Enhanced User Interface

1. Enhanced User Interface

Feature Highlights

Modernized User Experience

A cleaner, more intuitive interface designed for ease of use.

Simplified Navigation

Faster access to features, pages, and key information.

Improved Productivity

Streamlined layouts help users complete tasks more efficiently.

Enhanced Accessibility

Better visibility, readability, and usability across the platform.

Personalized Experience

More flexibility to customize the interface to individual preferences.

Familiar Functionality

Core workflows and business processes remain unchanged.

Seamless Transition

Enjoy the benefits of a refreshed design without a learning curve.

---

User Access Reviews (UAR) Updates

1. “Revoke Immediately” Real-Time Access Deprovisioning

Feature Highlights

Campaign review screens now feature a dual-action revocation menu offering standard Revoke alongside a new Revoke Immediately capability at the entitlement level. When a reviewer confirms Revoke Immediately, SecurEnds instantly initiates an automated access removal request via the application’s configured fulfillment channel (direct connector, ticketing system, or email notification) without waiting for the campaign to conclude. Successfully processed immediate revokes are automatically locked as read-only and excluded from end-of-campaign batch deprovisioning routines to eliminate duplicate fulfillment tickets.

User Impact: Critical access risks, unauthorized privileges, and compromised accounts identified during reviews can be neutralized instantly. Reviewers no longer have to wait weeks for a certification cycle to close before high-risk access is revoked, dramatically shrinking exposure windows.

---

2. Manager Escalation & Reminder Notification Exclusions for Manual Reminders

Feature Highlights

Campaign notification settings now allow administrators to exclude specific managers and executives from receiving automated escalation emails and review reminders when their direct reports have overdue review items. This builds upon existing campaign launch exclusion lists to provide granular communication controls for escalation flows.

User Impact: Prevents executive inbox fatigue and unnecessary alert noise for senior leaders while allowing campaign administrators to maintain firm escalation tracking across operational management tiers.

---

3. Next Scheduled Launch Date on Campaign Scheduler List

Feature Highlights

The Campaign Scheduler dashboard now displays the Next Scheduled Launch Date as a primary column directly on the main scheduler view. Administrators no longer need to open individual campaign configuration settings to inspect upcoming execution dates.

User Impact: Eliminates administrative overhead and loading delays previously experienced when opening settings on large campaigns with extensive Active Directory group mappings, providing an immediate snapshot of upcoming certification cycles.

---

Access Requests & Lifecycle Management (AR / ILM)

1. Entitlement List View & Multi-Line Display in Manage Access

Feature Highlights

The entitlement selection interface in Manage Access and Access Templates has been updated to provide a toggle between the traditional Tile View and a structured List View. In List View, each entitlement is presented in a full-width row displaying its complete name with word-wrapping, description, entitlement type, and owner, alongside alphabetical (A–Z) sorting controls.

User Impact: Significantly enhances usability when selecting from applications with hundreds of similarly named or lengthy entitlements. Requesters can easily scan, sort, and select entitlements without truncation issues.

---

2. Manual Entitlement Creation

Feature Highlights

Application custodians and administrators can now manually add new entitlements directly from the Application → Entitlements interface. The feature includes strict duplicate validation (case-insensitive) and automatically detects if an entitlement exists in a purged state, giving admins the option to reactivate it immediately with full audit trail logging.

User Impact: Enables rapid onboarding of newly created roles or ad-hoc entitlements for immediate access requests without waiting for scheduled overnight imports or executing full application synchronizations.

---

3. Access Templates Updates

Feature Highlights

Configurable “Requestable” Flag on Access Templates

Access Template management now includes a configurable option: “Should this Access Template be requestable?” Setting this option to No conceals the template from the standard self-service Manage Access catalog while keeping it fully available for automated Birthright, Termination, and Scoping policies.

Introduction of “Select All Entitlements” Option

Added a single-click “Select All Entitlements” option with individual deselection support when configuring Access Templates, with selected items pinned to the top of the list.

---

4. Automated Approval Workflows for Birthright & Termination Policies

Feature Highlights

Provisioning policies for Birthright Access and Termination Rules now include a dedicated Approval Workflow configuration. Administrators can specify whether policy-triggered assignments require standard approval routing or should be set to No approval flow (Auto-Approved). Auto-approved requests are immediately processed for fulfilment and stamped with Auto Approved audit status in request tracking.

User Impact: Accelerates day-one onboarding and enforces rapid offboarding security by removing manual approval bottlenecks for pre-approved standard access bundles and mandatory termination deprovisioning.

---

5. Visibility Policy Standard Attribute Support

Feature Highlights

Policy condition engines now natively evaluate core user profile attributes stored in primary database columns (such as Employee ID, Employee Type, and Access Status) in addition to custom JSON attributes.

User Impact: Simplifies the administration of scoping and visibility rules, drastically reducing policy setup time while enabling precise role- and attribute-based catalog filtering.

---

6. Full Catalog Visibility for Administrator Logins

Feature Highlights

When an administrator accesses the Manage Access module to submit requests on behalf of users, SecurEnds bypasses end-user scoping and visibility policy restrictions, displaying all configured applications and templates.

User Impact: Ensures system administrators have unrestricted oversight and the operational flexibility to provision any necessary application or entitlement across the organization without encountering artificial policy barriers.

---

7. Active Directory OU Selection & Default Provisioning Password

Feature Highlights

When configuring an Active Directory application with Access Requests enabled, a new OU Configuration section allows administrators to specify the default target Organizational Unit (OU) from a dropdown of available OUs and define an initial default account password for user provisioning.

User Impact: Streamlines automated AD account creation during access fulfillment, ensuring newly provisioned Active Directory accounts are created in the proper organizational structure with compliant temporary passwords.

---

8. Custom Application Branding for SFTP & Active Directory

Feature Highlights

Administrators can now upload custom logos and icon images when configuring SFTP and Active Directory applications, bringing parity with CSV and SaaS application branding options.

User Impact: Enhances user experience and visual recognition across the Manage Access self-service catalog, helping employees quickly identify corporate systems during access requests.

