Privileged Remote Access 26.3.1 release notes

Privileged Remote Access (PRA) can now proxy connections to Oracle databases. Database administrators and contractors connect through a protocol tunnel and keep using their local Oracle client tools. PRA injects the credentials into the connection, so users do not need to check out or handle privileged passwords. PRA logs the session, and you can audit queries that run through the tunnel. This gives you one audited path to your Oracle databases instead of direct LAN or VPN access.

ℹ️

For more information, see Protocol tunnel.

You can now choose a client certificate that is already installed on a Windows Gateway. When a web site or its identity provider asks for a client certificate during a Web sites session, Web sites presents that certificate. This lets users reach sites protected by Microsoft Entra policies that accept certificates, without adding IP address or named location exceptions. You set one certificate per Gateway, and it applies to all Web sites sessions through that Gateway. If no certificate is set, or the certificate or its private key cannot be used, the session and Gateway logs explain what happened.

ℹ️

This feature supports certificate presentation only, on Windows Gateway only. You are responsible for installing the certificate on the Gateway, making its private key available, and configuring the Entra policy that trusts it.

For more information, see Web sites client certificates.

Web sites now completes sign in flows that ask for a username more than once before asking for a password. For example, a Microsoft sign in page might send you to an identity provider page that asks for your username again, then to a password page. Web sites now handles the full sequence and injects credentials stored in Password Safe on each page. You can use Web sites with more enterprise single sign-on (SSO) applications instead of typing credentials by hand.

ℹ️

For more information, see SSO login pages.

You can now schedule Endpoint Automation jobs instead of only running them on demand. Set a one-time or recurring schedule, such as daily, weekly, or monthly, and target specific Asset Groups, tags, or sets of endpoints. Control each run with a run window, a limit on how many endpoints run at once, and automatic retries on failure. You can view, pause, edit, or cancel schedules, and see both upcoming and past runs. The audit log records who created each schedule, when it ran, and the result for each endpoint.

ℹ️

For more information, see Create a job.

AI Session Summaries has several additions:

• Retrieve session summaries through public APIs and use them in your own reporting, storage, and analysis.
• Summaries cover only 20 mins of the session recording being analyzed.
• Privileged Remote Access can create a summary when a session ends and write it into the matching ServiceNow incident. Ticket details can also pass from ServiceNow to PRA, so the summary reflects the ticket's context.
• AI Session Summaries is now available for Atlas deployments.

ℹ️

AI Session Summaries requires Pathfinder, including sites deployed on Atlas. It is not available on sites without Pathfinder.

For more information, see AI Session Summaries.

Privileged Remote Access on Pathfinder now supports FIDO2 authentication. You can register and sign in with FIDO2 security keys or platform authenticators, just as you can outside Pathfinder. When you move to Pathfinder, you keep your existing FIDO2 sign in method.

ℹ️

For more information, see Passwordless authenticator.

The Status page in /login now shows Total Active Users, right after Maximum Concurrent Users. This count includes any user(s) who have logged in and still exist in the system. It shows how many named user licenses you are using, so you can plan for licensing and renewals without asking BeyondTrust or building a report.

ℹ️

For more information, see Status page.

You can now add and manage assets (Jump Items) in /login, so you no longer have to switch between /login and the access console. The Asset tab now clearly shows each asset type. You can grant access to asset types by group or user, for both local users and identity provider users. APIs are also available for the same asset management tasks.

The Configuration API is now available through the MCP gateway. If you use an AI assistant or automation tool that supports MCP, it can now read and change PRA configuration settings without a custom REST integration. You control read and write MCP API access at the organization level, so you only grant the access you intend.

ℹ️

For more information, see Configuration API via the MCP gateway.

Copy and paste now works in Web sites sessions that run through a Linux Gateway, not just a Windows Gateway. You can copy and paste between your computer and the remote web session no matter which Gateway platform you use. If you prefer Linux Gateways, you no longer need to keep Windows Gateways just for clipboard support.

Administrators can now control the Reconnect button shown to users who join an RDP session through a session invitation link. Before this change, if the main user stepped away or locked the screen, an invited user could select Reconnect and unlock the full Windows session without signing in. You can now block this reconnect option for users who should not have it, such as vendors. This closes a path to unauthenticated access to a live Windows desktop.

ℹ️

For more information, see Terminal Sessions.

If you have the Premium SKU for PRA, you can now keep logs longer (365 days) than the current 90 day default. You can also choose which logs to keep for the longer period, instead of applying one retention setting to everything. This helps you meet audit, compliance, and investigation needs without exporting records to another system.

Important

In 26.3.1, we are only supporting the US region for this feature.

