses in JSON.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds an IP allowlist API under the Pathfinder Authentication API to manage the IP addresses and ranges that can reach your organization's resources and toggle enforcement on or off.

    2 details in Everything

13. docs update Oct 6, 2026 · issue 096

    BeyondTrust Identity Security Insights debuts with True Privilege Graph, threat detection, and cross-domain identity correlation⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢
    • Introduces Identity Security Insights, a new service that maps identity access paths via the True Privilege Graph to reveal direct, indirect, vertical, and lateral escalation routes across hybrid environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Threat Detection capability to spot session hijacking, unauthorized changes, and misuse of service principals in real time.
    • Adds Cross-Domain Correlation to surface hidden identity relationships across cloud and on-premises environments.
    • Adds Posture Tracking to measure privilege reduction, MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. adoption, and dormant account cleanup over time.
    • Adds Prebuilt Reports covering hygiene, misuse, and behavioral anomalies, continuously updated to reflect new identity risk patterns.

    +3 more show less

    • Adds Contextual Recommendations tied to each detection to guide remediation actions.
    • Ingests and normalizes identity data from AD, Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments., Okta, AWS, and BeyondTrust tools, then correlates it to show who can do what and whether they should.
    • Supports action via integrations with existing security stacks, enabling response without replacing current identity tooling.

    8 details in Everything

14. docs update Oct 6, 2026 · issue 096

    BeyondTrust launches Pathfinder, a unified portal at app.beyondtrust.io with shared SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., navigation, and multi-site access controls across all SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. products.

    • New integrationIntroduces Pathfinder, a new unified platform at app.beyondtrust.io providing single sign-onsingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. and cross-product navigation across all BeyondTrust SaaS products.
    • Enables multi-site organisation within Pathfinder, letting administrators create isolated site groups (e.g. by department or region) with per-site product access controls.

    2 details in Everything

15. Remote Support 26.2.3 release notes (2026-09-24) Sep 24, 2026 · release notes

    Remote Support 26.2.3 adds admin approval of incoming connections via email link and fixes get_connected_client_list pinned count omission.

    └──▷ TRY IT
    Verify that pinned clients are correctly returned for all connected devices via the API.
    copy

    $ curl https://<remote-support-host>/api/command?action=get_connected_client_list&type=all

    Approve an incoming support session by clicking the approval link provided in the admin notification email.
    📍Click Approve in the Remote Support admin notification email to grant access without logging into the console.
    • Enables administrators to approve incoming Remote Support connections directly from the notification email link.
    • GET /api/command?action=get_connected_client_list now includes the pinned_client_count in the response when type=all is specified.

    2 details in Everything

16. Endpoint Credential Manager 1.6.2609 release notes (2026-09-16) Sep 16, 2026 · issue 077

    ECM 1.6.2609 adds configurable certificate validation and field-debugging settings via named appSettings keys⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Allow ECM to connect when the appliance certificate is issued by an internal CA (e.g. ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise.) that does not publish a CRLCRLA Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live. — use only until the issuing CA certificate is deployed to the host.
    Example.config copy

    <appSettings>
      <add key="requireCertificateRevocationCheck" value="false" />
      <add key="allowUntrustedApplianceCertificate" value="true" />
    </appSettings>

    Enable full plugin exception detail during a field debugging session to diagnose credential retrieval failures without a rebuild.
    Example.config copy

    <appSettings>
      <add key="VerbosePluginExceptions" value="true" />
      <add key="MaxReturnedCredentials" value="750" />
    </appSettings>

    • Adds requireCertificateRevocationCheck appSettings key (default false) to reject certificates whose revocation status cannot be determined, for hosts without a reachable CRL or OCSPOCSPA protocol for checking whether a TLS certificate has been revoked, defined in RFC 6960, letting clients query a CA's responder in real time instead of downloading full CRL lists. endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds allowUntrustedApplianceCertificate appSettings key (default false) to accept appliance certificates that do not chain to a trusted root, for hosts where the issuing CA is not yet installed.
    • Adds MaxReturnedCredentials appSettings key to override the credential result limit in configuration (raised ceiling: 750) without requiring a rebuild.
    • Adds VerbosePluginExceptions appSettings key to return full plugin exception text to the appliance for field debugging, replacing the default correlation-ID-only response.
    • Documents every appSettings key ECM reads in Example.config.
    • Adds requireCertificateRevocationCheck appSettings key (default false) to reject certificates whose revocation status cannot be determined, for hosts without a reachable CRL or OCSPOCSPA protocol for checking whether a TLS certificate has been revoked, defined in RFC 6960, letting clients query a CA's responder in real time instead of downloading full CRL lists. endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds allowUntrustedApplianceCertificate appSettings key (default false) to accept appliance certificates that do not chain to a trusted root, for hosts where the issuing CA is not yet installed.
    • Adds VerbosePluginExceptions appSettings key to return full plugin exception text to the appliance for field debugging, replacing the default correlation-ID-only response.

