Immuta

No entries match these filters. Clear filters

1. updated seen Oct 30, 2026 · issue 125

   Immuta adds custom securables to extend subscription policies to dashboards, files, APIs, and SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. applications beyond native integrations⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

2. updated seen Oct 16, 2026 · issue 110

   Tag-driven domain updates now async (202 Accepted); SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. drops SHA-1SHA-1A cryptographic hash function standardized by NIST that produces a 160-bit digest; tools use it for file integrity checks, though it is now considered cryptographically broken and unsuitable for collision-resistant applications. and OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. drops unsigned none JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. algorithm.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • New and updated SAML IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. configurations no longer support SHA-1; supported signature and digest algorithm values are now SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. and SHA-512.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • The unsigned JWT algorithm (none) is no longer available as a supported ID token signing algorithm in OpenIDOpenIDAn open standard for decentralized authentication that lets a user prove their identity to a site via a trusted third-party provider, so tools can delegate login without managing credentials themselves. Connect configurations.
   • New and updated SAML IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. configurations no longer support SHA-1; supported signature and digest algorithm values are now SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. and SHA-512.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Tag-driven domain update API endpoints now return 202 Accepted instead of 200 OK; callers that assume the update is complete when the request returns will behave incorrectly and must be updated to handle the async response.
   • !New or updated SAML IAM configurations can no longer use SHA-1 for signature or digest algorithms; existing configurations using SHA-1 (explicitly or via the previous SHA-1 default) continue to work until further notice but must migrate before a future enforcement step.
3. docs update Oct 6, 2026 · issue 096

   Immuta adds an Agentic Access V1 API for ephemeral agent roles, Snowflake Low Row Access Policy Mode and Table Grants settings, and a Legacy-to-Connections API migration reference.

   • Adds Agentic Access V1 API to vend ephemeral roles for agents to access data on behalf of a user, with a dedicated Agent resource.
   • New integrationAdds Snowflake Low Row Access Policy Mode integration setting for controlling row-level policy application in Snowflake.
   • Adds Snowflake Table Grants integration setting for managing table-level grants in Snowflake.
   • Adds Legacy to Connections: API Changes reference documenting deprecated legacy onboarding endpoints and their replacement connections-based endpoints.
   • New integrationAdds Warehouse Sizing Recommendations guidance for tuning Snowflake warehouse compute under Immuta workloads.

   5 details in Everything

   • New integration Databricks Unity Catalog Integration Reference Guide
4. docs update Oct 2, 2026 · issue 092

   Immuta adds an Agentic Access V1 API for ephemeral agent roles and new reference guides for Databricks Unity Catalog and Snowflake integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds the Agentic Access V1 API to vend ephemeral roles for AI agents to access data on behalf of a user.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Agent resource documentation under the Agentic Access API.
   • Adds a Legacy to Connections: API Changes reference guide documenting deprecated endpoints and their replacements after migrating from legacy onboarding to connections.
   • Adds a Databricks Unity Catalog Integration Reference Guide covering authentication, audit, policy enforcement, and end-user data access.
   • Adds a Snowflake Integration Reference Guide covering authentication, audit, policy enforcement, data sharing, warehouse sizing, low row access policy mode, and table grants.
   • Adds the Agentic Access V1 API to vend ephemeral roles for AI agents to access data on behalf of a user.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Agent resource documentation under the Agentic Access API.

   3 more in Everything

5. docs update Sep 18, 2026 · issue 078

   Immuta adds Teradata integration and expands Amazon Redshift connection management capabilities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds Teradata integration with policy enforcement, access control, authentication, and audit support for data in Teradata environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Amazon Redshift connection management settings, including the ability to remove a Redshift connection.
   • Adds Teradata integration with policy enforcement, access control, authentication, and audit support for data in Teradata environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

6. updated seen Sep 18, 2026 · issue 078

   Immuta Request app now supports multi-user access requests in a single submission⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   When onboarding a team to a new dataset, submit a single governed access request covering all members instead of repeating the process per person.
   📍In the Request app, open the access request form, select all relevant users from the user picker, fill in the request details, and click Submit once to create a single request covering all selected users.
   • Supports requesting access for multiple users simultaneously in the Request app, replacing the need to submit separate requests per person.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds hover-over tooltips on user names in the Request app to display each user's email address, helping distinguish users with similar or identical names.
   • Supports requesting access for multiple users simultaneously in the Request app, replacing the need to submit separate requests per person.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !New Snowflake connections can no longer be created using username/password authentication, following Snowflake's deprecation of that method for service users; existing connections continue to work until Snowflake completes its deprecation phases in October 2026.
   • !Fingerprint-based masking options for Snowflake (format-preserving masking, randomized response masking, and rounding/grouping using a data fingerprint) are deprecated and will be removed from Immuta SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. on December 15, 2026; tenants without existing policies using these options can no longer create them.
7. updated seen Sep 15, 2026 · issue 075

