Introduced support for Okta as an Identity Provider for both Windows and macOS so that Okta group membership can be used in the Policy Editor to manage policy assignments. Active Directory Settings has also been changed to Directory Service Settings as part of this update.

📘

For more information, see Okta and EPM config guide.

BeyondTrust EPM for Windows is expanding its workstyle policy engine to support Active Directory computer groups as a filter target, giving IT and security teams a more precise, scalable way to enforce endpoint privilege policies.

Today, workstyle computer filters are limited to local OS constructs like hostnames and IP addresses. This forces admins into manual, brittle targeting that doesn't scale across large estates and leaves meaningful security gaps. With this capability, admins can reference existing AD computer groups directly within workstyle filters, applying policies to entire machine populations without managing individual device lists.

📘

For more information, see:

• Workstyles > Add filters (Pathfinder)
• Workstyles > Add filters (Classic)

Adds multi-language/locale support for macOS messages in the Policy Editor, matching the existing Windows support.

macOS Messages are now configurable for multiple languages, allowing you to translate policy message strings to their native locale on the endpoint. The macOS QuickStart has been updated to parity to Windows QuickStart which include Dutch - Netherlands, French, German, Italian, and Spanish.

Added Policy Editor API support for COM Windows application definitions. Read, create, and delete operations are now available programmatically against policy.

We've introduced a powerful new custom time and date filter on the Users and Events pages, giving you greater precision when analyzing your data.

You can now select a specific start and end date and time within the last 90 days, allowing you to focus on exact activity windows whether you're investigating an incident, reviewing a deployment, or tracking changes.

When loading a saved Users or Events view, the selected custom time range is now clearly displayed, ensuring full visibility into the timeframe being used before you run a query or download data.

This enhancement gives you sharper insights, clearer context, and greater confidence in your analysis.

ℹ️

For more information, see

• Events analytics and User analytics (Pathfinder)
• Events analytics and User analytics (Classic)

The Users page and the Events page now give you more flexibility in how and when you access your data. You can refine filters before running a query, then run it on demand when you're ready. This helps reduce unnecessary processing and ensures results reflect exactly what you need.

Downloading data is now even easier. You can generate a CSV on demand without running the query first. The Prepare Download modal also includes an Available Records count, so you can confirm how many records match your filters before exporting.

Together, these enhancements streamline your workflow and provide clearer visibility into your events data.

ℹ️

For more information, see

• Events analytics and User analytics (Pathfinder)
• Events analytics and User analytics (Classic)

EPM now includes a dedicated AI Configuration page, giving administrators explicit control over AI-generated insights such as JIT Session Summary. EPM AI features are off by default. You must opt in before any data is sent to a large language model (LLM) to ensure compliance with legal, privacy, and security requirements.

EPM now displays summaries (generated by a large language model) of just-in-time admin sessions directly in the user interface, giving reviewers an at-a-glance view of what the end user actually did during their elevated session and whether their activity aligned with the stated reason for access. This replaces manual, event-by-event review with a concise narrative, accelerating session audits and anomaly detection.

EPM now uses real, least-privilege validation for Amazon Web Services S3 access, replacing simulation and legacy methods to ensure accurate, reliable configuration. This update eliminates false validation failures, improves compatibility with modern IAM and S3 settings, and enhances overall security without requiring customer changes.

Administrators can now pin a specific Package Manager version for EPM Computer Groups, giving them full control over when updates are applied. Instead of automatically receiving the latest version, administrators can select a specific version from the dropdown in Manage Update settings, enabling staged rollouts and reducing the risk of unexpected changes in production environments.

The Latest Available option remains the default for organizations that prefer automatic updates. For those choosing a pinned version, we recommend selecting the highest available version that matches the current latest release (e.g., 26.1.1495 (Latest)) to ensure you start from the most current baseline.

Note: Downgrades are not currently supported. Downgrade support will be available in a future release.

📘

For more information, see Select a Package Manager version.