Cumulative changes: 24.04 through 26.0.0
This topic lists the features and improvements available when you upgrade from SecureAuth IdP release 24.04 to 26.x, through 26.4.0. It includes features from the 24.04 patch releases 24.4.1 through 24.5.0, so if you're on one of those patches, you may already have some of them.
Rows that don't name a release are available in 26.0.0 and later. Other rows name the release that introduced them.
For complete list of all updates, see Release Updates 24.04 and Release Updates 26.0.0.
24.04 (base) | 26.0.0 through 26.4.0 (cumulative) | Differences |
|---|---|---|
--- | Air-gapped deployment: Support for isolated network environments running SecureAuth IdP. | Deploy in networks without internet access. Supports Windows Server 2022, FIDO2/Passkey, help desk verification, and YubiKey HOTP. |
--- | API data store support: Authenticate users through API-based data stores. | Authenticate users and read profile data through API-based data stores, with no extra customization. |
--- | Identity Pools: Manage temporary or dynamic users without enterprise data stores. | Create cloud-based user directories for contractors or temporary access. Includes group management and direct application linking. |
--- | LOA risk engine dashboard: View and analyze Level of Assurance scores across your organization. | Shows LOA scores, authentication trends, and login locations, so you can tune LOA rules without searching audit logs. |
LOA confidence scoring: 0-4 scale for confidence levels | LOA confidence scoring: 0-100% scale with customizable ranges. | More granular scoring with configurable thresholds. Default ranges: Low (0-39), Medium (40-79), High (80-100). |
User Account page: Basic profile management | User Account page: Enhanced with device management, phone/email verification, and session history | Adds device registration, custom field labels, and language support. Read-only fields display only when populated. |
SSO Portal Themes: Theme configuration for SSO Portal only. | Modern Themes: Expanded theming for multiple Identity Management pages | Renamed from SSO Portal Themes. Applies modern layouts to the User Account page, SSO Portal, and other IdM pages. |
Session timeout: Basic timeout configuration. | Session timeout: Enhanced with session expired warnings. | Modern Theme pages warn users before the session expires, with options to wait or restart login. |
SAML attributes: Standard attribute set. | SAML attributes: Expanded to include Browser Session ID, Client IP Address, and Authentication Method. | New attributes available in Advanced Settings and New Experience SAML integrations. Also available in OpenID Connect ID Token Claims configuration. |
SAML metadata: Manual file management. | SAML metadata: Enhanced with URL import/export and global domain settings. | Set a global domain for all SAML applications, and import or export Service Provider metadata by URL or file. |
Microsoft Conditional Access: Custom Controls only. | Microsoft Conditional Access: Added External Authentication Methods (EAM) support. | Support for external authentication methods in Conditional Access with Microsoft Entra ID, including certificate-based Windows authentication. See Microsoft Conditional Access External Authentication Method (EAM) integration guide |
--- | OIDC Manager: OpenID Connect and OAuth management in New Experience. | Early Access feature for managing OIDC and OAuth applications in New Experience interface. See OIDC Manager |
FIDO2 device management: Basic enrollment controls. | FIDO2 device management: Approve devices by AAGUID and validate with FIDO Alliance. | Approve FIDO Alliance-verified devices by AAGUID. Users see approved devices on the FIDO enrollment page. |
MFA initialization: Redirect to separate enrollment pages. | Inline MFA initialization: Register additional MFA methods during login. | Users enroll Push/TOTP, FIDO2, YubiKey, and HID devices during login when a required method isn't set up. |
Login options: Username and MFA methods. | QR code-only login: Option to hide username field and show only QR code. | Sign in with a session-based QR code, which is faster and resists phishing. Set it on the policy's Login Workflow tab. |
Transparent SSO: Basic SSO functionality. | Transparent SSO: Enhanced with continuous authentication support. | Post-authentication pages re-check adaptive policies and group restrictions after login, so a valid cookie can't bypass them. A feature flag turns off continuous authentication during Transparent SSO flows. Added in SecureAuth IdP release 26.0.2 |