   Immuta Request app now supports multi-user access requests in a single submission.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Request access for an entire team in one submission rather than repeating the process for each individual.
   📍In the Immuta Request app, open the request form, select all relevant users from the user list, fill in the request details, and click Submit once to create a single access request covering all selected users.
   • Adds multi-user access requests to the Immuta Request app, letting managers and admins select multiple users in a single request form and submit once instead of once per user.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds email address hover-over on user names in the request form to distinguish between users with similar or identical names.
   • Adds multi-user access requests to the Immuta Request app, letting managers and admins select multiple users in a single request form and submit once instead of once per user.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Fingerprint-based masking options (format-preserving masking, randomized response masking, and rounding/grouping using a data fingerprint) for Snowflake integrations are deprecated and will be removed from Immuta SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. on December 15, 2026. Tenants without existing policies using these options can no longer create them.
8. updated seen Sep 10, 2026 · issue 070

   Immuta Request app now supports bulk multi-user access requests and email hover tooltips on user names.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   When a manager needs to onboard a team to a data product at once, submit a single group access request instead of repeating the process for each person.
   📍In the Immuta Request app, open the request form, select all relevant users from the user picker, fill in the request details, then click Submit once to cover the entire group.
   • Enables requesting access for multiple users in a single submission via the Immuta Request app, replacing the need to create separate requests per person.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds email address display on hover over user names in the request form to disambiguate users with similar or identical names.

   2 details in Everything

9. updated seen Sep 7, 2026 · issue 067

   Immuta adds intent-based access control for Databricks Unity Catalog, plus metric view subscription policy support.

   • Introduces intents (public preview) for Databricks Unity Catalog: policy authors configure groups authorized to use an intent and attributes that replace a user's birthright attributes while the intent is active, enabling use-case-driven, auditable access to sensitive data such as PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations..
   • Adds subscription policy support for Databricks Unity Catalog metric views, enabling access provisioning and governance for that object type through existing Immuta policies.
   • Introduces intents (public preview) for Databricks Unity Catalog: policy authors configure groups authorized to use an intent and attributes that replace a user's birthright attributes while the intent is active, enabling use-case-driven, auditable access to sensitive data such as PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations..

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Immuta will apply a lockout policy to data sources governed by a policy that references a nonexistent column or column tag; previously no lockout applied in these cases. Policies referencing missing columns or column tags will now trigger a lockout on rollout.
10. docs update Aug 28, 2026 · issue 058

    Immuta adds Intents for context-aware access control, a Connections API, Google BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. viewless integration, and new Starburst (Trino) connection management.

    • New Connections API available for programmatic registration and management of data connections, documented at the Connections API reference guide.
    • New Intents API lets practitioners create, edit, and delete intents programmatically via the Immuta v1 API, with a dedicated Manage Intents API reference guide.
    • New AWS Lake Formation Connection Registration Payloads Reference Guide documents parameters and payloads for registering a connection via the API.
    • Adds Intents — context-aware access control that lets data consumers assume an intent to unlock policy-conditional access — with UI and API management surfaces.
    • New Google BigQuery viewless integration enables registering and governing BigQuery data without view-based policy enforcement, with dedicated guides covering policy enforcement, data access, and security and compliance.

    +3 more show less

    • New Starburst (Trino) integration section adds how-to guides for registering, removing, and managing Trino connections, including legacy connection support and system API key rotation.
    • New Snowflake connection how-to guides cover registering, removing, and managing connection settings, with added reference pages for Snowflake Low Row Access Policy Mode and Snowflake Table Grants.
    • Adds Manage Connection Tags how-to guide for tagging registered connections.

    8 details in Everything

11. updated seen Aug 28, 2026 · issue 058

    Immuta adds intent-based access control for Databricks Unity Catalog and expands subscription policy support to metric views.

    • Introduces intents (public preview for Databricks Unity Catalog): policy authors can grant access based on a user's declared reason for accessing data, replacing birthright attributes with intent-specific attributes while the intent is active — enabling use-case-driven, auditable access to sensitive fields such as PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations..
    • Extends subscription policy support to Databricks Unity Catalog metric views, allowing access provisioning and governance for that object type through existing Immuta subscription policies.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Lockout policies will now apply to data sources governed by a policy that references a nonexistent column or column tag; previously no lockout was applied in those cases.
12. updated seen Aug 22, 2026 · issue 053

    Immuta adds at-a-glance access request queue metrics for governors and refines Databricks Unity Catalog ingestion logic.

