Release Notes

With this release we're introducing a new piece of PAM on PAS functionality with the ability to run IP Range Discovery Tasks. This allows administrators, or users with permissions, to run tasks that scan defined IP ranges on a selected gateway, report on the findings, and import discovered items directly to applications.

This feature turns raw scan results into structured objects, streamlining onboarding by automatically identifying hosts and services across defined network segments. It removes manual inventory collection, helping operations teams spend less time hunting for systems, validating IPs, reconciling spreadsheets, and importing data directly to the system.

Credentials Pools, a traditionally-PAS feature, were rebuilt in the new PAS Secrets Vault. Secret Pools allow administrators to store a group of credentials together so that when a service is launched, an available secret is extracted from the pool for use, thus allowing multiple users to connect to an endpoint simultaneously.

This is a widely utilized feature and a key differentiator for us compared to others in the market. Our customers use this feature because it allows concurrent connectivity to an endpoint using secure credential assignment that follows a least privilege access model.

Exclusive checkout, a common PAM offering, is a vault-enforced state where a secret can be used by exactly one user or workflow at a time. While checked out other users can’t view, inject, rotate, or modify that secret until it’s checked back in or force-released by an admin. Other PAMs do this, but our differentiator in this is that our version is a step stricter since other PAMs do not lock the entire secret down when it is checked out. Exclusive checkout solves for accountability by locking a secret down to all other users while it is checked out.

The goal of this feature is to provide more security and less exposure by locking the secret down while it's checked out. Since all actions are recorded in an audit, customers can feel confident they will be compliant and feel safe at the lowered risk of exposure.

Other enhancements and updates for this release are:

• VNC audit conversion now happens server-side and no longer requires downloading and running additional components in order to access VNC/desktop sharing audit.

• We've added a rule to enforce an 'only one instance per user' rule for the connection manager.

• Improvements were made to error messages to make them more intuitive for the end user.

• Improvements were made to the connection manager for launching custom clients.

• Resolved a login issue that was causing users from outside an authorized network to receive errors instead of the configured additional MFA check.

• Resolved an issue that was causing an interruption for the Connection Manager, impacting both regular connections and Nexus connections.

• Resolved a sorting issue on some of the VPAM tables.

• Resolved an issue where some new user permissions were not appearing on certain servers.

• Resolved an issue where users were receiving 'unauthorized' errors after logging in.

Administrators, and users who manage credentials, now have the ability to scope down access to sensitive credentials based on User Group assignment. Assigning a Secret to a specific User Group allows administrators to provision access more stringently by only allowing specific users to create, view, and manage Secrets. 

Implementing a way for administrators to tighten down access controls provides better security hygiene by eliminating exposure of sensitive credentials to users who don't need that level of access, and it aligns with regulatory and cyber insurance requirements by providing audit trails and proof of following a least-privilege model. This new option gives users a way to give/revoke access to certain secrets, by either granting general access via permissions, or by scoping down the secret itself so that only certain users within a user group can manage secrets.

Other enhancements and updates for this release are:

• Added support for additional SSH key types for SSH Audit.

• Improvements to Plugin management were made so that when a user installs a new version of an already existing plugin, all existing configurations are automatically migrated to the new version.

• Made an improvement to our end user's experience with using CyberArk credentials so that responses are case sensitive.

• New System Settings pages and configuration options were added to the VPAM New UI.

• Resolved an issue where the BeyondTrust plugin was ignoring SSL Certificate configuration options.

• Resolved an issue where user identification data was being incorrectly displayed when switching between the VPAM legacy UI and new UI.

• Resolved a credential error on product startup.

• Resolved an issue where vendor reps could not reset their password.

• Resolved an Access Request issue where Approval Emails were directing users to the legacy UI, when the request was generated from the new UI.

• Resolved an issue with the password reset workflow.

• Resolved an issue with IPConnect and host name mapping with a host set to 'Launch via Host Name'.

We’ve added new UI controls to the Device Certificate configuration screen that lets VPAM administrators enable, disable, and adjust device posture checks directly. These controls manage both Active Directory Certificate Service (ADCS) validation and Posture/Safety Checks, ensuring that connections are only allowed from trusted machines with valid client certificates and compliant security settings (like up-to-date antivirus and firewall).

