| Secrets Safe page of the BeyondInsight Console | Screen readers would show some unexpected behavior. | Resolved some accessibility issues involving screen readers. |
| Secrets Safe page of the BeyondInsight Console | When creating a new folder, focus was lost from the Secrets Safe page when the user clicked Create folder or Discard. | Focus now returns to the appropriate button when a folder is created or discarded. |
| Internal Smart Rules processing logic | A database stored procedure that affects bulk attribute updates was causing deadlocks. | The stored procedure was updated to avoid deadlocks. |
| Custom Platforms page of the BeyondInsight Console | When checking the password of a custom platform, the first step of  elevationcommand was sometimes causing the attempt to time out. | The first step has been changed to a LANG=en_US; whoami response for the AIX, HP-UX, Linux, Mac and Solaris custom platforms |
| Submit request tab | If the max concurrent request for a managed account was set to 1, users could still request and retrieve the account’s password, even if another request was still valid and displayed as unavailable. | A message now states that the max concurrent requests has been reached. |
| Workforce Passwords Browser Extension | When a website has two or more credentials saved, the username and password had to be populated individually. | When a credential is selected, both the username and password populate together. |
| User Audits page of the BeyondInsight Console | In the Audits grid, a failed Direct Connect login attempt was not showing the username. | The Audits grid now shows the username that attempted to log in. |
| Connectors page of the BeyondInsight Console | When running a scan for Google Cloud, Middle East regions were not listed and could not be queried for scan targets. | All regions are now available. |
| Managed Accounts page of the BeyondInsight Console | Editing a managed account without changing the next scheduled change date was saving an incorrect date to the database. | Dates are now being saved correctly. |
| BeyondInsight API | Entra ID users who were members of more than 100 groups could not log in via the API. | Users are now able to log in and their groups are enumerated successfully. |
| User Management page in the BeyondInsight Console | When editing an Active Directory user, credentials were a required field and would display an error if not filled out. Selecting a credential would allow the user to save, but opening the field again showed that the value was not saved. | The credential field is no longer treated as a required field for the editing of a user. User details now save correctly. |
| Secrets Safe page of the BeyondInsight Console | When assigning ownership to a group or members of a group, the user could navigate away from the page without a Save/Discard prompt and lose changes. | The user is now prompted to continue editing or discard changes when navigating away. |
| Secrets Safe page of the BeyondInsight Console | A secret could be saved without any owners. | If a user attempts to save a secret without an owner, an error appears and the secret cannot be saved until an owner is assigned. |
| Workforce Passwords | Workforce Passwords was failing to import passwords from a CSV if the password contained a comma. Additionally, if an exported password contained a quote, Workforce Passwords would import the password with the escape characters that LastPass added to the CSV. | Passwords are now imported correctly. |
| BeyondInsight API | A SCIM PATCH request could not handle a path with a sub attribute after the filter, returning a 500 error. | The attribute is now correctly changed on the given object. |
| Users page of the BeyondInsight Console, extension login | Error messages for attempted login without access were always in English, even if the user was using a different language. | The error message is now translated. |
| Managed Accounts page of the BeyondInsight Console | After editing a synced managed account, the description became NULL. | The description is now retained when a synced managed account is edited. |
| Secrets Safe page of the BeyondInsight Console | Users who owned all secrets within a folder received an incorrect error message: “The folder cannot be deleted. You do not own all the secrets" when attempting to delete a folder. | Users now receive an accurate error message indicating that all secrets need to be deleted before the folder can be deleted. |
| Internal group synchronization logic | Syncing an AD Group after removing a user also removed that user from all their groups, not just the group being synced. | The user will now only be removed from the currently syncing AD Group during synchronization. |