    2 more in Everything

17. Remote Support 26.3.1 Pre-release notice (2026-09-15) Prerelease Sep 15, 2026 · issue 076

    BeyondTrust Remote Support 26.3 introduces automatic version upgrades with configurable Fast Track, Standard Track, and Enterprise Track channels.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Select your upgrade cadence in the appliance admin interface so automatic version upgrades happen only in your approved window.
    📍1. Log in to the /appliance administrative interface. 2. Go to Updates › Maintenance Window. 3. Set your Maintenance Window Start Time and Maintenance day(s). 4. Set Minimum days notice before installing updates. 5. Under Automatic Updates Channel, choose Fast Track, Standard Track, or Enterprise Track. 6. Click Save.
    • Enables automatic version upgrades during configured maintenance windows via the Automatic Updates Channel setting (Fast Track, Standard Track, or Enterprise Track), building on the channel setting introduced in 25.3.1.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a rollout schedule that staggers upgrades by channel: Fast Track sites begin upgrading to 26.3.x in mid-November 2026, Standard Track after 27.1 GA, and Enterprise Track after 27.2 GA — no deployment is ever moved to a version older than 26.3.
    • Allows opting out by clearing Automatically install the latest updates during maintenance day(s) and time in the /appliance Updates > Maintenance Window interface, while retaining manual update capability.

    3 details in Everything

18. Integration Client 26.2.1 release notes (2026-09-09) Sep 9, 2026 · issue 070

    Integration Client 26.2.1 adds session asset columns and configurable HTTP timeouts via new config keys.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Prevent the client from hanging indefinitely against a slow appliance by setting explicit timeouts for each request class.
    api.settings copy

    DownloadTimeoutSeconds = 600
    ApiRequestTimeoutSeconds = 120
    ApiInfoTimeoutSeconds = 30

    • Adds DownloadTimeoutSeconds, ApiRequestTimeoutSeconds (default: 300 s), and ApiInfoTimeoutSeconds (default: 60 s) config keys so HTTP timeouts are bounded and tunable per environment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds four nullable session columns — asset_type, asset_name, asset_comments, and asset_tag — to both the Analytics DB Plugin and the SQL Server Plugin, populated from the Reporting API, so reporting teams can correlate session activity with the worked-on asset without joining an external inventory source.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The User Account / API Account toggle is removed from Site Configuration — every site must now be configured with a Client ID and Client Secret; any site that relies on username and password API authentication must be reconfigured before it will function.
19. Endpoint Credential Manager 1.6.2606 release notes (2026-08-13) Aug 13, 2026 · issue 045

    ECM 1.6.2606 adds configuration self-heal, env-variable support for ConfigCLI, and richer plugin-load diagnostics.

    • Adds env: prefix support in ConfigCLI arguments so sensitive values can be resolved from environment variables instead of the command line, keeping them out of process creation logs.
    • Adds configuration self-heal: the ECM service and Configurator automatically detect and repair a missing or stale configuration file at startup and during installation, preserving appSettings, proxy, and log configuration while refreshing only version-driven sections.
    • Improves plugin load diagnostics by logging assembly load failures with full detail, replacing the opaque Found 0 plugins message when tools such as WDAC, AppLocker, or EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. solutions block plugin loading.
    • Hardens plugin loading by loading plugins from the install directory rather than the process working directory.
    • Switches the credential store to per-installation encryption entropy, replacing a previously shared value.

    +5 more show less

    • Restricts configuration deserializationdeserializationTurning stored or transmitted data back into objects a program can use. Unsafe handling of untrusted data can allow unexpected behavior or code execution. to known types.
    • Enables certificate revocation checking on the appliance connection and enforces size limits on protocol and HTTP reads.
    • Changes log appenders to fail closed rather than falling back to an unprotected credential value.
    • Upgrades the log4net dependency from 3.1.0 to 3.3.1.
    • Creates a new ECSM.entropy file in the install directory as part of per-installation encryption; should be backed up alongside ECSM.settings.

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Certificate revocation checking is now enforced on the appliance connection — CRLCRLA Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live./OCSPOCSPA protocol for checking whether a TLS certificate has been revoked, defined in RFC 6960, letting clients query a CA's responder in real time instead of downloading full CRL lists. endpoints must be reachable from the ECM host before upgrading.
    • !Plaintext credential values in log appender configuration must be re-encrypted before upgrading, as log appenders now fail closed rather than falling back to an unprotected credential value.
    • !The credential store now uses per-installation encryption entropy; a new ECSM.entropy file is created in the install directory and must be backed up alongside ECSM.settings.
20. iOS Representative Console 3.1.11 release notes (2026-07-30) Jul 30, 2026 · issue 031

    BeyondTrust iOS Representative Console 3.1.11 adds audio support during Jump Client sessions.

21. docs update Jul 30, 2026 · issue 030

    BeyondTrust Identity Security Insights launches with True Privilege Graph, threat detection, and cross-domain identity risk visibility.

    • Introduces the True Privilege Graph — maps direct and indirect access paths, revealing hidden privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. routes across hybrid environments.
    • Adds real-time posture tracking for privilege reduction, MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. adoption, and dormant account cleanup.
    • Enables threat detection for session hijacking, unauthorized changes, and misuse of service principals.
    • Provides prebuilt reports covering identity hygiene, misuse, and behavioral anomalies, continuously updated for new risk patterns.
    • Supports cross-domain correlation to surface hidden identity relationships across cloud and on-premises environments.

    +2 more show less

    • Delivers contextual recommendations tied to each detection, indicating remediation next steps.
    • Integrates with AD, Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments., Okta, AWS, and BeyondTrust tools as identity data sources.

    7 details in Everything

22. docs update Jul 30, 2026 · issue 030

    BeyondTrust introduces PathfinderAI, an AI-powered natural language assistant for exploring security data.

