BeyondInsight and Password Safe 26.3 release notes

Application Connection Sets let a remote application draw credentials round-robin from a pool of managed accounts instead of a single account, so concurrent users no longer share or take over the same session. You define the set, add the managed accounts that belong to it, and specify the target server and port the application connects to, such as a Remote Desktop Services host.

• Password Safe assigns the next available account in the set when a session starts and blocks the session request when every account in the set is in use.
• A global session cooldown buffer of two minutes prevents an account from being reassigned immediately after a session ends.

ℹ️

For more information, see Configure Application Connection Sets for Remote Applications.

You can now store a time-based one-time password (TOTP) secret key alongside a credential, view the current code, and copy it when you sign in to a target application. This removes the need to keep authenticator secrets outside of BeyondInsight.

• Store a TOTP secret on a credential in Secrets Safe, then view and copy the current code from the web console or retrieve it through the API.
• Copy or autofill the code directly from the Workforce Passwords browser extension.
• Use TOTP as the multi-factor method when checking out a Password Safe managed account.

ℹ️

The maximum length of the TOTP secret key differs by credential type:

• 1024 characters in Secrets Safe
• 255 characters for Password Safe managed accounts.

For more information, see Store TOTP secret key in Secrets Safe.

Reporting and subscriptions features in on-premises deployments are now more closely aligned with the experience available in Password Safe Cloud. This is foundational work required to remove the Analytics & Reporting feature’s dependency on SSRS and includes some exciting new features for on-premises customers.

• Report Subscriptions can now be delivered as file downloads, either from an interactive grid or via the Public API
• Report Subscriptions now offer an email delivery method that does not rely on SSRS, in which a link to the file download is sent by email.
• Report subscriptions now support the creation, editing, and viewing of a logical custom name, making it easier to tell apart multiple subscriptions for the same report
  • When editing report subscriptions, the selected parameter values used for the report can now also be modified
  • Reports that are not available without SSRS have been deprecated. Equivalent non-SSRS reports have been added wherever possible.

🚧

Important

• These changes apply to on-premises deployments. These new capabilities are already available in Password Safe Cloud, which does not and has never relied on SSRS.
• These new features do not apply to subscriptions created for reports in the DEPRECATED folder.
• You cannot edit subscriptions for deprecated SSRS reports, and those subscriptions do not support a logical custom name. Shared folder and email delivery remain the only options for those subscriptions.

For more information, see Analytics and Reporting.

The Smart Rule editor now keeps your selections consistent as you page through and filter a selection grid, and the Smart Rules page loads reliably regardless of the reprocessing limit a rule holds.

ℹ️

For more information, see Smart Rules: Configure.

The Create Smart Rule button now opens a selection list so you choose the Smart Rule type before the configuration form opens. This makes the available rule types clear up front and reduces the chance of creating a rule of the wrong type.

ℹ️

For more information, see Create Smart Rules type.

The Analytics and Reporting Configuration Wizard includes an optional step that backs up existing report subscription details from the Report Server database, so subscription configuration is preserved when you reconfigure reporting.

This feature does not create new subscriptions. Instead, it provides subscription information that helps users manually recreate existing subscriptions.

🚧

Important

This change applies to on-premises deployments only.

Reporting continues to receive targeted performance work across releases. The following reports and items include performance enhancements:

• Smart Group parameter filter dataset on all reports
• Secrets Safe Entitlement Report
• Managed Account Password Age Report
• Account Password Age by Last Scan
• Password and Session Activity Report limit increase from 50,000 to 250,000 rows.

• Time-based one-time codes (TOTP) for Secrets Safe credential secrets
  A credential secret can now carry a TOTP configuration, and the current code can be retrieved through the API.
  • GET /api/public/v3/secrets-safe/secrets/{secretId}/totp/code: Returns the current one-time code with its validity window (Code, ValidFromUtc, ValidToUtc).
    Requires Secrets Safe (Read) or Workforce Passwords (Read).
• New request body version 3.3
  There is a new request body on version 3.3 to the following API endpoints:
  • POST /api/public/v3/secrets-safe/folders/{folderId}/secrets
  • PUT /api/public/v3/secrets-safe/secrets/{secretId}

Version 3.3 adds TotpEnabled and TotpSecretKey to the credential body. TotpSecretKey accepts a Base32 key or an otpauth:// URI and is required when TotpEnabled is set to true.

On update, null leaves the setting unchanged, false disables it, and true provisions or replaces it. The secret key is never returned in any response.

Secret response models now also return TotpEnabled and TotpParameters (Digits, PeriodSeconds).

• Connection Set credentials on applications
  
  GET application responses now include the ConnectionType property, which identifies the credential type used by the Application Session. The property returns the following:
  • ManagedAccount
  • FunctionalAccount
  • ConnectionSet for round-robin credential assignments

Active Directory, LDAP, and Microsoft Entra ID users can now sign in to Password Safe on Pathfinder with their existing directory accounts. For AD and LDAP, Password Safe acts as the Pathfinder proxy site: Pathfinder sends the user's credentials through a Resource Broker to Password Safe, which checks them against your directory and returns the result. Entra ID users sign in through Pathfinder SSO and are set up in Password Safe as Entra ID users.

ℹ️

This applies only to Password Safe Cloud on Pathfinder.

For more information, see Configure LDAP in Pathfinder and Configuring SAML User Mappings in Pathfinder.