Dashboard - User Profile Data: Basic login tracking. | Dashboard - Access History: Detailed view of user login activity. | Click an Access History count to see detailed login records. Cloud deployments only. |
Login for Windows: Standard configuration. | Login for Windows: Added Ctrl+Alt+Delete password change option. | Users change passwords through self-service or after authenticating. Faster login and a standardized interface. |
Help Desk - Password Reset: Manual password creation. | Help Desk - Generate Password: System-generated secure passwords. | A Generate Password button creates a password that meets complexity requirements. |
Policy configuration - Users and groups: Exact name matching. | Policy configuration - Users and groups: Wildcard support for names. | Wildcards now supported in Advanced Settings (Adaptive Authentication > User/Group Restriction) and New Experience (Authentication Policies > Users and groups). |
Application URLs: Standard URLs only. | Custom Application URL: Create unique URL aliases for applications. | Create user-friendly URL paths for application logins in New Experience. |
Authentication apps - TOTP: Standard TOTP validation. | Authentication apps - TOTP: Prevent re-use of TOTP codes. | New security setting prevents unauthorized use of previously generated TOTP codes. |
Regular expressions: Limited set for password deny lists. | Regular expressions: Expanded options with custom expressions. | Extended list of available regular expressions for password deny lists. Administrators can add custom expressions. |
User Account page: Standard English only. | User Account page: Customizable field labels with language support. | Translate the page into supported languages, including Spanish, French (Canadian), and Japanese, and rename field labels. |
TOTP configuration: Global settings only. | Offline TOTP: Individual setting overrides for air-gapped environments. | TOTP settings for systems without internet access. Works with SecureAuth Authenticate, the Desktop App, and standard TOTP apps. |
Password throttling: Standard configuration. | Password throttling: Enhanced for air-gapped deployments. | Improved brute-force password attack blocking without requiring connectivity. |
Risk Engine configuration: Manual updates only. | Risk Engine: Added "Refresh LOA Configuration" option. | New link in LOA provider settings to re-sync configuration with Risk Engine. Use only when instructed by SecureAuth Support. |
Authentication waiting page: Always visible during SAML post-auth. | Authentication waiting page: Toggle to show or hide during authentication. | Choose whether to show the waiting page during authentication. |
SCIM provisioning: Always includes password in payload. | SCIM provisioning: Option to exclude password from payload. | Option to leave the user password out of the SCIM payload. Some SCIM providers require it. |
Localization: Limited language support. | Localization: Added French-Canadian language support. | Expanded language support includes French-Canadian. |
LOA conditional rules: Require full configuration. | LOA conditional rules: Added "Continue to next rule" option. | New conditional rule for authentication policies supports Risk Engine learning phase. |
Audit logs - LOA: No specific LOA event tracking. | Audit logs - LOA: New Event ID for LOA scores and confidence levels. | A dedicated event ID logs the LOA score and confidence level for each authentication attempt. |
Product branding: SecureAuth Identity Platform branding. | Product branding: Updated SecureAuth branding and visual design. | New SecureAuth branding, with the same layout. |
Data store testing: Basic connection testing. | Data store testing: Fixed false negative issues with Test Credentials. | Resolved issue in cloud deployments where Test Credentials button sometimes returned false negatives for valid connections. |
Split Profile data stores: Basic configuration. | Split Profile data stores: Improved error handling and creation. | Fixed issues preventing data store selection during creation and errors when editing existing configurations. |
Dashboard: Available to administrators inside the admin console. | Dashboard: Publish the Dashboard as a standalone internal application. | SOC analysts, auditors, and help desk agents sign in to the Dashboard directly, without admin console access. You choose which reports they see and scope access by data store, policy, and user group. Added in SecureAuth IdP release 26.1.0 |
--- | Session Validation rule: Authentication rule that checks for a valid session from another realm. | Skips re-authentication when a valid session exists, for example where Transparent SSO prompts for a second factor on every login. See Policy configuration - Authentication rules. Added in SecureAuth IdP release 26.1.0 |
