SailPoint

No entries match these filters. Clear filters

1. New Capability: SailPoint Oracle Access Governance SaaS Connector (2026-10-12) Oct 12, 2026 · issue 105

   New Oracle Access Governance SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. connector brings OAG identities, roles, and access bundles into SailPoint Identity Security governance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds the Oracle Access Governance (OAG) SaaS connector for SailPoint Identity Security, enabling centralized visibility, lifecycle management, access requests, and governance over OAG-managed identities and Oracle applications.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Aggregates OAG identities as accounts and OAG roles and access bundles as entitlements, including application-level and included-permission context.
   • Supports access requests, grants, and revocations through the SailPoint Identity Security request center, with the connector forwarding approved requests to OAG for fulfillment — including clear provisioning results when an OAG guardrail or segregation-of-duties check prevents a request.
   • Supports lifecycle operations — activating, terminating, enabling, disabling, and deleting OAG identities and their downstream Oracle accounts — with per-application lifecycle controls to target a specific Oracle application without affecting others.

   4 details in Everything

2. New Capability: SAP Concur Connector Updated to Support Spend API V4.1 (2026-10-12) Oct 12, 2026 · issue 105

   SAP Concur connector updated to support Spend API V4.1 via new useSpendApiV41 config flag for controlled migration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Opt an existing SAP Concur source (created before June 1, 2026) into Spend API V4.1 after reviewing and updating customData mappings.
   xml copy

   <entry key="useSpendApiV41" value="true"/>
   
   <!-- Updated customData mapping pattern -->
   <entry key="orgUnit1" value="['urn:ietf:params:scim:schemas:extension:spend:2.0:User'].customData[*][?(@.id=='orgUnit1')].value"/>

   • Adds useSpendApiV41 application XML entry to the SAP Concur connector config, enabling administrators to opt existing sources into Spend API V4.1 on their own schedule.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Updates the SAP Concur SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. & VA connector to use Spend API V4.1 for Spend User retrieval, replacing the deprecated Spend API V4; sources created on or after June 1, 2026 use V4.1 by default.
   • Changes customData response format from label-based field names (V4) to strict camel-case technical field names (V4.1), requiring review and update of existing jsonPathMapping entries that reference customData.
   • Adds useSpendApiV41 application XML entry to the SAP Concur connector config, enabling administrators to opt existing sources into Spend API V4.1 on their own schedule.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   2 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Existing jsonPathMapping entries that reference customData labels will break under Spend API V4.1: V4.1 returns strict camel-case technical field names instead of the human-readable labels returned by V4. Mappings must be reviewed and updated before enabling useSpendApiV41 or before June 1, 2026 for sources created after that date.
3. Enhancement: Custom User Level - Read Only Sources (2026-10-12) Oct 12, 2026 · issue 105

   SailPoint Identity Security Cloud extends Custom User Levels to grant Read Only access to Sources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

4. Enhancement: ServiceNow Service Catalog v5.4 — Event-driven Approvals and Access Request Status Sync (2026-10-09) Oct 9, 2026 · issue 100

   ServiceNow Service Catalog v5.4 replaces polling with ISC event triggers for real-time approval and access request status sync.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Configure the ISC Event Processing Table Cleaner retention window to match your company data policy.
   📍In ServiceNow, navigate to the Data Management Policy for the ISC Event Processings table, activate the table cleaner rule, and set the retention period (default: 7 days) to your required value.
   • Adds five ISC event trigger subscriptions via https://{instance_name}.service-now.com/api/x_sap_intidn/isc_event_processor to push real-time state changes from Identity Security Cloud to ServiceNow, replacing timer-based polling.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds an ISC Backup Utility scheduled job to reconcile missed events during connectivity or event-delivery failures.
   • Adds an ISC Event Processing Table Cleaner job to purge old event records, with a default retention period of 7 days configurable via the Data Management Policy.
   • Adds quoted phrase search in the ISC Access Object Search widget: wrapping multi-word terms in double quotes in the Name, Description, or Additional Search fields matches a contiguous phrase (unquoted searches behave as in v5.3).
   • Adds five ISC event trigger subscriptions via https://{instance_name}.service-now.com/api/x_sap_intidn/isc_event_processor to push real-time state changes from Identity Security Cloud to ServiceNow, replacing timer-based polling.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds an ISC Backup Utility scheduled job to reconcile missed events during connectivity or event-delivery failures.
   • Adds an ISC Event Processing Table Cleaner job to purge old event records, with a default retention period of 7 days configurable via the Data Management Policy.

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Configuring ISC event triggers is mandatory from v5.4 — existing timer-based polling is replaced and will not function; customers must create a ServiceNow integration user (roles rest_service, x_sap_initidn.user, itil; identity type Machine, web services access only), subscribe to the five required event triggers, validate each subscription, verify the Identity Security Cloud Links table includes v5.4 endpoints, and activate the Data Management Policy and table cleaner rule before the integration will operate.
5. Enhancement: Collaboration Portal SSO - Flexible Identity Provider Matching (2026-10-09) Oct 9, 2026 · issue 100

   SailPoint Non-Employee Risk Management adds a Login Lookup Mode setting for collaboration portal SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management., enabling SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. assertion attribute matching.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢
   └──▷ HOW TO FIND IT
   When your IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. transforms or hashes the NameID, switch the collaboration portal SSO matching mode to assertion attribute so pre-provisioned collaborators can authenticate.
   📍In the admin UI, go to the collaboration portal SSO tab, locate the Login Lookup Mode setting, and select Assertion attribute. Then coordinate with your identity team to map the correct SAML attribute (for example, email) in the IdP.
   • Adds Login Lookup Mode setting on the collaboration portal SSO tab, letting administrators choose between NameID (default) and Assertion attribute matching to resolve SSO identity mapping failures when an IdP transforms or hashes the user identifier.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports assertion-attribute matching (for example, email) for both pre-provisioned (non-JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility.) and JIT user flows, configurable through the admin UI and API.
   • Adds Login Lookup Mode setting on the collaboration portal SSO tab, letting administrators choose between NameID (default) and Assertion attribute matching to resolve SSO identity mapping failures when an IdP transforms or hashes the user identifier.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

6. Enhancement: Disconnected applications connector - limited availability (2026-10-09) Oct 9, 2026 · issue 100

   New disconnected applications connector governs API-less web apps via browser-extension UI recording for provisioning, deprovisioning, and aggregation in ISC.

   • Adds the SailPoint connectivity browser extension to record administrator UI workflows once and replay them for automated provisioning, deprovisioning, and aggregation against web apps that expose no API.
   • New integrationIntroduces the disconnected applications connector as a new source type in Identity Security Cloud, bringing legacy web apps, custom internal tools, and API-less systems under centralized SailPoint governance.
   • Enables zero-code connectivity by letting administrators map recorded UI inputs to SailPoint identity attributes (such as name or email) without writing custom scripts.
   • Surfaces accounts and entitlements from disconnected applications in SailPoint's existing search, certifications, reporting, and reconciliation workflows alongside connected sources.

   4 details in Everything

7. New Capability: SailPoint ARM brings Fiori Application IDs and utilization into SAP access risk (2026-10-09) Oct 9, 2026 · issue 100

   SailPoint ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. adds SAP FioriSAP FioriSAP's design system and UI framework for building web applications on top of SAP software, giving cyber tools a consistent, role-based interface into SAP enterprise data and workflows. app tracking — Fiori IDs, usage, and risk rules now sit alongside transactions in reviews and reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   During an emergency access review, inspect exactly which Fiori apps an elevated user opened — with plain-language names, sensitivity flags, and Standard vs. Elevated markers.
   📍In ARM, open an emergency access review for the target session and check the activity grid — Fiori rows appear alongside transactions, each labeled with its Application ID and description (e.g. (F2223) Reset Cleared Items) and an Elevated marker if the access came only from the elevated session.
   • Enables Include Fiori Metadata on the SAP connection in the ARM agent (on by default for new connections) to activate Fiori app tracking via the ZARM_FIORI_META dictionary and ZARM_UTIL_DATA Launchpad plugin.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports Fiori intents with the [FAPP] prefix and OData services with the [SVC] prefix in rulebook risk definitions, alongside existing transaction codes.
   • Adds a new Fiori report listing which roles and catalogs grant which Fiori apps and OData services, with or without usage, filterable by Fiori Application ID as a dedicated field.
   • Surfaces Fiori intents and OData services in the emergency access activity grid, each row showing a readable description (e.g. (F2223) Reset Cleared Items), a sensitivity flag, and a Standard or Elevated access marker.
   • Includes Fiori intents and execution counts in User to Role periodic access reviews, showing what access a role grants and whether it was actually used.

   +5 more show less

   • Adds Fiori app usage to role-level utilization reports so reviewers can see what a user would lose before a role is removed.
   • Lets administrators choose whether to continue collecting raw OData service calls from the SAP Security Audit Log independently of app-level Fiori usage.
   • Adds a new out-of-the-box (OOTB) connector to manage Access Risk Management users' JMLJMLA formal specification language for Java that lets developers write machine-checkable contracts — preconditions, postconditions, and invariants — directly in source comments, enabling static verification and test generation. (Joiner-Mover-Leaver) access through ISC.
   • Allows ARM admins to edit a user's email address directly in the product, without contacting support.
   • Delivers a side and top navigation overhaul for customers not on legacy reporting.
   • Enables Include Fiori Metadata on the SAP connection in the ARM agent (on by default for new connections) to activate Fiori app tracking via the ZARM_FIORI_META dictionary and ZARM_UTIL_DATA Launchpad plugin.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a new Fiori report listing which roles and catalogs grant which Fiori apps and OData services, with or without usage, filterable by Fiori Application ID as a dedicated field.
   • Lets administrators choose whether to continue collecting raw OData service calls from the SAP Security Audit Log independently of app-level Fiori usage.
   • Adds a new out-of-the-box (OOTB) connector to manage Access Risk Management users' JMLJMLA formal specification language for Java that lets developers write machine-checkable contracts — preconditions, postconditions, and invariants — directly in source comments, enabling static verification and test generation. (Joiner-Mover-Leaver) access through ISC.

   6 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Existing rulebook entries for Fiori that lack a prefix must be updated: Fiori intents now require the [FAPP] prefix and OData services require the [SVC] prefix before the next rulebook import, or they will not match correctly.
8. New Capability: Data Access Security - Google BigQuery Connector (2026-10-05) Oct 5, 2026 · issue 096

   SailPoint DASDASDirect-Attached Storage: disks connected directly to a host machine rather than over a network, giving tools low-latency, high-throughput access to raw storage without SAN or NAS overhead. gains a Google BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. connector for warehouse inventory, effective-access explanation, and GCP classification tag ingestion; activity monitoring and remediation are not included in this launch.

   • New integrationAdds a Google BigQuery connector to Data Access Security, enabling crawl and inventory of BigQuery datasets, tables, views, and routines.
   • Collects effective permissions for BigQuery resources, explaining access in enterprise identity terms across users, groups, and service accounts.
   • Ingests classification tags already applied in Google Cloud onto the corresponding DAS assets, reusing existing GCP data classifications without re-classifying with the DAS engine.

   3 details in Everything

9. New Capability: Data Access Security - Atlassian Confluence Connector (2026-10-05) Oct 5, 2026 · issue 096

   SailPoint Data Access Security adds an Atlassian Confluence Cloud connector for identity-first visibility and content classification.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Onboard a Confluence Cloud site into Data Access Security to begin crawling spaces, pages, and attachments and collecting effective permissions.
   📍In the DAS console, go to Applications › Add Application, select Confluence Cloud, enter your Confluence site URL and credentials with the documented Confluence permissions, then run Crawl, Permission Collection, and Classification in sequence.
   • Adds a Confluence Cloud connector to Data Access Security, enabling inventory of Confluence spaces, pages, and attachments with effective-permission mapping expressed in enterprise identity terms.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports data classification of unstructured Confluence content using the existing DASDASDirect-Attached Storage: disks connected directly to a host machine rather than over a network, giving tools low-latency, high-throughput access to raw storage without SAN or NAS overhead. classification approach, extending the same governance model already applied to other data sources.
   • Surfaces unresolved-principal markers when a Confluence principal cannot be matched to a known identity, making permission gaps explicit.
   • Adds a Confluence Cloud connector to Data Access Security, enabling inventory of Confluence spaces, pages, and attachments with effective-permission mapping expressed in enterprise identity terms.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Surfaces unresolved-principal markers when a Confluence principal cannot be matched to a known identity, making permission gaps explicit.

   1 more in Everything

10. New Capability: HashiCorp Vault (On-Premise) Connector for NHI Discovery (2026-10-05) Oct 5, 2026 · issue 095

    New HashiCorp Vault (On-Premise) ISC Source connector brings Vault token and userpass NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. metadata into Identity Security Cloud via Virtual Appliance, without reading secret payloads or altering the existing Credential Provider.

    • New integrationAdds a new HashiCorp Vault (On-Premise) ISC Source connector that discovers and aggregates Vault token metadata (issue/expiration time, policies, token type) and userpass account metadata (username, policies, token TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit./period settings) as non-human identitiesnon-human identitiesA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. — without reading secret payloads.
    • Connects to on-premises HashiCorp Vault Community edition through the Virtual Appliance using the Vault host URL and an API token, keeping the existing HashiCorp Vault Credential Provider unchanged.
    • Surfaces NHI metadata as Dataset resources in Identity Security Cloud: Vault tokens modeled as credentials, and Vault userpass accounts modeled as machine accounts.
    • Supports both Express and standard source setup, with a Test Connection step to validate connectivity before aggregation.

    4 details in Everything

11. Enhancement: Delimited File Connector - Securely Connect to AWS S3 Using IAM Role Authentication Instead of Long-Lived Access Keys (2026-10-05) Oct 5, 2026 · issue 095

    SailPoint Delimited File Connector gains IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role-based authentication for AWS S3, eliminating long-lived access keys.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Configure an AWS EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware.-hosted VA Delimited File source to authenticate via a dedicated cross-account IAM role, avoiding any stored access keys.
    📍In Identity Security Cloud, open your Delimited File source › Connection Settings. Set File Transport to AWS S3, then set Authentication Type to IAM Role. Fill in: S3 Bucket: my-identity-bucket S3 Region: us-east-1 Role Name: sailpoint/S3ReaderRole Account ID: 123456789012 External ID: <your-sts-external-id> Role Session Name: sailpoint-aggregation Role Session Duration: 3600 Click Test Connection to confirm trust-policy and permissions before scheduling aggregation.
    • Adds Authentication Type dropdown (values: IAM User or IAM Role) to the Delimited File Connector when File Transport = AWS S3, letting practitioners choose IAM role auth instead of static access keys.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports Role Name (name or path such as sailpoint/S3ReaderRole), Account ID, External ID, Role Session Name, and Role Session Duration (default 3600 seconds) as new IAM Role configuration fields in source configuration.
    • Enables cross-account S3 bucket access by populating the optional 12-digit Account ID field when the target role lives in a different AWS account than the Virtual Appliance.
    • Stores External ID as an encrypted secret in Identity Security Cloud source configuration when the target role's trust policy includes an sts:ExternalId condition.
    • Credentials refresh automatically throughout long aggregation runs, so a session is never limited to a single role-assumption window.

    +1 more show less

    • Extends Test Connection to validate IAM role access against the configured bucket/path and return specific success or failure messages for trust-policy, permission, and missing instance-profile errors.
    • Adds Authentication Type dropdown (values: IAM User or IAM Role) to the Delimited File Connector when File Transport = AWS S3, letting practitioners choose IAM role auth instead of static access keys.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports Role Name (name or path such as sailpoint/S3ReaderRole), Account ID, External ID, Role Session Name, and Role Session Duration (default 3600 seconds) as new IAM Role configuration fields in source configuration.
    • Enables cross-account S3 bucket access by populating the optional 12-digit Account ID field when the target role lives in a different AWS account than the Virtual Appliance.
    • Stores External ID as an encrypted secret in Identity Security Cloud source configuration when the target role's trust policy includes an sts:ExternalId condition.

