These release notes provide information about updates, resolved issues, and security fixes addressed in EmpowerID build 7.212.0.0.

Apr 24, 2026

Period: April 18 - April 24, 2026

Zscaler: IP address are not visible in asset list

Jira ID(s): SMAOFPOC-1419, SMAOFPOC-1423

Fix/Feature: Fix

Pull Request: 7.212.0.0 (!30909)

What Changed

Two issues affecting the Zscaler asset list were resolved: (1) Facility IP Address values were not displaying in the asset selection view despite being present in the database, and (2) the asset list was silently capped at 1,000 items, making large deployments appear incomplete. Both issues are now fixed so administrators see all IP addresses and the full asset inventory.

Why It Matters

• Administrators can now see the complete Zscaler asset list without the 1,000-item pagination limit hiding records.

• Facility IP Address values are now visible in the asset selection view, eliminating the need to cross-reference the database directly.

• Reduces misconfiguration risk from working with an incomplete or incorrect asset view.

Customer Impact

Administrators working in Zscaler onboarding and segment management now see the complete facility asset list with all IP addresses visible, making selection accurate and reliable for large environments.

Group Management: Remove Group Assignment “Failed” (fulfillment successful but group not removed)

Jira ID(s): MT-2487, MT-2488

Fix/Feature: Fix

Pull Request: 7.212.0.0 (!30887)

What Changed

Removing a group-to-group or set-group membership in Resource Admin was failing with 'Fulfillment was successful, but the group was not removed.' A NullReferenceException in the fulfillment workflow (SetOperationInputs) caused the removal to terminate abnormally while reporting success. The fix resolves the null reference so that both standard group assignments and set-group assignments are fully removed after approval, and the change persists after page refresh.

Why It Matters

• Administrators can now successfully remove group-to-group and set-group memberships without assignments silently persisting after fulfillment.

• Removes the misleading 'Fulfillment was successful, but the group was not removed' state that caused audit discrepancies.

• Group membership state in Resource Admin matches what was actually requested and approved.

Customer Impact

Group membership management in Resource Admin now correctly completes removal requests end-to-end, so fulfilled tasks accurately reflect group state and audit records remain consistent.

Azure Connector: Fix errors in Azure AD SCIM

Jira ID(s): SIEMMSP-642

Fix/Feature: Fix

Pull Request: 7.212.0.0 (!30883)

What Changed

The Azure AD SCIM connector was updating the pagination skip token before finishing the processing of newly added and deleted users and groups. This race condition could cause records to be silently skipped during group inventory, resulting in data loss. The fix defers the skip token update until after all changes in the current batch have been processed.

Why It Matters

• Directory synchronization is more reliable and less likely to skip or mis-key records.

• Membership and group inventory align more closely with Entra / Azure AD as the source of truth.

• Operational teams spend less time reconciling drift between directories.

Customer Impact

Organizations relying on Azure / Entra synchronization see more dependable group and membership results with fewer reconciliation gaps.

Azure Connector: Fix Azure AD groups membership inventory job: use Entra group ID instead of internal GUID

Jira ID(s): SIEMMSP-592

Fix/Feature: Fix

Pull Request: 7.212.0.0 (!30880)

What Changed

The Azure AD group membership inventory job was using the EmpowerID internal group GUID instead of the Entra (Azure AD) group system identifier when correlating memberships. This caused the job to miss or misattribute members for groups whose internal GUID did not align with the Entra ID. The fix switches to the Entra group ID as the join key, which is the correct external identity for group membership lookups.

Why It Matters

• Directory synchronization is more reliable and less likely to skip or mis-key records.

• Membership and group inventory align more closely with Entra / Azure AD as the source of truth.

• Operational teams spend less time reconciling drift between directories.

Customer Impact

Organizations relying on Azure / Entra synchronization see more dependable group and membership results with fewer reconciliation gaps.

Network Zone Management: Refactor dropdown values to send to myIT/ServiceNow

Jira ID(s): NZLM-598, NZLM-461

Fix/Feature: Fix

Pull Request: 7.212.0.0 (!30873)

What Changed

Two related changes were delivered: (1) Network Zone owners and managers can now initiate ownership and manager role changes directly in the NZLM UI -- owner changes go through an EmpowerID approval workflow and sync to CMDB before taking effect, while manager-only changes write directly to the CMDB staging table (~30 min turnaround, no approval required). (2) Status and dropdown values sent to myIT/ServiceNow were refactored to use mapping tables instead of hardcoded numeric IDs, making the integration more maintainable and less fragile.