OpenLDAP data stores: Connect through the Generic LDAP connection type. | OpenLDAP data stores: Native connection type in the New Experience. | Native OpenLDAP support, including password reset, which didn't work reliably through Generic LDAP. Hybrid deployments only. Added in SecureAuth IdP release 26.1.0 |
Service disruption handling: Global realm-level settings in the classic experience only. | Service disruption handling: Available in New Experience policy configuration. | On the policy's Authentication Rules tab, choose what happens during IPv6 connectivity issues or service outages, from no action to refusing the request. See Policy configuration - Authentication rules. Added in SecureAuth IdP release 26.1.0 |
--- | Air-gapped installer: Installs and configures PostgreSQL automatically. | PostgreSQL no longer needs a separate server or connection strings before deployment. See Air-gapped deployment overview. Added in SecureAuth IdP release 26.1.0 |
SecureAuth Connector: No cache configuration during installation. | SecureAuth Connector 2.2.1: Cache configuration step during installation and upgrade. | Choose No Caching, In Memory (the default, 30-minute timeout), or Redis caching to reduce data store queries during authentication. See SecureAuth Connector installation and SecureAuth Connector update. Added in SecureAuth IdP release 26.1.0 |
On-premises data store configuration: Requires SecureStorage. | On-premises data store configuration: SecureStorage no longer required. | The Identity Platform stores data store settings directly. Encrypted passwords migrate automatically. Added in SecureAuth IdP release 26.1.0 |
Microsoft Entra ID data stores: Users redirected to the Microsoft sign-in page. | Microsoft Entra ID data stores: Added Validate user password option. | Username and password login workflows work with Entra ID data stores federated to Microsoft apps such as Office 365. Credentials go to Microsoft for verification. See Add Microsoft Entra ID data store. Added in SecureAuth IdP release 26.1.0 |
SSO Portal: Applications always open in a new browser tab. | SSO Portal: Added Open application behavior setting. | Choose New tab (the default) or Same tab on the SSO Portal Page configuration page. Added in SecureAuth IdP release 26.1.0 |
FIDO2 Enrollment application: Managed from the Multi-Factor Methods FIDO2 (WebAuthn) drawer. | FIDO2 Enrollment application: Managed in the Internal Application Manager. | FIDO2 Enrollment is now an internal application type. Create several, each with its own data stores, groups, policies, and email settings. Existing apps carry over on upgrade. See FIDO2 enrollment page configuration. Added in SecureAuth IdP release 26.2.0 |
Dashboard - enrolled devices: Read-only detail views. | Dashboard - enrolled devices: Unenroll devices from the Dashboard. | Unenroll several devices at once from the Authentication Types tab or the Dashboard application. Unenrolling is permanent, and users must re-enroll. See Dashboard: Authentication Types overview. Added in SecureAuth IdP release 26.2.0 |
--- | YubiKey Enterprise Attestation: Allow only the specific YubiKeys your organization bought. | Approve YubiKeys by serial number, set how strictly serials are checked at enrollment and sign-in, and revoke a key by removing its serial. See Approved YubiKey Inventory and Configure YubiKey Enterprise Attestation. Added in SecureAuth IdP release 26.2.0 |
Password suppression: Conditions do not include Level of Assurance. | Password suppression: Level of Assurance (LOA) available as a condition. | LOA is available as a password suppression condition, so users skip the password step when their confidence level meets the one you set. See Use LOA for password suppression. Added in SecureAuth IdP release 26.2.0 |
Hybrid deployment platforms: Windows Server 2025 not supported. | Hybrid deployment platforms: Windows Server 2025 supported. | Windows Server 2025 is supported for new installations and upgrades of Identity Platform 26.0.0. Windows Server 2022 remains supported. See Supported Windows servers for product deployments. Added in SecureAuth IdP release 26.2.0 |
Unique User ID: Not configurable in the data store properties. | Unique User ID: View and edit the property mapping. | Map a Unique User ID for AD, AD LDS, LDAP, OpenLDAP, NetIQ eDirectory, and Entra ID data stores. In a Split Profile, choose which member data store provides it. Added in SecureAuth IdP release 26.2.0 |