    • Adds three summary tiles to the Access Requests page showing pending request count, average age of pending requests, and stewards with at least one pending request assigned — with a hover-over breakdown of top individuals or groups by request volume.
    • Updates Databricks Unity Catalog crawl logic to skip ingestion of catalogs where the Immuta workspace has read-only access and isolated catalogs where the Immuta service principal lacks MANAGE permission, filtering them out at ingestion time rather than failing during policy enforcement.

    2 details in Everything

13. docs update seen Aug 6, 2026 · issue 037

    Immuta adds native Trino/Starburst integration with policy enforcement, customizable plugin properties, and read/write access mapping.

    • New Trino integration allows registering a Trino connection so Immuta can administer access controls directly on objects in Trino.
    • Adds customizable Trino plugin properties to tailor the Immuta Trino plugin configuration to your environment.
    • Supports customizing how read and write access policies are enforced for Starburst (Trino) via write access mapping.
    • Enables rotation of the system API key for the Trino integration to mitigate potential security risks.
    • Supports authentication methods and audit features for Trino to meet security and compliance requirements.

    +1 more show less

    • Enforces Immuta policies directly on data within Trino environments, including end-user access to policy-enforced data.

    6 details in Everything

14. updated seen Aug 6, 2026 · issue 037

    Immuta adds connection health states, per-object policy sync toggles, managed groups for policies, and Redshift viewless automated data discovery.

    • New ACTIVE, INACTIVE, or UNHEALTHY health state display per connection in the Connections UI for Databricks Unity Catalog and Snowflake integrations.
    • Tag inheritance at the database or schema level, with bulk assignment or removal propagating to all attached data sources.
    • Data products now support two separate request forms: one for data access requests and one for masking exception requests, each with independent questions and data use agreements.
    • Automated sensitive data discovery now supported for Immuta's Amazon Redshift viewless integration, covering regex, dictionary, and column-name-regex identifier types.
    • Snowflake data policy resync now resyncs both data policies and subscription policies when triggered from a data source health check.

    +1 more show less

    • Integration settings for Databricks Unity Catalog and Snowflake connections now live directly within the Connections UI rather than in a separate settings area.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Starting August 26, 2026, Databricks will mask query_text in the query_history system table by default; Immuta query audit will no longer contain query text and all query audit events will show as Indeterminant unless the Immuta service principal is added to the databricks_pii_access group in Databricks.
    • !Immuta policy role names used to grant users access to Snowflake data sources will be renamed and recreated as part of the Snowflake integration architecture update rolling out from July 23, 2026 (user role names remain unchanged).
    • !Integration error banners for Snowflake integration validation failures will no longer be displayed; errors will instead appear in the new Connections experience.
15. updated seen Aug 5, 2026 · issue 036

    Immuta adds Connection health dashboards, split data-product request forms, Redshift viewless auto-discovery, and system-managed identity groups.

    • Adds per-connection health state display (ACTIVE, INACTIVE, or UNHEALTHY) and moves integration settings directly into Connections for Databricks Unity Catalog and Snowflake.
    • Adds a per-object policy sync toggle in Connections that controls whether Immuta pushes policy down into the platform for a given data object, with a Custom label when a child object's setting differs from its parent.
    • Adds detail pages for leaf data objects in Connections, each including a direct link to the corresponding data source.
    • Adds bulk and individual tag assignment or removal at the database or schema level, with tags inherited by all attached data sources.
    • Adds configurable New tag behavior in App Settings — enabled for columns and disabled for data sources by default.

    +7 more show less

    • Adds force-delete capability for connections in an UNHEALTHY state.
    • Adds automated sensitive data discovery (regex, dictionary, and column-name regex identifiers) to Immuta's Amazon Redshift viewless integration.
    • Adds three built-in system-managed groups — All Agents, All Users, and All Identities — available for use in both subscription policies and data policies.
    • Enables separate access request forms and masking exception request forms per data product, with independent questions and data use agreements for each form type.
    • Manual data policy resync for Snowflake data sources now resyncs both data policies and subscription policies simultaneously.
    • Improves query performance for Snowflake securables with advanced masking exceptions via a more efficient comparison method.
    • Starburst (Trino) principal name matching is now case-insensitive by default for all customers as of July 1.