    └──▷ HOW TO FIND IT
    Enable PathfinderAI for a site so users can start querying security data in natural language — requires Identity Security Insights and at least one configured connector.
    📍In the Administration site, locate your Pathfinder site, select Edit, set PathfinderAI to On, and save your changes. PathfinderAI will appear in the main navigation menu for users on that site.
    • Adds PathfinderAI, an AI-powered assistant that lets users query and explore security data through natural language conversations directly in the BeyondTrust Pathfinder UI.
    • PathfinderAI integrates with Identity Security Insights, surfacing data from configured connectors through a conversational interface accessible from the main navigation menu.

    2 details in Everything

23. docs update Jul 30, 2026 · issue 030

    BeyondTrust launches PathfinderAI, a natural-language GenAI assistant for querying identity and privilege data across all connected Insights providers.

    └──▷ HOW TO FIND IT
    Identify which accounts have the broadest privilege paths to global admin — useful during an access review or incident triage.
    📍In the Pathfinder console, go to PathfinderAI (main navigation menu) and type: "Who can get to global admin?" — follow up with "Break that down by provider." to slice results by directory or cloud provider.
    Surface stale privileged accounts across all connected providers to prioritise remediation before an audit.
    📍In the Pathfinder console, go to PathfinderAI and type: "Are there any stale accounts with privileged access?" — then ask "Break that down by provider." to see which systems have the most exposure.
    • Adds PathfinderAI, a GenAI chat assistant embedded in Pathfinder that answers natural-language questions about your identity environment using live Insights data.
    • Supports privilege analysis queries — ask who holds specific roles or can reach them via privilege paths, with breakdowns by account type (human, service, application).
    • Supports stale/dormant account queries, surfacing inactive privileged accounts with days-inactive counts, password age, and risk context.
    • Supports excessive-permissions ranking across Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments., Azure AD, AWS, ServiceNow, and any other connected provider.
    • Supports risk prioritization queries, returning severity-ranked findings with instance counts and impact context.

    +4 more show less

    • Supports cross-provider breakdowns and conversational follow-up questions without restating the original topic.
    • Returns structured responses including formatted summaries, tables, severity-ranked findings, and prioritized remediation recommendations.
    • Supports voice input via a microphone button in addition to typed queries.
    • Each response includes copy, retry, quote, and thumbs-up/down feedback actions.

    9 details in Everything

24. docs update Jul 30, 2026 · issue 030

    BeyondTrust adds a Pathfinder MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. prompt library for AI-agent queries across PRA, EPM, Password Safe, Entitle, and Insights.

    └──▷ HOW TO FIND IT
    Get a one-page identity risk brief for a specific user across PRA, EPM, and Insights in a single agent prompt.
    📍Create an identity risk brief for <user_upn> for 2026-02-01..2026-02-07. Pull: (1) PRA session summaries, (2) EPM JIT admin session summaries, (3) Identity Security Insights recommendations. Return a 1-page narrative + all session IDs, recommendation IDs referenced.
    Detect anomalous JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility. elevation patterns on endpoints during an investigation window.
    📍Retrieve EPM JIT admin session summaries for 2026-02-01..2026-02-07. Identify: (1) endpoints with most JIT elevations, (2) repeated elevations by same identity, (3) sessions with unusual durations. Include all session IDs used.
    Query Password Safe managed accounts for a domain while confirming no credentials are surfaced in the agent response.
    📍Retrieve managed accounts for domain <domain>. Return account names and managed system associations. Confirm no secrets or credentials are included in the output.
    • New Pathfinder MCP prompt library provides ready-to-use prompts for querying BeyondTrust products (PRA, EPM Win/Mac, EPM Linux, Entitle, Password Safe, Identity Security Insights) through any MCP-compatible AI agent.
    • Adds multi-product identity risk brief prompt that orchestrates PRA sessions, EPM JIT admin sessions, and Insights recommendations into a single user-scoped narrative.
    • Adds EPM JIT anomaly detection prompt that identifies hot endpoints, repeat elevators, and unusual session durations across a date range.
    • Adds EPM admin access request summary prompt covering approval/denial counts, break-glass activity detection, and linked ticket references.
    • Adds Entitle policy structured summary and keyword search prompts for policy review via MCP agent.

    +3 more show less

    • Adds Password Safe managed account lookup prompt with explicit secret-suppression instruction to prevent credential exposure in agent output.
    • Adds Insights prioritized risk top-5 and recommendations-with-fallback prompts for structured, actionable security guidance.
    • Introduces best-practice patterns for MCP prompt engineering: absolute date ranges, graceful no-results handling, and data-grounding instructions to prevent agent hallucination.

    8 details in Everything

25. docs update Jul 30, 2026 · issue 030

    BeyondTrust Pathfinder adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. gateway (Early Access) so AI agents can securely query Identity Security Insights, Password Safe, EPM, PRA, and Remote Support through a single endpoint.