---

Connectors & Enterprise Integrations

1. AWS Connector Modern Authentication via IAM Roles

Feature Highlights

The AWS Connector has been upgraded to support authentication via AWS IAM Roles (AssumeRole) alongside traditional IAM user credentials.

---

2. Salesforce Connector Support for External Client Apps (ECAs)

Feature Highlights

The Salesforce Connector has been updated to integrate via Salesforce External Client Apps (ECAs) using OAuth 2.0 flows, aligning with Salesforce’s modern integration framework and phasing out legacy username-password authentication.

---

3. Lightweight Slack Messaging Integration

Feature Highlights

The Slack integration has been streamlined to focus exclusively on 1-on-1 direct user notifications. Legacy code dependencies for public channel broadcasting have been removed, drastically reducing the OAuth permissions and bot token scopes requested from workspace administrators.

---

System Administration, Audit & Compliance

1. Automated Notification for Terminated Employee Application Credentials

Feature Highlights

A new automated security notification has been introduced. When an SOR sync flags an identity as Terminated, SecurEnds automatically compiles all associated application accounts that still show Active status for the terminated identity, across target systems, and emails a CSV report (Active_Accounts_with_HR_Status_Terminated.csv) to administrators. Refer to configuration IS_EMAIL_TERMINATED_APP_CREDENTIAL_NOTIFICATION.

---

2. Dedicated Ticketing System Logs & Separated IGA Auditing

Feature Highlights

Under Admin Console → Logs, a dedicated Ticketing System category has been established, cleanly separating logs into Campaigns and Access Requests (IGA). Access Request logs capture Request ID, Application Name, Action, Status, Log Message, and Timestamp for every ticket interaction.

---

3. Auditor Role Access to Export Downloads

Feature Highlights

Users assigned the Auditor role have been granted direct access to the Admin Console → Export Downloads menu to view and download asynchronous reporting exports they initiate.

---

4. Mappings for Inactive Definitions

Feature Highlights

The “SOR Fields Mapping” interface has been redesigned as Mappings for Inactive Definitions, with updated instructional tooltips clarifying how application status values map to Inactive/Terminated definitions.

---

5. Updates on Jira Ticketing System

Feature Highlights

Inline Jira Ticketing Settings

The Jira ticket label setting (JIRA_TICKET_LABEL) has been moved directly inside the Jira Ticketing Setup wizard, and the Manage Assign Details button has been promoted to a primary action on the Ticketing dashboard.

Jira Project Key for IGA

There is a new optional field, jira.IGA.projectKey, under Admin Console → Configuration → Ticketing System setup. Admins can use it to pick a dedicated Jira project for Access Request (IGA) tickets.

---

Non-Human Identity (NHI) & AI Agent Governance

1. Azure AI Agents Connector for AI Foundry & Copilot Studio

Feature Highlights

SecurEnds introduces a specialized Azure AI Agents connector enabling organizations to centralize the discovery, governance, and auditing of AI agents deployed across both Azure AI Foundry and Microsoft Copilot Studio. The connector normalizes agent configurations into a standardized governance model, ingesting critical resource hierarchies, agent descriptions, publishing statuses, assigned tool definitions, knowledge sources, and external connection metadata.

User Impact: Security and Identity teams can close the visibility gap surrounding autonomous AI agents and Non-Human Identities (NHIs). Administrators gain comprehensive visibility into all deployed enterprise agents from a centralized dashboard, ensuring corporate compliance and governance standards are maintained across modern AI deployments.

---

2. Azure AI Foundry & Microsoft Copilot Studio Access Reviews

Feature Highlights

Access review campaigns now fully support AI agents discovered from Azure AI Foundry and Microsoft Copilot Studio. SecurEnds maps agent access permissions into structured entitlements (Agent Name / Role, such as HR Assistant / Consumer or Policy Bot / Editor) and identifies whether permissions are granted directly to a user or inherited via Microsoft Entra ID security groups. Reviewers can inspect assignment scopes (Agent-level, Project-level, or Environment-level) and agent capability context directly within the review interface.

User Impact: Reviewers are empowered with actionable context to evaluate AI agent access without needing administrative console access to Azure or Power Platform. This mitigates over-permissioned agent access, ensures clear least-privilege enforcement, and simplifies audit proof generation for enterprise AI tools.

---

3. Self-Service Access Requests for AI Agents

Feature Highlights

The Manage Access catalog has been expanded with a dedicated AI Agents category card. When the AI Agents module is enabled for a tenant, end users and managers can browse approved Azure AI and AWS AI agent applications, select required roles or access tiers, and submit self-service access requests following standard organizational approval and provisioning workflows.

User Impact: Employees can request necessary AI agent tooling through the familiar SecurEnds self-service portal, eliminating manual ticketing delays and shadow-IT provisioning while ensuring every access grant is tracked and authorized.

---

4. Interactive Visual Mindmaps for Applications, Entitlements & Templates

Feature Highlights

Visual Mindmap views have been upgraded across Applications, Entitlements, and Access Templates to align with the interactive graph visualization introduced for AI Agents. Users can interactively navigate relationships between identities, roles, parent-child groups, and assigned applications within an intuitive, graphical node layout.

User Impact: Administrators and compliance managers can quickly understand complex, multi-tiered entitlement structures and inheritance paths at a glance, significantly reducing the time required to diagnose permission sprawl or audit access architectures.

---

The post Q3 2026 Version 2.381 (09/10/2026) appeared first on SecurEnds.

IGA Enhancements & Fixes

Upcoming Feature

UAR Enhancements & Fixes

1. Updates in Campaigns

Auto-Revoke Pending Reviews at Campaign Close

A new configurable option allows administrators to automatically revoke all pending reviews when a campaign closes (manually or at the end date) and there are any pending reviews. This can be enabled during campaign launch and edited while the campaign is open. The revoking admin is captured as the “Actual Reviewer” for audit purposes.

Prevent Emails on Failed Campaign Creation

Campaign notification emails are now sent only after a campaign has been created successfully. If creation fails, no emails are triggered — preventing confusion for reviewers.