    12 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Immuta will rename Snowflake policy role names as part of the new Snowflake integration architecture rollout (beginning July 23, 2026); existing policy roles will be recreated under new names. User role names remain unchanged and there is no downtime.
    • !Starting August 26, 2026, Databricks will mask query_text in the query_history system table by default; Immuta's Databricks Unity Catalog query audit will lose query text and all affected events will show as Indeterminant unless the Immuta service principal is added to the databricks_pii_access group.
    • !Immuta will no longer display integration error banners when integration validation fails; error messages will only be available through the new Connections experience.
    • !When a data source is disabled, Immuta now revokes data owners' Immuta-managed grants in the data platform (behavior change release; on by default August 1, enabled for all accounts September 1).
16. updated seen Aug 3, 2026 · issue 034
    • Adds integration health states (ACTIVE, INACTIVE, UNHEALTHY) displayed per connection for Databricks Unity Catalog and Snowflake, giving admins at-a-glance integration status.
    • Adds per-object policy sync toggle in Connections, letting admins enable or disable policy push to the platform for individual data objects with visibility into child object configuration.
    • Adds automated sensitive data discovery for Immuta's Amazon Redshift viewless integration, supporting regex, dictionary, and column name regex identifier types.
    • Adds tag ingestion support for Databricks Unity Catalog foreign catalogs (Lakehouse FederationLakehouse FederationA data architecture pattern that lets a single query engine read from multiple external data sources—databases, data lakes, warehouses—without moving or copying the data, reducing pipeline complexity for tools that need broad data access.) by falling back to system.information_schema tag views.
    • Enables case-insensitive Starburst (Trino) principal name matching for more reliable user and service account identification.
    └──▷ BREAKING ON UPGRADE

    • !Immuta policy role names used to grant users access to Snowflake data sources will be renamed as part of the Snowflake integration architecture update rolling out from July 23, 2026; existing policy roles will be recreated under new names.
    • !Integration error banners for Snowflake integration validation failures are removed; these messages are now only available through the new Connections experience.
    • !When a data source is disabled, Immuta now revokes data owners' Immuta-managed grants in the data platform (behavior change release; on by default 8/1, enabled for all 9/1).
17. updated seen Aug 1, 2026 · issue 032

    Immuta adds richer Connections controls, split request forms for data products, Redshift viewless data discovery, and new managed identity groups.

    └──▷ HOW TO FIND IT
    Force-delete a stuck UNHEALTHY Snowflake or Unity Catalog connection without waiting for it to recover.
    📍In the Immuta console, navigate to Connections, locate the connection showing UNHEALTHY status, open its detail page, and select Force Delete.
    • Adds integration health states (ACTIVE, INACTIVE, UNHEALTHY) and per-connection settings directly within Connections for Databricks Unity Catalog and Snowflake.
    • Introduces per-object policy sync toggle to control whether Immuta pushes policies down to a given data object, with visibility into child object configuration and a Custom label when child settings differ from the parent.
    • Adds individual detail pages for leaf data objects, including a direct link to the corresponding data source.
    • Enables bulk or individual tag assignment and removal at the database or schema level, with tag inheritance flowing to all attached data sources.
    • Makes the behavior of the New tag configurable in App Settings (default: enabled for columns, disabled for data sources).

    +7 more show less

    • Allows force-deletion of connections in an UNHEALTHY state.
    • Supports two distinct request forms per data product — one for data access requests and one for masking exception requests — each with independent questions and data use agreements.
    • Introduces three built-in, system-managed groups — All Agents, All Users, and All Identities — available for use in subscription and data policies.
    • Expands Unity Catalog tag ingestion to include foreign catalogs created via Lakehouse FederationLakehouse FederationA data architecture pattern that lets a single query engine read from multiple external data sources—databases, data lakes, warehouses—without moving or copying the data, reducing pipeline complexity for tools that need broad data access., using system.information_schema tag views as a fallback.
    • Improves Snowflake manual policy resync to synchronize both data policies and subscription policies in a single operation.
    • Delivers query performance improvements for Snowflake securables that have policies with advanced masking exceptions.
    • Treats Starburst (Trino) principal names as case-insensitive when matching to Immuta users and service accounts.

    12 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Immuta policy role names used to grant users access to Snowflake data sources will be renamed as part of the Snowflake integration architecture update rolling out beginning July 23, 2026; existing policy roles will be recreated under new names.
    • !Integration error banners for Snowflake validation failures will no longer be displayed; error details are now available only through the new Connections experience.
    • !When a data source is disabled, Immuta now revokes data owners' Immuta-managed grants in the data platform (behavior change release, on by default 8/1).
18. updated seen Jul 30, 2026 · issue 030
    • Expands automated sensitive data discovery (regex, dictionary, and column-name regex identifiers) to Immuta's Amazon Redshift viewless integration.
    • Snowflake integration error messages are moved out of error banners and into the connections experience.
    └──▷ BREAKING ON UPGRADE

    • !Immuta policy role names used to grant users access to Snowflake data sources will be renamed as part of the Snowflake integration architecture update rolling out from July 23, 2026.
19. updated seen Jul 28, 2026 · issue 028

    Immuta adds separate access/masking request forms, Redshift viewless auto-discovery, managed groups for policies, and OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. for Alation.