    2 more in Everything

12. Enhancement: Delimited File Connector - SMB File Transport with Kerberos Authentication (2026-10-05) Oct 5, 2026 · issue 095

    Delimited File Connector gains SMB2SMB2A Microsoft network file-sharing protocol (version 2 of SMB) used for remote file, printer, and service access over a network; cyber tools target or implement it to inspect, relay, or exploit Windows file-sharing traffic./SMB3SMB3The third major version of Microsoft's Server Message Block protocol, used for file and printer sharing over a network, adding encryption, multichannel support, and improved performance that cyber tools exploit or inspect. + KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. file transport, removing the need to stage Windows share files onto SFTPSFTPSSH File Transfer Protocol, a file transfer standard built on top of SSH that provides encrypted upload, download, and remote file management; cyber tools use it to move files or exfiltrate data over an authenticated, encrypted channel. or S3 before aggregation.

    • New integrationAdds SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. as a File Transport option on the VA-based Delimited File Connector, enabling direct aggregation from Windows File Server and Samba shares over SMB2/SMB3 without staging files to SFTP or S3.
    • Supports Kerberos authentication for SMB transport, configured via Host (FQDN), Port (default 445), Share Name, Kerberos Realm, Username, Password, and optional Kerberos Configuration Directory (folder on the VA containing krb5.conf) fields in source configuration.
    • Returns explicit success or failure messages for authentication, path, permission, and network errors when using Test Connection to validate Kerberos login, share access, and file read before scheduling aggregation.

    3 details in Everything

13. docs update Oct 3, 2026 · issue 093

    SailPoint adds Dark Mode and a Security Settings authentication-method selector to user Preferences.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Enable Dark Mode to reduce eye strain during extended console sessions.
    📍1. Select the User icon from the upper-right corner of the page. 2. From the dropdown menu, toggle Dark Mode to On.
    Switch your MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. or authentication method without contacting an admin.
    📍1. Select the User icon from the upper-right corner of the page. 2. From the dropdown menu, select Preferences. 3. Complete any authentication. 4. Select Security Settings. 5. For the Select Method field, choose the authentication method you want to use. 6. Enter any required information and select Save.
    • Enables Dark Mode via a toggle in the User menu dropdown, giving practitioners a low-glare UI option.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a Security Settings tab in Preferences with a Select Method field for choosing and configuring your authentication method.

    2 details in Everything

14. docs update Oct 3, 2026 · issue 093

    SailPoint adds customizable home dashboard tiles and admin-assigned managed dashboards with widget export options.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    View a managed dashboard assigned by your admin to monitor specific activity in your tenant.
    📍1. On the home dashboard, select the dropdown list beside Current Dashboard. 2. Select the dashboard you want to view. 3. Select the Menu icon beside any widget graph to export the chart as a .csv or .png, or view it in full screen.
    Set a preferred default dashboard so it loads automatically each time you sign in.
    📍1. On the home dashboard, open the Current Dashboard dropdown list. 2. Navigate to the dashboard you want as your default. 3. Select the Mark as favorite icon (star) beside it — only one dashboard can be marked as favorite.
    • Adds a customizable home dashboard where users can add, remove, and drag-and-drop reorder tiles via the Edit Current Dashboard icon.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces managed dashboards — admin-assigned dashboards containing widgets with detailed activity data — accessible via the Current Dashboard dropdown.
    • Enables setting a favorite/default dashboard using the Mark as favorite icon in the Current Dashboard dropdown, controlling which dashboard appears on sign-in.
    • Adds per-widget export options (CSV, PNG) and full-screen view via the Menu icon beside each widget graph on managed dashboards.

    4 details in Everything

15. docs update Oct 3, 2026 · issue 093

    SailPoint IdentityIQ gains AI-driven identity security features: Access Insights, Role Discovery, GenAI Entitlement Descriptions, and Access Recommendations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds Access History for understanding access patterns across your organization via the new AI-Driven Identity Security module.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Role Insights and Role Discovery to dynamically determine at scale who should have access to what.
    • Adds GenAI Descriptions for Entitlements to generate human-readable descriptions for your organization's entitlements.
    • Adds Certification and Approval Recommendations to help users and certifiers make more informed access decisions.

    4 details in Everything

16. docs update Oct 3, 2026 · issue 093
    • New integration File Access Manager Connector catalog documentation
17. docs update Oct 3, 2026 · issue 093
    • New integration New connectors: Celigo, Eventzilla, FileCloud, Finch
18. docs update Oct 3, 2026 · issue 093

    SailPoint adds Application Visibility with IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. connectors (Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments., Okta, Other) and a browser extension for discovering user app activity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Navigate to Application Visibility portal and connect your Okta IdP to begin discovering shadow IT and user-application activity.
    📍1. Open a browser and go to https://app.savvy.security/ (or https://app.us-east4.savvy.security/ if your domain was provisioned on us-east4). 2. Sign in with your Org Admin credentials. 3. Navigate to the IdP connector settings and select Okta to connect your Identity Provider. 4. Deploy the browser extension in your environment following the instructions under Browser Extension setup. 5. Once connected, view discovered application inventories, user accounts, and accounts under Application Visibility.
    Disable personal-activity collection to comply with privacy obligations before rolling out the browser extension org-wide.
    📍1. Sign in to the Application Visibility portal as a Global Administrator. 2. Go to Settings › Privacy Controls (Configuring Privacy Controls). 3. Toggle off the personal-activity capture options as required by your legal and compliance team. 4. Save and confirm the updated privacy configuration before deploying the browser extension.
    • Adds Application Visibility, a new capability that discovers inventories of applications, user accounts, and accounts in your environment via a browser extension and IdP connector.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports Microsoft Entra ID, Okta, and generic Other IdP as Identity Provider connectors for Application Visibility.
    • Deploys a browser extension to capture user-related application activity across browsers for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. discovery.
    • Adds Configuring Privacy Controls settings to manage and optionally disable all privacy-related features in Application Visibility.
    • Exposes the Application Visibility portal at https://app.us-east4.savvy.security/ or https://app.savvy.security/ depending on your provisioned domain.

    5 details in Everything

19. docs update Oct 3, 2026 · issue 093

    SailPoint CIEM now documents Okta alongside AWS, Azure, and GCP as a supported cloud source and identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..

    • New integration Okta CIEM integration
    • New supported platform Okta as a supported identity provider for CIEM
20. docs update Oct 3, 2026 · issue 093

    SailPoint adds Shadow AI Remediation for real-time visibility and just-in-time control over employee GenAI tool usage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Ensure a home-grown GenAI app appears in inventory and is covered by dashboards and logs — add it to both required lists after creating it as a Custom Application.
    📍1. In the Shadow AI Remediation admin console, create a Custom Application for the internal tool. 2. Navigate to Lists and open the generative-ai-apps list; add the custom application so it appears in GenAI inventory and dashboards. 3. Open the generative-ai-hostnames list and add the application hostname (e.g. ai-tool.acme.com) so activity logs capture traffic to it.
    Prevent playbooks from triggering on Microsoft Copilot (a sanctioned app) by adding it to the sanctioned lists before enabling remediation playbooks.
    📍1. In the Shadow AI Remediation admin console, go to Lists and open generative-ai-sanctioned-apps; add Microsoft Copilot. 2. Open generative-ai-sanctioned-hostnames and add the relevant Copilot hostname so hostname-mapped traffic is also excluded from playbook triggers. 3. Navigate to Playbooks, configure and enable the desired policy playbooks, then follow the deployment best-practice steps to test.
    • Adds generative-ai-apps, generative-ai-hostnames, generative-ai-sanctioned-apps, and generative-ai-sanctioned-hostnames lists to control which GenAI applications appear in inventory, dashboards, activity logs, and playbook triggers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Shadow AI Remediation, a new module providing real-time visibility into employee GenAI tool usage — covering web apps, IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.-registered applications, and browser extensions — with just-in-time remediation via guided playbooks.
    • Adds a Browser Extension deployment step that discovers user GenAI activity across any browser, with privacy controls configurable via Configuring Privacy Controls.
    • Adds Custom Application support so organizations can add home-grown or unlisted GenAI apps to the Shadow AI inventory and dashboards.
    • Adds Org Admin, Cert Admin, Helpdesk Admin, and Report Admin user-level roles for administering and viewing Shadow AI Remediation.

    5 details in Everything

21. docs update Oct 3, 2026 · issue 093

    SailPoint Agentic Fabric launches AI agent and non-human identitynon-human identityA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. governance with registry, endpoint/browser sensors, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. client tracking, and EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device./SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    After onboarding, connect your SIEM or EDR platform so Agentic Fabric can automatically discover available AI agent data sources.
    📍In SailPoint Human Fabric, go to Admin › Global › Agent Settings, then select SIEM and EDR Connections from the left panel and add your EDR or SIEM credentials.
    Deploy the endpoint agent sensor to managed Windows devices to start discovering AI agent software running as background processes.
    📍In SailPoint Human Fabric, go to Admin › Global › Agent Settings › Sensors, select the Endpoint Agent tab, and follow the artifact download and Microsoft Intune deployment steps.
    Audit which MCP clients have been granted access to AI agents in your environment after endpoint and browser sensors are active.
    📍In SailPoint Agentic Fabric, go to the MCP Clients page to review all discovered MCP clients, their connected agents, and source metadata collected via endpoint agents, browser extensions, and cloud connectors.
    • Adds a Non-Human Identity Registry unifying AI agents, applications, non-human accounts, MCP clients, credentials, and endpoints in a single governed inventory.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds an MCP Clients page providing central visibility into all Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. clients connected to AI agents, discovered via endpoint agents, browser extensions, and cloud connectors.
    • Adds a Credentials page with a filterable single view of all secret-bearing credentials discovered by Agentic Fabric sensors, including owner, status, and source metadata.
    • Adds an Endpoints page showing all endpoints with the endpoint agent sensor deployed, broken down by OS type and version, with average agent count per endpoint.
    • Adds endpoint agent sensor deployment for discovering and monitoring AI agent software running on managed laptops and desktops as a background service, managed at Admin > Global > Agent Settings > Sensors > Endpoint Agent.

    +8 more show less

    • Adds a browser extension sensor for GenAI governance visibility across managed and unmanaged SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. environments, managed at Admin > Global > Agent Settings > Sensors > Browser Extension.
    • Adds EDR and SIEM platform integration for AI agent discovery and monitoring, configured during onboarding or post-activation at Admin > Global > Agent Settings > SIEM and EDR Connections.
    • Adds cloud source connectors for AWS, Azure, and other AI platforms (read-only) to discover AI agents, managed post-activation at Admin > Connections > Sources.
    • Adds a Business Apps construct grouping non-human identitiesnon-human identitiesA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. into logical applications/agents/services with sanctioned or prohibited status, managed at Agentic Fabric > Business Apps.
    • Adds a Non-Human Identity Trends widget on the MySailPoint home page showing total non-human identity trends over a selectable time window, with per-day hover detail.
    • Adds an embedded Identity Graph accessible from individual agent and application records.
    • Adds a guided multi-step onboarding experience (Getting Started, Connect Identity Provider, Deploy Sensors, Connect Sources, Connect EDR/SIEM, Sanction Business Apps, Review and Activate) that supports skipping and returning to incomplete steps.
    • Supports Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. and Okta as identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems., with Jamf Pro (macOS) and Microsoft Intune (Windows) for MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies.-based endpoint agent deployment.

    13 details in Everything

22. New Capability: Manual Task Support for Governance Groups (2026-09-25) Sep 25, 2026 · issue 086

    SailPoint ISC now routes manual provisioning tasks to Governance Groups, letting any member complete work with full audit attribution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Enables assigning a Governance Group to a source so that manual provisioning tasks are routed to all group members instead of a single owner, with ISC recording which individual member completed each task.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Extends existing task notifications — Pending Manual Changes, Pending Task Daily Digest, and Task Reassignment — to reach all members of an assigned Governance Group.
    • Displays group-assigned manual tasks as a single row listing all assigned members in the admin task view.
    • Enables assigning a Governance Group to a source so that manual provisioning tasks are routed to all group members instead of a single owner, with ISC recording which individual member completed each task.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    2 more in Everything

23. SaaS Release Notes - September 25, 2026 Sep 25, 2026 · release notes

    New UiPath, Oracle AG, GitLab, JFrog connectors; CrowdStrike Foundry integration; Salesforce NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. discovery; Dark mode expansion

    • Adds the UiPath SaaS connector for Identity Security Connectivity to aggregate robot accounts, groups, and discover machine identities via SailPoint Agentic Fabric.
    • Adds the Oracle Access Governance SaaS connector to Identity Security Cloud for aggregating identities, roles, entitlements, and supporting grants/revocations.
    • Adds the GitLab SaaS connector for Identity Security Cloud to aggregate users, groups, projects, and discover non-human identitiesnon-human identitiesA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. (tokens, bots, service accounts) from GitLab.com and self-managed instances.
    • Expands Quick Compliance support to include Anvil, DataHub, Employment Hero, Fibery, Freshcaller, Juniper Mist, LangChain, noCRM, Redpanda Cloud Control Plane, and UserVoice as read-only sources for account/entitlement aggregation.
    • Adds ARM AGENT 2026.08.24.2 with enhanced Fiori functionality including expanded Fiori role metadata and Fiori intent utilization telemetry.

    +9 more show less

    • Adds the SailPoint Identity Security Intelligence CrowdStrike Foundry app that adds an Identity Security Intelligence panel to CrowdStrike Falcon Endpoint Security detections for reviewing human and non-human identitynon-human identityA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. context.
    • Enables containment of compromised human identities via SecOpsSecOpsThe practice of merging security and IT operations teams so that threat detection, response, and infrastructure management share the same workflows, giving cyber tools a single pipeline from alert to remediation. Identity Intelligence Response Action workflow, offering Disable Identity and Disable Account actions with tracked request status (Submitted, In Progress, Completed/Failed).
    • Enables security operations teams to retrieve SailPoint identity context from Identity Security Cloud without leaving their security tooling via the SecOps Identity Intelligence response.
    • Expands dark mode support to more areas across Identity Security Cloud, including custom branding.
    • Adds Event Lite transaction type support for delta aggregation in the Workday SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. connector (requires enabling Delta Aggregation Lite Events and entering Event Lite Types).
    • Adds discovery of Amazon Quick agents and action connectors with permission-grant relationships in the AWS SaaS connector.
    • Certifies SAP Sybase 16.1 as a managed system for the SAP Sybase ASE connector.
    • Adds Secrets and Non-Human Identity (NHI) discovery (Connected Apps, External Client Apps) and exposed credential detection across Salesforce objects in the Salesforce SaaS connector.
    • Aggregates auth tokens, customer secret keys, SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. credentials, and OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. Vault secret metadata in the Oracle Cloud Infrastructure SaaS connector's IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Credentials and Vault Secrets datasets.

    14 details in Everything

24. New Capability: Purview, Cyera & BigID Data Classification Labels Integration in Data Access Security (2026-09-24) Sep 24, 2026 · issue 085

    SailPoint Data Access Security gains native integration with Microsoft Purview, Cyera, and BigID to import data classification labels via a new wizard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Bring Purview classification labels into ISC entitlements so your access reviews reflect actual data sensitivity — without re-running classification.
    📍In the SailPoint ISC console: 1. Go to Data Access Security and onboard your data source application. 2. Select Import data classification during application setup. 3. Run discovery and permission collection. 4. Navigate to Compliance › Data Classification › Classification Import and configure Microsoft Purview as the vendor with a scheduled import cadence.
    • Adds a Classification Label Import wizard in Data Access Security to onboard Microsoft Purview, Cyera, or BigID as data classification sources, or upload a CSV, eliminating duplicate classification runs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports scheduled imports so classification labels stay current without manual re-runs, configurable per application in Data Access Security.
    • Enables each Data Access Security application to run either the native classification engine or import results from a third-party DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. vendor (Purview, Cyera, BigID).
    • Exposes classification import configuration under Compliance → Data Classification → Classification Import in the SailPoint ISC console.