This update gives administrators full self-service control over security configurations without needing Imprivata assistance, while also improving overall system protection. By enforcing posture and certificate validation at the device level, it limits attack exposure and ensures that both the machine and the user are properly authenticated before access is granted.

Other enhancements and updates for this release are:

• Imprivata VPAM now automatically update Azure Entra ID (formerly Azure AD) SAML signing certificates during key rollovers, eliminating manual intervention. The system also supports multiple active certificates to ensure uninterrupted SSO authentication.

• Imprivata VPAM now support additional Syslog protocols, including RFC 3164 and RFC 5425 (TLS over TCP), alongside the existing RFC 5424 (UDP) implementation. This enhancement enables more secure, flexible, and standards-compliant event logging across varied network environments.

• We've added OAuth 2.0 support for SMTP so customers can authenticate securely with Microsoft 365.

• Improvements were made to the process of syncing Gatekeeper hosts from the Nexus.

• New System Admin controls were added to the VPAM New UI.

• Resolved an issue where customers were unable to connect to XenApp service.

• Resolved an issue where users were experiencing errors when logging in using an SSO method.

• Resolved an issue with Reports V2 where an invalid sort was causing an error.

With this release we're excited to offer HTML5 browser-based connectivity for RDP and SSH sessions, which allows users and vendors to access internal systems, resources, and virtual desktops without the need for downloading and running the connection manager. This feature is offered alongside our connection manager, so users can decide on their connectivity method when they go to connect.

This new connection method offers significant benefits for all user and vendor connections by enabling real-time, cross-platform, and secure communication all through a standard web browser. This method of connectivity ultimately allows our customers and other third-party users to launch RDP and SSH services without using the connection manager, offering faster, more dynamic connections to applications. End users get a more intuitive and interactive experience when going through the connection process, and IT workload is reduced since no software has to be installed. Most importantly, this offers improved security and control since communication is tunneled through secure protocols.

Hand-in-hand with the HTML5 browser-based connectivity, we're excited to introduce in-browser session playback for RDP and SSH audit files. Previously, audit playback required a separate download and legacy converters, but now users can view audit playback directly from the UI.

Along with many of the security and user experience benefits, giving users the option to view audit playback in-browser, versus downloading files, reduces storage needs and conversion overhead since users can play videos right in the browser. This optimized format improves customer satisfaction and optimizes the entire user journey with the combination of browser-based connection and playback.

Before this release, ImprivataPrivileged Access Security (PAS) products supported best practices checks for HIPAA, PCI, NERC, and CJIS standards. This release offers users to enable a set of checks against NIST (National Institute of Standards and Technologies) to ensure their organization meets the controls and recommendations suggested by that regulatory entity.

Adding this standardization to our toolbelt of industry-specific checks enables our customers in government and other highly regulated industries to demonstrate their adherence to NIST standards alongside other regulatory checks offered with ImprivataPrivileged Access Security (PAS) products. These best practice checklists provide a single pane of glass for compliance posture and reduce manual cross-reference efforts to ensure compliance.

Other enhancements and updates for this release are:

• When launching RDP connections Users can select their screen size when launching browser-based RDP connections.

• Users can now access our public Help Documentation site directly from the UI Help menu.

• Users can view a detailed Task History on the Task Details page.

• Resolved an issue where a character limit was preventing user from creating or editing tunneled services

• Resolved an issue where users were unable to enable application groups.

• Resolved an issue where Vendor Email Verification was not being triggered on Vendor Rep Login.

• Resolved a Nexus issue where one customer was not seeing the option to connect.

• Resolved an issue where user was receiving an error when downloading a video audit.

• Resolved an issue where connections were timing out due to Gateway maintenance tasks on a high number of Gateways.

• Resolved an issue with inconsistencies on the User Preferences page.

To tighten control over sensitive credentials, we will enforce a permissions-based gate on viewing protected secret fields; only users granted the right permission can unlock and reveal raw secret values. Following each unlock, any rotation task linked to that secret will automatically trigger after a configurable delay, ensuring that no credential remains exposed longer than necessary and maintaining a minimized “exposure window” for users.

This functionality improves compliance and auditability by logging unlock events in the admin log and linking rotation tasks to the triggering user, enhances security posture via automatic, time-bound credential rotation, and ultimately gets us one step closer to our 'PAM in PAS Co-platforming' product goals.