    └──▷ HOW TO FIND IT
    Write a subscription policy that allows every registered identity (agents and users) to subscribe to non-sensitive data without manually maintaining group membership.
    📍In the Immuta policy editor, create a subscription policy and set the target group to the built-in managed group All Identities to automatically include all agent and non-agent user accounts.
    • Adds separate access and masking exception request forms for data products, allowing stewards to configure independent questions and data use agreements per request type.
    • Expands automated sensitive data discovery to Immuta's Amazon Redshift viewless integration, automatically tagging matching columns using regex, dictionary, and column-name regex identifiers.
    • Introduces three built-in Immuta managed groups — All Agents, All Users, and All Identities — available for authoring subscription and data policies without manual group management.
    • Adds OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0 authentication support for Immuta's Alation integration alongside existing API key authentication, eliminating recurring token refresh requirements.
    • Extends Snowflake manual policy resync to cover both data policies and subscription policies when triggered from a data source health check.

    +2 more show less

    • Enables Unity Catalog tag ingestion for foreign catalogs (Lakehouse FederationLakehouse FederationA data architecture pattern that lets a single query engine read from multiple external data sources—databases, data lakes, warehouses—without moving or copying the data, reducing pipeline complexity for tools that need broad data access.) by falling back to system.information_schema tag views when per-catalog views are unsupported.
    • Embeds Immuta documentation and an AI-powered chatbot directly in the Immuta UI, accessible from the top menu Documentation icon.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Immuta policy role names used to grant users access to Snowflake data sources will be renamed as part of the Snowflake integration architecture update rolling out beginning July 23, 2026; policy roles will be recreated under new names.
    • !Integration error banners for Snowflake integration validation failures will no longer be displayed; errors will only be available through the connections experience.
20. updated seen Jul 24, 2026 · issue 024
    └──▷ HOW TO FIND IT
    When onboarding a data product with sensitive columns, configure distinct request forms so access requestors and masking-exception requestors each see only relevant questions and agreements.
    📍In the Immuta UI, navigate to your data product › Settings › Request Forms, then configure a separate form under Data Access Requests and another under Masking Exception Requests, adding tailored questions and data use agreements to each.
    Write a subscription policy that restricts AI-restricted data to human users only, excluding all agent accounts system-wide.
    📍In the Immuta UI, create a subscription policy targeting your data source, set the condition to allow only members of the built-in group All Users (excluding All Agents), and save.
    Enable OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. for the Alation integration to avoid recurring token expiry issues.
    📍In the Immuta UI, navigate to Settings › Integrations › Alation, select OAuth 2.0 as the authentication method, and provide the required OAuth credentials.
    • Adds separate request forms for data products: one for data access requests and one for masking exception requests, each with independent questions and data use agreements.
    • Expands Snowflake manual policy resync to cover both data policies and subscription policies simultaneously.
    • Adds automated sensitive data discovery (regex, dictionary, and column-name identifiers) for the Amazon Redshift viewless integration.
    • Adds OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0 authentication support to the Alation integration, eliminating repeated token refresh cycles required by API key authentication.
    • Embeds Immuta documentation and an AI-powered chatbot directly in the Immuta UI via a new Documentation icon in the top menu.

    +1 more show less

    • Starburst (Trino) principal name matching is now case-insensitive, enabled by default for all customers as of July 1.
    └──▷ BREAKING ON UPGRADE

    • !Snowflake integration architecture update (rolling out July 23, 2026): Immuta policy role names used to grant users access to Snowflake data sources will be changed and recreated; any automation or tooling that references specific policy role names by their current values will need to be updated.
    • !Immuta will no longer display integration error banners when integration validation fails for Snowflake; errors will only be visible through the connections experience.
    • !When a data source is disabled in Immuta, Immuta now revokes data owners' Immuta-managed grants in the data platform (behavior change releasing 8/1 by default, 9/1 for all).
21. updated seen Jul 23, 2026 · issue 023

    Immuta adds separate access/masking request forms, managed groups for policies, Redshift viewless discovery, and OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. for Alation.

    └──▷ HOW TO FIND IT
    Configure separate request forms for data access vs. masking exceptions on a data product so stewards can ask context-appropriate questions for each request type.
    📍In the Immuta UI, navigate to your data product's settings, open the Request Forms section, and configure one form under Data Access Requests and a separate form under Masking Exception Requests — each with its own questions and data use agreement.
    Get answers about Immuta features without leaving the product during an investigation or policy authoring session.
    📍In the Immuta UI, click the Documentation icon in the top menu, then type your question in natural language into the AI-powered documentation chatbot.
    • Adds separate access and masking exception request forms for data products, allowing stewards to configure independent questions and data use agreements per request type.
    • Introduces three built-in system-managed groups (All Agents, All Users, All Identities) for writing subscription and data policies without manual membership management.
    • Enables automated sensitive data discovery for Amazon Redshift viewless integration, supporting regex, dictionary, and column name regex identifiers with automatic tag application.
    • Adds OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0 authentication support for the Alation integration, eliminating the need to manually rotate expiring access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions..
    • Expands Databricks Unity Catalog tag ingestion to support foreign catalogs (created via Lakehouse FederationLakehouse FederationA data architecture pattern that lets a single query engine read from multiple external data sources—databases, data lakes, warehouses—without moving or copying the data, reducing pipeline complexity for tools that need broad data access.) by falling back to system.information_schema tag views.