| Smart Rules page of the BeyondInsight Console | There is an option to clear existing mappings when creating a Smart Rule to apply propagation mappings via an action. If users switched mapping from Smart Rule to scan data or vice versa, the previous mappings were not cleared correctly. This resulted in mappings for both scan data and discovery on a Smart Rule. | When the clear option is enabled, all previous mappings are now cleared. |
| Internal logic | When checking if a hostname had a valid DNS entry, the comparison was case-sensitive. Also, there was no debug logging on a failed DNS lookup. | DNS comparison is now case-insensitive, and debug logging has been added to improve troubleshooting. |
| Workforce Passwords Browser Extension | When the URL field on a Secrets Safe secret has a trailing space, the Workforce Passwords Browser Extension displayed an error when that Secret was used. | Trailing spaces in URLs on Secrets no longer cause errors with Workforce Passwords Browser Extension. |
| Secrets Safe Entitlement Report | When exporting a PDF or TIFF Software Entitlement Report, each page of the report would also generate a second blank page. The first entry into Secret Safe would not show in the report, but subsequent entries appeared. | Reports now generate with all data and without extra pages. |
| Configuration page of the BeyondInsight Console | SHA1 was available as a signature method option, but support was recently removed for this option. | Due to weaknesses in SHA1 and remove of support for it in various third-party libraries, we have removed it as a signature method option. |
| Smart Rules page of the BeyondInsight Console | If a child Smart Rule was a Managed Account quick group, processing any Smart Rules with the child could fail with an error referencing the DisabledAtRest column. | Smart Rule processing now runs without error. |
| Smart Rule internal processing | Some timeout errors may occur during onboarding Smart Rules processing. | Performance improvements were made to some queries that are executed during Smart Rule internal processing. This helps avoid timeout processing. |
| Secrets Safe page of the BeyondInsight Console | Insufficient validation checks in the Import Secrets API. | An authorization check now ensures the calling user has sufficient access to the target folder when using the Import Secrets API. |
| SCIM API | A long wait time occurred when a large number of results were returned when attempting to access /scim/v2/Users or /scim/v2/Groups via the SCIM API. | All results are returned as expected at a much faster speed. |
| SCIM API | An attempt to query more than one attribute for a SCIM endpoint was not supported. | The SCIM API now supports multiple attributes in a query. |
| User Management page of the BeyondInsight Console | The username field in the database was too short to handle Azure User Principal Names (UPNs), causing them to be truncated. | The username field size has been increased to accommodate Azure User Principal Names (UPNs). |
| Public API | Certain API calls were taking longer than expected. This was because a cache accessed by the API was reloading its entries after about ten minutes. | The cache was adjusted so that it no longer requires a reload after the first hit. |
| Internal logic | PBSMD SSH fingerprints were not unique across multiple U-Series Appliances in a user’s environment. | Internal logic has been updated to ensure that PBSMD receives unique SSH fingerprints across multiple U-Series Appliances in an environment. |
| Asset page of the BeyondInsight Console | The Users grid would fail to load when the last logon date contained certain non-English date formatting. | The Asset > Asset Advanced Details > Users grid now loads appropriately even if the last logon date contains non-English date formatting. |
| Internal logic | When the Graph API would throw ODataError exceptions, not much information was provided about what the specific error was. | More details are now captured in the log. |
| Start menu shortcuts for BeyondInsight Configuration and BeyondInsight Console | Shortcuts were displayed in the eEye Digital Security folder instead of the BeyondTrust folder. | Removed eEye Digital Security folder from Start menu. Shortcuts now display in the BeyondTrust folder. |
| Proxy Settings page of the BeyondInsight Console | Errors messages when retrieving Entra ID groups for EPM clients did not include helpful information. | More details are now captured in the log. |
| Installer Activation Keys page of the BeyondInsight Console | The Cloud installation command, BeyondInsight URL, and endpoint were incorrect when viewing system generated key details. | The installation command, BeyondInsight URL, and endpoint have been corrected for Cloud. |
| User Management page of the BeyondInsight Console | When large AD groups were added or synced, the stored procedure that updates external attributes caused blocking in the database. | The stored procedure has been modified to prevent blocks. |
| Password Update Activity page of the BeyondInsight Console | The Password Update Activity report was missing the Asset column for Functional Accounts. | The report now has an Asset column in the Functional Account table. |