Before this release, the Tunneled Services only displayed either Online or Offline. When a tunnel is Offline, there is now a way to reset it or test it from the UI, or display contextual help information if something is misconfigured or not working.

This work helps our PAM integrations and syslog export with setup and testing by giving users the capability and guidance to test and troubleshoot in the UI. Additionally, this streamlines troubleshooting and resolution of connectivity issues that impact these service integrations which ultimately helps our internal teams.

Other enhancements and updates for this release are:

• Additional data points were added to the Audit Archival Storage tables to reflect the storage usage based on the method used.

• If you have multiple servers, automated emails will now include the specific server name.

• The new connection manager is now able to authenticate and connect to an HTTP proxy server.

• Resolved an issue where the connection manager's executable file was being flagged by Microsoft Defender SmartScreen for not having a publisher.

• Resolved an issue where user was receiving an 'Invalid Application ID' error when deleting applications.

• Resolved an issue where the History tab intermittently showed a 'Something went wrong' error.

• Resolved an issue where customer was seeing blank SSH audit files with SFTP file transfers.

• Resolved an issue where Gatekeeper Registration information was not showing in the Admin Log.

• Resolved an issue where users were experiencing an 'Invalid Filter Parameter' error when in the Edit Multiple Applications > Edit User Groups workflow.

• Resolved an issue where service connection retries were not being captured in the Admin Log when the service was using a stored credential.

• Resolved an issue where users were receiving a 'The server failed to provide a valid SSL certificate' error when launching the new connection manager.

• Resolved an issue where a customer could not log in because the Terms & Conditions were not enabled.

• Resolved an issue where vendor representatives could not successfully activate their account when the new VAPM UI was disabled.

• Resolved an issue where users were unable to configure or use LDAPS servers.

Our new connection manager is out of Beta! This milestone release of this feature has overall improved stability and functionality with all services working to include a better end user experience for both Mac and Windows users.

The New C-based connection manager rewrite is finished and will be the default connection manager for both the New UI and Legacy UI. This enables new capabilities such as the Containerized Network feature as well as removing the dependency on Java. The new connection manager capabilities include integration with Nexus, HTTP Tunnels, Virtual Interfaces, IP Connect, FTP support, and Magnet Links. It does not include support for UDP at this time. Note that users can still download and use the Legacy Connection Manager (SCM) if they need it.

This release introduces VPAM's first official Internal Access application controls, providing administrators with the ability to require internal users to request and be approved for access to applications. Controls are turned on/off at the system administration level and can be granularly controlled and configured at the User Group level, providing both broad and specific controls.

Administrators can configure prescriptive workflows for their internal users which require users to request access to an application before connecting to it. This workflow previously existed for vendor reps, and we've reconfigured it to also apply to internal users, providing administrators with granular controls over which users can freely connect to applications and which ones must request access.

This release introduces the ability to configure credential rotation tasks for local RDP and SSH credentials. Whoever is configuring the tasks can configure the settings for tasks to be rotated based on events, such as the use of the credential, or run on demand. The new password is created based on criteria defined in the customized password policy.

25.1.5 introduced task rotation for AD credentials, so this addition expands the capabilities with new credential and task types for RDP and SSH, allowing for broader use of the secrets and password rotation tasks.

Other enhancements and updates for this release are:

• Credential information is now available in the History tables and Session ID tables.

• When using AWS and Imprivata's SES, we've made some improvements so that our SES recognizes domains outside of our default ones.

• We've improved our Java8 optional support so users will no longer see error messages when editing multiple applications.

• Performance enhancements and maintenance fixes went in to the new Connection Manager.

• Users can now edit and delete Password Policies in the VPAM new UI.

• Improvements to the new VPAM UI around user management, approval forms, and modifying approvals

• Resolved an issue where Credential Pools were not working for RDP connections over Nexus when the CPAM had version 25.1.5 and the VPAM had either version 23.3 or 24.2.

• Resolved an issue with where the sorting function in Reports v2 wasn't working.

• Resolved an issue where valid authentication combinations were returning errors.

• Resolved an issue where users were unable to change the name of a Gateway.

• Resolved an issue where an intermediate certificate was being placed into the SSL chain twice.