“On Sync” Option for Scheduled Exports

A new “On Sync” frequency option has been added to Application/SOR schedule exports. When selected, exports are automatically triggered after each successful sync completes.

Manager Review – Escalation to Application Manager

Escalation emails can now be sent to Application Managers (Risk Managers) when reviewers have pending items in a Manager Review campaign. Administrators can enable this feature by selecting Send Escalation Email to Application Manager in the campaign reminder settings. If multiple pending users share the same Application Manager, they receive a single consolidated email.

2. Notifications

Sync Completion Email

A new configurable email notification is sent to administrators when an application or SOR sync completes successfully. The email includes sync summary details (uploaded, skipped, and total records) and a credential breakdown (matched, unmatched, service accounts, excluded, deleted, purged). Enable this under the Notifications section on the Application/SOR page.

Data Transformation – File Upload Notifications

The platform now sends automated email notifications during the Data Transformation workflow.

When a file is uploaded for transformation, our support team is immediately notified.

Once the transformed file is uploaded back, the original uploader receives an email confirming the file is ready, along with a direct link to access it.

3. Connector Updates

Snowflake — Key Pair Authentication

The Snowflake connector now supports key pair authentication, replacing the legacy username/password method ahead of Snowflake’s planned deprecation of password-based authentication.

Cloud Storage — SharePoint Support

SharePoint has been added as a new option in the Cloud Storage connector, alongside AWS and Box.

Industry-Based Connector Filtering

Administrators can filter available connectors by categories such as Cloud Platform, Database, Human Capital Management, and Identity and Access Management, making it easier to locate the appropriate connector.

UltiPro — Email as Credential for SOR

The UltiPro connector now uses the email address as the credential when configured as an SOR endpoint, with improved handling of duplicate records and manager mapping.

Confluence — Account Type Filter

The Confluence connector now filters out non-human accounts (bot and system-level accounts) during sync, consistent with the Jira connector behaviour.

Salesforce — Complete Permission List

The Salesforce connector now retrieves the complete list of permissions available within the connected Salesforce environment during synchronization. This provides more complete entitlement visibility for access reviews, analysis, and governance.

IGA Enhancements & Fixes

1. Ticketing Integration

Freshservice for IGA

Freshservice ticketing support has been extended to the IGA (provisioning) module, allowing Freshservice tickets to be created for access request provisioning workflows — in addition to the existing UAR/Campaign support.

2. Access Template Enhancements

Access Template Analysis

A new “Access Template Analysis” option is now available under Intelligence → Access Analysis.

Select an Access Template and apply attribute filters to see which users have complete access versus incomplete access relative to the template. Users with missing applications or entitlements are highlighted, and full export support is included.

Entitlement Visibility in Request Screens

Access Template request details now display the specific entitlements selected under each application.

This information is available across All Requests, My Requests, and related request-detail screens, providing approvers, administrators, and auditors with greater visibility into the access included in each request.

3. Manage Access / Access Requests

Service Account Requests

A new “Service Account” tile has been added to the Manage Access screen, allowing users to search for and raise access requests for service account credentials. Requests follow the same approval and provisioning workflow as user requests.

Default Approver at Application Level

You can now assign an “Application Default Approver” at the application level. If a user’s manager is unavailable, requests automatically route to this approver before falling back to the Global Default Approver.

Entitlement Sorting in Manage Access

Entitlements are now displayed in alphabetical order by default, with a dropdown to toggle between A–Z and Z–A sorting. Already-assigned entitlements appear first.

Delegation Audit Trail & Export

A full audit trail is now available for access request delegations, tracking all add, delete, and update actions with timestamps. Both the delegation list and audit trail support CSV export.

Auto-Remove Custodians on Application Disable

When an application is disabled, all entitlement custodian and application custodian assignments are now automatically removed, preventing orphaned assignments. A warning message is displayed in a Popup.

Upcoming Feature

1. NHI-AI Agents

Non-Human Identity:  

AI Agent Access Discovery & Reviews (Azure & AWS) 

What’s New: 

• You can now discover and govern User → AI Agent access relationships from Microsoft Azure AI Foundry and AWS directly within the platform. 

Key Capabilities: 

• New “AI Agents” connector category — Two new connectors (“Azure AI Agents” and “AWS AI Agents”) are available on the Applications page

Automated discovery of: 

• AI Agents available in your Azure AI Foundry / AWS environments 

• Users who have access to those agents 

• Permissions and roles granted to users on each agent 

• Project/workspace context associated with each agent

Access Reviews — Discovered user-to-agent access can be included in UAR campaigns for periodic review and certification 

Why It Matters: 
As organizations adopt AI agents across cloud platforms, governing who can access these non-human identities is critical for security and compliance. This feature extends your existing access review capabilities to cover AI agent access alongside traditional application entitlements. 

2. AI Agent Mind Map

            This mind map provides an overview of: 

• The AI Agents available to users based on their access permissions. 

• The entitlements each AI Agent can access. 

• The relationship between users, AI Agents, and entitlements to help understand access and authorization controls. 

Use this diagram as a quick reference to identify which AI Agents users can interact with and the capabilities available to each agent. 

The post Q2 2026 Version 2.380 (07/10/2026) appeared first on SecurEnds.

UAR Enhancements & Fixes

IGA Enhancements

Access Template Based Reviews

The Problem
Traditional access review campaigns often require reviewers to evaluate access at the individual user and entitlement level. This approach can be time-consuming, difficult to interpret, and misaligned with how organizations actually design and manage access-through roles and expected access patterns. As a result, reviewers may face high manual review burden, miss access misalignments, or struggle to identify access exceptions, increasing audit risk.

The Solution
SecurEnds now supports Access Template-Based Campaigns for User Access Reviews, enabling organizations to conduct role-based access reviews using approved access templates instead of reviewing access at just the user and entitlement level.
This creates a more structured review model that aligns users, entitlements, and expected access by role.

This release includes three key capabilities:

1.Composition Reviews allow template owners to review the entitlements that define each access template, helping ensure each role remains accurate, complete, and aligned with policy.

2.Membership Reviews allow reviewers to validate which users are assigned to each access template, making role-based access reviews faster, more intuitive, and easier to complete.