    4 details in Everything

25. New Capability: SaaS Connector Log Download (2026-09-24) Sep 24, 2026 · issue 085

    SailPoint ISC admins can now download SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. connector log snapshots directly from the UI without CLI access or a support case.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Troubleshoot a SaaS connector connectivity failure without opening a support case or using the CLI.
    📍1. In the ISC admin console, go to Admin → Sources → <your SaaS source> → Source Details → Advanced → Logging. 2. Enable Debug log level. 3. Reproduce or wait for the connectivity failure. 4. Click Download to retrieve the connector-scoped log snapshot (up to ~24 hours of history). 5. Review the log for error details; if the snapshot is still insufficient, escalate to SailPoint support.
    • Adds a log download section in the SaaS connector UI at Admin → Sources → Source Details → Advanced → Logging, letting administrators download connector-scoped log snapshots covering ~24 hours of history.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Debug log level changes are reflected in downloaded snapshots, so admins can enable debug mode and re-download to capture more detail during an incident.
    • Adds a log download section in the SaaS connector UI at Admin → Sources → Source Details → Advanced → Logging, letting administrators download connector-scoped log snapshots covering ~24 hours of history.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 more in Everything

26. Enhancement: Workflow Versioning — History tab (2026-09-24) Sep 24, 2026 · issue 085

    SailPoint: Enables opening any history row to view event details such as Workflow Update, Version Created, or Version Forked.

    └──▷ HOW TO FIND IT
    Audit who changed a specific workflow step and what version that change produced, without digging through Admin Activity logs.
    📍1. Open the NERM Classic Admin console and navigate to the workflow you want to audit. 2. Select the History tab. 3. In the search box, enter the step label or step ID you are investigating. 4. Click a Version Created or Workflow Update row to open event details and confirm the actor, timestamp, and affected step. 5. From a version-oriented row, click through to open a side-by-side comparison of the before and after versions.
    • Enables following a version-oriented event to compare two workflow versions side-by-side, including across forks.

    1 detail in Everything

27. IdentityIQ 9.0 and Jakarta EE: a modern application-server foundation for self-hosted IGA (2026-09-24) Sep 24, 2026 · issue 085

    IdentityIQ 9.0 migrates to Jakarta EE 10Jakarta EE 10A vendor-neutral specification for enterprise Java applications, maintained by the Eclipse Foundation, that standardizes APIs for web services, persistence, and messaging so tools can run portably across compliant application servers., enabling support for Tomcat 10.1/11.0, JBoss EAP, and WebSphere Liberty LTS runtimes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Supports Jakarta EE 10 as the new application-server foundation, enabling IdentityIQ to run on current LTS runtimes: Apache Tomcat 10.1.40, Tomcat 11.0.6, JBoss EAP, and WebSphere Liberty.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces the IdentityIQ 9.0 Upgrade Pre-Check Utility, which inventories Java EE customizations and generates proposed Jakarta EE updates for team review and testing.
    • Delivers a single forward IdentityIQ release line, consolidating all future capabilities — including Metadata Campaigns, time-based access controls, and modernized application definitions — onto the Jakarta EE 10 stack.
    • Supports Jakarta EE 10 as the new application-server foundation, enabling IdentityIQ to run on current LTS runtimes: Apache Tomcat 10.1.40, Tomcat 11.0.6, JBoss EAP, and WebSphere Liberty.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces the IdentityIQ 9.0 Upgrade Pre-Check Utility, which inventories Java EE customizations and generates proposed Jakarta EE updates for team review and testing.

    1 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !Apache Tomcat 9.0.x features APR/native connectors and Tomcat Native 1.3.x will not be included in the upcoming Tomcat 9.1.x stream; installations relying on these must audit their configuration before moving to 9.1.x.
28. docs update Sep 24, 2026 · issue 084

    SailPoint: Adds connector for Anvil.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds connector for Checkmk.
    • Adds connector for Cloudiway.
    • Adds connector for Condens.
    • Adds connector for DataHub.
    • Adds connector for Employment Hero.

    +16 more show less

    • Adds connector for Fibery, enabling identity governance and access reviews for the work management platform.
    • Adds connector for FOSSA.
    • Adds connector for Freshcaller.
    • Adds connector for Infisical.
    • Adds connector for Juniper Mist.
    • Adds connector for Kashoo.
    • Adds connector for LangChain.
    • Adds connector for Nifty.
    • Adds connector for noCRM.
    • Adds connector for Qdrant.
    • Adds connector for Scrive.
    • Adds connector for StackHawk.
    • Adds connector for Trigger.
    • Adds connector for UserVoice, enabling identity governance and access reviews for the product feedback platform.
    • Adds connector for Vendasta.
    • Adds connector for YouSign.

    21 details in Everything

29. New Availability: The SailPoint Identity Graph is Coming to Business+ Tenants (2026-09-23) Sep 23, 2026 · issue 085

    SailPoint: Enables unified visibility across all identity types — humans, non-humans, and agents — in a single interactive graph view.

    ⤢
    └──▷ HOW TO FIND IT
    Navigate to Identity Graph from the MySailPoint homepage to immediately visualize a user's full access landscape and assess blast radius after a suspected compromise.
    📍1. Log in to your MySailPoint homepage. 2. Click the Identity Graph icon (red circle on the left sidebar). 3. Search for the suspected compromised identity. 4. Review the blast radius view to see all access paths, entitlements, and connected agents. 5. Use Direct action controls within the graph to remediate access without leaving the view.
    • Visualizes agent-human relationships and flags overpermissioned identities by comparing access side-by-side.
    • Extends Identity Graph (previously available as Observability & Insights) to all Business+ customers at no additional charge, with no licensing, configuration, or implementation required.
    • Extends Identity Graph (previously available as Observability & Insights) to all Business+ customers at no additional charge, with no licensing, configuration, or implementation required.

    1 more in Everything

30. New Availability: The SailPoint Identity Graph is Coming to Your Environment (2026-09-23) Sep 23, 2026 · issue 084

    SailPoint Identity Graph rolls out to all Business+ customers, enabling interactive visualization of identity relationships and blast radius analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢
    └──▷ HOW TO FIND IT
    Navigate to Identity Graph for a specific identity or entitlement directly from any list or menu in the product.
    📍In any identity, entitlement, or access list across the SailPoint product, click the Identity Graph icon in the top right of the item row. Identity Graph loads scoped to that item, showing its full access context and relationships.
    • Accesses Identity Graph directly from the MySailPoint homepage and from context menus across the product by clicking the graph icon on any identity, entitlement, or access item.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Visualizes the full identity estate — humans, non-human identitiesnon-human identitiesA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls., and agents — in a single interactive graph to surface overpermissioned identities and complex access pathways.
    • Identifies the blast radius of a compromised identity immediately, leveraging context across SailPoint's portfolio.
    • Enables direct remediation actions from within Identity Graph to reduce risk without leaving the visualization.

    4 details in Everything

31. Enhancement: Workflow Versioning — History tab (2026-09-23) Sep 23, 2026 · issue 084

    NERM Classic workflows gain a History tab for paginated, searchable version and change event review.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Review the full change history of a NERM Classic workflow after a suspected misconfiguration, filtering by version ID to isolate the offending change.
    📍1. Open the target workflow in NERM Classic Admin. 2. Select the History tab. 3. Enter the version ID in the search box to filter events. 4. Select the matching Version Created or Version Forked row to open event details. 5. Click through to the version comparison view to see exactly what changed.
    • Adds a History tab to NERM Classic workflow configuration, showing a paginated newest-first table of version-lifecycle and step/configuration-change events — including when, who, event type, step label, and version identifier — without requiring Admin Activity or the audit API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports search by step labels, step IDs, and version IDs within the History tab, with quick filters to narrow the event list.
    • Enables version comparison from within the History tab, letting admins follow changes that spawned a version and open a diff, including after a fork.

    3 details in Everything

32. docs update Sep 23, 2026 · issue 083

    SailPoint adds 21 new connectors including Infisical, StackHawk, FOSSA, and Redpanda Cloud Control Plane⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds connector support for Infisical, enabling identity governance over secrets management platform access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds connector support for StackHawk, extending compliance coverage to application security testing workflows.
    • Adds connector support for FOSSA, bringing license compliance and dependency data under identity governance.
    • Adds connector support for Redpanda Cloud Control Plane, enabling access governance for streaming data infrastructure.
    • Adds connector support for Anvil, Checkmk, Cloudiway, Condens, DataHub, Employment Hero, Freshcaller, Juniper Mist, Kashoo, LangChain, Nifty, noCRM, Qdrant, Scrive, Trigger, Vendasta, and YouSign.

    5 details in Everything

33. GA Announcement: Next Generation Certifications (2026-09-22) Sep 22, 2026 · issue 083

    SailPoint Next Generation Certifications reaches GA, bringing multi-million-item campaign scale, a new reviewer UI, and a Generate and Start option.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    After cutover, locate pre-migration campaigns that are no longer on the active list by navigating to the Legacy Campaigns view in the admin console.
    📍In the SailPoint admin console, go to Certifications › Legacy Campaigns in the left navigation to view and manage campaigns generated before your tenant cutover date.
    • Introduces a new certification engine that scales campaign generation to multi-million items, reducing large campaign generation time from days to minutes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a Generate and Start option so small campaigns kick off immediately after generation without requiring a manual start step.
    • Adds Generate and Start availability for campaigns launched from workflows, replacing the legacy manual-start pattern for targeted certifications.
    • Migrates campaign templates, campaign notification templates, and scheduled campaigns automatically as part of the engine cutover — no manual recreation required.
    • Introduces a new certification email template set alongside the existing templates (labeled Legacy in the UI), enabling side-by-side comparison during migration.

    +5 more show less

    • Adds Enriched Campaign Filters (in-progress feature) to replace the unsupported combination of search queries and campaign filters on a single campaign.
    • In-flight certifications pick up the improved reviewer UI automatically after tenant cutover, with no reviewer action required.
    • Administrators can access campaigns generated before cutover under Legacy Campaigns in the left navigation.
    • Certification report data retrieval endpoint is changing — migration guidance published at the Certification Reports Endpoint Moving resource.
    • FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. environments are excluded from this GA rollout; availability details to follow.
    • Introduces a new certification engine that scales campaign generation to multi-million items, reducing large campaign generation time from days to minutes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a Generate and Start option so small campaigns kick off immediately after generation without requiring a manual start step.
    • Migrates campaign templates, campaign notification templates, and scheduled campaigns automatically as part of the engine cutover — no manual recreation required.
    • Introduces a new certification email template set alongside the existing templates (labeled Legacy in the UI), enabling side-by-side comparison during migration.
    • Adds Enriched Campaign Filters (in-progress feature) to replace the unsupported combination of search queries and campaign filters on a single campaign.

    +2 more show less

    • Administrators can access campaigns generated before cutover under Legacy Campaigns in the left navigation.
    • FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. environments are excluded from this GA rollout; availability details to follow.

    3 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The endpoint for extracting certification report data (CSV and PDF) via the /campaign/ and /certification/ reporting flow is changing; existing API integrations that pull report data must be updated per the Certification Reports Endpoint Moving migration guidance.
    • !A small number of template attributes are no longer supported in the new certification email template set; customized notification templates using those attributes must be updated after migration (see Deprecated Variables in Certs Email Templates).
    • !Very high-volume offset-paginated calls to /campaign/ and /certification/ endpoints may time out on tenants with approximately 4,000 or more records — affected tenants are held from rollout until a fix ships.
    • !Campaigns configured with both a search query and campaign filters on the same campaign will not run on the new engine; these must be migrated to use campaign filters only (via Enriched Campaign Filters) before cutover.
    • !Email notification templates larger than 133 KB will have images trimmed automatically during migration to fit the new v2 templating engine size limit.
    • !Role Composition campaigns are excluded from the new engine at GA and continue to run on the legacy engine until a later migration date.
34. docs update Sep 19, 2026 · issue 079

    SailPoint adds 13 new connectors including FOSSA, StackHawk, Infisical, Qdrant, and YouSign⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds native connector support for FOSSA (open-source license compliance).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds native connector support for StackHawk (API security testing).
    • Adds native connector support for Infisical (secrets management).
    • Adds native connector support for Qdrant (vector databasevector databaseA database built to store embeddings and find the nearest ones to a query quickly. It is the retrieval half of most RAG systems.).
    • Adds native connector support for YouSign (e-signature).

    +8 more show less

    • Adds native connector support for Scrive (e-signature).
    • Adds native connector support for Checkmk (IT monitoring).
    • Adds native connector support for Cloudiway (cloud migration).
    • Adds native connector support for Condens (user research).
    • Adds native connector support for Kashoo (accounting).
    • Adds native connector support for Nifty (project management).
    • Adds native connector support for Trigger (workflow automation).
    • Adds native connector support for Vendasta (digital marketing platform).

    13 details in Everything

35. SaaS Release Notes - September 18, 2026 Sep 18, 2026 · release notes

    TeamCity, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally., and Delinea Platform connectors added; Quick Compliance expanded to 13 sources.

    └──▷ HOW TO FIND IT
    Use Quick Compliance to quickly set up aggregation for one of the new supported sources.
    📍In the console, navigate to Quick Compliance and select a source from the list (e.g., Checkmk, FOSSA, StackHawk).
    Monitor scheduled access revocations via audit logs after end date modifications.
    📍Review the Access Request audit logs for events related to end date changes.
    • Adds the TeamCity SaaS connector for aggregating users as accounts, groups/roles as entitlements, and access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions./SSH keys as non-human identitiesnon-human identitiesA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls.
    • Adds Oracle Cloud Infrastructure (OCI) IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. SaaS connector support for aggregating OCI IAM users as accounts, Generative AI Agents as machine identities, and API keys as credentials
    • Adds Delinea Platform SaaS connector support in Identity Security Connectivity
    • Adds Quick Compliance support for 13 new sources: Checkmk, Cloudiway, Condens, FOSSA, Infisical, Kashoo, Nifty, Qdrant, Scrive, StackHawk, Trigger, Vendasta, and YouSign
    • Enables audit events for changes to access request end dates in Identity Security Cloud - Access Requests

    5 details in Everything

36. docs update Sep 14, 2026 · issue 074

    SailPoint adds Work Reassignment to automatically redirect access request reviews, manual tasks, and certifications to other users.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Set up a temporary work reassignment before going on vacation so access request reviews are automatically routed to a colleague.
    📍1. Select the User icon in the upper-right corner. 2. Select Preferences from the dropdown. 3. Select Work Reassignment from the left panel. 4. Choose Access Request Reviews as the work item type. 5. From the Assign To list, select the colleague who will cover your reviews. 6. Specify a start date/time (or select Start Now) and an end date/time matching your vacation window. 7. Select Add Reassignment.
    As a manager, redirect a direct report's certification work to another team member while they are on leave.
    📍1. From your Dashboard, select the My Team widget. 2. Select the direct report who is on leave. 3. Select the Work Reassignment tab. 4. Choose Certifications as the work item type. 5. From the Assign To list, select the covering team member. 6. Set the start date to today and enable the No end date toggle for an open-ended reassignment. 7. Select Add Reassignment.
    • Adds Work Reassignment, reachable via User icon > Preferences > Work Reassignment, to automatically redirect access request reviews, manual tasks, and certifications to another identity for a configured time window.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Enables managers to configure Work Reassignment for direct reports via the My Team widget > select identity > Work Reassignment tab, covering the same work item types.
    • Adds a Reassignment History page under Preferences > Work Reassignment showing reassignment details — assignee and date — for the past 90 days.
    • Supports a Start Now toggle to begin a reassignment immediately and a No end date toggle to make a reassignment permanent until manually removed.