• Resolved an issue where the server was not checking or recognizing additional LDAP servers when the first one failed.

• Resolved an issue where connections were timing out due to Gateway maintenance tasks on a high number of Gateways.

• Resolved an issue where Gateways stopped trying to connect after multiple server restart events.

Our new connection manager is out of Beta! This milestone release of this feature has overall improved stability and functionality with all services working to include a better end user experience for both Mac and Windows users.

The New C-based connection manager rewrite is finished and will be the default connection manager for both the New UI and Legacy UI. This enables new capabilities such as the Containerized Network feature as well as removing the dependency on Java. The new connection manager capabilities include integration with Nexus, HTTP Tunnels, Virtual Interfaces, IP Connect, FTP support, and Magnet Links. It does not include support for UDP at this time. Note that users can still download and use the Legacy Connection Manager (SCM) if they need it.

This release introduces VPAM's first official Internal Access application controls, providing administrators with the ability to require internal users to request and be approved for access to applications. Controls are turned on/off at the system administration level and can be granularly controlled and configured at the User Group level, providing both broad and specific controls.

Administrators can configure prescriptive workflows for their internal users which require users to request access to an application before connecting to it. This workflow previously existed for vendor reps, and we've reconfigured it to also apply to internal users, providing administrators with granular controls over which users can freely connect to applications and which ones must request access.

This release introduces the ability to configure credential rotation tasks for local RDP and SSH credentials. Whoever is configuring the tasks can configure the settings for tasks to be rotated based on events, such as the use of the credential, or run on demand. The new password is created based on criteria defined in the customized password policy.

25.1.5 introduced task rotation for AD credentials, so this addition expands the capabilities with new credential and task types for RDP and SSH, allowing for broader use of the secrets and password rotation tasks.

Other enhancements and updates for this release are:

• All changes to Global RDP settings are now logged in the Admin Log.

• CRUD operations around User Management were added to the VPAM new UI.

• Added the ability to create customized Password Policies in the VPAM new UI.

• Resolved an issue where user could not select and save a custom service on a host.

• Resolved an issue where Internal Server Error was appearing when user tried to create a new report in reports v2.

• Resolved an issue where Internal Server Error was appearing when user sorted/filtered a reports v2 dashboard.

• Resolved an issue where convoluted user session history data was appearing on the History tables.

• Resolved an issue where Nexus RDP connections with attached Credentials were failing when the CPAM customer was on 25.1.5 and the VPAM was on 24.2 or older.

• Resolved an issue where admins were seeing audit entries attached to the wrong session user.

• Resolved an issue where QuickConnect sessions were throwing log errors but no visible error for the end user in the UI. Note this issue was only observed on new databases.

• Resolved an issue where data was not reflected in the Admin log on subsequent connection attempts to a service.

In a continuous effort to improve the new Secrets Vault, we've added the ability to create and view Password Policies that can be applied to the rotation task. Users can set the policies to follow industry or regulatory best practices and configure details such as minimum/maximum length, letter, and number policies. When passwords are rotated the newly created passwords will follow the policy that's set.

Allowing users to set password policies gives them more control over password strength. These policies aim to enhance security by ensuring strong, unique passwords, while preventing reuse of old ones.

This new functionality, suggested by one of our CPAM customers, allows administrators to define custom parameters for the Client Title launch parameters. The customized names will appear in the window and tab header, making it easier and faster to find a window. This improvement applies to both VPAM and CPAM.

Allowing users to customize the naming convention of title bars allows them to display what they think is the most relevant information at the beginning of the text string, ultimately making windows much easier to find if multiple sessions are ongoing at the same time and easier to switch between them. The customized naming convention appears when a user hovers over a minimized window.

Other enhancements and updates for this release are:

• An improvement was made to the debug console that allows users to click on the 'Not Healthy' status on the status of Disaster Recovery Diagnostics to view and investigate the details of the Health Check.

• Application Labels can now be created, edited, and deleted in the VPAM New UI.

• User Groups can now be created and viewed in the VPAM New UI.

• Vendor Reps can use previously entered values to fill out the Vendor Connection Form in the VPAM New UI.

• Activities related to Tasks are now recorded in the Admin Log.

• Filezilla's internal putty process will default to IPv4 resolution when connecting to an SFTP service on MacOS.