Why It Matters

• Network Zone owners can now initiate ownership transfers and manager changes directly through the UI without workarounds.

• Status and dropdown values sent to myIT/ServiceNow resolve through mapping tables rather than brittle hardcoded IDs, keeping CMDB integrations stable.

• Manager-only changes take effect quickly (~30 min) via CMDB staging without requiring a full approval workflow.

Customer Impact

Network Zone owners and managers can change ownership roles through the NZLM UI with proper approval and CMDB-backed confirmation, and the myIT/ServiceNow integration receives stable mapped values instead of hardcoded IDs.

Build Tooling: Add support for Visual Studio 2026 Build Tools

Jira ID(s): N/A Fix/Feature: Feature Pull Request: 7.212.0.0 (!30848)

What Changed

Add support for Visual Studio 2026 Build Tools.

Why It Matters

• Branch builds stay compatible with current build agents and toolchain expectations.

• Reduces failed builds and manual workarounds during servicing and patch releases.

• Keeps packaging and compilation aligned with your standard CI environment.

Customer Impact

Build and release engineers can produce this branch using current Visual Studio build tooling without falling back to unsupported compiler paths.

Notification Security: Encryption for emails with confidential information (reports and bulk templates)

Jira ID(s): SMAOFPOC-1380

Fix/Feature: Feature

Pull Request: 7.212.0.0 (!30828)

What Changed

A new IsEncrypted parameter was added as a method overload, enabling callers to explicitly request email encryption. Emails containing confidential information (including generated reports and pre-filled bulk templates) are now sent encrypted, addressing the security requirement that sensitive identity data not be transmitted in plaintext.

Why It Matters

• Reports and bulk templates often contain sensitive identity data; sending them unencrypted exposed that data to interception in transit.

• The new IsEncrypted parameter gives callers explicit control over which emails are sent encrypted.

• Meets organizational security requirements for email handling of confidential content.

Customer Impact

Confidential emails containing reports and bulk templates are now sent encrypted, protecting sensitive identity data in transit and satisfying organizational security requirements.

Zscaler: Add IsSharedAcross warnings to Application Alias/IP and Facility Alias/FQDN/IP

Jira ID(s): RESADMIN-5928

Fix/Feature: Feature

Pull Request: 7.212.0.0 (!30779)

What Changed

Previously, only the isFQDNSharedAcrossApps flag was used to display a warning icon in the asset selection dialog and tag chips. This change extends the same warning pattern to isAliasSharedAcrossApps and isIPAddressSharedAcrossApps flags, which are now returned by the API for both Application and Facility assets. The isFacility flag is derived from the query params and passed through to the shared components so that each of the 6 combinations (3 asset types x 2 contexts) displays a distinct tooltip message. The shared flags are also now correctly persisted through select-all handlers, individual checkbox selections, and the save model.

Associated SQL Patch

https://empowerid.visualstudio.com/EmpowerID/_git/EID-Release-SQL/pullrequest/30781

Why It Matters

• Administrators see complete and accurate asset data when configuring segments and applications.

• Shared-asset warnings reduce accidental changes to infrastructure used in multiple contexts.

• Fewer manual cross-checks are needed to validate IP, alias, and FQDN visibility.

Customer Impact

Teams managing Zscaler onboarding and assets get clearer visibility into shared infrastructure and complete asset lists, reducing misconfiguration risk.

Apr 17, 2026

Period: April 11 – April 17, 2026

Zscaler: Expand FQDN Sharing Warning to Include Aliases and IPs

Jira ID(s): SMAOFPOC-1396

Fix/Feature: Feature

Pull Request: 7.212.0.0 (!30802)

What Changed

The "Is FQDN Shared Across Applications" warning feature, which informs administrators via a tooltip when an asset is used by multiple applications, has been extended beyond FQDNs. The check now also applies to Aliases and IP addresses for Applications, and to FQDNs and IPs for Facilities in Zscaler. The schema was updated with new attributes on the AuditLogOperation view and ApplicationSystemInfo table to support the expanded detection logic.

Why It Matters

• Administrators now receive complete cross-application sharing warnings regardless of whether an asset is identified by FQDN, alias, or IP address.

• Zscaler Facility records are now included in the shared-asset detection scope.

• Reduces the risk of unintentionally reconfiguring an asset that is actively shared across multiple application contexts.

Customer Impact

Administrators managing Zscaler application and facility configurations will see accurate shared-asset warnings for all asset types, preventing configuration conflicts caused by overlapping IP or alias references across applications.