    4 details in Everything

37. SaaS Release Notes - September 11, 2026 Sep 11, 2026 · release notes

    Octopus Deploy and Buildkite connectors; JDBCJDBCA Java standard API for connecting applications to relational databases, maintained as part of the Java SE platform, letting tools query any compliant database through a single consistent interface./REST Dataset Resource model for NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls.; SoDSoDSeparation of Duties — an access-control principle requiring that no single user can complete a sensitive operation alone, reducing insider-threat and error risk by splitting authority across multiple roles. policy expansion; Webhooks activity output trimming

    • Adds Octopus Deploy SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. connector to aggregate users as accounts, teams and user roles as entitlements, service accounts, API keys, and stored credentials as non-human identitiesnon-human identitiesA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls.
    • Adds Buildkite SaaS connector to aggregate organization members as accounts, organization roles and teams as entitlements, agent tokens, secrets, and registry tokens as non-human identities
    • Enables the Dataset Resource model in JDBC and REST WebServices connectors to aggregate non-human identitynon-human identityA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. (NHI) entities including Agent, MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface., and Tools
    • Expands SoD policy criteria in Identity Security Cloud to include roles and access profiles alongside entitlements
    • Enables Activity Output Trimming for POST requests in the Workflows HTTP Request Action to reduce payload sizes when output feeds into a loop

    5 details in Everything

38. docs update Sep 10, 2026 · issue 070

    SailPoint adds 10 new connectors: Absence.io, Attio, FreeAgent, GitGuardian, Holded, Movidesk, Ploomes, ProdPad, SOTI MobiControl, and StatusGator.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

39. File Access Manager 8.5 Service Pack 2 Released! (2026-09-09) Sep 9, 2026 · issue 071

    File Access Manager 8.5 SP2 adds mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. for NetApp ONTAP, KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. for Exchange Server, and OAuth SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. authentication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds mutual TLSmutual TLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. (mTLS) authentication support for NetApp ONTAP connectivity, covering both client-side and server-side authentication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Kerberos authentication support for Microsoft Exchange Server integrations.
    • Adds OAuth-based SMTP authentication for outbound email communications, replacing Basic Authentication for Exchange Online compatibility.
    • Upgrades the core application framework to .NET 10.
    • Adds mutual TLSmutual TLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. (mTLS) authentication support for NetApp ONTAP connectivity, covering both client-side and server-side authentication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Kerberos authentication support for Microsoft Exchange Server integrations.
    • Adds OAuth-based SMTP authentication for outbound email communications, replacing Basic Authentication for Exchange Online compatibility.

    1 more in Everything

40. Enhancement: Dark Mode Updates (2026-09-09) Sep 9, 2026 · issue 070

    SailPoint Identity Security Cloud adds Dark Mode across the platform, including Agentic Fabric, DASDASDirect-Attached Storage: disks connected directly to a host machine rather than over a network, giving tools low-latency, high-throughput access to raw storage without SAN or NAS overhead., and custom branding support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢
    • Enables Dark Mode across Identity Security Cloud, including SailPoint Agentic Fabric and most ISC modules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports custom brand colors in Dark Mode, automatically switching between Light and Dark modes based on existing brand configuration.
    • Adds color pickers for branding configuration.
    • Extends Dark Mode configured in ISC automatically to Data Access Security (DAS) with no additional configuration required.
    • Enables Dark Mode across Identity Security Cloud, including SailPoint Agentic Fabric and most ISC modules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds color pickers for branding configuration.
    • Extends Dark Mode configured in ISC automatically to Data Access Security (DAS) with no additional configuration required.

    1 more in Everything

41. Enhancement: A Guided Builder for Workflow Trigger Filters (2026-09-09) Sep 9, 2026 · issue 071

    SailPoint Workflows adds a guided Basic mode filter builder with AND/OR logic, no JSONPathJSONPathA query language for extracting values from JSON documents, modeled after XPath for XML. Cyber tools use it to pinpoint specific fields in structured data without parsing the whole document manually. required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Use the Basic mode filter builder in the Workflows UI to add a trigger filter without writing JSONPath, then verify it matches your test input before promoting.
    📍In Identity Security Cloud, go to Workflows › select a workflow with a filterable event trigger › Trigger › Filter › switch to Basic mode › add conditions using AND/OR logic from the trigger schema › save, then open the Test panel and confirm the filter matches your test input.
    • Adds a Basic mode guided condition builder for workflow trigger filters, using AND/OR logic derived from the trigger schema, as an alternative to writing JSONPath expressions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Retains Advanced mode for full JSONPath authoring, including array expressions such as $.changes[?(@.attribute == 'department')], alongside the new Basic mode.
    • View, Edit, Download, and List operations now present trigger filters in the new trigger filter format after this update is enabled.
    • Adds a Basic mode guided condition builder for workflow trigger filters, using AND/OR logic derived from the trigger schema, as an alternative to writing JSONPath expressions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    2 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !During the Staging-to-Production rollout gap, uploading a workflow JSON that uses the other environment's trigger filter format will fail. Remove the trigger filter from the definition first, then upload the file and re-add the filter in the UI of the target environment. This applies to both JSON and API updates.
42. New Capability: Next-Gen Access Request (2026-09-08) Sep 8, 2026 · issue 071

    SailPoint Next-Gen Access Request replaces the legacy Request Center with enhanced search, multi-identity selection, machine identity support, and an AI agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    • Introduces Next-Gen Access Request, replacing the legacy Request Center with a unified flow for requesting access for self, others, a team, or machine identities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds cross-field catalog search in Find Access, searching across name, description, source, application, owner, privilege, and access model metadata — with filters for roles, access profiles, entitlements, and applications.
    • Adds effective privilege labels (HIGH, MEDIUM, or LOW) on each access item card so requesters can evaluate sensitivity before adding items to a request.
    • Adds identity search by name, email, or manager when requesting for others, with a toggle between All and My Team and support for filtering on up to five public identity attributes configured by an administrator.
    • Adds dedicated machine identity request support for customers with the Machine Identity Security add-on, including filtering by owner or type.

    +1 more show less

    • Adds the Harbor Pilot Access Request Agent for entitled customers, enabling natural-language access request search, interactive selection, form submission, request cancellation with a reason, and request status reporting.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Opting a production tenant into Next-Gen Access Request is permanent — it cannot be rolled back to the legacy Request Center experience. All production tenants are forcibly migrated on February 16, 2027 if not opted in earlier.
43. docs update Sep 5, 2026 · issue 065

    SailPoint adds 11 new connectors including Huntress, Scalefusion, and Recruitee for compliance coverage

    • Adds AlertOps connector for compliance integration.
    • Adds Bill4Time connector for compliance integration.
    • Adds Canny connector for compliance integration.
    • Adds Documo connector for compliance integration.
    • Adds Honeybadger connector for compliance integration.

    +6 more show less

    • Adds Huntress connector for compliance integration.
    • Adds Kobiton connector for compliance integration.
    • Adds Labelbox connector for compliance integration.
    • Adds PactFlow connector for compliance integration.
    • Adds Recruitee connector for compliance integration.
    • Adds Scalefusion connector for compliance integration.

    11 details in Everything

44. Enhancement: Delimited File Connector - Beyond Basic Authentication - SSH Keys for SFTP and Client Certificates for FTPS (2026-09-04) Sep 4, 2026 · issue 065

    Delimited File Connector gains SSH key auth for SFTPSFTPSSH File Transfer Protocol, a file transfer standard built on top of SSH that provides encrypted upload, download, and remote file management; cyber tools use it to move files or exfiltrate data over an authenticated, encrypted channel. and TLS client certificate auth for FTPSFTPSFTP with TLS/SSL encryption layered on top, standardized in RFC 4217, used by tools that need to transfer files over authenticated, encrypted channels while staying compatible with legacy FTP infrastructure., beyond Basic username/password.

    └──▷ HOW TO FIND IT
    Configure a Delimited File source to authenticate to a hardened SFTP server using an SSH private key instead of a password.
    📍In the Identity Security Cloud admin console, open the Delimited File source › Connection Settings. Set File Transport to SFTP, then set Authentication Type to Public Key. Enter the Host, Port, and Username (SSH account). Paste your PEM or OpenSSH private key into SSH Private Key. If the key is passphrase-protected, enter it in SSH Private Key Passphrase. Click Test Connection to confirm before saving.
    Configure a Delimited File source to authenticate to an FTPS server using a TLS client certificate (hybrid model: certificate for the TLS layer, credentials for the FTP layer).
    📍In the Identity Security Cloud admin console, open the Delimited File source › Connection Settings. Set File Transport to FTPS, then set Authentication Type to Client Certificate. Enter Host, Port, Username, and Password (FTP account). Paste the Base64-encoded PKCS12 (.p12) content into FTPS Client Certificate. If the keystore is protected, enter the passphrase in FTPS Client Certificate Passphrase. Click Test Connection to validate the TLS handshake and FTP login before saving.
    • Adds Public Key option to the Authentication Type dropdown for SFTP (File Transport = SFTP), enabling SSH private key authentication with SSH Private Key (PEM, OpenSSH, or OpenSSH v1 format) and optional SSH Private Key Passphrase fields.
    • Adds Client Certificate option to the Authentication Type dropdown for FTPS (File Transport = FTPS), enabling TLS mutual auth via a Base64-encoded PKCS12PKCS12A file format standard from RSA Labs, now maintained under IETF, that bundles a private key, certificate, and chain into one encrypted container, letting cyber tools ship or load credentials as a single portable file. (.p12) certificate pasted into FTPS Client Certificate, with an optional FTPS Client Certificate Passphrase field.
    • SSH private keys, client certificates, and passphrases are stored as encrypted attributes in Identity Security Cloud source configuration — no key files need to be uploaded to the Virtual Appliance filesystem.
    • Test Connection now validates SSH key authentication (invalid keys, wrong passphrases, network errors) and FTPS TLS handshake and FTP login before aggregation is scheduled.
    • Adds Public Key option to the Authentication Type dropdown for SFTP (File Transport = SFTP), enabling SSH private key authentication with SSH Private Key (PEM, OpenSSH, or OpenSSH v1 format) and optional SSH Private Key Passphrase fields.
    • Adds Client Certificate option to the Authentication Type dropdown for FTPS (File Transport = FTPS), enabling TLS mutual auth via a Base64-encoded PKCS12PKCS12A file format standard from RSA Labs, now maintained under IETF, that bundles a private key, certificate, and chain into one encrypted container, letting cyber tools ship or load credentials as a single portable file. (.p12) certificate pasted into FTPS Client Certificate, with an optional FTPS Client Certificate Passphrase field.
    • SSH private keys, client certificates, and passphrases are stored as encrypted attributes in Identity Security Cloud source configuration — no key files need to be uploaded to the Virtual Appliance filesystem.

    1 more in Everything

45. SaaS Release Notes - September 4, 2026 Sep 4, 2026 · release notes

    New SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. connectors for Spacelift, Bitbucket, CircleCI, N8N and Quick Compliance sources; SoDSoDSeparation of Duties — an access-control principle requiring that no single user can complete a sensitive operation alone, reducing insider-threat and error risk by splitting authority across multiple roles. controls for FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. customers.

    • Adds Spacelift SaaS connector to Identity Security Cloud
    • Adds Bitbucket Cloud SaaS connector with NH visibility via deploy keys and pipeline variables
    • Adds CircleCI SaaS connector with NH visibility via checkout, SSH, and deploy keys
    • Adds N8N connectivity support for account entitlement aggregation and NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. visibility
    • Adds Quick Compliance support for Akaunting, Alegra, AppDirect, Pipefy, Remote, Twist, and Upstash connectors

    +3 more show less

    • Adds Quick Compliance support for AlertOps, Bill4Time, Canny, Documo, Honeybadger, Huntress, Kobiton, Labelbox, PactFlow, Recruitee, and Scalefusion connectors
    • Enables SoD Violation Management and SoD Violation Controls for FedRAMP customers licensed for Separation of Duties
    • Allows Separation of duties permissions to be included in custom user levels

    8 details in Everything

46. Enhancement: Easier Trigger Filter Testing in Workflows (2026-08-31) Aug 31, 2026 · issue 061

    SailPoint Workflows now warns on missing trigger filters and applies filters during test runs before you enable a workflow.

    └──▷ HOW TO FIND IT
    Validate a JSONPathJSONPathA query language for extracting values from JSON documents, modeled after XPath for XML. Cyber tools use it to pinpoint specific fields in structured data without parsing the whole document manually. trigger filter against a real test payload before enabling a workflow, to confirm only intended events will fire it.
    📍In Identity Security Cloud, open your Workflow › select a filterable event trigger › add your JSONPath filter expression › go to Test Workflow, provide your test input JSON, and run the test. The result now shows whether your trigger filter matched the input, letting you confirm scope before enabling.
    • Adds missing-filter warnings in the workflow editor and on the Test Workflow experience when a filterable trigger has no filter configured.
    • Applies your trigger filter against the test input during test runs, showing whether the filter matches — previously, testing ignored the trigger filter entirely.

    2 details in Everything

47. announced Aug 31, 2026 · issue 060

    SailPoint SecOpsSecOpsThe practice of merging security and IT operations teams so that threat detection, response, and infrastructure management share the same workflows, giving cyber tools a single pipeline from alert to remediation. Identity Intelligence integrates with CrowdStrike Falcon Next-Gen SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. to bring identity governance and access data into SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. workflows.

    • Brings SailPoint identity governance, access, and risk data for human, machine, and AI agent identities into Falcon Next-Gen SIEM for use during security investigations.
    • Enables correlation of SailPoint identity data alongside endpoint, cloud, threat intelligence, and third-party telemetry already present in Falcon Next-Gen SIEM.

    2 details in Everything

48. SaaS Release Notes - August 28, 2026 Aug 28, 2026 · release notes

    Enhanced connectivity auth for Delimited File/Generic SDIM, agentic connector support, CIEM tag search, machine ID userInput, and dashboard templates.

    └──▷ HOW TO FIND IT
    Use dynamic user input to configure machine identity accounts securely.
    📍Generate account using $(userInput.technicalkey) in generator form inputs
    Locate cloud resources by their native tags in SailPoint CIEM.
    📍Use Search interface to query AWS/Azure tags or GCP labels
    • Adds gmsaMsDSSupportedEncryptionTypesInNumeric=true config key to Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. source configuration to retrieve numeric encryption types for gMSA accounts
    • Adds SSH key authentication support in the Delimited File connector for SFTPSFTPSSH File Transfer Protocol, a file transfer standard built on top of SSH that provides encrypted upload, download, and remote file management; cyber tools use it to move files or exfiltrate data over an authenticated, encrypted channel. connections
    • Adds TLS client certificate authentication support in the Delimited File connector for FTPSFTPSFTP with TLS/SSL encryption layered on top, standardized in RFC 4217, used by tools that need to transfer files over authenticated, encrypted channels while staying compatible with legacy FTP infrastructure. connections
    • Adds Client Credentials grant type support to Generic SDIM connector for OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. authentication
    • Enables activation and deactivation of Cursor agents via the Cursor SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. connector

    +4 more show less

    • Enables activation and deactivation of N8N agents via the N8N SaaS connector
    • Allows passing form input variables into machine account generators using the $(userInput.technicalkey) pattern
    • Adds tag/label-based search capability in SailPoint CIEM to query AWS/Azure tags and GCP labels for cloud resources
    • Allows configuring default widgets and tiles on the MySailPoint Home Page using dashboard templates

    9 details in Everything

49. Announcing the IdentityIQ 9.0 Upgrade Pre-Check Utility (2026-08-26) Aug 26, 2026 · release notes

    New iiq-precheck CLI utility scans IdentityIQ environments for Jakarta EE namespace conflicts and XHTML-to-XML migration gaps.

    • Introduces the iiq-precheck command-line utility to scan existing IdentityIQ environments before upgrading to version 9.0
    • Adds support for detecting javax.* references in rules, workflows, forms, plugins, and connectors that break on Jakarta EE 10Jakarta EE 10A vendor-neutral specification for enterprise Java applications, maintained by the Eclipse Foundation, that standardizes APIs for web services, persistence, and messaging so tools can run portably across compliant application servers. application servers like Tomcat 10+
    • Enables automated output of transformed Jakarta-safe file copies to a separate directory while preserving originals for review
    • Inventories Connector Registry application templates that still use .xhtml form or access files instead of the new XML source configuration format
    • Provides Precheck-userguide.pdf and SourceConfigXMLReferenceGuide.pdf alongside the utility for installation and XML format details

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !IdentityIQ 9.0 requires Jakarta EE 10, making all existing code referencing javax.* namespaces incompatible without migration to jakarta.*
50. Enhancement: HTTP Request Action - Sensitive Request Headers (2026-08-24) Aug 24, 2026 · issue 056

    ISC Workflows HTTP Request action adds Sensitive Request Headers field to mask API keys and tokens in definitions and execution history.