    +4 more show less

    • Snowflake data policy resync now resyncs both data policies and subscription policies when triggered from a health check.
    • Introduces case-insensitive Starburst (Trino) principal name matching, now on by default for all customers not opted out.
    • Adds in-product documentation search and AI-powered chatbot accessible from the top menu in the Immuta UI.
    • Improves query performance for Snowflake policies with advanced masking exceptions using a more efficient comparison method.

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Immuta will update Snowflake policy role names used to grant users access to Snowflake data sources as part of the architecture rollout beginning July 23, 2026; policy roles will be recreated under new names (user role names remain unchanged).
    • !Integration error banners for Snowflake integration validation failures will no longer be displayed in the UI; error messages will instead be available through the connections experience.
22. updated seen Jul 20, 2026 · issue 020

    Immuta adds managed groups for agentic policies, Redshift viewless discovery, Delta Sharing enforcement, and OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. for Alation.

    └──▷ HOW TO FIND IT
    Restrict AI-sensitive data sources so only human (non-agent) accounts can subscribe, using the new built-in All Agents group.
    📍In the Immuta UI, go to Policies › Subscription Policies › New Policy. Under Who is denied, select the built-in group All Agents. Apply the policy to data sources tagged as AI-restricted.
    Switch Alation integration to OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0 to eliminate 90-day refresh-token rotation for the Immuta–Alation connection.
    📍In the Immuta UI, go to App Settings › Integrations › Alation, select OAuth 2.0 as the authentication method, and supply your OAuth 2.0 client credentials.
    Enable automated sensitive data discovery on a Redshift viewless data source to auto-tag PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. columns.
    📍In the Immuta UI, open your Amazon Redshift viewless data source, navigate to the Sensitive Data Discovery settings, and enable automated discovery. Immuta will scan columns using regex, dictionary, and column-name-regex identifiers and apply matching tags automatically.
    • Adds three built-in system-managed groups (All Agents, All Users, All Identities) usable in subscription and data policies to enforce system-wide access rules without manual group management.
    • Supports row filtering and column masking on Unity Catalog managed, external, and foreign tables in Databricks Delta Sharing shares.
    • Adds OAuth 2.0 authentication option for Immuta's Alation integration, eliminating recurring API key rotation requirements.
    • Extends Databricks Unity Catalog tag ingestion to foreign catalogs (Lakehouse FederationLakehouse FederationA data architecture pattern that lets a single query engine read from multiple external data sources—databases, data lakes, warehouses—without moving or copying the data, reducing pipeline complexity for tools that need broad data access.) by falling back to system.information_schema tag views.
    • Embeds Immuta documentation and an AI-powered chatbot directly in the Immuta UI, accessible from the top menu Documentation icon.

    +1 more show less

    • Introduces case-insensitive Starburst (Trino) principal name matching when mapping Trino principals to Immuta users and service accounts.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Snowflake policy role names will be renamed as part of the back-end architecture update rolling out beginning July 23, 2026; existing policy roles will be recreated under new names (user role names remain unchanged).
    • !Integration error banners for Snowflake integration validation failures will no longer be displayed in the existing location; errors are now only available through the new connections experience.
    • !When a data source is disabled in Immuta, data owners' Immuta-managed grants in the data platform will be revoked (behavior change release: on by default 8/1, enabled for all 9/1).
23. updated seen Jul 18, 2026 · issue 019
    └──▷ HOW TO FIND IT
    Access in-product documentation and ask questions in natural language without leaving Immuta.
    📍In the Immuta UI, click the Documentation icon in the top menu, then type your question into the AI-powered documentation chatbot.
    Switch the Alation integration to OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. to eliminate recurring 90-day API key rotation.
    📍In the Immuta console, go to App Settings › Integrations › Alation, select OAuth 2.0 as the authentication method, and enter your OAuth credentials.
    • Supports automated sensitive data discovery (regex, dictionary, and column-name regex identifiers) for the Amazon Redshift viewless integration.
    • Embeds Immuta documentation and an AI-powered chatbot directly in the Immuta UI for in-product search.
    └──▷ BREAKING ON UPGRADE

    • !When a data source is disabled, Immuta will revoke data owners' Immuta-managed grants in the data platform (opt-in 6/30–7/31, on by default 8/1, enforced for all 9/1) — workflows that depend on owners retaining access after disabling a source will break.
24. updated seen Jul 17, 2026 · issue 018

    Immuta adds managed groups for system-wide policies, automated Redshift discovery, OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. for Alation, and Delta Sharing row/column enforcement.