| BeyondInsight Console | Customized logos were not appearing in the web console. | Updated how custom logos are handled so that existing instructions on replacing these will continue to work. Custom logos may still need to be replaced after product upgrades. |
| SCIM API | Updating a group via the SCIM API would cause unexpected settings changes. | Only the attributes what were changed in the request are now changed. |
| Password Safe Sessions | Password Safe was unable to validate system fields from a ServiceNow ticket. | If a user does not have access to a particular managed system, the ServiceNow ticket validator fails and the user is denied access. |
| BeyondInsight internal communication | Identity Service would not update the client ID when creating a client. | The client ID is now updated so that the two client IDs match. |
| User login (Active Directory) | Active Directory users were unable to log in to BeyondInsight after being renamed in Active Directory. | The logic in the login process has been updated to handle this scenario correctly. Renamed AD users can log in without requiring a group sync to occur first. |
| Smart Rule Processing | When deploying Endpoint Privilege Management Policy, the Smart Rule failed to process in some environments. | Performance has improved when processing Smart Rules that include the deploy Endpoint Privilege Management Policy action. |
| Password Safe Sessions | When selecting “User ID Mapping : UPN format” in a ServiceNow connector, an error was returned stating “Logged in user ID is null or empty”. | The UserPrincipalName (UPN) can now validate ServiceNow tickets for Entra ID users. |
| User Management page of the BeyondInsight Console | Details sometimes did not switch when editing a different Password Safe role for a mapped smart group. | Switching between roles now correctly switches the details. |
| API Registrations page of the BeyondInsight Console | Changes to API registrations were not being audited. | User Audits now appropriately shows changes. |
| BeyondInsight Password Services | Password Services could crash after attempting multiple “keyboard-interactive” mode connections via SSH if the initial connection attempt was only partially successful. | The service has been updated to limit the number of “keyboard-interactive” attempts made. |
| BeyondInsight API | Any failed API authentication would send an email to the administrator email account. | This has been deprecated, and emails for failed API authentications are no longer sent. |
| Access Policies page of the BeyondInsight Console | If an admin created an access policy not attached to a requestor group, and then a requestor with a different access policy created and actioned a request, admins were unable to delete the new access policy. | The dependency check logic around access policy deletion is improved. Admins can now delete new access policies in this scenario. |
| BeyondInsight Configuration > Secure Remote Access > Connect to Secure Remote Access area | Missing validation and empty default values could lead to errors in the log files if these values were saved by the user. | The field validation and default port value were updated on this form. |
| Internal logic | Insufficient validation was used on LDAP query creation. | Enhanced validation for directory queries to mitigate the creation of invalid LDAP queries. |
| Smart Rules | The ordering of actions displayed in a Smart Rule when editing was not consistent between creation and editing. | The Smart Rule actions are now sorted consistently regardless of whether the Smart Rule is being created or edited. |
| Sessions grid | On the Sessions grid in the Password Safe portal, the column picker contained a duplicate “Status” column entry. | The duplicate “Status” column has been removed. |
| BeyondInsight Configuration > IP Allow List | When configuring an IP Allow List rule with an IP range, there was no validation to prevent a user from entering a “From IP Address” value which was higher than the “To IP Address” value. Attempting to save a rule with this misconfiguration would display a generic error message. | The IP address range is now validated in the input form, with informative messaging if the data is not valid. |
| Password Safe | If a ticket was supplied when creating a request and ticket validation failed, only a generic validation error was shown, which may have been insufficient to troubleshoot the error. | Additional error messaging is now shown in the details of the error message that occurs in this scenario. |
| Workforce Passwords Browser Extension | If a Workforce Passwords extension was in use while the Password Safe instance was upgraded, new features did not always appear right away. | The Workforce Passwords Browser Extension now shows new features right away when the Password Safe instance is upgraded, even if the extension is in use. |