    ⤢
    └──▷ HOW TO FIND IT
    Move secret values out of plain-text Request Headers into Sensitive Request Headers when editing an HTTP Request action, so tokens no longer appear in workflow definitions or execution history.
    📍In a Workflow, open an HTTP Request action › locate the Sensitive Request Headers field › add your key (e.g. Authorization) and secret value (e.g. Bearer <token>) there instead of in Request Headers › save the workflow.
51. SaaS Release Notes - August 21, 2026 Aug 21, 2026 · release notes

    SailPoint SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Aug 21: GitHub/Snowflake/Databricks dataset connectors, request forms, Quick Compliance list, Shared Signals search

    • Adds GitHub SaaS connector support for aggregating fine-grained tokens, personal access tokenspersonal access tokensA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it., GitHub Copilot agents, GitHub Workflows, and GitHub environments as datasets.
    • Adds JDBC SaaS connector support for the Dataset Resource model to aggregate non-human identitynon-human identityA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. (NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls.) entities including Agents, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Servers, and Tools with agent owner correlation.
    • Adds Snowflake SaaS connector support for the Dataset resource model for Snowflake Cortex Agents, aggregating capabilities like Cortex Analyst, Cortex Search, generic functions/procedures, MCP servers, skills, web search, data-to-chart, and code execution.
    • Adds Databricks SaaS connector support for the Dataset resource model for Databricks Mosaic AI Agents, allowing activation/deactivation of agents as dedicated agent resources with agent owner correlation.
    • Expands Quick Compliance connectors to include Anypoint Exchange, Castor EDC, Doppler, Givebutter, IBM NS1 Connect, Kommo, Moneybird, and Runrun.it for expedited read-only account and entitlement aggregation.

    +3 more show less

    • Makes events from Shared Signals Framework transmitters and receivers associated with an identity available in Search and in the identity’s Event History.
    • Adds ability to attach forms to roles, access profiles, and entitlements in Access Requests to gather additional information from users requesting access.
    • Updates UI so application navigation bar is always visible on Admin pages including Sources, Discovery Connectors, Virtual Appliances, Credential Providers, Identities, Accounts, Roles, Access Profiles, Entitlements, Campaigns, Email Templates, and Forms.

    8 details in Everything

52. Enhancement: MySailPoint Managed Defaults, Dashboard Templates & Widget Sizing (2026-08-19) Aug 19, 2026 · issue 052

    MySailPoint gains admin-controlled Home defaults, dashboard templates (including Admin Overview), and multi-size widgets.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Set an org-wide Home baseline so all users start from an approved layout when they first log in.
    📍In the Dashboard Manager, go to Templates › Home Page Templates. Select Home Page, click Create Dashboard to preview the default layout. Remove unwanted tiles or widgets from the preview, then click Edit to add items. Click Save and confirm to apply the Managed Default immediately across the tenant. The saved default then appears under Managed Dashboards › Default Home Pages for future edits.
    Give your admin team an Admin Overview dashboard so they are ready before the classic Admin Overview page is deprecated.
    📍In the Dashboard Manager, go to Templates › Home Page Templates. Select the Admin Overview template and click Create Dashboard to generate a copy. Customize as needed and save — the dashboard is available to all administrators regardless of license.
    • Adds Managed Defaults: admins can draft and publish a global default Home layout (action tiles and widgets) that applies tenant-wide, overriding previous individual customizations; found under Dashboard Manager > Templates > Home Page Templates.
    • Adds a Default Home Pages section under Managed Dashboards > Default Home Pages where published managed defaults can be further edited or deleted (deleting reverts to the SailPoint baseline).
    • Adds Dashboard Templates: ready-made copyable dashboards covering persona, industry, or information type so admins can start with a pre-built layout instead of a blank canvas.
    • Adds an Admin Overview dashboard template available by default to all administrators regardless of license, recreating the classic Admin Overview page's capabilities inside Custom Dashboards.
    • Adds multi-size widget support: widgets built by SailPoint product teams now ship as Small (three per row), Medium (two per row — current default), or Large (one per row); size is set at widget creation and is not configurable by admins.

    +1 more show less

    • Users receive an in-app notification on their first Home visit after an admin publishes a Managed Default change, alerting them that the layout was updated and prior personalizations may need to be re-applied.

    6 details in Everything

53. docs update Aug 18, 2026 · issue 049

    SailPoint adds nine new connectors: Cobot, Losant, Prismatic, Productboard, ServiceM8, StoryChief, SupportBee, UpCloud, and Ziflow.

54. New Capability: Workflow Audit and Visibility for Non-Employee Risk Management Workflows (2026-08-17) Aug 17, 2026 · issue 049

    Non-Employee Risk Management workflows now emit structured audit events and expose version context via the Audit Events API.

    • Adds dedicated audit events to the Audit Events API for Non-Employee Risk Management workflow definition lifecycle actions — create, fork, deprecate, and delete — each with structured payload fields including workflow identity, definition label, actor, and timestamp.
    • Adds dedicated audit events for workflow step changes (add, edit, delete, reorder) with definition context in the event payload, retrievable via the existing Audit Events query API.
    • Enriches existing workflow session audit events with a workflow_version_label field (and workflow_version_id) identifying the workflow definition version in effect when the session started, enabling correlation of session behavior to configuration without extra tooling.
    • Supports filtering of new workflow audit events by workflow subject and definition identifiers using the existing Audit Events query API.

    4 details in Everything

55. New Capability: Integration Service (IQService-August-2026) is now LIVE! (2026-08-17) Aug 17, 2026 · issue 049

    IQService-August-2026 requires explicit enablement and TLS for ScriptExecutor and gMSAPasswordData privileged services.

    └──▷ TRY IT
    Before upgrading, explicitly enable the ScriptExecutor privileged service on a TLS-configured IQService instance to prevent script execution from silently stopping after the update.
    copy

    $ IQService.exe -g --enable ScriptExecutor

    Explicitly enable gMSA password retrieval so managed accounts that rely on gMSAPasswordData continue to function after the IQService-August-2026 upgrade.
    copy

    $ IQService.exe -g --enable gMSAPasswordData

    • Adds IQService.exe -g --enable <Service Name> command to explicitly enable privileged services; ScriptExecutor and gMSAPasswordData will not run unless enabled this way.
    • Extends mandatory TLS-only enforcement to the ScriptExecutor (native before/after script execution) and gMSAPasswordData (gMSA password retrieval) privileged services — both are silently disabled if TLS is not exclusively configured on the IQService instance.
    • Auto-update push via UpdateService begins October 19, 2026, with a 60-day manual configuration window starting August 18, 2026 for administrators to download, configure, and validate before auto-updates begin.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !ScriptExecutor and gMSAPasswordData privileged services will not run after upgrading to IQService-August-2026 unless TLS is exclusively configured on the IQService instance AND each service is explicitly enabled via IQService.exe -g --enable <Service Name>. Environments using either service without completing these steps will experience service interruptions on upgrade.
    • !Non-TLS ports must be disabled when switching an IQService instance to a TLS port; running both simultaneously is no longer a supported configuration.
56. SaaS Release Notes - August 14, 2026 Aug 14, 2026 · release notes

    SailPoint adds Privilege on Demand for JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility. access, SailPoint Agentic Fabric for AI/NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. governance, and new SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. connectors.

    • Enables Just-In-Time (JIT) activation of approved entitlements via Privilege on Demand in Identity Security Cloud
    • Adds SailPoint Agentic Fabric suite for discovering, governing, and auditing non-human identitiesnon-human identitiesA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. (NHIsNHIsA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls.) and AI agents
    • Supports AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. roles as governable machine accounts within SailPoint Agentic Fabric and Machine Identity Security
    • Introduces Datasets and Resources in SailPoint Agentic Fabric to group resources on a single aggregation schedule
    • Adds Multi Owner Correlation and Succession to automatically map human owners to machine identities and handle succession

    +7 more show less

    • New SaaS connectors available: Cursor, N8N, Jenkins, Argo CD, Wiz, and Quick Compliance sources (Cobot, Losant, Prismatic, etc.)
    • Microsoft Entra SaaS connector now supports activating/deactivating Copilot Studio agents and aggregating Azure AI Foundry agents
    • Adds Privilege on Demand UI in Launchpad > Just-In-Time Access for users to activate time-bounded access
    • Admins can configure JIT behavior in System Settings > Feature Settings for Privilege on Demand
    • Adds instance badge configuration in Admin > System Settings > Product Branding to indicate environment context
    • Supports dark mode across SailPoint Agentic Fabric and limited support in Identity Security Cloud via user menu
    • Oracle Database connector now supports mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. authentication for secure connections

    12 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Microsoft Entra SaaS connector classic module is deprecated and becomes obsolete on August 26, 2026; users must switch to the new Azure AI Foundry Agents module.
57. docs update Aug 11, 2026 · issue 042

    SailPoint Agentic Fabric adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. client discovery and governance to the non-human identitynon-human identityA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. registry

    • Adds an MCP Clients page to the non-human identity registry, providing a central view of all discovered MCP clients connected to AI agents, discoverable from endpoint agents, browser extensions, and cloud connectors.
    • Extends SailPoint sources to aggregate and govern MCP clients alongside AI agents, credentials, and IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. roles objects using datasets and resources.
    • Treats MCP clients as governed non-human identity assets within Agentic Fabric, enabling review and management of agent access to tools, systems, data sources, and credentials.

    3 details in Everything

58. New Capability: Machine Identity Access Requests (2026-08-10) Aug 10, 2026 · issue 042

    SailPoint adds access request support for Machine Identities, letting users request entitlements on behalf of machine identities via the ISC Request Center.

    ⤢ ⤢ ⤢
    • Enables users to request entitlements on behalf of Machine Identities through the Identity Security Cloud (ISC) Request Center for Machine Identity Security customers.
    • Routes manager-assigned approvals for Machine Identity access requests to the Machine Identity owner instead of a human manager.
    • Requires requesters to select a target account when a Machine Identity has multiple accounts on a source, ensuring precise provisioning targeting.

    3 details in Everything

59. New Capability: Non-Employee Risk Management Report Delete & Visibility (2026-08-10) Aug 10, 2026 · issue 042

    Non-Employee Risk Management gains report deletion and permission-scoped report list visibility on the Reports All tab.

    • Report creators can now delete their own report definitions directly from the Reports page in Non-Employee Risk Management; deleting a report also removes all associated exports.
    • The Reports All tab now shows only reports the logged-in user created or reports shared with them, preventing exposure of sensitive metadata in report titles to unauthorized users.

    2 details in Everything

60. Enhancement: Approvals Migration and Notification Reminders and Escalations, Regional Routing, and CC:/BCC: (2026-08-10) Aug 10, 2026 · issue 042

    SailPoint adds approval reminders/escalations UI, regional AWS SESAWS SESAmazon's cloud email-sending service, used by tools that need to deliver alerts, reports, or notifications without running their own mail infrastructure. routing, and CC:/BCC: support in email templates.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Configure a global escalation policy with a cron-based cadence and a governance-group fallback approver for all access-request approvals.
    📍In the console, go to Admin › System Settings › Feature Settings, select the Approval Settings tab, set the reminder and escalation cadence using a Cron string, define the number of escalation levels, assign a Governance Group as the fallback approver, and save.
    Migrate a verified sender domain to your primary AWS region so emails no longer route through us-east-1.
    📍In the console, go to the email identities section, locate the domain showing the us-east-1 region label, remove it, and re-add the same domain — the new entry will replace the existing record and trigger verification in your primary region automatically.
    Add CC: recipients to an approval notification template so managers are copied on access-request decisions.
    📍In the console, open the target email template (e.g., an access-request approval template), navigate to the CC:/BCC: configuration, select recipients from Manager, Governance Group, or enter a static email address, and save the template.
    • Adds Admin > System Settings > Feature Settings > Approval Settings tab for globally configuring approval reminders, escalations, and timeouts — including cron-string cadence, multi-level escalation chains, and a fallback approver set to an identity or governance group.
    • Adds per-access-item reminder and escalation configuration under the Access Requests section for Entitlements, Access Profiles, and Roles, overriding the global config for those items.
    • Adds a region field to EMAIL_SENT audit events, reflecting the AWS region used to send each email.
    • New identities (email addresses and domains) are now created and verified in the tenant's primary AWS region rather than always routing through us-east-1.
    • Email templates now support configuring CC:/BCC: recipients from Manager, Identity, Governance Groups, Org Admins, and/or a static email address (restricted on cloud_user_password_expiration, cloud_user_password_reset_token, cloud_user_unlock_token, cloud_user_verification_token, and onboarding_password_reset templates for security reasons).

    +1 more show less

    • Supports defining independent reminder and escalation configurations — reminders without escalations, escalations without reminders, and custom escalation targets outside the approver's management chain.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Pending approvals that have been open for longer than 90 days will begin expiring starting August 10, 2026; any remaining open pre-migration approvals will be closed.
    • !Domains with a custom MAIL FROM attribute configured will NOT be automatically migrated to the primary region — owners must manually re-add and re-verify the domain in their primary region or emails risk being blocked by SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. servers.
    • !Existing verified sender email addresses are not auto-migrated and continue to send from us-east-1; they must be manually removed and re-added to trigger verification in the primary region.
61. Enhancement: Data Segmentation for Identities (2026-08-10) Aug 10, 2026 · issue 042

    SailPoint Identity Security Cloud extends Data Segmentation to Human Identities, enabling least-privilege visibility across complex orgs.

    ⤢
    • Extends Data Segmentation to cover Human Identities, so administrators can restrict which identities a given user can see — not just Roles and Entitlements.
    • Enables delegated administration at subsidiary or team level without exposing cross-organizational identity data to scoped admins.

    2 details in Everything

62. SaaS Release Notes - August 7, 2026 Aug 7, 2026 · release notes

    New Analysis Dashboard for Access Risk Management, Quick Compliance connectors, and Oracle HCM delta aggregation.

    └──▷ HOW TO FIND IT
    View executive risk posture and drill into role or user risk details.
    📍Access the new Analysis Dashboard in Access Risk Management to view summary by severity, execution status, aging, risk type, and business process.
    Configure a new vendor integration token with a specific vendor selected.
    📍When creating a new API Token or Personal Access Token for an authorized vendor integration, select the vendor in the configuration process.
    • Adds the new Analysis Dashboard in Access Risk Management to view executive risk posture and remediation progress
    • Adds Action1, AppFollow, CanIPhish, EZOfficeInventory, FireHydrant, Gremlin, infobip, Tallyfy, and Zoho Catalyst as Quick Compliance connectors
    • Adds delta aggregation support (API and HCM Extract modes) to the Oracle HCM Cloud connector
    • Expands Customizers support to all out-of-the-box SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. connectors in the SaaS Connectivity infrastructure
    • Adds SailPoint Accelerated Application Management wizard with AI-powered connectivity agent for REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. systems

    +6 more show less

    • Adds trigger filter recommendations and warning icons for filterable workflow triggers in Identity Security Cloud Workflows
    • Adds z/OS 3.2 support to the ACF2-Full connector
    • Adds displayName, status, and transformConfig attributes to IDENTITY_PROFILE_UPDATE audit events
    • Allows Non-Employee Risk Management API requests to be authenticated with Identity Security Cloud API keys in addition to Personal Access Tokens
    • Adds vendor selection capability when creating API Tokens or Personal Access Tokens for authorized vendor integrations
    • Enhances Machine Account Discovery learning model with broader attribute analysis, ambiguous account handling, and discovery explanations

    11 details in Everything

63. docs update Aug 6, 2026 · issue 037

    SailPoint Agentic Fabric brings AI agent and non-human identitynon-human identityA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. governance to Identity Security Cloud with discovery, registry, and audit-ready reporting.

    └──▷ HOW TO FIND IT
    After activating Agentic Fabric, manage the endpoint agent sensor that discovers AI software running on corporate endpoints.
    📍In Identity Security Cloud, go to Admin › Global › Agent Settings › Sensors, then select the Endpoint Agent tab to view and update endpoint agent configuration.
    Classify which AI tools and agents are permitted or prohibited so that matching agents automatically inherit the sanctioned/unsanctioned status.
    📍In Identity Security Cloud, go to Agentic Fabric › Business Apps, select a business app, and set its sanction status to Sanctioned, Unsanctioned, or Unknown.
    Connect an EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. or SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. platform post-activation so Agentic Fabric can automatically find available data sources for AI agent monitoring.
    📍In Identity Security Cloud, go to Admin › Global › Agent Settings, then select SIEM and EDR Connections from the left panel to add or update your EDR/SIEM integration.
    • Navigating to Admin > Global > Agent Settings > Sensors and selecting the Endpoint Agent tab manages the background endpoint agent that discovers AI agent software installed on managed laptops and desktops.
    • Navigating to Admin > Global > Agent Settings > Sensors and selecting the Browser Extension tab manages the browser extension sensor for GenAI governance across managed and unmanaged SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. environments.
    • Navigating to Admin > Global > Agent Settings and selecting SIEM and EDR Connections connects EDR or SIEM platforms for AI agent discovery and monitoring.
    • Navigating to Admin > Security Settings > Service Provider manages identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. (Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. or Okta) post-activation to correlate human identities to owned AI agents.
    • Navigating to Admin > Connections > Sources connects cloud platforms (AWS, Azure, and other AI platforms) as sources for non-human identity aggregation.