    └──▷ TRY IT
    After generating an MCP access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions., configure your AI agent to authenticate against the Pathfinder MCP gateway.
    copy

    $ Authorization: Bearer MCP_xxxxxxxxxxxxxxxxxxxx

    Enable the MCP gateway for a site so users can start connecting AI agents to BeyondTrust product data.
    📍In the Administration site, go to Site Feature Configuration › Platform AI Features, set the Platform Model Context Protocol (MCP) dropdown to Read Only, then select Update Site.
    • New Pathfinder MCP (Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) gateway lets AI agents securely query data across BeyondTrust products through a single authenticated endpoint.
    • Administrators can enable or disable MCP per site via Site Feature Configuration > Platform AI Features.
    • Users can self-serve MCP access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. with configurable expiration (30, 60, 90 days, or custom up to one year) from their profile.
    • Token management grid lets users view creation date, last login, expiration, and status, with per-token revoke (active) and delete (expired) actions.
    • Supports Identity Security Insights (v26.04.1), Password Safe (v26.1), EPM for Windows/Mac (v26.1), EPM for Linux (March 2026), Privileged Remote Access (v26.1), and Remote Support (v26.1) as connected data sources.

    5 details in Everything

26. docs update Jul 30, 2026 · issue 030

    BeyondTrust launches Pathfinder MCP GatewayMCP GatewayA server that sits between MCP clients and one or more Model Context Protocol backends, routing tool calls and aggregating context sources so a single endpoint exposes many AI-agent integrations at once. — a single MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.-compatible endpoint for AI agents to query data across all BeyondTrust products

    └──▷ USE IT
    Connect VS Code to the Pathfinder MCP Gateway so analysts can query live BeyondTrust data from their editor.
    json copy

    {
      "inputs": [
        {
          "id": "pathfinder-token",
          "type": "promptString",
          "description": "MCP access token for Pathfinder",
          "password": true
        }
      ],
      "servers": {
        "pathfinder": {
          "type": "http",
          "url": "https://mcp.beyondtrust.io/mcp",
          "headers": {
            "Authorization": "Bearer ${input:pathfinder-token}"
          }
        }
      }
    }

    Register the Pathfinder MCP server in Claude Code to allow an AI assistant to query BeyondTrust product data interactively.
    copy

    $ claude mcp add pathfinder "https://mcp.beyondtrust.io/mcp" \
      --transport http \
      --scope user \
      --header "Authorization: Bearer <your-mcp-token>"

    Enable the MCP gateway for your site so agents can begin connecting — requires administrator access.
    📍In the Pathfinder console, go to Administration › Site Settings and set the Platform Model Context Protocol (MCP) dropdown to Read Only.
    • Introduces the Pathfinder MCP Gateway, a single JSON-RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. 2.0/MCP endpoint (https://mcp.beyondtrust.io/mcp) that lets AI agents discover and query data across Identity Security Insights, Entitle, Password Safe, EPM, Privileged Remote Access, Remote Support, and Platform without building individual product integrations.
    • Supports any MCP-compatible AI agent or client, including VS Code with MCP extension, Claude Code/Claude Desktop, Cursor, custom internal agents, and Microsoft Security Copilot.
    • Exposes namespaced read-only tools per product (e.g., insights___, password-safe___, pra___, entitle___) discoverable via tools/list, returning structured JSON responses.
    • Enforces Pathfinder identity and product-level role permissions on every tool call — agents inherit only the token owner's existing access rights.
    • MCP access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. are generated from the Pathfinder profile and can be scoped with configurable expirations; gateway is opt-in and can be enabled by setting Platform MCP to Read Only in site settings.

    5 details in Everything

27. docs update Jul 30, 2026 · issue 030

    BeyondTrust Pathfinder gains Audit Logs for user management actions, accessible via the Administration console.

    └──▷ HOW TO FIND IT
    Investigate suspicious sign-in activity for a specific user by filtering audit logs to their email and sign-in events.
    📍In app.beyondtrust.io, go to [Site Name] › Administration › Audit Logs. Enter the user's email in the User Email box and sign in the Action box, then set a Start date and End date to scope the time window.
    • New Audit Logs page in Pathfinder tracks user management actions including password resets, IDPIDPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. config changes, auth events, machine/PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. token changes, permission changes, and user sign-ins.
    • Supports filtering audit events by date range, user email (partial match), and action keyword (partial match) to narrow investigation scope.
    • Expandable event rows reveal additional detail about each audit event.

    3 details in Everything

28. docs update Jul 30, 2026 · issue 030

    BeyondTrust Pathfinder gains SCIM 2.0SCIM 2.0A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. provisioning support for Okta, Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments., and SailPoint IdentityNow

    └──▷ HOW TO FIND IT
    Connect Microsoft Entra ID to Pathfinder for automated user provisioning without waiting for the 40-minute sync cycle.
    📍In Azure Portal, go to Entra ID → Enterprise Applications → New Application → Create your own application. Set Provisioning Mode to Automatic, then under Admin Credentials set: Tenant URL: https://api.beyondtrust.io/api/{organization-id}/platform/auth/scim/v2 Secret Token: SCIM_<token> Click Test Connection, then use Provisioning → Provision on demand → select user → Provision to push immediately.
    Generate a SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. bearer tokenbearer tokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else. in Pathfinder to supply to any supported identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. connector.
    📍In app.beyondtrust.io, select your site name → Administration → ☰ › Administration › SCIM Tokens → enter a name → select an expiration date → click Create Token. Use the resulting SCIM_<token> value as the Bearer token in your IdP connector.
    Configure Okta to provision and deactivate Pathfinder users automatically via SCIM.
    📍In Okta Admin, go to Applications → Browse App Catalog → search SCIM 2.0 Test App (Bearer Token) → Add Integration. Under Provisioning → Integration set: SCIM connector base URL: https://api.beyondtrust.io/api/{organization-id}/platform/auth/scim/v2 Unique identifier field for users: userName Authentication Mode: HTTP Header Authorization: Bearer SCIM_<token> Under Provisioning → To App, enable Create Users, Update User Attributes, and Deactivate Users.
    • Adds SCIM 2.0 provisioning integration to Pathfinder, enabling automated user and group lifecycle management from external identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..
    • Supports Okta, Microsoft Entra ID, and SailPoint IdentityNow as SCIM-capable identity providers.
    • New SCIM token generation workflow in the Pathfinder administration console with configurable expiration dates.
    • Supports full user lifecycle operations via SCIM: create (POST), update (PUT/PATCH), deactivate (PATCH active=false), reactivate, and delete (DELETE) for Users.
    • Supports group provisioning operations: create/update groups and manage group membership via SCIM Groups endpoints.