    └──▷ HOW TO FIND IT
    Write a subscription policy that allows every registered identity (agents and users) to subscribe to non-sensitive data sources, without maintaining manual group membership.
    📍In the Immuta UI, go to Policies › Subscription Policies › New Policy, set the subject to the built-in group All Identities, and configure the access condition for your non-sensitive data sources.
    • Automated sensitive data discovery now available for Immuta's Amazon Redshift viewless integration, supporting regex, dictionary, and column-name-regex identifiers.
    • Row filtering and column masking now enforced for Databricks Delta Sharing recipients on Unity Catalog managed, external, and foreign tables.
    • Manual data policy resync in Snowflake data source health checks now resyncs both data policies and subscription policies.
    • Integration error banners replaced by error visibility through the new connections experience.
    • Snowflake back-end architecture update improves efficiency and performance at higher scale for the Snowflake integration.

    +2 more show less

    • Documentation embedded directly in the Immuta UI with AI-powered chatbot accessible from the top menu.
    • Improved query performance for Snowflake policies that include advanced masking exceptions via a more efficient comparison method.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Immuta policy role names used to grant users access to Snowflake data sources will be renamed as part of the Snowflake architecture update beginning July 23, 2026; existing policy roles will be recreated under new names.
    • !When a data source is disabled in Immuta, Immuta-managed grants for data owners in the data platform will be revoked (behavior change release: on by default 8/1, enabled for all 9/1).
25. updated seen Jul 16, 2026 · issue 017

    Immuta adds automated Redshift data discovery, built-in managed groups, Delta Sharing row/column masking, Teradata hashing, and OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. for Alation.

    └──▷ HOW TO FIND IT
    Use the embedded documentation chatbot to answer governance questions without leaving the Immuta UI.
    📍In the Immuta UI, click the Documentation icon in the top menu, then type your question in natural language in the AI-powered documentation chatbot.
    • Introduces three built-in Immuta-managed groups — All Agents, All Users, and All Identities — available for use in subscription and data policies without manual membership management.
    • Enables row filtering and column masking (subscription and data policies) on Unity Catalog managed, external, and foreign tables in Databricks Delta Sharing shares.
    • Supports OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0 authentication for Immuta's Alation integration alongside existing API key authentication, eliminating recurring token rotation.
    • Extends Immuta's Databricks Unity Catalog tag ingestion to foreign catalogs (Lakehouse FederationLakehouse FederationA data architecture pattern that lets a single query engine read from multiple external data sources—databases, data lakes, warehouses—without moving or copying the data, reducing pipeline complexity for tools that need broad data access.) by falling back to system.information_schema tag views.
    • Adds constant and hash masking support for Immuta's Teradata integration, expanding beyond existing null masking.

    +4 more show less

    • Slack and Microsoft Teams notifications for the Request app are now generally available, delivering real-time alerts for approvals, data access changes, and requests.
    • Extends Microsoft Teams Request app notifications to the Asia Pacific region (previously North America and Europe only).
    • Embeds Immuta documentation and an AI-powered documentation chatbot directly in the Immuta UI via a Documentation icon in the top menu.
    • Immuta's Starburst (Trino) integration now treats Trino principal names as case-insensitive when matching users and service accounts.

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Beginning August 1, disabling a data source in Immuta will revoke data owners' Immuta-managed grants in the data platform for that data source; previously, disabling a data source did not remove those grants.
    • !Beginning August 1, Starburst (Trino) principal name matching becomes case-insensitive for all accounts; setups relying on case-sensitive principal name matching will be affected.
26. updated seen Jul 15, 2026 · issue 017

    Immuta adds automated Redshift discovery, built-in managed groups, OAuth for Alation, Delta Sharing masking, and Teams/Slack notifications.

    └──▷ HOW TO FIND IT
    Access Immuta documentation and ask governance questions in natural language without leaving the product.
    📍In the Immuta UI, click the Documentation icon in the top menu to open the embedded docs or AI-powered chatbot, then type your question in natural language.
    • Introduces three built-in system-managed groups — All Agents, All Users, and All Identities — usable in both subscription and data policies without manual membership management.
    • Supports OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. authentication for Immuta's Alation integration, eliminating the need for recurring API key rotation.
    • Enables row filtering and column masking on Unity Catalog managed, external, and foreign tables in Databricks Delta Sharing shares (now GA for all accounts).
    • Adds Slack and Microsoft Teams notifications for the Request app (generally available), delivering event-driven alerts for approvals, data access changes, and requests.
    • Expands Microsoft Teams Request app notifications to the Asia Pacific region (public preview).