3.Outlier Reviews identify additional entitlements assigned outside the approved template baseline, helping teams quickly detect exceptions, reduce excess access, and reinforce role integrity.

Together, these capabilities standardize role-based access reviews, reduce manual review burden, improve audit readiness, and strengthen access governance.

To use Access Template-Based Campaigns, IC must enable this capability. Please reach out to your IC.

UAR Enhancements & Fixes

1. Updates in Campaigns

Dynamic Entitlement Columns in Reviews & Reports:
Campaign reviews and reports now support dynamic, multi-attribute entitlement columns (e.g., application, account, path/group), giving reviewers clearer visibility into what they are certifying. Usability has also been improved with enhanced filtering and sorting, preserved selections during navigation, and new sort options like Entitlement and Last Login-helping reviewers work faster and focus on higher-risk or stale access.

Unmatched / Orphaned Accounts in Campaigns:
Campaigns can now optionally include unmatched application accounts (orphaned credentials not tied to a known identity) in the review scope. This gives organizations greater visibility into stray or legacy accounts and helps reduce risk by ensuring these accounts are either properly associated or removed.

2. Updates in Connectors:

. Oracle Connector: Clearer Entitlement Details for Tables and Roles;Updated the Oracle connector to make application entitlements easier to understand. Table entitlements now show the permission, table owner, and whether it’s grantable, and role entitlements now list the role’s permissions in the entitlement description.

.Configurable Jack Henry Template Ingestion:
Added configuration to control how deep Jack Henry template-level data is ingested, and ensured missing/blank entitlements are included

.Improved AWS IAM Identity Center Group Descriptions
For the AWS IAM Identity Center connector, when a group description is missing or empty, the system now automatically uses the associated Permission Set description as a fallback, ensuring more complete and informative entitlement details.

3.Updates in Access Template

.Create Access Templates from Access Analysis
Users can now create Access Templates for user access reviews through Access Analysis screen. Selected applications and entitlements are automatically populated into the template and can be reviewed and edited as needed, streamlining template creation and improving efficiency.

.Improved Access Template Update & Approval Workflow:
When Access Templates are changed, updates now follow a more controlled approval workflow. Admins can submit changes for approval to template owners, who can then approve or reject the requests. Once approved, updates are applied consistently, and users’ access can be updated automatically based on the new template definition. This improves governance, reduces manual follow-up, and provides a clear audit trail of who approved which changes.

4.Updates in Ticketing System:

.Improved Ticket Status Synchronization for Campaigns:
Ticket status updates from connected ticketing systems are now synchronized on a scheduled basis, with manual refresh still available. Reviewers and administrators can see uptodate fulfilment status directly in campaign reports without having to switch tools, improving visibility into whether approved changes have been completed.

.Multiple Slack Workspace Support for Notifications:
Organizations can now configure multiple Slack workspaces; notifications (launch/reminders/escalations) are sent based on active workspaces.

IGA Enhancements

1.Form Management

Forms continue to be central to standardizing access related requests. In this release, we have enhanced the visualization of form based requests (for example, nonemployee and service account forms) by adding a mind map view that shows the request flow and status. This helps requesters and approvers quickly understand where a request is in the process and which steps are pending.

2.Updates in Provisioning Policy:

SOR-driven identity changes (such as department or title updates) are now more clearly detected and reliably drive downstream access controls, strengthening joiner/mover/leaver processes. Admins can also configure which identity attributes are used for access analysis and control, improving performance and ensuring insights and HRdriven changes focus only on the attributes that matter most.

3. Enhanced SOD Reporting with Violated Entitlements:

SOD reports now include a Violated Entitlements column across the UI and exports (PDF/CSV), clearly showing which entitlement(s) triggered each violation.

The post Q1 2026 Version 2.379 (05/08/2026) appeared first on SecurEnds.

IGA Enhancements

1. Updates in Campaigns

PDF Export for Audit Trails: Audit Trails can now be exported in PDF format, in addition to the previously available CSV format. PDF provides a clean, structured layout that is easier to review compared to raw CSV data.

2.Updates in Connectors

UltiPro Connector: Inclusion of an option to add Additional Columns This will allow users to select attributes like department, location, etc.

Servicenow Connector: Inclusion of an option to configure whether Group or Role or Both should be used as the entitlement.

Github: Inclusion of an option to use the following as entitlement type.

• Teams
• Teams & Roles
• Teams, Roles & Repositories
• Teams, Roles, Repositories & Permission Sets

3. Updates in Ticketing System

Freshservice: Freshservice can now be used as the ticketing system for access reviews. After adding the application details and selecting the ticketing system, you will see Freshservice available as an option.

4. Access Analysis Updates

Employee HR Status: Access Analysis with built-in Role Mining provides deep visibility into how access is distributed across your environment. Additionally, Employee HR Status has been added as a default attribute in Access Analysis, enabling users to verify whether a credential is active according to the SOR.

5. Bug Fixes & Improvements

• Optimized Application Loading:
  Resolved issues causing blank screens and slow loading on login or SSO due to large JavaScript bundles and caching problems. Implemented bundle splitting, lazy loading, and caching enhancements for faster performance.

IGA Enhancements:

1. Form Management

Forms are structured, customizable interfaces used to collect standardized information for initiating processes like access requests, approvals, and provisioning. This will help in standardizing and streamlining data collection for access requests. These forms can be designed and configured by the organization’s Admin to suit their specific needs and policies.

• Types of Forms

Non-Employee Forms: These forms are used to request access for individuals who need system access but are not regular employees of the organisation. This can include contractors, vendors, consultants, interns, or any third parties.

Service Account Forms: These forms are used to request access to service accounts-special system or application accounts that are not tied to a human user but are used by software processes, automated tasks, or services to perform specific functions.

2. Updates in Provisioning Policy

• System Change Tracking: After each SOR sync, the system now tracks changes in employee attributes and sends an email to the manager summarizing the updates.

Example: Department changed from IT to Sales, or Title changed from Lead Analyst to  XYZ.