    +1 more show less

    • Exposes SCIM 2.0 API endpoint at https://api.beyondtrust.io/api/{organization-id}/platform/auth/scim/v2 for IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. connector configuration.

    6 details in Everything

29. docs update Jul 30, 2026 · issue 030

    BeyondTrust Pathfinder gains LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory./Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. authentication support via Privileged Remote Access or Remote Support as proxy.

    └──▷ HOW TO FIND IT
    Register an LDAP/AD provider in Pathfinder so directory users can authenticate through an existing Privileged Remote Access or Remote Support site.
    📍In the Pathfinder console, go to Administration (tenant dropdown) › Directory Authentication › Add provider, then configure Label, Provider type, Domain or server, Proxy site, and Product (Privileged Remote Access or Remote Support).
    • Supports LDAP and Active Directory authentication on Pathfinder, proxied through a connected Privileged Remote Access or Remote Support product instead of direct directory access.
    • New Directory Authentication configuration page in Pathfinder administration lets admins register directory providers with label, provider type, domain/server, proxy site, and product settings.
    • Enables automatic provisioning of Active Directory and LDAP user accounts on first sign-in via the organization-specific login URL.

    3 details in Everything

30. docs update Jul 22, 2026 · issue 022

    BeyondTrust Pathfinder now supports IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. metadata file import for SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. setup with Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments., Okta, and PingOne.

    └──▷ HOW TO FIND IT
    Configure Okta as a SAML IdPSAML IdPA SAML Identity Provider is a service that authenticates users and issues signed XML assertions to relying applications, letting a single login session span many services without re-entering credentials. in Pathfinder using metadata file import, then test with a domainless setup before enforcing domain binding.
    📍In the Pathfinder console, go to Administration › Identity & Authentication Providers › Add Identity Provider. Upload the Okta IDP metadata XML file, click Add Identity Provider, then copy the SAML Configuration URL to Clipboard. In Okta SAML Settings, replace the placeholder Single sign-on URL and Recipient URL (Entity ID) with the copied value. Leave the Domain Name box blank to test, then add your email domain under Edit Identity Provider Settings after a successful login.
    • Adds IdP metadata file import in Pathfinder to streamline SAML configuration for Microsoft Entra ID, Okta, and PingOne, reducing manual entry errors.
    • Supports domainless IdP configuration in Pathfinder, enabling administrators to test SAML authentication with a local account before binding an email domain.
    • Automatically sets ACS URL and Service Provider Entity ID to the same value when importing IdP metadata, simplifying SP configuration.

    3 details in Everything

31. docs update Jul 22, 2026 · docs issue 004

    BeyondTrust Pathfinder now supports IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. metadata file import for SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. setup with Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments., Okta, and PingOne.

    └──▷ HOW TO FIND IT
    Configure Okta as a SAML IdPSAML IdPA SAML Identity Provider is a service that authenticates users and issues signed XML assertions to relying applications, letting a single login session span many services without re-entering credentials. in Pathfinder using metadata file import, then test with a domainless setup before enforcing domain binding.
    📍In the Pathfinder console, go to Administration › Identity & Authentication Providers › Add Identity Provider. Upload the Okta IDP metadata XML file, click Add Identity Provider, then copy the SAML Configuration URL to Clipboard. In Okta SAML Settings, replace the placeholder Single sign-on URL and Recipient URL (Entity ID) with the copied value. Leave the Domain Name box blank to test, then add your email domain under Edit Identity Provider Settings after a successful login.
    • Adds IdP metadata file import in Pathfinder to streamline SAML configuration for Microsoft Entra ID, Okta, and PingOne, reducing manual entry errors.
    • Supports domainless IdP configuration in Pathfinder, enabling administrators to test SAML authentication with a local account before binding an email domain.
    • Automatically sets ACS URL and Service Provider Entity ID to the same value when importing IdP metadata, simplifying SP configuration.

    3 details in Everything

32. docs update Jul 22, 2026 · issue 022

    BeyondTrust Pathfinder adds SAML SSOSAML SSOAn authentication protocol that lets a user log in once with an identity provider and access multiple services without re-entering credentials, by passing signed XML assertions between parties. identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. support with group claims, default access rules, and IdP-initiatedIdP-initiatedA SAML or OIDC login flow where the identity provider starts the session and pushes an assertion to the service provider without the user first requesting access, removing the SP-side redirect step. provisioning.