Localization: Fix Race Condition Causing Corrupted Display Values

Jira ID(s): EMPOWERID-13599

Fix/Feature: Fix

Pull Request: 7.212.0.0 (!30788)

What Changed

A race condition in LocalizationManager.cs — the core class responsible for resolving localization strings throughout the application — was causing display strings to be corrupted and rendered with unexpected values. Two threads were updating the same string reference simultaneously, producing mismatched or garbled output. The issue became more prominent after a separate caching optimization began holding onto the corrupted values longer; previously, the corruption was self-correcting because cache entries expired more quickly. The fix prevents concurrent writes to the same reference, eliminating the corruption at its source.

Why It Matters

• Workflow action labels (e.g., Verb Noun Actions) now display correctly across all screens.

• Loading indicators, such as the EIDWatch spinner, no longer display incorrect Display Names (e.g., "Logging in to Display Name").

• The fix is stable across multiple workflows, including AD Group Onboarding and AD Account Onboarding.

Customer Impact

Users and administrators will see correct, consistent localization strings throughout the application. The corruption that caused confusing or mismatched labels during login and workflow interactions is resolved.

Customer Impact

Users and administrators will see consistent, correctly localized strings throughout the application. The corruption that caused confusing or mismatched labels during login and workflow interactions is resolved.

Recertification: Fix Out of Memory Issues in Local Right/Role Assignment Recertification Workflow

Jira ID(s): EMPOWERID-13577

Fix/Feature: Fix

Pull Request: 7.212.0.0 (!30789, !30738)

What Changed

The ProcessLocalRightAssignmentRecertification workflow was causing out-of-memory conditions during execution. The root cause was the accumulation of mover recertification requests over time — open requests were reclaimed after 16 days due to the escalation policy, triggering automatic revoke cases and recurring failed fulfillments. The fix introduces a fallback assignment point resolution via ResourceAttestationSnapshot within the ProcessTimeConstraint logic in both the LocalRight and LocalRole recertification workflows, preventing the unbounded accumulation that led to memory exhaustion.

Why It Matters

• Recertification workflows now complete without crashing due to memory pressure.

• The fallback resolution prevents stale escalation cycles from re-queuing indefinitely.

• Both LocalRight and LocalRole recertification paths are covered by the fix.

Customer Impact

Administrators running recertification campaigns will no longer encounter service crashes or workflow failures caused by out-of-memory conditions in the recertification engine. Existing open requests will be processed correctly without re-triggering escalation loops.

Safari: Fix Empty File Download When Toggling Between Microservices

Jira ID(s): EMPOWERID-13598

Fix/Feature: Fix

Pull Request: 7.212.0.0 (!30727)

What Changed

An empty .cshtml view file was causing Safari to misinterpret the HTTP response as a file download rather than a page navigation event. When users toggled between microservices (e.g., switching between the IAM Shop and Resource Admin), Safari would briefly flash an "under construction" placeholder and then trigger an empty file download. The fix updates the .cshtml file to return a properly structured response that Safari handles as a standard page load.

Why It Matters

• Safari users no longer receive unexpected file download prompts when switching between microservices.

• Navigation between EmpowerID microservices is now consistent across all major browsers.

• No changes to functionality — this is a browser compatibility fix only.

Customer Impact

Users accessing EmpowerID via Safari will no longer experience unsolicited file downloads when navigating between microservices. The application navigation flow works as expected.

My Tasks — Business Requests: Fix Inconsistent Search and List Results

Jira ID(s): MT-2453

Fix/Feature: Fix

Pull Request: 7.212.0.0 (!30748)

What Changed

Search and list results in the My Tasks — Business Requests view were returning inconsistent results depending on how a request was accessed. Users with "View All" access now correctly see all requests in search results, while users with limited access see only requests in which they are a participant. Previously, a limited-access user could open a request via a direct link, but the same request would not appear in their search results. The fix updates the GetAsParticipant stored procedure methods to consistently apply the OwnRequest filter.

Why It Matters

• Users with limited access now get predictable, consistent results whether they navigate via search or a direct link.

• The access control logic enforces the correct visibility boundary: requests are shown only to participants unless the user has elevated access.

• Reduces confusion and support requests caused by requests that appear accessible but are not visible in lists.

Customer Impact

Administrators and end users experience consistent business request visibility across all entry points in the My Tasks interface, with access controls properly enforced in search and list views.

