Page Comparison

We are pleased to announce the release of EmpowerID Build 7.212.0.0, a comprehensive update with new features, enhancements, and refinements aimed at empowering administrators and enriching the user experience. This release emphasizes the following key areas:

Connectors

• Major upgrade transitions all microservices from .NET 6.0 to .NET 8.0. The update addresses the upcoming end-of-support for .NET 6.0, ensuring continued security and support by leveraging the latest .NET framework enhancements. This upgrade does not affect current functionality or performance but is crucial for maintaining future compatibility and receiving ongoing support.

GCP Connector

• We have added and implemented full and delta inventory features for GCP users. The enhancements include:

  • Full Inventory for Users

  • Delta Inventory for Users

  • Delta Inventory for Users in the Connector

  • Full Inventory for Guest Accounts in the Connector

• We have implemented full and delta inventory features for GCP groups and memberships. The enhancements include:

  • Full Inventory Endpoints for Groups and Memberships

  • Delta Inventory Endpoints for Groups and Members in the Microservice

Zscaler Connector

• The functionality for Reconciliation of SCIM groups with Azure AD groups has been added. This functionality retrieves SCIM groups provisioned in Zscaler, matches them with the Zscaler group IDs and Azure system identifiers stored in Azure Blob, and performs a reconciliation process to ensure both systems are aligned. This enhancement streamlines group management and synchronization across both platforms.

• Inventory of Zscaler Segment Groupsis now available. This feature follows the JSON inbox method, where JSON data is retrieved and imported into EID. The stored procedure Custom_ZScalerJSONInbox_ProcessResourceSystem handles the processing of JSON inbox entries for each resource system. The processed data is then stored in the EID segment group tables: ZscalerSegmentGroup and ZscalerSegmentGroupAccessPolicy. The JSON inbox data is stored in ZScalerJSONInbox and zscalerjsondoctype, ensuring seamless integration and synchronization across the system.

• We have introduced the capability to inventory Application Segments from ZScaler using the JSON inbox method. This process retrieves JSON data and imports it into the EID system, where it is processed using the stored procedure Custom_ZScalerJSONInbox_ProcessResourceSystem. The JSON inbox entries are synchronized with the EID components, and the application segments , along with their and associated data , are stored in the relevant EID tables. This ensures a seamless and automated method for managing application segments.

• The feature to inventory  inventory Server Groups from ZScaler using ZScaler using the JSON inbox method allows seamless import of JSON data into the EID system. The stored procedure Custom_ZScalerJSONInbox_ProcessResourceSystem processes the JSON inbox entries for each resource system.

• Managing Access Policies in Zscaler is now available from EmpowerID. This integration allows users to seamlessly define and manage access policies within the Zscaler environment directly from EmpowerID. Users can create, delete, and update access policies using a self-service wizard workflow, simplifying the management process and enhancing user experience.

Microservices

• Major upgrade transitions all microservices from .NET 6.0 to .NET 8.0. The update addresses the upcoming end-of-support for .NET 6.0, ensuring continued security and support by leveraging the latest .NET framework enhancements. This upgrade does not affect current functionality or performance but is crucial for maintaining future compatibility and receiving ongoing support.To address data privacy concerns, a new SearchToLoad configuration parameter has been implemented for the MyIdentity tabs (All People, Internals, and Externals). This enhancement prevents users from viewing a full, unfiltered list of identities unless a search term is entered. By default, the identity lists will display nothing until a search is performed. This feature ensures compliance with privacy regulations and prevents the potential export of user data by requiring searches for specific identities.

• A new enhancement has been introduced to display the Service Principal Object ID on the overview page of Azure applications in the Resource Admin UI.

• This update introduces the ability to assign application rights to individual users and groups. This enhancement allows for more efficient management of app rights assignments, enabling administrators to streamline permissions across multiple users simultaneously. This feature aims to simplify the user management process and improve operational efficiency.