    └──▷ HOW TO FIND IT
    Set baseline access for all new SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. users so they receive the correct role and site access automatically on first login, without admin intervention.
    📍In the console, go to Administration › Identity & Authentication Providers, expand Default Access Rules, select a role (Standard User or Administrator), select one or more sites and applications, then click Save Changes.
    Pass Azure AD security group membership to Pathfinder applications via SAML so group-based access policies are enforced at the application layer.
    📍In Azure SAML app › Group Claims: set group type to Security groups, source attribute to sAMAccountName, enable 'Customize the name of the group claim' and enter groups as the claim name.
    • Supports connecting any SAML-compatible identity provider (e.g., Entra/Azure, Okta) to BeyondTrust Pathfinder for centralized SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. authentication.
    • Adds IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.-initiated authentication flow to auto-provision Pathfinder accounts for users not pre-created locally, suited for large-scale onboarding.
    • Introduces default access rules to automatically assign roles (Standard User or Administrator) and site/application access to users on their first SAML login.
    • Enables SAML group claims passthrough so Pathfinder applications can consume IdP group membership (e.g., AD security groups, cloud-only groups) via a Groups assertion.
    • Provides UI workflows under Administration > Identity & Authentication Providers to add, edit, and delete SAML identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..

    5 details in Everything

33. docs update Jul 22, 2026 · docs issue 004

    BeyondTrust Pathfinder adds SAML SSOSAML SSOAn authentication protocol that lets a user log in once with an identity provider and access multiple services without re-entering credentials, by passing signed XML assertions between parties. identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. support with group claims, default access rules, and IdP-initiatedIdP-initiatedA SAML or OIDC login flow where the identity provider starts the session and pushes an assertion to the service provider without the user first requesting access, removing the SP-side redirect step. provisioning.

    └──▷ HOW TO FIND IT
    Set baseline access for all new SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. users so they receive the correct role and site access automatically on first login, without admin intervention.
    📍In the console, go to Administration › Identity & Authentication Providers, expand Default Access Rules, select a role (Standard User or Administrator), select one or more sites and applications, then click Save Changes.
    Pass Azure AD security group membership to Pathfinder applications via SAML so group-based access policies are enforced at the application layer.
    📍In Azure SAML app › Group Claims: set group type to Security groups, source attribute to sAMAccountName, enable 'Customize the name of the group claim' and enter groups as the claim name.
    • Supports connecting any SAML-compatible identity provider (e.g., Entra/Azure, Okta) to BeyondTrust Pathfinder for centralized SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. authentication.
    • Adds IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.-initiated authentication flow to auto-provision Pathfinder accounts for users not pre-created locally, suited for large-scale onboarding.
    • Introduces default access rules to automatically assign roles (Standard User or Administrator) and site/application access to users on their first SAML login.
    • Enables SAML group claims passthrough so Pathfinder applications can consume IdP group membership (e.g., AD security groups, cloud-only groups) via a Groups assertion.
    • Provides UI workflows under Administration > Identity & Authentication Providers to add, edit, and delete SAML identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..

    5 details in Everything

34. docs update Jul 22, 2026 · issue 022

    BeyondTrust introduces multi-site management for grouping applications by team, region, or org structure.

    └──▷ HOW TO FIND IT
    Restrict a set of users to only the applications in a specific region or team by switching to that site's Administration view.
    📍In login.beyondtrust.io, click your site name (top right) › select Administration › locate the target site tile to manage users and connectors scoped to that site.
    • New Sites feature lets administrators group BeyondTrust applications by company structure (e.g., IT vs. Engineering) or region (e.g., North America vs. Europe) for isolated user access control.
    • Supports switching between sites from the top-right site name drop-down on the BeyondTrust Home page.
    • Enables renaming a site via Administration > Edit Site without disrupting access.
    • Site deletion removes all associated user permissions and configured connectors immediately and irreversibly.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Deleting a site is an unrecoverable operation that immediately removes all associated user permissions and configured connectors.
35. docs update Jul 22, 2026 · docs issue 004

    BeyondTrust introduces multi-site management for grouping applications by team, region, or org structure.

    └──▷ HOW TO FIND IT
    Restrict a set of users to only the applications in a specific region or team by switching to that site's Administration view.
    📍In login.beyondtrust.io, click your site name (top right) › select Administration › locate the target site tile to manage users and connectors scoped to that site.
    • New Sites feature lets administrators group BeyondTrust applications by company structure (e.g., IT vs. Engineering) or region (e.g., North America vs. Europe) for isolated user access control.
    • Supports switching between sites from the top-right site name drop-down on the BeyondTrust Home page.
    • Enables renaming a site via Administration > Edit Site without disrupting access.
    • Site deletion removes all associated user permissions and configured connectors immediately and irreversibly.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Deleting a site is an unrecoverable operation that immediately removes all associated user permissions and configured connectors.
36. docs update Jul 22, 2026 · issue 022

    BeyondTrust Pathfinder unifies Password Safe, PRA, Remote Support, EPM, Identity Security Insights, and Entitle under a single pane of glass at app.beyondtrust.io.