    +7 more show less

    • New Non-Human Identity Trends widget on the MySailPoint home page shows total non-human identity counts over a selected time window, with day-level detail on hover.
    • New unified Non-Human Identity Registry centralizes discovery and management of agents, applications, accounts, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers, credentials, and endpoints.
    • New Business Apps grouping lets administrators declare a sanction status (sanctioned, unsanctioned, or unknown) for logical applications and agents, with matching agents inheriting the same classification.
    • New embedded Identity Graph is available per agent and per application for visualizing relationships between non-human identitiesnon-human identitiesA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls..
    • Audit and compliance reporting produces auditor-ready records covering agent inventory, ownership, action audit trails, and compliance evidence packaging.
    • Datasets and resources model lets SailPoint sources aggregate non-human identities, AI agents, MCP servers, credentials, and IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role objects on a configurable per-dataset aggregation schedule.
    • Continuous post-activation monitoring fires shadow AI alerts for unsanctioned tools and updates identity correlations in real time.

    12 details in Everything

64. New Capability: Roles Criteria in SoD Policy Definition (2026-08-03) Aug 3, 2026 · issue 050

    SailPoint SoDSoDSeparation of Duties — an access-control principle requiring that no single user can complete a sensitive operation alone, reducing insider-threat and error risk by splitting authority across multiple roles. policies now support Roles and Access Profiles as criteria alongside entitlements in List A and List B.

    ⤢ ⤢ ⤢
    • Adds support for SailPoint Roles in Separation of Duty (SoD) policy List A and List B criteria, configurable via Admin → Policies → Separation of Duty.
    • Adds support for Access Profiles in SoD policy criteria, enabling mixed criteria across lists (e.g., entitlements in List A and a Role in List B).
    • Preserves existing conflict detection, access-request approval visibility, and violation management workflows for policies that use Role or Access Profile criteria.

    3 details in Everything

65. New Capability: Auto-Discovery of Privileged Entitlements (2026-08-03) Aug 3, 2026 · issue 035

    SailPoint adds rule-based auto-discovery of privileged entitlements with accept/reject workflows and auditable classification records.

    • Surfaces recommendations for potentially privileged entitlements based on aggregate privilege classification pattern analysis, covering access that falls outside vendor-published lists or custom criteria.
    • Integrates recommendations into existing entitlement and source pages, allowing administrators to accept or reject each recommendation and assign a privilege level when marking an entitlement as privileged.
    • Enables delegation of recommendations to entitlement owners, source owners, governance groups, or other subject matter experts using the existing approvals flow.
    • Maintains an auditable record of all privilege classification decisions for governance and compliance tracking.

    4 details in Everything

66. SaaS Release Notes - July 31, 2026 Jul 31, 2026 · release notes

    New Personal Access Tokens management page, CIEM support for GCP AI/Microsoft Cognitive Services, Coupa license entitlements, OAuth for Non-Employee sources

    └──▷ HOW TO FIND IT
    Review all organization-wide Personal Access Tokens and modify their expiration dates directly from the new UI page.
    📍Navigate to Admin › Security Settings › Personal Access Tokens
    • Adds Admin > Security Settings > Personal Access Tokens page to view and edit expiration dates for organization-wide Personal Access Tokens
    • Enables CIEM ingestion of effective access and access paths for GCP AI Platform (Vertex/Gemini AI Agents) and Microsoft Cognitive Services (Foundry Agents)
    • Extends access model metadata custom attributes to allow ad hoc values up to 100 characters, with limits expanded to 250 attributes per access object type and 5,000 values per attribute
    • Allows filtering access requests by Current Owner, Requested For, and Requested By on the Admin > Approval Management page for inactive identities
    • Adds support for OAuth credentials as an authentication method in Non-Employee Risk Management user and profile sources

    +3 more show less

    • Updates Coupa connector to support Coupa licenses as entitlements
    • Enables viewing inherited access from within the Identity Graph data table
    • Enables bulk actions from within the Identity Graph data table

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Personal Access Tokens for workflow executions must now use sp:workflow-execution:read scope instead of sp:workflow:read; GET endpoints /workflows/{id}/executions, /workflow-executions/{id}, /workflow-executions/{id}/history, and /workflow-executions/{id}/history-v2 require the updated scope
67. Enhancement: Smarter Output Handling for HTTP Request (POST) (2026-07-28) Jul 28, 2026 · issue 029

    SailPoint Workflows now auto-trims HTTP POST response payloads inside loops, matching existing GET behavior.

    • Extends automatic payload trimming to HTTP Request (POST) steps — loop inputs now retain only the fields referenced in downstream steps, reducing data stored and transferred per run.
    • Full POST response remains accessible during test/build mode so practitioners can inspect all fields while authoring workflows.

    2 details in Everything

68. Introducing the connectivity agent for simplified web services configuration in SailPoint (2026-07-27) Jul 27, 2026 · issue 028

    SailPoint introduces an AI-guided connectivity agent wizard to configure Web Services sources without deep API expertise.

    • Adds a connectivity agent: an AI-powered, wizard-based setup experience for configuring Web Services connector sources directly within the SailPoint application onboarding workflow.
    • Supports AI-recommended configuration for authentication endpoints, account aggregation with data preview, pagination rules for large datasets, attribute mapping for accounts and entitlements, and identity-to-account correlation.
    • Enables detection of compatible REST and SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. public APIs for any target application, compressing multi-day Web Services configuration into hours.
    • Includes provisioning endpoint recommendations covering Get Object, Create Account, Account Update, and Add/Remove Entitlement.
    • Each AI recommendation is validated in-UI with a live data preview before the administrator accepts — no changes are applied without explicit approval.

    +1 more show less

    • Standard manual Web Services configuration flow remains available alongside the new wizard for teams requiring full control.

    6 details in Everything

69. New Capability: Access Model Metadata Adhoc Values (2026-07-27) Jul 27, 2026 · issue 035

    SailPoint ISC Access Model Metadata now supports free-form ad hoc values on roles, access profiles, and entitlements.

    └──▷ HOW TO FIND IT
    Configure an existing AMM attribute to accept free-form project names or application IDs sourced from a CMDBCMDBA Configuration Management Database: a repository that stores records of IT assets and the relationships between them, giving cyber tools a single authoritative source for infrastructure context., without maintaining a static list.
    📍In the ISC console, go to Admin → Access Model Metadata, open the target attribute, enable Allow Ad Hoc Values, and save. Then open any role, access profile, or entitlement and assign values directly in the metadata field.
    • Adds Allow Ad Hoc Values option when creating or editing a custom metadata attribute, enabling free-form values up to 100 characters per value — no pre-defined list required — on roles, access profiles, and entitlements.
    • Adds Allow Multivalued Assignment option on custom metadata attributes, permitting more than one value to be assigned to a single attribute (note: once enabled, cannot be undone).
    • Expands value capacity to up to 5,000 different values per custom attribute and up to 250 custom metadata attributes per access object type.
    • Enables search for roles, access profiles, and entitlements by ad hoc metadata attribute values.
    • Ad hoc values entered while Allow Ad Hoc Values is enabled are retained even if the option is later disabled.

    5 details in Everything

70. New Capability: US Region Deployment for SAAM (2026-07-27) Jul 27, 2026 · issue 031

    SailPoint SAAM now available in AWS US East (us-east-1), enabling US customers in-region data residency and full app discovery-to-governance workflows.

    └──▷ HOW TO FIND IT
    Set up the Browser Extension connector in ISC to surface US-region discovered apps with risk and exposure data on the Discovered Applications page.
    📍In ISC, go to Admin › Connections › Discovery Connectors → Select Create Connector → choose Browser Extension category → Continue → Configure → Start Connector Setup → Run Discover to populate Admin › Connections › Sources › Discovered Applications.
    Access the full Application Visibility portal via the App Switcher to connect an IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. and deploy the browser extension for app inventory and risk analytics.
    📍In ISC, select the SailPoint Solutions Center icon (App Switcher) → Application Visibility tile → Connect Identity Provider (Microsoft Entra ID, Okta, or Other IdP) → Deploy browser extension via MDM (Intune / Jamf / Workspace ONE).
    • Adds AWS US East (us-east-1) region hosting for SAAM, giving US customers in-region data residency and lower latency.
    • Enables the App Switcher Application Visibility portal in the US region for full SAAM configuration, discovery, risk & usage analytics, and privacy controls.
    • Supports Browser Extension (BE) connector in ISC for US-region customers, syncing SAAM discovery and risk data into ISC's Discovered Applications page with risk score, sensitivity, exposure, and credential/MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. signal columns.
    • Provides a direct discovery-to-governance path within ISC, enabling access reviews, certifications, and app onboarding without leaving the platform.

    4 details in Everything

71. Enhancement: Centered Navigation Bar for Enhanced User Experience (2026-07-24) Jul 24, 2026 · issue 025

    SailPoint ISC gets a centered navigation bar for admins, end users, and Data Access Security.

    • Moves the Admin tab and its megamenu to the top center of the screen for a symmetrical, at-a-glance view of all menu and submenu items.
    • Relocates the + Add/Create quick-access button to the center of the main menu bar, making it reachable from anywhere on the page.
    • Centers core navigation items (home icon, primary product tabs) in the header for end users to reduce eye and mouse fatigue.
    • Applies the same centered navigation layout to Data Access Security, creating a consistent visual experience when switching between ISC and DASDASDirect-Attached Storage: disks connected directly to a host machine rather than over a network, giving tools low-latency, high-throughput access to raw storage without SAN or NAS overhead..

    4 details in Everything

72. New Capability: Forms for Access Request (2026-07-24) Jul 24, 2026 · issue 025

    SailPoint ISC adds custom Forms for Access Request, collecting contextual data from requesters before submission.

    ⤢ ⤢
    • Enables admins to define custom forms and attach them to Roles, Access Profiles, or Entitlements, prompting requesters for supplementary data before submitting an access request.
    • Passes submitted form data to approvers as name-value pairs, giving decision-makers full context at approval time.
    • Makes form data accessible throughout the request flow, including before-provisioning rules, enabling custom provisioning logic driven by requester-supplied data.
    • Automatically copies form data across multiple form instances when a requester asks for several items that each require the same form.
    • Supports external access request portals (e.g., SailPoint ServiceNow Catalog Integration) by allowing supplementary form data to be passed into the request flow independent of the native UI.

    5 details in Everything

73. SaaS Release Notes - July 24, 2026 Jul 24, 2026 · release notes

    MySailPoint dashboards now include Shared Signals widgets; MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. supports OAuth 2.1OAuth 2.1A consolidated draft of the OAuth authorization framework that merges OAuth 2.0 with its most important security BCP updates, dropping unsafe flows so tools can delegate user access without handling credentials directly. with PKCEPKCEProof Key for Code Exchange, an OAuth safeguard that binds an authorization code to the client that requested it. An intercepted code cannot be redeemed without the client's matching verifier..

    └──▷ HOW TO FIND IT
    Monitor the health and activity of your Shared Signals Framework deployment directly from the MySailPoint dashboard.
    📍In the MySailPoint home page, add the Shared Signals Framework widget to a dashboard to view transmitter/receiver counts and event metrics.
    • Adds MySailPoint home page widgets for tracking Shared Signals Framework transmitters and receivers.
    • Adds OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..1 with PKCE support to the SailPoint MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server for Machine Identity Security Access Requests.

    2 details in Everything

74. Enhancement: Dark Mode Support Across SailPoint Agentic Fabric and Limited Support Across Identity Security Cloud (2026-07-22) Jul 22, 2026 · issue 037

    SailPoint adds Dark Mode across Agentic Fabric and select Identity Security Cloud pages.

    ⤢
    └──▷ BREAKING ON UPGRADE

    • !Custom branding colors will not be applied in Dark Mode — they continue to appear in Light Mode only.
75. New Product: SailPoint Agentic Fabric (2026-07-22) Jul 22, 2026 · issue 035

    SailPoint Agentic Fabric launches in Sandbox, delivering unified discovery, governance, and protection for AI agents and non-human identitiesnon-human identitiesA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. across 32+ frameworks.

    └──▷ HOW TO FIND IT
    Navigate to agent approval routing to configure who must approve activation or deactivation of AI agents before provisioning proceeds.
    📍In the ISC console, go to Global → System Settings → Approval Settings → Agent Requests and configure approval routing for agent provisioning operations.
    Review all machine accounts and NHIsNHIsA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. in one place to assess IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role exposure across your environment.
    📍In the ISC console, open the Agentic Fabric tab in the top navigation, then select Accounts from the left nav to view all machine accounts (IAM roles) and machine/application identities.
    • New Agentic Fabric tab in top navigation (MIS and AIS tenants) surfaces a dedicated governance workspace for AI agents and non-human identities (NHIs).
    • New Applications and Accounts left-nav items consolidate machine accounts (IAM roles) and machine/application identities into a single view.
    • Adds approval routing for agent provisioning (activation/deactivation) configurable under Global → System Settings → Approval Settings → Agent Requests.
    • Introduces a unified NHINHIA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. registry — a single registry for discovering and governing all AI agents and non-human identities across enterprise, endpoint, and browser surfaces.
    • Supports 32+ agent frameworks from day one across three surfaces: endpoint agents (Claude Code, Claude Desktop, Cursor, Cline, Windsurf, GitHub Copilot, OpenAI Codex, Gemini CLI, and others), enterprise agents (Amazon Bedrock, Amazon Bedrock AgentCore, Anthropic Claude Console, Databricks Mosaic AI, Google Vertex AI, Microsoft Copilot Studio, Microsoft Foundry, Salesforce Agentforce, ServiceNow AI Platform, Snowflake Cortex AI, N8N, WIZ, and custom agents via BYO schema/API), and browser agents (Zendesk, MS Office Copilot 365, Cursor, Dify, Claude, OpenAI).

    +8 more show less

    • Embeds an Identity Graph for visualizing relationships between agents, identities, and resources.
    • Adds endpoint and browser discovery capabilities to detect agents running on managed devices and in browsers.
    • Adds owner correlation and lifecycle controls for AI agents, with optional default owner mapping configurable in Datasets and Resources for automated ownership assignment.
    • Adds CLI threat detection and remediation capability for endpoint agents.
    • Adds prompt and response security monitoring for AI agents.
    • Adds agent audit and compliance reporting for audit-ready governance of AI agent activity.
    • Adds agent authorization controls as part of the Protect capability set.
    • AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. Roles / Datasets & Resources integration available via the AWS SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. connector, with automatic migration for existing MIS and AIS customers who already have AWS configured.

    13 details in Everything

76. Enhancement: Support for Stronger Integrations (2026-07-20) Jul 20, 2026 · issue 021

    SailPoint ISC admins must now specify an approved integration when creating API or Personal Access Tokens.

    • Requires admins to select an approved integration when creating API or Personal Access Tokens, enabling per-integration traffic visibility.
    • Introduces the Unified Platform Access Program, enabling deeper product integrations tied to specific tokens.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !When creating an API or Personal Access Token, admins must now specify the approved integration — existing token-creation workflows that do not supply an integration will require updating.
77. New Capability: Personal Access Token Management for Admins (2026-07-20) Jul 20, 2026 · issue 021

    SailPoint admins can now view, edit, and bulk-manage all Personal Access Tokens org-wide, plus a new Bulk update PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. expiration API.