IAM Shop

• In the IAMShop application window, a new feature has been added to improve the user experience when requesting access to applications. A Select All button has been implemented for multi-select FieldType controls, specifically for the MultiSelectCheckBoxList field type. This enhancement allows users to select all values associated with a FieldType in one action, streamlining the selection process and reducing manual entry time. Additionally, functionality has been added to force users to select at least one value when the EnforceFieldTypeSelection flag is true , and the isFieldTypes flag is also true. This will prevent ensure users from adding can add to the cart without by meeting the selection criteria. The EnforceFieldTypeSelection flag is available in OnboardAzLocalRight WF advanced settings.

• The IAM shop has implemented an enhancement to enforce a minimum character length of three in the search box on listing screens. This update addresses issues of database timeouts caused by excessive load when search API calls were made with fewer than three characters. With this enhancement, the search functionality will only trigger if at least three characters are entered, improving performance and reducing the likelihood of timeouts.

• Resource Admin and IAM Shop have added a new configuration option, making the BusinessRequestName field mandatory or optional.

• A new encrypted media streaming infrastructure has been implemented to enhance the security and efficient streaming of PSM session recordings. This approach ensures that all recordings are encrypted by default to protect data at rest, while specific recordings can be encrypted with unique keys, restricting access unless authorized.

  The new solution employs HTTP Live Streaming (HLS) protocol with AES-128 encryption, dividing videos into smaller segments and generating a manifest file for adaptive streaming. This method improves start times and allows seamless playback by dynamically loading segments based on connection strength, minimizing buffering.

  Encrypted segments prevent unauthorized playback, even if downloaded locally. The infrastructure utilizes a streaming server to serve encrypted segments, and the VideoJS player decrypts these on the fly, ensuring secure, on-demand access to recordings without impacting performance.

Resource Admin

• A new Pre-Approved Members grid has been added to the Groups overview. This feature provides a convenient view of members who have pre-approved access, enhancing visibility and streamlining group management by allowing admins to quickly review and manage pre-approved memberships directly from the Groups overview page.

• A new update introduces menu links to enhance navigation across standard functionalities within the Resource Admin. Access to Access Managers (RBAC Owners), Direct Assigned Locations, and Access Request Policy settings is streamlined and available across resources, including Applications, Groups, Management Roles, and Mailboxes. This addition simplifies the management experience, making it easier for users to access these critical functions from any relevant resource.

• The Resource Admin now provides access to inventoried permissions for Shared Folders. This enhancement allows users to view and manage permissions for Shared Folders directly within the Resource Admin.

• The Application Details interface now includes the ProtectedApplicationResourceUsageTypeFriendlyName property, displayed under the App Authorization Model.

• This update introduces the ability to assign app rights to groups in Application-> App Right Assignments. This enhancement allows for more efficient management of app rights assignments, enabling administrators to streamline permissions across groups.

• Introduced new assignment capabilities within the PBAC Role Definition Assignments section, allowing users to assign Role Definitions to various entities within an application. With this update, users can now assign Role Definitions to Groups, Business Roles and Locations, and SetGroups. These new functionalities include options to view, add, or remove assignments, enhancing flexibility and control over role definition assignments.

• Introduced the "Assign to Person" feature in the PBAC Assignments -> Role Definition Assignments section. This functionality allows users to assign Role Definitions to eligible individuals within the application, streamlining role management by fetching eligible persons, retrieving their roles, and displaying current assignments. Implemented the "Assign to Management Role" functionality within the PBAC Definitions -> Details -> Assignments. Section. This feature will allow users to assign Role Definitions to management roles within an application, including the ability to view, add, or remove assignments.

• New assignment functionalities were added to the PBAC Definitions -> Details -> Assignments section, allowing users to assign Role Definitions to SetGroups, Groups, and Business Roles and Locations within an application. These enhancements provide a comprehensive set of options to view, add, or remove assignments, giving users greater flexibility and control over managing PBAC definitions.

