Entitle October 2026 release notes

Entitle now manages access to its own roles. Users request an Entitle role, such as Admin, the same way they request access to any other system. The request goes through an approval workflow, and Entitle removes the role when the time runs out.

ℹ️

For more information, see Request Entitle roles with just-in-time access.

Entitle can store and read secrets in HashiCorp Vault. You tell Entitle where to keep these secrets with the KV mount setting.

ℹ️

For more information, see Store Entitle secrets in Hashicorp Vault.

Entitle now gives you a set of built-in roles. Each role grants only the access a person needs for their job. You no longer have to make someone a full admin just so they can view logs or manage one app.

ℹ️

For more information, see Entitle roles and Grant Entitle roles to users.

You can now start access requests from ServiceNow, so users can request access in the tool they already use. Entitle handles the access request and provisioning.

For more information, see ServiceNow app for access requests​.

Entitle can now manage access to ServiceNow access controlled resources, including tables, views, scripts, processors, UI pages, UX data brokers, and GraphQL. Users request access to specific operations on these resources. Entitle creates a temporary role, attaches the requested access control lists (ACLs) to it, and assigns it to the user. When access ends, Entitle removes the ACLs and deletes the role. To use this, install the entitle_acl_access_management update set and grant the admin role to the Entitle user.

For more information, see ServiceNow​.

Entitle can manage permissions on Azure AI resources through the Azure integration. These resources include Azure OpenAI and AI Services resources, Azure AI Foundry hubs and projects, and Azure Machine Learning workspaces. To see these resources, you opt in to the resources asset type.

For more information, see Azure​.

The Entitle Terraform provider adds a write-only connection_json_wo argument to entitle_integration. Entitle receives integration connection secrets on create and update, and Terraform never stores them in state or plan files. Use connection_json_wo_version to resend a value, for example after you rotate a credential. Write-only arguments require Terraform 1.11 or later.

• The connection_json argument still works. You can't use both arguments on the same integration.
• You can get the value from an ephemeral source, such as HashiCorp Vault, AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, or an ephemeral variable.

For more information, see Entitle Terraform provider: Configure the provider

The Bulk Actions page no longer selects every integration, resource, and role when it opens. Changes now apply only to the items you choose, so an edit can’t reach your entire tenant by accident. Entitle also keeps your filter and tab selections when you switch tabs. On integration and resource pages, the Bulk Actions button now opens with only the current integration’s resources selected.

For more information, see Filtering and bulk actions

Docusign requires every account to have one permission profile. To revoke a profile that a user requested, Entitle needs a default profile to switch back to. Entitle now makes permission profiles available for request only when you set the default_permission_profile_id connection setting. To find a profile ID, go to Admin > Permission Profiles in Docusign, then copy the ID from the profile's View/Edit page.

For more information, see Docusign: Create the DS integration in Entitle

You no longer need to supply an organization name (ORG_NAME) when you install the Entitle agent. Entitle identifies your company automatically.

For more information, see Entitle agent​.

The Entitle API now lets you filter the roles, integrations, and resources lists. Before this change, you had to sort through every returned item yourself to find the ones you needed. Now you can find what you need in one request. The integrations and resources lists also show more details about each item, so you can check settings without looking up each one individually.

For more information, see the Entitle API Reference.

The Entitle API now has bulk update endpoints for roles, integrations, and resources. Before, you sent a separate request for each item. Now you send one request with a list of items and the change you want, and Entitle applies that change to every item on the list. The endpoints do the same job as the bulk actions in the Entitle web app, and they make infrastructure as code tools, such as Terraform, easier to use with Entitle.

For more information, see the Entitle API Reference.

The Active Directory integration guide now explains how to manage permissions for RDP and local admin access.

ℹ️

For more information, see Active Directory​.

The Azure agent installation guide no longer includes the steps to set the account subscription and register the Microsoft.ContainerService provider. The cluster tenant ID now comes from your Azure account.

ℹ️

For more information, see Install the Entitle agent on Azure.

The GCP and GKE integration guides now explain how to limit synced resources with scope constraints. Use organization_ids_constraints, folder_ids_constraints, and project_ids_constraints to control which parts of your GCP resource hierarchy Entitle syncs. Each constraint filters only its own level. If you set more than one, a resource must pass all of them. Listing a folder includes everything under it, and if a project’s organization or folder is excluded, Entitle drops the project even when the project is listed.

ℹ️

For more information, see Google Cloud Platform (GCP) and Google Kubernetes Engine (GKE).

The GCP agent installation guide now covers installing the Entitle agent with GCP Secret Manager for clusters that run on GKE.

ℹ️

For more information, see Install the Entitle agent on GCP.