    └──▷ HOW TO FIND IT
    Audit and revoke stale PATsPATsA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. across your org before they become a security risk — reach this without contacting individual users.
    📍In the Admin console, go to Admin → Security Settings → Personal Access Tokens to view all tokens in the environment, then select one or more tokens and edit their expiration dates in bulk.
    • New admin screen under Admin → Security Settings → Personal Access Tokens lets admins view and manage all PATs in the environment, not just their own.
    • Admins can edit individual PATs or modify multiple tokens at once using bulk operations.
    • Admins can change or remove expiration dates on any PAT across the organization.
    • New Bulk update PAT expiration API enables programmatic management of PAT expiration dates at scale.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Any Personal Access Token created before February 5, 2026 that has never had an expiration date added or removed will automatically be assigned an expiration date 6 months (180 days) from the release date (production rollout: 7/28/2026), which may break long-lived integrations relying on those tokens remaining non-expiring.
78. SaaS Release Notes - July 17, 2026 Jul 17, 2026 · release notes

    Identity Security Cloud adds Express Setup for Deep Governance connectors and auto-sync for Non-Employee Risk Management.

    • Adds Express Setup for configuring Deep Governance connectors in Identity Security Cloud, marked with an asterisk (*) on the connector list
    • Enables automatic synchronization for Non-Employee Risk Management user accounts and roles without scheduled aggregations
    • Expands Employee filter in SAP SuccessFactors connector to include inactive external users

    3 details in Everything

79. Closed Preview: Next-Generation Mainframe Connectors for RACF, ACF2, and Top Secret (2026-07-16) Jul 16, 2026 · issue 018

    SailPoint previews next-gen mainframe connectors for RACF, ACF2, and Top Secret that eliminate the Connector Gateway layer.

    • Introduces direct connectivity from SailPoint Identity Management products to the SailPoint agent on the mainframe, removing the requirement to deploy and maintain a Connector Gateway.
    • Adds new security and maintainability improvements to the RACF, ACF2, and Top Secret integrations on z/OS.
    • Includes migration tooling to help transition existing configurations and customizations from the legacy connector to the new architecture.

    3 details in Everything

80. Enhancement: Non-Employee Risk Management Users Connector - Automatic Synchronization (2026-07-14) Jul 14, 2026 · issue 015

    NERM Users connector gains real-time ISC sync toggle and UI-based role assignment for non-employee accounts.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Enable real-time ISC sync so that every NERM user or role change immediately triggers an aggregation in Identity Security Cloud, eliminating propagation delay.
    📍In the NERM Admin UI, go to Admin › System › Identity Security Cloud Connection Settings › USERS tab, set the Sync with Identity Security Cloud toggle to ON, confirm or enter the Source ID, then click Save.
    Assign a role to a non-employee user directly in the UI during implementation, without needing API access.
    📍In the NERM Admin UI, go to Admin › Lifecycle › User Roles, select the target user, and assign or unassign the desired role.
    • Adds a new Sync with Identity Security Cloud toggle in Admin > System > Identity Security Cloud Connection Settings > USERS tab, triggering immediate account or entitlement aggregation on any NERM user/role change instead of waiting for periodic aggregation.
    • Adds a Source ID field to the USERS tab, allowing NERM to auto-detect an existing NERM Users connector source or optionally create one automatically when the sync toggle is first enabled.
    • Enables NERM admins to assign and unassign roles directly to users from Admin > Lifecycle > User Roles in the Non-Employee Risk Management Admin UI, a capability previously limited to the API.

    3 details in Everything

81. SaaS Release Notes - July 10, 2026 Jul 10, 2026 · release notes

    SailPoint adds Databricks connector for Data Access Security and AI Privilege Discovery.

    • The Databricks connector for Data Access Security is available to customers, supporting structured data crawling, object-level permission analysis, and ingestion of Data Classification labels.
    • Identity Security Cloud introduces AI Privilege Discovery to identify high-risk entitlements and automatically present privilege level recommendations for review.
    • Separation of Duties (SoDSoDSeparation of Duties — an access-control principle requiring that no single user can complete a sensitive operation alone, reducing insider-threat and error risk by splitting authority across multiple roles.) now features a new UI for policy creation and violation viewing, allowing suites customers to apply controls with expiration duration to violations.

    3 details in Everything

82. Enhancement: SailPoint MCP Server Now Supports Global URL and OAuth — Connect Any AI Client in Minutes (2026-07-09) Jul 9, 2026 · issue 014

    SailPoint MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. adds a global tenant-agnostic URL and OAuth 2.1OAuth 2.1A consolidated draft of the OAuth authorization framework that merges OAuth 2.0 with its most important security BCP updates, dropping unsafe flows so tools can delegate user access without handling credentials directly./PKCEPKCEProof Key for Code Exchange, an OAuth safeguard that binds an authorization code to the client that requested it. An intercepted code cannot be redeemed without the client's matching verifier. auth, plus native Cursor IDE support.

    └──▷ USE IT
    Connect Cursor IDE to SailPoint ISC so an AI agent can handle access requests without manual token management.
    json copy

    // ~/.cursor/mcp.json
    {
      "mcpServers": {
        "sailpoint-access-requests": {
          "url": "https://mcp.api.cloud.sailpoint.com/latest/access-requests/mcp",
          "auth": {
            "CLIENT_ID": "your-client-id",
            "scopes": ["sp:scopes:all"]
          }
        }
      }
    }

    Create the required public OAuth API client in ISC before wiring up Cursor or Claude Desktop.
    📍In the ISC console, go to Admin › Security Settings › API Management › Create API Client: - Set client type to Public - Enable Authorization Code + Refresh Token grants - Set Redirect URL to: cursor://anysphere.cursor-mcp/oauth/callback - Set Scope to: sp:scopes:all Copy the resulting Client ID for use in mcp.json.
    • New global MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. endpoint (https://mcp.api.cloud.sailpoint.com/latest/access-requests/mcp) works for all non-FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. tenants — no per-org URL construction needed.
    • Replaces manual PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it./token workflow with OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..1 + PKCE: browser-based login, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. support, consent screen, and automatic token refresh for up to one month.
    • Adds native Cursor IDE support: configure the global URL and Client ID in ~/.cursor/mcp.json, and the full OAuth flow is handled automatically on connect.
    • AI assistants can now manage ISC access requests conversationally — search the access catalog, submit requests, check approval status, and cancel requests.

    4 details in Everything

83. New Capability: Data Access Security (DAS) for DataBricks (2026-07-09) Jul 9, 2026 · issue 014

    SailPoint DASDASDirect-Attached Storage: disks connected directly to a host machine rather than over a network, giving tools low-latency, high-throughput access to raw storage without SAN or NAS overhead. adds a Databricks connector for resource discovery, permission analysis, and data classification.

    ⤢ ⤢
    • New Databricks connector for Data Access Security (DAS) enables discovery of Databricks resources including Tables, Views, and Stored Procedures.
    • Supports permission analysis to detect over-permissioned accounts and limit entitlement sprawl across Databricks deployments.
    • Ingests data classification labels directly from Databricks (when enabled), surfacing classification forensics within the DAS platform (preview).
    • Unifies Databricks governance with existing SailPoint frameworks covering applications, infrastructure, and file storage systems.

    4 details in Everything

84. Expanding PAM application discovery: CyberArk Enhancement and New BeyondTrust & Delinea connectors (2026-07-09) Jul 9, 2026 · issue 014

    SailPoint adds BeyondTrust & Delinea PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. discovery connectors and upgrades CyberArk to instance-level application discovery.

    └──▷ HOW TO FIND IT
    Set up the new BeyondTrust Password Safe Cloud PAM Discovery connector to maintain a live inventory of managed systems in ISC.
    📍In the ISC console, go to Admin › Connections › Discovery Connectors › Create Connector › PAM category › Configure next to BeyondTrust Password Safe Cloud PAM. In Express Setup, enter your OAuth 2.0 client_id and client_secret from the Application user assigned to the group with Password Safe System Management (Read) permission, then click Test Connection and Discover (or set a recurring schedule under Additional Settings › Discovery Settings).
    Set up the new Delinea Secret Server PAM Discovery connector to catalogue secrets and their metadata in ISC.
    📍In the ISC console, go to Admin › Connections › Discovery Connectors › Create Connector › PAM category › Configure next to Delinea Secret Server PAM. In Express Setup, paste the Secret Server URL from Settings › Secret Server › Secret Server Connection as Host URL and enter the Service User username/password as Client ID/Client Secret, then click Test Connection and Discover.
    Validate the upgraded CyberArk connector returns instance-level results after granting Safe-level permissions to avoid a blank discovery run.
    📍In Privilege Cloud, go to Policies › Safes, open each relevant Safe › Members › Add Member, add the connector service user with Read-only + Access enabled permissions. Then in ISC, open the CyberArk Privilege Cloud Shared Services PAM connector and click Test Connection followed by a manual discovery aggregation before the next scheduled run.
    • Upgrades CyberArk Privilege Cloud Shared Services PAM Discovery connector to discover individual application instances (e.g., three MySQL instances as three distinct entries) rather than generic platform templates.
    • New BeyondTrust Password Safe Cloud PAM Discovery connector retrieves managed systems via the BeyondTrust public API using OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. client credentials, with support for continuous scheduled discovery.
    • New Delinea Secret Server PAM Discovery connector discovers secrets and associated metadata (names, IDs, template types, creation dates, active status) from Delinea Secret Server via OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0, mapping results into ISC-consumable datasets.
    • Breaking change for existing CyberArk Discovery customers: next discovery aggregation after the update will return instance-level applications instead of platform templates; new Safe-level read permissions must be configured on the CyberArk service user before the next scheduled run or discovery may return no results.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Existing CyberArk PAM Discovery connector users will see a different set of discovered applications after the update: instance-level applications are now discovered instead of platform-level templates, so previously discovered platform-level entries may no longer appear and new instance-level entries will be returned instead.
    • !If the required CyberArk service user permissions are not configured before the next discovery run (including the Privilege Cloud Users role and Read-only Safe membership for each relevant Safe), the CyberArk PAM Discovery connector may return no applications.
85. Enhancement: ServiceNow Service Catalog for Identity Security Cloud v5.3 Released (2026-07-09) Jul 9, 2026 · issue 014

    ServiceNow Service Catalog for ISC v5.3 adds Additional Owner approvals, questionnaire UX, and faster OAuth.

    • Supports Additional Owner approval type, expanding flexibility in organizational approval flow definitions.
    • Introduces Additional Info / Questionnaire capabilities for catalog item requests, streamlining the requester experience.
    • Reduces total OAuth calls to the Identity Security Cloud API, improving integration response times.

    3 details in Everything

86. New Capability: Privilege On Demand (2026-07-08) Jul 8, 2026 · issue 014

    SailPoint adds Privilege On Demand (JITJITA runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility.-P v1.0) to shift elevated access from standing to time-bounded, on-demand activation.

    └──▷ HOW TO FIND IT
    Configure JIT activation windows and mark entitlements as eligible so users can activate privileged access on demand rather than holding it standing.
    📍In the Admin console, go to Admin Settings › Privilege on Demand and set global JIT activation duration and extension duration. Then navigate to the target entitlement, enable Requestable, and configure JIT entitlement assignment with the desired approval behavior (auto-approve or approval-required).
    • Introduces Privilege On Demand (JIT-P v1.0): an activation-based model where eligible entitlements are requested, then explicitly activated for a bounded duration with automatic expiration — replacing always-on standing access.
    • Enables configurable global JIT activation and extension durations via Admin settings, giving IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. teams control over how long elevated access windows last.
    • Supports auto-approve or approval-required workflows for JIT entitlement activation, selectable per entitlement.
    • Delivers end-user JIT activation through Launchpad, allowing authorized users to self-activate approved access when work begins.
    • Adds five new email notification templates: Access Request Assignment, JIT Activation 15-Minute Reminder, Just-In-Time Activation Extended, Just-In-Time Activation Failed, Just-In-Time Activation Ready, and Just-In-Time Deactivated — providing full lifecycle visibility for activation events.

    +1 more show less

    • Produces clear activation and expiration audit events per entitlement, improving auditability of privileged access compared to standing access models.

    6 details in Everything

87. SaaS Release Notes - July 3, 2026 Jul 3, 2026 · release notes

    SailPoint adds Quick Compliance connectors (Tenable.io, Zylo, etc.), LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. SASLSASLA framework for plugging authentication mechanisms into network protocols, standardized by the IETF, so a tool can support password, Kerberos, or certificate login without rewriting auth logic per protocol. auth, PIMPIMProtocol Independent Multicast, an IETF routing protocol that distributes IP multicast traffic across networks without depending on a specific unicast routing protocol, letting tools monitor or manipulate multicast group traffic. Group support, and API filters

    • Adds Exotel, Grist, SafetyCulture, Tenable-io, and Zylo as Quick Compliance connectors for expedient read-only account and entitlement aggregation
    • Updates the List Accounts API to filter results by recommendation.type using eq, in, and isnull operators, with a new AGENT enum value
    • Adds SASL certificate-based authentication to the Generic LDAP and OpenLDAPOpenLDAPAn open-source implementation of the Lightweight Directory Access Protocol, maintained by the OpenLDAP Project, used to store and query structured identity data like users and groups over a network. connectors
    • Adds PIM Groups (azureADEligibleGroup and azureADActiveGroup) support to the Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. connector for aggregation and entitlement management
    • Enables setting a static field attribute to "lenient": "true" in Provisioning Policy APIs to support Apache Velocity default value syntax

    +1 more show less

    • Adds CC and BCC fields to the Workflows Send Email action

    6 details in Everything

88. New Capability: View Permission Paths Now Available for Campaign Reviewers (2026-07-02) Jul 2, 2026 · issue 014

    SailPoint DASDASDirect-Attached Storage: disks connected directly to a host machine rather than over a network, giving tools low-latency, high-throughput access to raw storage without SAN or NAS overhead. adds in-context Permission Path viewer for campaign reviewers, eliminating navigation away from the review screen.

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Review how a user obtained access to a sensitive resource without leaving the certification screen during a Permissions-type campaign.
    📍In the DAS console, go to My Tasks › Access Certification, select the desired Permissions-type campaign, locate the user row in the review table, and click the Permission Path icon in the Actions column to open the Permission Path overlay.
    • New View Permission Path action in the Actions column of the Campaign Review screen opens a pop-up showing the full permission path for a user's access, including whether access is actively used.
    • Supports visualization of multiple permission paths to a single resource within Permissions-type campaigns.
    • Permission Path icon is available for User permission rows and visible-but-disabled for Group permission rows, giving reviewers clear context on scope.

    3 details in Everything

89. Enhancement: Data Access Security Resource Selector Redesign (2026-07-02) Jul 2, 2026 · issue 014

    Data Access Security gets a redesigned Resource Selector with full-view modal and free-text search.

    ⤢
    └──▷ HOW TO FIND IT
    Use the new overlay to quickly locate a deeply nested cloud resource when building a Forensics permission filter.
    📍In the console, go to Forensics › Permissions, set Attribute to Resource and Operator to Any Of, then click the Value field — the new Browse and Select Resources overlay opens. Type a name or path in the search bar to jump directly to the target resource without expanding the folder tree manually.
    • Introduces a new Browse and Select Resources overlay in Data Access Security, replacing the previous compact resource picker with a full-view modal.
    • Adds free-text search bar (Search by name or path) to the Resource Selector, enabling instant navigation to resources without manually drilling through folder hierarchies.
    • New hierarchical tree view supports expanding and collapsing major integrations (AWS, Azure, Box, GDrive, OneDrive) and nested drive structures within the selector.

    3 details in Everything

90. Maintenance: HTTP/2 Enablement in Cloudflare (2026-06-30) Jun 30, 2026 · issue 014

    SailPoint ISC enables HTTP/2 via Cloudflare on Jul 27, 2026 — API response headers will shift to lowercase.

    • Enables HTTP/2 on all ISC environments via Cloudflare, delivering improved security and performance over HTTP/1.1.
    • Breaking change: HTTP/2 lowercases all response header keys (e.g., X-Total-Count becomes x-total-count) — scripts and API clients that match headers case-sensitively must be updated.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !HTTP/2 enablement in Cloudflare will cause response header keys to become lowercase (e.g., X-Total-Count becomes x-total-count), which may break API calls or scripts that expect case-sensitive header keys in responses from ISC
91. New Capability: Customizable DAS Insights on ISC Homepage (2026-06-29) Jun 29, 2026 · issue 014

    SailPoint ISC homepage gains Data Access Security widgets and a pre-built DASDASDirect-Attached Storage: disks connected directly to a host machine rather than over a network, giving tools low-latency, high-throughput access to raw storage without SAN or NAS overhead. dashboard template for unified identity + data risk visibility.