• Enhanced Field Type Support: Previously, provisioning policies for both Birthright and Termination supported only the String field type. Now, additional field types—Integer, Boolean, and Date—are supported.

3. Updates in Access Template

• Time-Bound Fields with Justification in Access Templates:
  Access request templates will now include time-bound fields along with a justification section, similar to the existing time-bound functionality for entitlements.

This feature improves governance by ensuring temporary access is automatically revoked after the specified duration, supports compliance by capturing the reason for access for audits and certifications, and reduces risk by preventing unnecessary long-term access through enforced expiry dates.

The post Q4 2025 Version 2.378 (01/13/2026) appeared first on SecurEnds.

Campaign Scheduler

Campaign Scheduler

The Campaign Scheduler helps in planning your campaigns ahead of time by selecting the desired launch date. This ensures timely execution without manual intervention.

Once scheduled, the system automatically generates and launches the campaign at the specified date.

Add a new Employee Type when using the Identities–> Add action

We will be able to add a new Employee type in Identities while adding a new user

Manage Access

Manage Access is a centralized self-service portal designed for submitting and managing access requests. It allows users to request access to multiple applications and access templates —either for themselves or on behalf of others—all from a single, convenient interface.

My Requests

This is a read-only screen and is available to all users.

This section lists access requests that you have submitted, as well as those submitted by others on your behalf. You can view either pending requests or all requests by selecting the appropriate ‘Status’ filter.

All Requests

This is accessible to admin users only.

An admin can see all access requests submitted across the system. In addition, the admin could delegate any pending request to another approver.

Access Request details

My Approvals

This view is available to all users.

Users can only see the requests that require their approval. By default, the view shows requests with the ‘Pending Approval’ status, but you can use the ‘Status’ filter to view all approval requests.

Access Template

An access template allows you to combine multiple applications and entitlements (permissions) into a single template. This template can then be used to raise a request, instead of requesting access to each application individually. This is especially useful for recurring or role-based access needs.

Policy Templates (Visibility Policy/Scoping Policy)

Policy templates define how access templates, applications, and entitlements are displayed and how users are scoped for access request operations. These policies ensure that visibility and user selection are governed by ownership and organizational hierarchy, maintaining security and relevance in access management.

Visibility Policy

Visibility policy determines which Access Templates, Applications and Entitlements each user can view and request

Scoping Policy

Scoping Policy controls each individual’s privilege to search & copy other users for Access Request purposes.

Provisioning Policy

Provisioning Policies define automated access rules for onboarding (Birthright) and offboarding (Termination) scenarios. These policies streamline access provisioning and de-provisioning based on predefined conditions, ensuring consistency and compliance across the organization.

Delegation

Global Delegation

Delegation will simply allow another user to view and perform the approval flow on behalf of the original reviewer. If enabled, both parties will receive an email that there has been a delegation.

Request Level Delegation

Request Level Delegation helps to delegate each request to the new approver. Delegation can be performed by approver or admin.

Request Mindmap

Request Mindmap Layout gives the request centric view across users and applications. Here you can view an individual request and see all relevant user/applications/Access Templates/entitlements/ approval flow/approvers associated in an easy-to-read format.

Access Template Mindmap

This mindmap displays all the users/applications and entitlements associated with template.

The post Q3 2025 Version 2.377 (09/19/2025) – IGA 1.0 appeared first on SecurEnds.

Access Analysis

Access Analysis

Access Analysis with built-in Role Mining is a new capability that gives you deep visibility into how access is distributed across your environment. It scans your entire user population and analyzes entitlements to identify common access patterns, enabling you to detect anomalies, reduce over-provisioning, and lay the groundwork for scalable role-based access control (RBAC). 

What It Does: 

• Automatically clusters users with similar access to suggest baseline roles
• Detects outlier access that may indicate risk or misalignment
• Provides insights into high-risk entitlements and unused permissions
• Surfaces hidden trends across departments, teams, or functions

Available now to all User Access Review (UAR) customers as part of our IGA platform expansion. It will serve as the foundation for upcoming features like Access Templates, which allow users to request access aligned with mined roles 

SFTP Connectors – Now have Box/ Cloud/ Flexfolder options

Our SFTP-based connectors for Fiserv, Fiserv Director, Fiserv Integrated Teller, Jack Henry, Global Funds Exchange, Symitar, Concur, and Lawson have been enhanced to support multiple file ingestion sources. In addition to traditional SFTP, you can now ingest data directly from AWS S3 buckets, Box, Flex Folder, or use a manual upload option. This added flexibility simplifies integration across diverse IT environments, and accelerates onboarding by accommodating both automated and manual data flows.

ManageEngine ServiceDesk On-prem ticketing implementation

SecurEnds now supports ticket creation through the on-premise version of ServiceDesk, expanding integration options for organizations with locally hosted ITSM systems. 

To configure Servicedesk, navigate to Configuration->Ticketing System for Access Review. Select “Set Up”.  Select “Servicedesk” in Ticketing System dropdown and “On Premise” in Instance Type dropdown and then enter connection details.  

Campaign Messaging – Exclude reviewers from Launch Campaign message

During campaign launch, notifications can now be sent via email or messaging platforms such as Microsoft Teams and Slack. Previously, the option to exclude specific users from notifications was available only for email. With this update, exclusion controls are now extended to messaging notifications as well, giving administrators more flexibility in tailoring communication and ensuring only the intended recipients are notified, regardless of the delivery channel. 

Mandating an election note when moving from Revoke to Approve in Campaign

During a campaign, reviewers often revoke access, add a justification note, and save their decision. If the decision is later changed from Revoke to Approve, the original revocation note remains attached and cannot be removed. To address this, SecurEnds now allows administrators to configure a rule that mandates a new election note whenever a reviewer changes an access decision from Revoke to Approve. This ensures a clear, auditable explanation is captured for all decision reversals, improving transparency and reducing ambiguity in review data. 

To set this configuration, go to Administration > Configuration > Campaigns > Configurations and search as in below screen shot.  

Nested Entitlements support for Azure AD

Nested entitlements can be now pulled into campaigns for Azure applications. To bring in nested data, while configuring Azure application in securends, just flip a config switch and the next data sync will bring in the nested data from Azure. Earlier this feature was only available for on-premises AD.  