Aux IDs: Aux ID 1 through 10. | Aux IDs: Aux ID 1 through 25. | Map Aux IDs 11–25 to data store fields, like Aux IDs 1–10, and use them in SAML applications and other configurations. See List of stored profile field properties. Added in SecureAuth IdP release 26.2.0 |
Help Desk - user verification: Push to accept, with a single setting for SMS. | Help Desk - user verification: Added Symbol to Accept and separate SMS controls. | With Symbol to Accept, the user taps the symbol the agent sees, in the Authenticate app. SMS passcode and SMS login request are now separate options. See Help Desk user verification configuration and Help Desk user verification process. Added in SecureAuth IdP release 26.2.0 |
NovellSSO.aspx page: Present but unused. | NovellSSO.aspx page: Removed. | The page only worked with a legacy Novell ActiveX control in old Internet Explorer. NetIQ eDirectory data stores are unaffected. Added in SecureAuth IdP release 26.2.0 |
--- | Password breach detection: Reject passwords exposed in known data breaches. | Checks new and reset passwords against a breach database that SecureAuth hosts, and rejects any match. Off by default; requires the Prevent package. See Using a password policy in the Identity Platform. Added in SecureAuth IdP release 26.4.0 |
Level of Assurance: Confidence score ranges set globally in the LOA provider. | Policy-level Level of Assurance: Override score ranges and restrict MFA methods per policy. | Set the Medium and High thresholds, and the MFA methods offered at each level, for a single policy on its Login Workflow tab. Off by default; requires the Prevent package. See Policy configuration - Login workflow and SecureAuth Level of Assurance (LOA) Provider settings. Added in SecureAuth IdP release 26.4.0 |
Dynamic IP Blocking: Set the block threshold, block duration, and allowed IP addresses. Blocked IP addresses can't be viewed or unblocked in the admin console; contact Support. | Blocked IP addresses: View and unblock IP addresses that Dynamic IP Blocking has blocked. | The IP Filtering page lists IP addresses blocked by Dynamic IP Blocking, and you can unblock them without contacting Support. See Dynamic IP Blocking settings. Added in SecureAuth IdP release 26.4.0 |
Help Desk - user verification: Push to accept, with a single setting for SMS. | Help Desk - user verification: Added Voice OTP. | Help desk agents can verify a user with a one-time passcode read out in a phone call. Off by default. See Help Desk user verification configuration and Help Desk user verification process. Added in SecureAuth IdP release 26.4.0 |
Security questions: A fixed list of 16 questions with built-in translations. The only setting is how many questions users must answer. | Security questions: Localized and customizable, with answer rules. | Questions are translated into all 19 supported languages, and you can reword them per language in a Modern Theme. New profile settings set a minimum answer length and require unique answers. See Customize a Modern Theme, Profile, and User Account page configuration. Added in SecureAuth IdP release 26.4.0 |
--- | Dynamic AMR attribute: Tell SAML and WS-Fed applications which authentication method the user completed. | Tells the application which authentication method the user completed, so it can skip its own MFA prompt. See SAML application integration. Added in SecureAuth IdP release 26.4.0 |
SAML attribute Friendly Name: Set only in Advanced Settings. | SAML attribute Friendly Name: Set in the New Experience. | Set a SAML attribute's Friendly Name in the New Experience instead of Advanced Settings. See SAML application integration. Added in SecureAuth IdP release 26.4.0 |
--- | Identity Sources: Updated layout and a new Resources tab. | Create and edit data stores on their own page. A new Resources tab lists the applications that use each identity source. See Manage data stores, Add Split Profile data store, and Add an Identity Pool as an identity source. Added in SecureAuth IdP release 26.4.0 |
Transparent SSO: Basic SSO functionality. | Transparent SSO: Continuous authentication scoring. | Transparent SSO sessions send continuous authentication events to the risk engine, and an expired risk engine token renews without sending the user back to the login page. Added in SecureAuth IdP release 26.4.0 |
Default login page: Browser tab shows the realm's title text. No visible page heading or page description. | Default login page: Shows the organization name and a page description. | Shows the realm's organization name in the heading and browser tab title, and adds a page description, so browser safety services recognize it as a legitimate sign-in page. Added in SecureAuth IdP release 26.4.0 |