Team leads and team managers can now monitor their team members' active sessions from the web access console. Before, this was only available in the desktop access console. You can supervise your team from a browser without installing the desktop console.

ℹ️

For more information, see Monitor team sessions.

In the web access console, you can now select several Assets and start them all at once, instead of one at a time. This matches the desktop access console and saves time when you connect to several endpoints in a row.

ℹ️

For more information, see Multiple Assets Groups.

You can now save a default view for the Jump Client installer list in /login. Choose the columns that matter most to you, such as the Asset Group name, instead of seeing the same fixed columns every time. New check boxes also let you delete several Jump Client installers at once. Bulk actions require administrator permission, the same as viewing the list.

ℹ️

For more information, see Customize installer list.

You can now control Jump Client upgrades by Asset Group instead of upgrading every Jump Client at once. Choose which groups upgrade and when, so you can test a small set of Jump Clients first and roll out upgrades during your maintenance windows. Jump Clients stay usable during a staged rollout.

For more information, see Upgrade.

Vault domain discovery can now import its results automatically, so you no longer need to import them by hand. This helps you keep Assets and Vault accounts in sync with Active Directory in large or fast-changing environments.

You can now assign attended and unattended session policies to a group policy through the API. You can fully set up a group policy in one automated workflow, without returning to the UI.

ℹ️

For more information, see Link session policies.

You can now set how many days a Gateway can go without connecting before it uninstalls itself. The setting is in /login with the other Jump Client maintenance settings. The default stays at 30 days, so nothing changes unless you update it. Give Gateways that are staged early or shipped to remote sites a longer window, so they do not remove themselves before you use them.

For more information, see Install a Windows Gateway.

A new setting on the Cluster tab in /login controls whether the traffic node selector appears on the web access console login page. When it's on, users can choose a traffic node as they do today. When you turn it off, the selector is hidden and PRA connects users to the closest available traffic node automatically. This removes a choice that can confuse users. Only administrators with cluster configuration permissions can change this setting, and it stays in place after restarts and upgrades.

Cloud administrators can now choose how clients pick a traffic node in a cluster. Go to /login > Management > Cluster and select SRV Record Lookup (the default), Random, or Timezone Offset. If you use Timezone Offset, set an offset on each traffic node. If all your outbound traffic leaves through one internet egress point, you can pick a different routing option to spread sessions across several traffic nodes instead of one. Changing the method makes all Jump Clients reconnect at once, so plan the change for a maintenance window.

ℹ️

This feature is only available in the Cloud.

The direct Password Safe integration now includes features that used to require the Endpoint Credential Manager:

• Search external Assets through the Password Safe connection.
• Discover and inject credentials for more system types, including web and database systems.
• Use self-signed certificates when connecting to Password Safe.

The integration also needs fewer highly privileged Password Safe API permissions for discovery and credential injection. You can move to the direct integration without losing features and without maintaining a separate credential manager.

ℹ️

For more information, see Password Safe enhancements.

When you share a smart card reader into a session, it now stays shared if the endpoint client restarts because the Windows user changed. For example, this happens when you use the smart card to sign in as a privileged user. The client reconnects and restores the reader automatically, so you do not have to share the card or sign in again. The access console shows the reader as shared during the restart. If the client does not reconnect within the set timeout, PRA removes the shared reader. A full system reboot still removes shared readers.

ℹ️

For more information, see Smart Card improvements.

The bt command-line interface (CLI) includes improvements that make it a fully supported way to perform privileged access tasks from a terminal. If you work in a terminal or script your access workflows, you can do more without switching to a console.

ℹ️

For more information, see bt CLI guide.

The Privileged Remote Access features bar now stays pinned by default when you enter full screen mode in a session. Full screen hides the window controls, which made it hard to exit. With the bar pinned, you always have a clear way out of full screen.

ℹ️

For more information, see Pin session toolbar.

The Auth Database field on MongoDB protocol tunnel Assets is now saved permanently. Before this fix, the field could be cleared after an appliance restart, a failover or a backup restore. Changes that edited only the Auth Database could also fail to save. When the setting was lost, sessions tried to authenticate against the item's Database instead, so sign ins failed for MongoDB users defined in a different database.

If an existing MongoDB Assets Auth Database was cleared before you upgraded, it has to be entered again.

Starting with the 27.1 release, Privileged Remote Access no longer supports RADIUS authentication. If you use RADIUS as an authentication provider, migrate to a supported authentication method, such as SAML, LDAP, or another supported two-factor authentication option, before you upgrade to 27.1. This notice gives you time to plan your move on your own schedule.