IAM Shop: Fix Pre-Approved Role Activation Failing for Group Resources

Jira ID(s): ITSHOP-7175

Fix/Feature: Fix

Pull Request: 7.212.0.0 (!30753)

What Changed

Activation of pre-approved roles failed when the target resource was a group in the IAM Shop. Users attempting to activate these roles received an error and were unable to complete the activation. The fix corrects the activation logic so that group resource types are handled correctly during the pre-approved role activation flow.

Why It Matters

• Users can now successfully activate pre-approved roles assigned to group resources directly from the IAM Shop.

• Removes a blocking error that required administrator intervention to resolve activation failures.

• Consistent behavior is now maintained across individual and group resource types.

Customer Impact

End users with pre-approved role assignments on group resources can now activate those roles from the IAM Shop without errors.

Apr 10, 2026

Period: April 4 – April 10, 2026

Zscaler Integration: Custom FQDN Asset Validation on Update Application Segment

Jira ID(s): SMAOFPOC-1413

Fix/Feature: Fix

Pull Request: 7.212.0.0 (!30735)

What Changed

The Update Application Segment operation in the Zscaler integration was not validating assets against the certificate URL list during update operations. Custom FQDN entries were accepted without verification, potentially leading to misconfigured application segments. Asset validation logic has now been added to the update operation to enforce the same FQDN checks that apply at creation time.

Why It Matters

• Ensures consistent validation behavior between create and update operations for Zscaler application segments

• Prevents invalid or uncertified custom FQDNs from being saved during updates

• Reduces the risk of misconfiguration in network access policies managed through EmpowerID

Customer Impact

Administrators managing Zscaler application segments will now see proper validation feedback when attempting to save a segment with a custom FQDN that does not pass certificate URL list checks, bringing update behavior in line with creation behavior.

Network Zone Management: Status Column Tooltip with RITM Details

Jira ID(s): NZLM-439

Fix/Feature: Fix

Pull Request: 7.212.0.0 (!30669)

What Changed

A new NetworkZoneColumnTooltipValue has been wired to the Status column on the Network Zone View All page. When a network zone has associated RITM data, hovering over the Status value now displays a tooltip containing the RITM number, state, status, and last updated timestamp. Additionally, the backend now returns an extended success message after provider API or provider attribute changes during an update, informing users that the changes may take time to be reflected.

Why It Matters

• Surfaces RITM-related context directly in the list view without requiring users to navigate into individual records

• Provides transparency on pending provider changes after save operations

• Reduces support burden by making status information and update latency visible in the UI

Customer Impact

Users managing network zones can now hover over the Status column to view current RITM details inline, and will receive informative feedback after saving provider-related changes, indicating that propagation may take some time.

My Tasks: Recertification Start Date/Time Defaults to Current Date

Jira ID(s): MT-2461

Fix/Feature: Fix

Pull Request: 7.212.0.0 (!30667)

What Changed

In the My Tasks recertification flow for App Roles and Rights, the Start Date/Time field in the Limit Validity panel was blank and disabled, preventing users from selecting a validity duration. The field has been updated to default to the current date and time, enabling users to interact with the control and set a validity window during recertification.

Why It Matters

• Unblocks users who were unable to complete recertification tasks requiring a validity duration

• Ensures the Limit Validity panel behaves consistently and is always actionable

• Removes a silent UX failure where a required field appeared disabled with no explanation

Customer Impact

Users performing App Role or Right recertification in My Tasks can now select a start date and time for validity periods, resolving a blocker that prevented them from completing the recertification process.

Resource Admin: Tooltip Copy Action for Field Type Values

Jira ID(s): RESADMIN-5911

Fix/Feature: Fix

Pull Request: 7.212.0.0 (!30637)

What Changed

Copying text from tooltips displaying field type values (such as Organization Scope identifiers) was not possible because the tooltip dismissed on interaction. The tooltip has been updated to support direct text selection and copying from within field type value displays, extending the interactive tooltip behavior to field type contexts in Resource Admin.

Why It Matters

• Allows users to copy technical identifiers shown in field type value tooltips without navigating away

• Extends copy-enabled tooltip support to additional tooltip contexts beyond the earlier RESADMIN-5911 fix

• Reduces friction for administrators who need to reference or share exact field values during access reviews

Customer Impact

Users can now select and copy text directly from field type value tooltips in Resource Admin, making it easier to capture and reference exact values shown in assignment and approval contexts.

Apr 3, 2026

Period: March 28 – April 3, 2026