• Added the ability to manage global field types under Applications, allowing users to view, create, and delete field types. This enhancement provides greater flexibility and control over field type management, similar to the functionality available for app-owned field types. Global Field Types will now be listed in the left-side menu, similar to Claim Mapping policies, making it easier for users to maintain and organize field data. This feature benefits customers by improving the management of field types under applications.

Azure

• This update introduces the detection, reporting, and recertification of stale Azure applications, streamlining the identification and management of inactive applications. The integration leverages the Azure AD Graph API to retrieve application activity data, now recorded in the LastActivityDate field in the ProtectedApplicationResource table. Applications identified as inactive based on this date are automatically flagged and sent for recertification. This enhancement ensures that stale applications are actively monitored, with any gaps in logging promptly addressed to maintain accurate tracking and reporting for recertification workflows.

• A new permanent workflow, AzureCredentialExpirationNotification, has been implemented to automatically detect and manage expired Azure client secrets and certificates across all Azure tenants within the system. This workflow checks all registered tenants, identifies expired credentials, and executes the following actions for each expired item:

  • Deletes the expired secret or certificate directly in Azure.

  • If the deletion is successful in Azure, remove the corresponding external credential in EmpowerID.

  Additionally, for applications with multiple expired credentials, the workflow sends individual notification emails to app owners and credential owners for each expired item, ensuring prompt awareness and action.

PBAC

• A new setting now enables splitting business request items by field type values, broadening the applicability of the approval splitting feature. The setting, configured as a pointer column (AzFieldTypeIDToSplitBy) on the AzLocalRight name, allows the designation of a specific FieldType for splitting requests. When this is set, business requests are split per unique value of the specified field type, while other field type values in the assignment are copied to each split item.

Workflows

• Implemented enhancements for the OnboardMailbox workflow, including adding a popup grid search for the Responsible Party and introducing IsRequired parameters for Responsible Party, Owner, and Deputy fields. The lookup now targets a more flexible configuration, allowing customization for the desired audience. Adjustments were made to use GetSearchAdvanced for Owner selection, enhancing accuracy in the selection process. These updates improve the onboarding experience for mailboxes.

• A fix has been implemented for the DisableMultiplePeopleWF, EnableMultiplePeopleWF, and ResetPassword workflows to address an issue where the advanced search options were not displaying when expanding the search box after selecting No for user selection. With this This update , shows the appropriate attributes are shown, ensuring users can efficiently perform advanced searches within these workflows.

• The latest enhancement in the ManageAzLocalRightWizard workflow introduces the capability to set SplitBusinessRequestApprovalPerFieldTypeValue and ApprovalAzLocalRightID for multiple AzLocalRights selections. The Edit Settings for Right label has been renamed to Edit Local Right Settings, and this option has been added to both single and multi-actions within the wizard. A disclaimer regarding setting overwrites has been implemented, and radio buttons are now used for specific checkboxes to ensure changes are made only upon selection. Additionally, the PBAC approval right is now a dropdown, reflecting changes only when a selection is made. This update also allows owners and deputies to be set for multiple AzLocalRights selections, aligning with existing activities in the ManageAzureAppRoleWizard workflow. Finally, the Assign Responsible Party action for multi-selection has been deprecated.

• The Role Definition Information form for onboarding local roles has a new optional dropdown field for selecting the fulfillment group and aligning it with the setup in the OnboardAzLocalRight workflow. Additionally, the section previously labeled App Right Options has been renamed Advanced Settings to provide a more intuitive interface. This enhancement allows users to assign fulfillment groups to roles during onboarding, improving flexibility in role management.

• The ManageComputerWizard workflow has been updated to include support for configuring RDP (Remote Desktop Protocol) and SSH (Secure Shell) connections for computers. This feature enables users to set up RDP and SSH access options directly within the workflow, along with other configurations such as hostname, Telnet, and VNC access. The updated workflow can be accessed through ITShop → Computers → Workflows → Manage Computer Wizard, providing streamlined setup and enhanced control over computer access configurations.

Security and Performance Enhancements