New Dashboard and Menu improvements

The dashboard has been refreshed with a modernized stylesheet, delivering a cleaner, more streamlined user experience. The left-hand menu has been redesigned for a sleeker look, featuring updated menu names and a reorganized layout for improved navigation. 

The post Q2 2025 Version 2.376 (28/07/2025) appeared first on SecurEnds.

Transformation Services – Allow clients to send SecurEnds a CSV file for application setup

Transformation Services – Allow clients to send SecurEnds a CSV file for application setup

SecurEnds Transformation Services allows customers with a service contract or managed services to streamline onboarding by sending a CSV file for application setup. SecurEnds handles the data transformation and mapping, ensuring CSV data is correctly formatted and imported into the platform. This service accelerates deployment, reduces manual setup effort, and ensures a seamless and accurate integration of application data.

FloQast – New Connector

SecurEnds now offers a seamless integration with the FloQast accounting platform through an out-of-the-box connector. This feature enables automated ingestion of user and entitlement data from FloQast to perform User Access Reviews (UARs) efficiently. To activate the integration, an API key is generated within the FloQast application and configured in SecurEnds, ensuring secure and continuous data synchronization for improved compliance and access governance.

Workday Enhancement – ability to include entitlements/roles

The SecurEnds Workday connector now supports parsing entitlements and roles when the customer’s customized Workday report includes entitlements grouped under the security_groups header. This enhancement allows organizations to ingest and review entitlements directly from Workday, enabling more granular access governance and improving the completeness of User Access Reviews (UARs) for Workday-connected applications. 

UAR: Bulk Upload of Delegation

The Bulk Delegation Upload feature allows customers to import delegation data files to update global people delegation settings in bulk, eliminating the need to create delegation records manually. This is especially useful for organizations that maintain delegation information within their HR system and can easily export it as a file. This enhancement streamlines delegation management, saving time and ensuring consistency across the User Access Review (UAR) process

Campaign Delegation – Audit Ready Notes

This enhancement allows admins to provide a reason note when delegating a campaign to another reviewer. The reason is captured directly within SecurEnds and made available in audit reports, ensuring full transparency. This eliminates the need to maintain separate documentation and helps auditors easily track and verify the rationale behind delegation decisions. 

The post Q1 2025 Version 2.375 (05/01/2025) appeared first on SecurEnds.

Bulk Reviewer Management at Campaign Level

Bulk Reviewer Management at Campaign Level

A new Bulk Update Reviewer option has been added to the campaign page, allowing administrators to efficiently manage and delegate reviewer responsibilities at scale. This enhancement significantly reduces the time required to update multiple reviewers, streamlines reviewer management, and minimizes the risk of oversight. Additionally, the Update Manager Notification now includes details of delegated users, entitlements, and applications, enhancing transparency and ensuring all stakeholders remain informed throughout the delegation process. This feature saves valuable administrative time by enabling mass updates, reducing manual effort, and ensuring that no critical tasks are missed due to oversight.

Credential Visibility Control at Campaign Level

The credential hiding configuration, previously applied globally, can now be set at the campaign level. This allows administrators to selectively exclude single credentials (with no entitlements) from specific campaigns, providing greater flexibility and precision in managing credential visibility without impacting other campaigns. By allowing credential visibility to be customized for individual campaigns, this enhancement ensures that unnecessary data is excluded only where relevant, improving the focus and efficiency of specific reviews without affecting global settings.

Track Reviewer Changes with Notes for Full Audit Visibility

A Notes section has been introduced in the Update Reviewer feature, allowing administrators to document reasons for reviewer changes. These notes will appear in reports, exports, and notifications, offering a clear audit trail for all reviewer updates and improving overall accountability. The inclusion of this feature strengthens audit readiness by maintaining detailed records of reviewer changes, promoting transparency, and ensuring that all actions taken are clearly documented and easy to reference during audits.

Automated Campaign Data Archival for Better System Performance

Campaign data is now automatically archived based on configurable retention periods. Administrators can download archived campaign reports at any time, ensuring access to historical data without cluttering the active campaign list, which improves overall system performance. This feature enhances system efficiency by preventing active campaign lists from becoming overloaded with old data while preserving long-term access to critical historical records, supporting both compliance requirements and performance optimization.

Customizable Email Reminders for Timely Campaign Completion

Administrators can now configure specific dates for reminder emails instead of relying on a fixed number of days before the campaign end date. This added flexibility ensures reminders are sent at the most appropriate times, aligning with internal workflows and increasing the likelihood of timely reviews. By offering more control over reminder scheduling, this enhancement increases the chances of task completion, reduces overdue reviews, and ensures that notifications are timed strategically to maximize response rates.

Dynamic Button Visibility on Application Credentials Screen

The Application Credentials screen now dynamically hides irrelevant buttons based on the selected status in the Status dropdown. This declutters the interface and ensures users only see actions relevant to the current state of the credential, improving overall user experience and reducing potential for errors. By simplifying the interface, this change allows users to focus on necessary tasks, minimizes distractions, and ensures a smoother, error-free experience when managing credentials.

Enhanced WebAPI Security with Bearer Token Authentication

The WebAPI Connector now supports authentication using Basic Auth with a Bearer Token. This enhancement enables more secure and versatile API integrations, meeting diverse security requirements while maintaining compatibility with existing systems. The ability to use both Basic Auth and Bearer Tokens enhances integration security, providing stronger protection for sensitive data and allowing organizations to comply with modern authentication standards.

Expanded SharePoint Connector for Multi-Site Data Access

The SharePoint Connector has been enhanced to retrieve data from multiple site collections when configured with an account that holds Site Collection Admin permissions. This improvement supports complex SharePoint environments and ensures broader data access. By enabling multiple site collection retrieval, the connector reduces manual data consolidation efforts, improves operational efficiency, and simplifies data gathering from diverse SharePoint resources.