You can now add and manage Active Directory, LDAP, and Microsoft Entra ID users and groups in Password Safe on Pathfinder. This works in User Management and through the Public API. You can then give those groups permissions.

• Active Directory Group Sync and Entra ID Group Sync are now available in Pathfinder mode, as is the Use Group Resolution option on directory credentials.
• Assign roles, permissions, and Smart Group access to directory groups. Group membership is checked at sign in.

ℹ️

This applies only to Password Safe Cloud on Pathfinder.

For more information, see Sync Entra ID in Password Safe on Pathfinder.

A new SAML User Mappings page under Authentication Management lets you choose how SAML sign ins from each identity provider match to Password Safe users.

• Choose a mapping type for each identity provider (issuer): None or Active Directory.
• With Active Directory, a sign in whose SAML assertion includes a security identifier (SID) is matched to the Active Directory user with that SID.
• LDAP mapping is handled with the None/legacy logic.

ℹ️

This applies only to Password Safe Cloud on Pathfinder.

For more information, see Configure SAML user mappings in Pathfinder.

Set up SCIM once in Pathfinder, and Password Safe stays in sync as users and groups change in your identity provider. Pathfinder sends user and group changes to Password Safe, which creates, updates, and removes the matching users and groups automatically.

• Users: Creates and updates, including renames, are synced. Deleting or deactivating a user disables the Password Safe account, so release history is kept.
• User type comes from externalId: An Entra object ID creates an Entra ID user. A distinguished name creates an Active Directory or LDAP user, checked live against your configured directories. Any other value, or no match, creates a local user.
• Groups: Creating, renaming, and deleting groups is synced, along with membership changes. Provisioned groups are local groups. A local group and a directory group can't share the same name.
• Renames keep access: Users and groups are tied to their Pathfinder identity, so renaming one in your identity provider updates the existing Password Safe account or group. Memberships and permissions stay in place.
• Permissions stay in Password Safe: Pathfinder manages group existence and membership. Assign roles, Smart Groups, and permissions to provisioned groups in Password Safe.

🚧

Important

• Check your externalId mapping before you turn on provisioning, because it sets the user type. To get directory users, the matching Entra ID, Active Directory, or LDAP directory credentials must already exist in Password Safe. Each LDAP server host must also be registered in a Resource Zone.
• Point your identity provider at Pathfinder. Password Safe doesn't provide a SCIM endpoint in Pathfinder mode.

ℹ️

This applies only to Password Safe Cloud on Pathfinder.

For more information, see SCIM provisioning.

Directory attributes for Active Directory and Microsoft Entra ID users are now available in Pathfinder mode.

• View directory attributes in the PAM configuration panel and in Account Settings.
• Smart Rules can filter on directory attribute values.
• The Dedicated Account Smart Rule filter now offers Directory Attribute Match.

ℹ️

This applies only to Password Safe Cloud on Pathfinder.

For more information, see Directory attributes and Dedicated Smart Rules.

On Pathfinder, every sign in passes through Pathfinder's OIDC handoff, so the Authentication Type audit field always shows OIDC. Sign in audits now also record a User Type (Local, Active Directory, LDAP, or Microsoft Entra ID), so you can tell which kind of account the user signed in with.

• User Type is added next to Authentication Type. It doesn't replace it, so existing audit tools and parsers keep working.
• Pathfinder Audit Logs show directory users as username@domain.<Org ID>, while Password Safe User Audits show only the username. To match a sign in across both, compare the username and the time.

ℹ️

This applies only to Password Safe Cloud on Pathfinder.

When an organization administrator turns on Enforcement for the IP allowlist in Pathfinder, Password Safe now applies the same allowlist to the network security rules on your Password Safe Cloud instance. Only approved public source IP addresses can reach the instance, so the allowlist protects Password Safe as well as Pathfinder.

• You manage the allowlist in Pathfinder only. Whenever entries change or Enforcement is turned on or off, Password Safe updates its rules to match.
• Turning off Enforcement stops blocking traffic but keeps your entries.
• Changes aren't instant. Pathfinder settings can take up to five minutes to apply.

🚧

Important

Password Safe applies the allowlist exactly as Pathfinder sends it, and doesn't automatically allow your Resource Broker IP addresses. Before you turn on Enforcement, add the public egress addresses your Resource Brokers use, along with your user, VPN, and integration networks.

If administrators get locked out, there's no in-product override. Contact BeyondTrust Support for help.

ℹ️

This applies only to Password Safe Cloud on Pathfinder.

For more information, see Configure IP allowlists in Pathfinder.

BeyondInsight now displays in the language you select in the Pathfinder platform menu, so you no longer configure a separate language setting in BeyondInsight.

• Your selection follows you across Pathfinder applications. BeyondInsight reads the language at startup, so a language you select in another Pathfinder application is already in effect the first time BeyondInsight loads.
• If you select Browser Default, BeyondInsight uses your browser's current language setting. If you change your browser language, BeyondInsight automatically updates to match only if the browser language matches one of the languages that BeyondInsight supports. Otherwise, selecting Browser Default results in BeyondInsight displaying in English (United States).
• BeyondInsight ships English, French, German, Japanese, Korean, Portuguese,and Spanish.

❗

Important

This change applies only to BeyondInsight running in Pathfinder.

On-premises and cloud installs keep BeyondInsight's own language selection on the sign in page and in the header.

ℹ️

For more information, see Language selection in BeyondInsight.