    └──▷ HOW TO FIND IT
    Access all your BeyondTrust SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. products from a single login instead of signing into each product separately.
    📍Navigate to https://app.beyondtrust.io and sign in with your credentials. From the Pathfinder Home page, use the shared navigation menu to switch between Password Safe, Privileged Remote Access, Remote Support, EPM, Identity Security Insights, and Entitle.
    • New Pathfinder platform provides a single pane of glass across all BeyondTrust SaaS products — Password Safe, Privileged Remote Access, Remote Support, Endpoint Privilege Management for Windows & Mac, Endpoint Privilege Management for Linux, Identity Security Insights, and Entitle.
    • Supports shared single sign-onsingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. across all BeyondTrust SaaS products via a central authentication source at app.beyondtrust.io.
    • Enables multi-site organization so administrators can group SaaS applications into isolated sites that mirror organizational or regional structure (e.g., Engineering vs. IT, or North America vs. Europe), with per-site user access controls.
    • Supports custom CNAMECNAMEA DNS record type that maps one hostname to another as a canonical alias, letting cyber tools track infrastructure by following chains of names to their true origin. records with your own SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. certificate to replace the default yoursite.beyondtrustcloud.com address for Secure Remote Access Cloud sites.

    4 details in Everything

37. docs update Jul 22, 2026 · docs issue 004

    BeyondTrust Pathfinder unifies Password Safe, PRA, Remote Support, EPM, Identity Security Insights, and Entitle under a single pane of glass at app.beyondtrust.io.

    └──▷ HOW TO FIND IT
    Access all your BeyondTrust SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. products from a single login instead of signing into each product separately.
    📍Navigate to https://app.beyondtrust.io and sign in with your credentials. From the Pathfinder Home page, use the shared navigation menu to switch between Password Safe, Privileged Remote Access, Remote Support, EPM, Identity Security Insights, and Entitle.
    • New Pathfinder platform provides a single pane of glass across all BeyondTrust SaaS products — Password Safe, Privileged Remote Access, Remote Support, Endpoint Privilege Management for Windows & Mac, Endpoint Privilege Management for Linux, Identity Security Insights, and Entitle.
    • Supports shared single sign-onsingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. across all BeyondTrust SaaS products via a central authentication source at app.beyondtrust.io.
    • Enables multi-site organization so administrators can group SaaS applications into isolated sites that mirror organizational or regional structure (e.g., Engineering vs. IT, or North America vs. Europe), with per-site user access controls.
    • Supports custom CNAMECNAMEA DNS record type that maps one hostname to another as a canonical alias, letting cyber tools track infrastructure by following chains of names to their true origin. records with your own SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. certificate to replace the default yoursite.beyondtrustcloud.com address for Secure Remote Access Cloud sites.

    4 details in Everything

38. docs update Jul 22, 2026 · issue 022

    BeyondInsight + EPM now supports OAuth-based agent enrollment, eliminating client-certificate deployment for endpoint attachment.

    └──▷ HOW TO FIND IT
    Enroll a Windows EPM agent via OAuth using a system-generated activation key — no certificate deployment needed as long as BeyondInsight has a publicly trusted HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. cert.
    📍In BeyondInsight, go to Configuration › Authentication Management › Installer Activation Keys. Select System Generated Key, set Installer Type to Endpoint Privilege Management Agent, copy the generated installation command, and run it on the endpoint.
    Deploy the EPM for Windows agent in BeyondInsight-integrated mode pointing at the Event Service endpoint.
    copy

    $ msiexec.exe /i PrivilegeManagementForWindows_x64.msi BIMODE=1 BEYONDINSIGHTURL="https://example.com/EventService/Service.svc"

    • Supports OAuth-based communication between EPM agents and BeyondInsight (starting in BeyondInsight 24.1 and EPM 24.3), removing the need to distribute client authentication certificates to endpoints.
    • Adds OAuth support for EPM for Mac starting in version 25.2, with Activation ID and Activation Key provisioned via the Rapid Deployment Tool.
    • Adds Installer Activation Keys UI in BeyondInsight (Configuration > Authentication Management > Installer Activation Keys) for generating and managing OAuth-based agent enrollment credentials.
    • Starting in U-Series Appliance 4.2, EPM Policy Editor and Privilege Management Reporting (PMR) are automatically installed on appliances — no manual installation required.
    • Documents a primary/secondary U-Series Appliance deployment model supporting up to 10,000 endpoints per event server, with internet-facing event server option for on/off-network devices.

    5 details in Everything

39. docs update Jul 22, 2026 · docs issue 004

    BeyondInsight + EPM now supports OAuth-based agent enrollment, eliminating client-certificate deployment for endpoint attachment.

    └──▷ HOW TO FIND IT
    Enroll a Windows EPM agent via OAuth using a system-generated activation key — no certificate deployment needed as long as BeyondInsight has a publicly trusted HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. cert.
    📍In BeyondInsight, go to Configuration › Authentication Management › Installer Activation Keys. Select System Generated Key, set Installer Type to Endpoint Privilege Management Agent, copy the generated installation command, and run it on the endpoint.
    Deploy the EPM for Windows agent in BeyondInsight-integrated mode pointing at the Event Service endpoint.
    copy

    $ msiexec.exe /i PrivilegeManagementForWindows_x64.msi BIMODE=1 BEYONDINSIGHTURL="https://example.com/EventService/Service.svc"

    • Supports OAuth-based communication between EPM agents and BeyondInsight (starting in BeyondInsight 24.1 and EPM 24.3), removing the need to distribute client authentication certificates to endpoints.
    • Adds OAuth support for EPM for Mac starting in version 25.2, with Activation ID and Activation Key provisioned via the Rapid Deployment Tool.
    • Adds Installer Activation Keys UI in BeyondInsight (Configuration > Authentication Management > Installer Activation Keys) for generating and managing OAuth-based agent enrollment credentials.
    • Starting in U-Series Appliance 4.2, EPM Policy Editor and Privilege Management Reporting (PMR) are automatically installed on appliances — no manual installation required.
    • Documents a primary/secondary U-Series Appliance deployment model supporting up to 10,000 endpoints per event server, with internet-facing event server option for on/off-network devices.