Automated CSV Entitlement Mapping for Streamlined Imports

The CSV connector now supports mapping multiple entitlements spread across horizontal columns. This removes the need for manual transformations, as the application can process Entitlement 1, Entitlement 2, etc., directly from the CSV headers. This feature significantly reduces administrative workload by automating entitlement mapping, ensuring greater accuracy, and saving time otherwise spent on manual data manipulation.

Role-Data for Azure AD Imports

A new feature in the Azure AD connector enables administrators to include or exclude specific roles during data imports. This feature allows for more precise control over role-based review management. This update reduces unnecessary data imports, streamlines the onboarding process, and ensures that only relevant roles are included in each campaign.

Detailed User Change Tracking with From/To Values in Audit Logs

The User Audit Trail now captures and displays both the old and new values for all user actions. This enhancement improves visibility into data changes, making audits more effective and comprehensive. The ability to view both the original and updated values ensures greater accuracy in audits, facilitates rapid troubleshooting, and provides a more complete understanding of user actions and system modifications.

Campaign Approvals Fully Captured with Approve All Logging

Actions taken by reviewers using the “Approve All” button are now logged in the Campaign Audit Trail. This provides administrators with greater insight into the review process, ensuring full transparency. Capturing these bulk approval actions increases accountability, ensures all decisions are traceable, and provides clear documentation for regulatory and audit requirements.

Enhanced Clarity in Audit Logs with Campaign and Application Names

Audit trail entries now include application and campaign names in descriptions, offering greater clarity and context for logged actions. This update simplifies audit reviews by making logs easier to interpret and directly linking actions to their corresponding campaigns or applications, reducing investigation time and improving traceability.

Dynamic End Date Inclusion in Reviewer Notification Emails

A dynamic variable for the campaign end date has been added to the Notify Update Manager email template. This ensures reviewers are aware of deadlines, promoting timely review completion. By including campaign end dates in notifications, this enhancement reduces the risk of missed reviews, improves communication clarity, and ensures that reviewers are fully informed about their responsibilities and deadlines.

The post Q4 2024 Version 2.374 (01/06/2025) appeared first on SecurEnds.

Campaigns

Enhanced Auto-Close Campaign Feature

Instead of triggering the auto-close feature once the 100% completion threshold is reached, this functionality is enhanced to wait until the end date of campaign before closing the campaign automatically. This ensures that admins have sufficient time to make any necessary changes before the campaign closure. However, it is configurable to close the campaign immediately or wait till campaign end date.

Display Percentage Complete at Top of All Campaign Election Pages

Campaign progress percentage is shown at top-right of review screens with fill colour indicating the overall progress (akin to traffic-light red-yellow-green)

This is how it looks when 100% complete

As campaign progresses, percentage complete is shown in yellow as below-

Campaign Close Confirmation to Include Campaign Name

With this change User can be doubly sure that they are closing the correct campaign, as Campaign Name is shown in the Campaign close confirmation popup. Customer suggested and we listened.

Delta Campaign with no changes Shown 100% Complete

Progress of a Delta campaign with no changes/elections to be made, is changed to 100% immediately on launch of campaign, thus helping UAR admin in campaign management.

Additional Columns on Reviewer Pages

Two new columns “SOR Email” and “HR Status” is available on the UAR Campaign screen. This additional information would help expedite review process for manager with large number of reportees.

Campaign Notes for Credential and Entitlement during Revoke Process

Today when Credential is revoked all corresponding Entitlements are revoked automatically by the application. As part of this enhancement whenever credential is revoked and user provides notes, the same Notes is applied and displayed to associated entitlements as well.

Application

Clone a SOR as an Application

Earlier SOR was allowed to be included in a campaign. In an earlier release, we removed and made to only include Applications. Hence if same HR system is required for Credential reviews user had to duplicate that as an Application. With this enhancement a user can decide to clone a SOR as an Application during creating the SOR itself.

Configuration for cloning the SOR as an Application

SOR & Application Created

Connectors

Bitbucket – A New Connector

Securends is expanding its Out-of-the-Box integration with addition of this new connector with Bitbucket. Bitbucket connector will pull project permissions as entitlements with format : {Project Name} – {Permissions} 

Navigate to Applications->Add->Data Ingestion = Connector.

Select Bitbucket Connector. Add connection details and mapping.

Active Directory – Employee ID Flag is Now UI Level Config

Employee ID field while using Active Directory can be mapped to different incoming fields. However this mapping had to be done in database with the help of support team. With this enhancement the mapping is now available in the SOR/Application screens for AD Connector. This also gives flexibility to have different mapping for different AD.

SOR Connectors – Exclude Employee ID Through Config

During connector sync of a SOR, if the source system had employee ID data, Securends ingested that attribute.  This affected how records are added to People and updated.  In some cases the employee id attribute in the source system was used for other reasons than as a unique value.

With this release by providing an additional configuration option, API need not always ingest the employee ID attribute. This option at SOR connector level, gives freedom to clients to pull employee ID from one SOR and not from another SOR.

Snowflake Connector – Additional Functionality

Currently, from Snowflake Integration, Securends application was pulling Single/Default Role of user in data sync. However users can have multiple roles in Snowflake. Securends integration with Snowflake is now improved to pull all the Roles of user (Default Role + Granted Roles)

FlexFolder Connector – Custom Configuration Options

Similar to SFTP or Cloud Storage flex connectors, FlexFolder is a helpful way to automate ingesting data through CSV automatically. We are now making FlexFolder more configurable so that customer can provide their own mapping instead of having to follow the default header names in the CSV.

Credential Updates

Application Credential is Purged -> Un-assign From the People Identity

This feature is part of Securends plan of improving the product continuously for better user experience.

When status of a credential moves to purged in any application, earlier our guideline to admins was to manually unassign credential from respective user/identity. This enhancement automates this step reducing manual user intervention.

SOR People Identity is Purged -> Un-assign From All Applications

Similar to the previous enhancement, this enhancement automates un-assigning purged identities.

When an identity/Credential is purged in any SOR (only if the identity is matched automatically)

• All credentials from other applications which are assigned to respective identity/email are unassigned
• All credentials from All SORs which are assigned to respective identity/email are unassigned

Matching Logic

Admin Can Now Assign an Unmatched Credential

Fuzzy logic is great. But for those unmatched credentials, this feature reduces number of clicks to search for an identity and assign.