    +4 more show less

    • Adds constant and hash masking support for Teradata in addition to existing null masking, improving cross-platform masking policy consistency.
    • Enhances Review Assist (AI-powered access request recommendation engine) to incorporate request form responses as contextual input for its analysis.
    • Embeds Immuta documentation and an AI-powered documentation chatbot directly in the Immuta UI via a Documentation icon in the top menu.
    • Starburst (Trino) principal name matching is now case-insensitive by default, enabling more reliable user and service account identification.

    9 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !When a data source is disabled in Immuta, Immuta now revokes data owners' Immuta-managed grants in the data platform; previously, disabling a data source did not remove those grants (on by default 8/1, enabled for all 9/1).
27. updated seen Jul 15, 2026 · issue 015
    • Adds automated sensitive data discovery for the Amazon Redshift viewless integration, supporting regex, dictionary, and column name regex identifier types with automatic tag application.
    • Adds Slack and Microsoft Teams event-driven notifications for the Request app (approvals, access changes, requests), now generally available.
    • Expands Teradata integration masking support to include constant and hash masking in addition to existing null masking.
    • Revokes data owner grants when a data source is disabled (behavior change rolling out via opt-in period starting June 30).
    • Review Assist now incorporates request form responses as additional context in its AI-powered access request recommendations.
    └──▷ BREAKING ON UPGRADE

    • !When a data source is disabled in Immuta, Immuta now revokes data owners' Immuta-managed grants in the data platform — previously, disabling a data source did not remove those grants. This change follows the behavior change release process (on by default: 8/1; enabled for all: 9/1).
    • !Starburst (Trino) principal name matching is now case-insensitive; previously, Trino principals had to match the exact capitalization of the corresponding user or service account in Immuta. This is on by default starting 7/1 and enabled for all accounts on 8/1.
28. updated seen Jul 13, 2026 · issue 014

    Immuta adds automated Redshift discovery, managed policy groups, Alation OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms., Delta Sharing masking, and Teams/Slack notifications.

    └──▷ HOW TO FIND IT
    Apply a system-wide subscription policy that restricts AI-restricted data to human users only, using the new built-in All Agents group to exclude agent accounts.
    📍In the Immuta console, go to Policies › Subscription Policies › New Policy, set the condition to deny access when the subscriber is a member of All Agents, and scope it to data sources tagged as AI-restricted.
    Switch the Alation integration to OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0 to eliminate the need for recurring API key rotation every 24–90 days.
    📍In the Immuta console, go to App Settings › Integrations › Alation, select OAuth 2.0 as the authentication method, and supply your OAuth client credentials.
    Enable automated sensitive data discovery on a Redshift viewless data source to automatically tag columns matching regex, dictionary, or column-name patterns.
    📍In the Immuta console, open your Amazon Redshift viewless data source, navigate to the Sensitive Data Discovery tab, and enable automated discovery to begin applying identifier-based tags to matching columns.
    • Adds automated sensitive data discovery (regex, dictionary, and column name regex identifiers) for the Amazon Redshift viewless integration, auto-tagging matching columns.
    • Introduces three built-in Immuta-managed groups — All Agents, All Users, and All Identities — usable in subscription and data policies without manual membership management.
    • Enables case-insensitive Starburst (Trino) principal name matching for more reliable user and service account identification (on by default 7/1, mandatory 8/1).
    • Revokes data owner grants when a data source is disabled in Immuta (behavior change: opt-in 6/30, on by default 8/1, mandatory 9/1).
    • Extends Unity Catalog tag ingestion to foreign catalogs (Lakehouse FederationLakehouse FederationA data architecture pattern that lets a single query engine read from multiple external data sources—databases, data lakes, warehouses—without moving or copying the data, reducing pipeline complexity for tools that need broad data access.) by leveraging system.information_schema tag views as a fallback.

    +7 more show less

    • Embeds Immuta documentation and an AI-powered chatbot directly in the Immuta UI via a Documentation icon in the top menu.
    • Adds OAuth 2.0 authentication support for the Alation integration, eliminating recurring API key rotation alongside the existing API key method.
    • Supports row filtering and column masking on Unity Catalog managed, external, and foreign tables in Databricks Delta Sharing shares.
    • Slack and Microsoft Teams notifications for the Request app are now generally available, delivering event-driven alerts for approvals, access changes, and requests.
    • Extends Request app Microsoft Teams notifications to the Asia Pacific region (previously North America and Europe only).
    • Adds constant and hash masking support for Immuta's Teradata integration, complementing existing null masking.
    • Review Assist (AI-powered access request recommendation engine) now incorporates request form responses as additional context for recommendations.

    12 details in Everything