    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Quickly stand up a unified DAS monitoring view for your security team without manually assembling individual widgets.
    📍In the ISC console, go to MySailPoint Homepage › Dashboards › Dashboard Templates and select Data Access Security Dashboard to instantiate the pre-built template.
    • Adds a suite of Data Access Security (DAS) widgets to the MySailPoint homepage, enabling instant visibility into unstructured data access exposure and high-risk accounts with excessive permissions.
    • Introduces a pre-built Data Access Security Dashboard template that bundles all available DAS widgets for quick, one-click setup.
    • Enables drill-down from any DAS widget directly into Data Access Security forensics for deeper analysis of flagged metrics.

    3 details in Everything

92. Enhancement: Tablet Support for Certifications (2026-06-26) Jun 26, 2026 · issue 014

    SailPoint ISC adds dedicated tablet support for Certification Reviewers with smart device detection and landscape-mode prompting.

    ⤢ ⤢
    • Adds automatic tablet detection for Certification Reviewers, evaluating screen capabilities to determine if the reviewer UX can be displayed optimally.
    • Introduces landscape orientation prompting on tablets, guiding reviewers to rotate their devices for full visibility of access review tables and critical details.
    • Delivers an optimized Certification Reviewer UX in landscape mode, presenting a comprehensive view of access items to support informed decision-making on mobile devices.

    3 details in Everything

93. SaaS Release Notes - June 26, 2026 Jun 26, 2026 · release notes

    SailPoint adds Quick Compliance connectors, BeyondTrust/Delinea discovery, sampling for data classification, and workflow start dates

    └──▷ HOW TO FIND IT
    Configure a new Quick Compliance source (e.g., Logrhythm) for rapid read-only account aggregation via the platform UI.
    📍Go to SaaS Connectors, select Quick Compliance sources, and configure the Logrhythm connector settings.
    Enable sampling in Data Access Security to quickly map sensitive data landscapes without network overhead.
    📍Navigate to Compliance › Data Classification › Application Scope and configure the new sampling rate technology.
    Set a future effective date for an approved access request using the new workflow field.
    📍In the Workflows Manage Access action, select the Access Start Date field to define when the approved access takes effect.
    • Adds 13 new SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. connectors as Quick Compliance sources for read-only account and entitlement aggregation: 8x8 XCaaS, Appspace, Bytebase, Calibre, Crowdin, Exasol, Freshchat, Hexnode, iDeals, Incident.io, Logrhythm, Planview AgilePlace, SuperTokens.
    • Adds the BeyondTrust Cloud PAMPAMBrokering administrator sessions through a gateway instead of handing out standing credentials. Access is granted for one session, to one target, and recorded. Discovery SaaS connector for enterprise application discovery.
    • Adds the Delinea PAM Discovery connector to discover applications and metadata from the Delinea Platform.
    • Introduces sampling rate technology in Data Access Security > Data Classification to map data assets with minimal network impact.
    • Adds an Access Start Date field to the Workflows Manage Access action to defer granted access.

    +3 more show less

    • Adds a new Account Requests tab on the Approvals Administration page for centrally tracking and managing account creation/deletion approvals.
    • Enables Claude Enterprise connector aggregation of login activity metadata (last_login, last_login_method), archived managed agents, multiple workspaces, and Express Source Setup.
    • Enables excluding inherited appRoleAssignments during Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. account aggregation to aggregate only direct assignments.

    8 details in Everything

94. Announcement: Salesforce External Client App is now Available (2026-06-24) Jun 24, 2026 · issue 014

    SailPoint ISC Salesforce connector now supports External Client App (ECA) auth; legacy OAuth flows retire Sep 30, 2026.

    └──▷ HOW TO FIND IT
    Enable ECA authentication on an existing ISC Salesforce connector to maintain connectivity before the September 30, 2026 deadline.
    📍In the Identity Security Cloud UI, open the Salesforce connector › go to the ECA Authentication section › turn on Enable External Client App (ECA) › under Client Configuration, add key host_name with value login.salesforce.com (production) or test.salesforce.com (sandbox) › click Authorize and complete the OAuth 2.0 Authorization Code Grant flow › click Save › click Test Connection to verify.
    • Adds support for Salesforce External Client App (ECA) authentication as the new default and only supported auth method for the ISC Salesforce connector (VA and SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally.).
    • Supports OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. Authorization Code Grant flow exclusively, replacing JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. Bearer, Refresh Token, Client Credentials, and Basic Authentication.
    • New Enable External Client App (ECA) toggle and ECA Authentication section available in the Identity Security Cloud UI Salesforce connector configuration.
    • Breaking change: Basic Auth and all OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0 Connected App flows are permanently removed October 1, 2026 — connectors not migrated will lose all Salesforce connectivity.
    • Backward compatibility toggle available in the connector UI during the 90-day migration window (July 1–September 30, 2026) to temporarily revert to legacy auth if issues arise.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Basic Authentication, OAuth 2.0 JWT Bearer, OAuth 2.0 Refresh Token, and OAuth 2.0 Client Credentials are permanently removed from the ISC Salesforce connector (VA and SaaS) on October 1, 2026; connectors not migrated to External Client App (ECA) Authentication will lose Salesforce connectivity and all connector operations (provisioning, aggregation) will fail.
95. New Capability: Accelerated Data Discovery with Sampling Ratio (2026-06-24) Jun 24, 2026 · issue 014

    SailPoint Data Discovery adds configurable Sampling Ratio for faster, lighter sensitive-data classification scans.

    ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Quickly surface sensitive-data hot spots in a newly integrated application before committing to a full scan.
    📍In the console, go to Admin › Applications › Add New, complete the application setup, then on the Data Classification configuration screen set the Sampling Ratio to your desired percentage (default is 10%).
    Tune the sampling percentage on an existing application to balance discovery speed against scan coverage.
    📍In the console, go to Compliance › Data Classification › Application Scope, locate the application, click Edit, and adjust the Sampling Ratio sliding scale to the desired value.
    • New Sampling Ratio option for Data Classification scans lets you scan a configurable percentage of documents (default 10% for new apps) to rapidly identify sensitive-data hot spots without a full resource-intensive scan.
    • New applications are automatically onboarded with 10% sampling enabled by default, accelerating time-to-insight for sensitive data exposure.
    • Existing applications with Data Classification enabled retain 100% sampling by default to preserve consistency with prior behavior.
    • New Sampling Ratio sliding-scale control added to the Application Scope edit screen under Compliance > Data Classification > Application Scope.

    4 details in Everything

96. Enhancement: CIEM — Support for Cloud Resource Tags/Labels (2026-06-23) Jun 23, 2026 · issue 014

    SailPoint CIEM now surfaces AWS Tags, Azure Tags, and GCP Labels alongside cloud resource access data.

    └──▷ HOW TO FIND IT
    When you need to answer 'who has access to production-tagged cloud resources', use ISC Search to filter by tag key and value without leaving SailPoint CIEM.
    📍In ISC CIEM, go to Search and query by cloud resource tag key (e.g., Environment) and tag value (e.g., Production) to list all identities with effective access to matching resources.
    • Adds native AWS Tags, Azure Tags, and GCP Labels visibility directly within the CIEM effective access view, enabling practitioners to see which identities can access tag-scoped resources.
    • Enables ISC Search to query cloud resources by tag/label key and value, supporting ad-hoc access reviews such as 'who can access PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations.-tagged resources'.
    • Surfaces cloud resource tags and labels within CIEM AIC dashboards for reporting and governance validation across cloud environments.

    3 details in Everything

97. Enhancement: Identity Graph UI Updates (2026-06-19) Jun 19, 2026 · issue 014

    Identity Graph UI redesigned with clearer visual hierarchy, elevated Data Table, and consolidated controls rail.

    • Colocates help menus, documentation, and the legend into a unified location for faster access.
    • Makes the graph's root node more visually apparent, improving at-a-glance orientation.
    • Elevates the Data Table to a first-class UI citizen alongside the graph view.
    • Redesigns Explorer to function as a search history rather than a navigation panel.
    • Consolidates filtering, grouping, and other widgets into a single horizontal rail.

    +1 more show less

    • Updates Details panels for clearer presentation of identity and access information.

    6 details in Everything

98. SaaS Release Notes - June 19, 2026 Jun 19, 2026 · release notes

    SailPoint adds Shadow AI paste logging, Machine Identity account creation workflow, and Define Comparison operator to Workflows.

    └──▷ HOW TO FIND IT
    Monitor sensitive data pasting into GenAI apps by defining detection keywords.
    📍Configure Shadow AI Remediation in the Security Cloud console to define keywords and enable end-user guidance playbook
    Use the new operator to evaluate complex conditions without splitting logic across steps.
    📍In Workflows builder, select Define Comparison operator and choose Advanced JSON view to define criteria
    • Shadow AI Remediation logs paste events across GenAI web applications with keyword-based detection
    • New Quick Compliance connectors: Axway, Celonis, DataStax Astra DB, Detectify, Dremio, Fortanix DSM, Huawei Cloud, Mimecast Incydr, Reltio, SonarQube Cloud
    • Machine Identity Security enables account creation requests with subtype-specific forms and multistep approval processes for connected sources
    • Workflows Define Comparison operator allows combining multiple comparison criteria in Basic builder or Advanced JSON view

    4 details in Everything

99. Deprecation: Virtual Appliance network access - AWS URLs (2026-06-16) Jun 16, 2026 · issue 014

    Virtual Appliance traffic migrating to SailPoint-hosted URLs for SQS and ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure.; new hostnames to allowlist by June 29.

    └──▷ TRY IT
    Add the new SailPoint-hosted Docker/ECR endpoint to your firewall allowlist before the June 29 production rollout to ensure uninterrupted VA image updates.
    copy

    $ # Commercial environments — add to your outbound firewall allowlist:
    va-docker.secure-api.infra.identitynow.com
    
    # FedRAMP environments — add to your outbound firewall allowlist:
    va-docker.secure-api.saas.sailpointfedramp.com

    • Introduces SailPoint-hosted endpoints for Virtual Appliance message queue traffic, replacing direct regional Amazon SQS URLs (sqs.<region>.amazonaws.com).
    • Introduces SailPoint-hosted endpoints for VA container image updates, replacing direct Amazon ECR paths — new hostnames: va-docker.secure-api.infra.identitynow.com (Commercial) and va-docker.secure-api.saas.sailpointfedramp.com (FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one.).
    • Sandbox rollout of SailPoint-hosted URLs begins June 15; production rollout begins June 29, 2026.

    3 details in Everything

100. SaaS Release Notes - June 12, 2026 Jun 12, 2026 · release notes

     SailPoint adds Quick Compliance connectors (Enclave, Firebolt, Flowlu) and Harbor Pilot region/FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. expansion

     • Identity Security Cloud now supports Enclave, Firebolt, and Flowlu as Quick Compliance connectors for expedient read-only account and entitlement aggregation.
     • Harbor Pilot is now available in Amazon sa-east-1 and us-gov-west-1 regions.
     • Harbor Pilot has been approved for availability in FedRAMP environments.
     • Harbor Pilot now shows reasoning process by revealing responses word by word instead of as a block of text.
     • Access Risk Management now supports extracting SAP Security Audit Log data with the RSAU_CONFIG recording target of Record in Database.

     +5 more show less

     • Within Identity Graph, users can now switch between the graph and table view when viewing data.
     • Identity selector match criteria using GT, LT, GTE, and LTE operators now allow comparisons between mixed numeric types.
     • SailPoint SuccessFactors connectors updated to support multi-level nested OData account schema attributes for user and employee data.
     • Epic EMP connector adds disableRemoveBlockOnAccountEnable configuration parameter (default: false) to retain existing blocks when an account is enabled.
     • Epic EMP connector adds disableAddBlockOnAccountDisable configuration parameter (default: false) to not add blocks when an account is disabled.

     10 details in Everything

101. SaaS Release Notes - June 5, 2026 Jun 5, 2026 · release notes

     SailPoint adds Quick Compliance connectors, ServiceNow Parameter Storage integration, and custom user levels

     • Identity Security Cloud supports Quick Compliance for Cloudways Hosting, DeployHQ, Kentik, Mage AI, Mimecast, OnceHub, Linode, Reputation, Turso, and YugabyteDB connectors

     1 detail in Everything

102. SaaS Release Notes - May 29, 2026 May 29, 2026 · release notes

     SailPoint adds Quick Compliance connectors, the Serial Loop operator, and Microsoft Entra SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. connector support for Custom Security Attributes.

     • Identity Security Cloud now supports 8base, Calendly, Elasticsearch, Pulumi, and Scalr as Quick Compliance connectors for read-only account and entitlement aggregation
     • Workflows introduces the Serial Loop operator with While and For loop types (up to 1,000 iterations) for sequential execution of input list items
     • Microsoft Entra SaaS connector can now be configured for Activity Insights
     • Microsoft Entra SaaS connector now supports reading Custom Security Attributes (CSAs) for Service Principals, User-Assigned Managed Identities, and System-Assigned Managed Identities

     4 details in Everything

103. SaaS Release Notes - May 22, 2026 May 22, 2026 · release notes

     SailPoint adds Claude Enterprise connector, Quick Compliance sources, inline template variable selector, and custom user level entitlements

     └──▷ HOW TO FIND IT
     Quickly configure read-only connections to new sources like Discord for account aggregation without full connector setup.
     📍Go to Quick Compliance sources in Identity Security Cloud and select Discord from the list of supported connectors.
     View available template attributes when customizing email templates directly in the editor.
     📍Type '${' in the email template editor to open the inline variable selector.
     Enable a newly published custom user level as an access request entitlement.
     📍Publish a custom user level in Identity Security Cloud; the system automatically generates a corresponding entitlement that can be enabled for access requests.
     • Adds Codemagic, Discord, Gravitee, impact, LightSpeed, Scaleway, and SingleStore as new Quick Compliance connectors for expedited read-only account aggregation.
     • Adds a notifications icon and inbox to Identity Security Cloud.
     • Enables inline variable selector for email templates by typing ${ in the editor to view available template attributes.
     • Introduces the SailPoint Claude Enterprise connector with a beta API for importing Managed Agents.
     • Allows publishing custom user levels to generate corresponding entitlements that can be enabled for access requests when entitlement requests are enabled globally.

     +7 more show less

     • Adds support for sorting custom user level permissions by category or name in ascending/descending order.
     • Updates UI so the Identity Security Cloud navigation bar is always visible on specific configuration pages.
     • Moves the Resource Center icon to the top-right corner of the app as a lightbulb icon in MySailPoint.
     • Adds quick filters to the Aggregation Activity page.
     • Adds Microsoft Windows Server 2025 support for IQService.
     • Adds Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. Domain Services (AD DS) functional level 2025 support.
     • Updates Microsoft Entra SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. connector Machine Identity Schema with creator and last_modified_by attributes for Azure AI Foundry Agents.

     12 details in Everything

104. SaaS Release Notes - May 15, 2026 May 15, 2026 · release notes

     New Quick Compliance connectors, SAP GRCGRCGovernance, Risk, and Compliance — a framework for aligning IT controls with business policy, regulatory requirements, and risk management so organizations can audit and report on their posture systematically. 12 SPS31 support, and identity details utility for V2 templates.

     └──▷ TRY IT
     Retrieve identity details within a V2 template using the new utility functions.
     copy

     $ $__util.getIdentityDetailsByID($someIdentityId)

     • Adds Apollo, Google Classroom, Grafana, MediaSilo, MSP360, and Postman as Quick Compliance connectors
     • Adds automatic revocation configuration for SharePoint Online and OneDrive records in Data Access Security campaigns
     • Adds GRC 12 SPS31 support to the SAP GRC connector
     • Adds credential provider support to Deep Governance, Discovery, and Quick Compliance SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Connectors
     • Adds Automation Anywhere platform support to the RPA Connector

     +3 more show less

     • Adds workflow execution limit notifications with filtering capability
     • Enables custom approval fields display for Slack integrations
     • Adds $__util.getIdentityDetailsByID and $__util.getMultipleIdentitiesDetailsByID template utilities

     8 details in Everything