When user navigates to fuzzy match screen(Application –> Credentials –> Match) and when there are no results(empty table) displayed for Fuzzy match and user clicks on ‘Assign Button’, now here itself we display Assign Credential popup for user to search and assign.

Audit Logging

Audit Trail of Application Config Change Captures Additional Details

We have now enhanced the audit logging for Application config changes by capturing additional details. Any change to individual fields is logged by clearly indicating what was the config before this change and what it is now for better clarity.

Messaging

Slack & Teams – Launch Campaign Message Directly Sent to User Instead of Channel

Currently, system sends Campaign Launch Message to Slack channel. If any new reviewers are part of campaign then admin has to manually add those users to channel.To avoid this, Securends now sends the Launch Message to Direct Chat of individual users.

While sending the Bulk Launch Message, it also consolidates and includes only the relevant Campaign Names associated with the user/reviewer.

Ticketing

SNOW – For Scripted API method Table Name is Configurable

A configurable product offers greater flexibility in product functionality. Here in SNOW ticketing for scripted API, system created attachment to ‘Incident’ table by default. There was an ask for making the table name configurable. Hence with this release we now allow a configurable Table name within Ticketing Configuration.

JIRA – Issue Type is Configurable

Similar to SNOW Ticketing, Jira ticketing integration is enhanced to allow further flexibility.

Today for Jira ticketing, the ticket gets created as a ‘Task’ issue type. Since some Jira projects do not support ‘Task’ issue type, this “Issue Type” field is now made configurable.

For onprem Jira – Issue type field is added

For Jira Cloud – Issue type field is introduced

Report

Add additional Columns to Users Report

User Report now has these additional columns:

Termination Date and Last Authentication Date from SOR, and Last Authentication Date from Application.

This aids admin in their SOX audit to determine if a user that was terminated accessed an application after their termination date.

The post Q3 2024, Version 2.373 (10/01/2024) appeared first on SecurEnds.

Campaigns

Added Ability to Assign a Manager’s Direct Reports to a New Reviewer at One Time

SecurEnds has made it easier to delegate a manager’s direct report reviewers to another reviewer.  We have added “SOR Manager Email” as an option for credential delegation.  When selected, users may search for a manager’s email and then select the direct reports that should be assigned to a new reviewer.  A Credential Delegation Audit Trail will track the delegation.

Navigate to Access Review->Delegation.  Select Credential Delegation in the dropdown and select applications. 

Select SOR Manager Email in the dropdown, then search for a manager and select.  Select direct reports to reassign in the Direct Report dropdown and then enter the new reviewer in Assign Reviewer.  Then click SAVE.

The reviews previously assigned to the manager’s direct reports will now be assigned to the user in Assign Reviewer.

Applications

NEW Flex RPA Connector

The RPA (Robotic Process Automation) connector revolutionizes the extraction of entitlement data from a multitude of applications without an API. This connector was introduced in a limited release and is now available to all in this Q2 wider release. 

Navigate to Applications, click ADD button. 

Select Flex Connector radio button.  Enter name and select Flex RPA.  Click Save and follow the instructions in our Flex RPA Users Guide.

NEW Microsoft Dynamics Business Control Connector

We have added the Microsoft Dynamics Business Control Connector that will pull users and permissions and be available as an SOR or Application.

Navigate to Applications->Add.  Select Connector radio button and search for “dynamics”.  Select the Dynamics 365 Business Central Connector.

Add connection details.

NEW Paylocity Connector

The new Paylocity Connector may be used as an SOR or application and will pull users.  We currently only support one Company ID.

Navigate to Applications->Add.  Select Connector radio button and search for “paylocity”.  Select the Paylocity Connector.

Add connection details and Save.

Updated Match Logic

SecurEnds has updated our application match logic to handle specific customer use cases.

When syncing and matching, all credentials will be unassigned and all identities will be terminated when an SOR is disabled.

Emails

Added Optional “Reply To” Field and Header to Email Configuration

We have added the option to set the “Reply To” field as a different address than the login email address.  It will show as a header in all SecurEnds emails.  When “Reply To”, the email will be forwarded to this address.

Navigate to Configuration->Email Settings->Setup

Enter “Reply To” address in Configuration.

Ticketing

Added Ability to Configure Columns in the CSV Sent for Ticketing and Email Provisioning

Improved Display Fields in CSV and Reordered Columns

A new configuration was added to specify which columns should be displayed in the Ticketing and Email CSV attachment. 

Navigate to Administration->Configuration->Ticketing System for Access->Configurations. 

Search for EXCLUDE_COLUMNS_FROM_TICKETING_SYSTEM_ATTACHMENT and select Update in the action gear.

To include all columns, enter No.  To specify columns to include, enter each column header separated by commas. 

In this example, the following columns are excluded:  entitlement description, entitlement DN, notes, termination date, Business justification

The excluded columns are not displayed in the CSV attachment.

For Manager Elections, we will display “App Credential – <credential value>” on the Ticketing and Email CSV attachment.  Columns will be displayed in the following order: 

NEW – Deskpro Ticketing

SecurEnds is now able to send tickets via Deskpro

To configure Deskpro, navigate to Configuration->Ticketing System for Access Review. Select “Set Up”.  Select “Deskpro” in Ticketing System dropdown and enter connection details.

When setting up applications, select “Deskpro” for ticketing.

Added a New Configuration to Service Now Ticketing to Pull Assignee from “Display Name”

By default, SecurEnds will pull Assignee from the “Name” field in Service Now.  An option has been added to pull Assignee from the “Display Name” field.  This configuration is in the application property file.  If this change is desired, request a property file change from your Implementation Consultant.

Platform Modernization

Java Upgrade

Adhering to industry best practices is important to SecurEnds so we are continually upgrading our IT platform. In this release we have upgraded Java to version 17 and Spring Boot to version 3.2.1.

The post Q2 2024, Version 2.372 (7/01/2024) appeared first on SecurEnds.