    5 details in Everything

40. Base 8.3.0 release notes (2026-07-16) Jul 16, 2026 · issue 018

    BeyondTrust Base 8.3.0 brings OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work.-structured syslog, a unified patch inventory view, and upload progress visibility.

    • Remote syslog output now follows OCSF structure, enabling richer, standardized event forwarding to SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. platforms with new log categories for on-premises appliances.
    • Local file uploads now show an estimated progress bar instead of a generic spinner, giving clearer visibility into upload duration.
    • Removes the opt-in default certificate mechanism, simplifying certificate configuration.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The ability to opt out of seamless (no-downtime) critical security updates is removed; these updates now apply automatically on on-premises appliances.
    • !If an appliance has not successfully communicated with the update server within a defined time window, key functionality is degraded or disabled.
41. Remote Support 26.2.1 release notes (2026-07-16) Jul 16, 2026 · issue 018

    BeyondTrust Remote Support 26.2.1 adds multi-group Jump Client installs, FIDO2FIDO2The open standard behind passkeys and hardware security keys, where a website checks a signature from the user's device instead of a password. Because the key is bound to the site, phishing pages cannot use it. Group Policy enforcement, AI session summaries, syslog streaming, and ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware.-native support.

    └──▷ TRY IT
    Deploy a Jump Client into multiple Jump Groups simultaneously at install time, avoiding post-deployment API calls to reassign group membership.
    copy

    $ msiexec /i JumpClient.msi JC_JUMP_GROUP="group-id-1,group-id-2,group-id-3" /quiet

    • Assigns a Jump Client to multiple Jump Groups at installation time via a comma-separated JC_JUMP_GROUP installer parameter, eliminating post-deployment API calls to reassign group membership.
    • Enforces FIDO2 phishing-resistant MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. at the Group Policy level, using the same model as existing TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. enforcement; FIDO2 is also now supported on Pathfinder deployments.
    • Adds search, filtering, CSV export, and API access to the Duplicate Jump Clients report for programmatic duplicate detection and resolution at scale.
    • Automatically generates AI-powered session summaries on session end, including case summary, step-by-step resolution, system tags, and key highlights; summaries are editable, exportable in multiple formats, multi-language, and integrate with Salesforce and ServiceNow.
    • Brings vault discovery and managed/shadow account capabilities natively into the product, including a filter dropdown on the Vault > Endpoints page, new import and auto-create options for SSH, RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely., and Password Safe Jump Items, and a direct-access Password Safe Discovery method.

    +8 more show less

    • Adds a Collaboration Mode shortcut in the Representative Console to start a screen-sharing session with yourself and immediately invite other representatives, replacing the legacy Presentation feature.
    • Supports vault credential injection during an active RDP session (run-as scenario) without disconnecting, requiring the BeyondTrust RDP Tools component on the endpoint.
    • Streams appliance platform and infrastructure logs (web server access/error, authentication, SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination./HAProxy, proto-handler, and more) to an existing syslog destination for SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. integration; available for on-premises deployments.
    • Officially supports the Jump Client on Windows Server Core (2019, 2022, and Azure-hosted), including remote shell, file transfer, session recording, credential injection, and auto-update.
    • Runs BeyondTrust clients natively on ARM-based systems (e.g., Windows 11 ARM) without x86 emulation, covering credential injection, Virtual Smart Card, and Jump Client download via API.
    • Supports vault credential auto-entry for Remote VNC Jump sessions (Cloud only), enabled per asset via the Config API with a recorded consent notice, useful for OT/ICSICSIndustrial Control Systems — hardware and software that monitor and control physical processes like power grids, pipelines, and manufacturing lines, making them a target for cyber tools focused on operational technology environments. legacy endpoints.
    • Allows representatives to pop out each remote monitor into its own independent, resizable window instead of cycling through monitors one at a time.
    • Scales the Vault to support up to 200,000 accounts.

    13 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The ability to opt out of seamless (no-downtime) critical security updates is removed; these updates are now applied automatically on upgrade.
    • !RADIUSRADIUSA networking protocol for centralised authentication, authorisation, and accounting of users connecting to a network, maintained under IETF standards. Cyber tools use it to integrate with existing enterprise identity infrastructure. authentication provider is deprecated: existing configurations can be edited but new ones cannot be created — migrate to SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. or LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. before future versions remove the provider entirely.
42. Remote Support 25.3.5 release notes (2026-06-30) Jun 30, 2026 · issue 014

    Remote Support 25.3.5 adds LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. authentication and SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. integration support through Pathfinder.

    • Adds LDAP authentication support via Pathfinder, enabling user validation against existing directory services with improved login reliability and error feedback.
    • Adds SCIM integration for Pathfinder, enabling automated user and access synchronization with identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. to reduce manual administration.

    2 details in Everything