• Resolved an issue where the Vendor Self-registration button was appearing on the login page when the setting was disabled.

• Resolved an issue where Vendor Reps were not being prompted for MFA in the Legacy VPAM UI.

• Resolved an issue where the BeyondTrust PAM plugin was not working correctly.

• Resolved an issue that prevented users from downloading Scheduled Reports on-demand.

• Resolved an issue related to Disaster Recovery Health Checks where the UI was timing out before the health check was complete.

• Resolved an issue on where the Connection Manager (beta) was not terminating correctly on Linux.

With the 25.1.4 release, VPAM introduces the new vault and tasks. Tasks allow for the scheduling and management of specific events, such as password rotation, and will see growing capabilities as new tasks are developed. Task history is captured to show details around the status of tasks executed and the user initiating any task. Tasks are a core piece of how users can manage capabilities such as password rotation in a straightforward way.

Adding this functionality was a requirement to give users a place to configure, schedule, and execute credential rotation tasks.

With the 25.1.4 release, VPAM introduces the ability to rotate Active Directory credentials. Users can now create tasks that allow for rotation of AD account passwords.

Adding this functionality automates password management with centralized control, significantly enhances security by reducing the risk of compromised credentials and breaches, and minimizes the window of opportunity for attackers. Delivering this functionality on the PAS platform is the first major feature in our co-platforming roadmap that gives customers a better single solution for privileged access.

Other enhancements and updates for this release are:

• Entra ID and x509 were added as authncontext SAML configuration options.

• Improvements were added to the VPAM new UI to include enhancements to User Management and Application Labels.

• Ephemeral tokens now work with VNC credential injection.

• An issue was resolved where Approver users were receiving an error when trying to approve Nexus vendor application requests.

• A pagination issue was resolved that resulted in only 25 hosts displaying in an application.

• An issue was resolved where SCP/SFTP audit logs were broken.

• An issue was resolved where the Vendor Approval settings were not sticking when saved.

• An issue was resolved so that ARM Linux receives the proper architecture Java package on upgrade.

• An issue was resolved where Nexus vendors were unable to register or connect to Gatekeeper V2 with a proxy.

• An issue was resolved which caused hostname mapping to fail after upgrading from Windows 11 23H2 to 24H2 with IP Connect installed.

With the 25.1.3 release, the VPAM new UI has added functionality within User Management. This includes viewing a user details page, users managing their own preferences, and the ability to enable/disable users.

Adding this functionality to the new UI prevents Admins from having to toggle back and forth between the new and legacy UI, which ultimately prevents frustration and saves the end user time when managing internal users.

Pre-flight checks were added to the self-upgrade process via the CLI.

The CLI now has the ability to run the pre-flight check without performing the upgrade, including checking on Disaster Recovery notes. If anything is amiss in the DR configuration the pre-flight check will fail and notify the user. Adding this functionality will empower hundreds of customers to self-service their upgrades while reducing operational burden from our Support team.

Other enhancements and updates for this release are:

• Pre-connection notifications were added to the new VPAM UI, allowing administrators to configure the settings and end users to receive the notifications.

• Resolved an issue that prevented users from inputting an MFA code into the login screen successfully. The MFA login workflow works as expected now.

• Resolved an issue that prevented reseting registration keys in some circumstances.

• Added a configuration option for disabling port monitoring from the Gatekeeper or Gateway. When this feature is disabled, the Gatekeeper or Gateway will not check if configured services are listening, and users will not see those services rendered as red text in the UI if no service is available on the remote system.

With the 25.1.2 release, the VPAM new UI added an ad hoc reporting feature to the History and Application History tables by allowing users to export the data in those tables. Users can specify a preferred date range and download the file as an .xls or .csv.

Exportable history tables allow users to filter and export all their historical data, or on an application-by-application basis, without navigating to the reporting module, providing more granularity and control over reporting functions directly from the page they’re on.

New checks and regulations added to our CJIS, HIPAA, and PCI Best Practices Checklists. The additions include updates and additions around password length and requirements, MFA, account expiration, client anti-virus health, and disaster recovery.

These additional checks ensure organizations continue to operate within regulatory boundaries, minimize operational risk, and maintain quality and efficiency within their industry.

Other enhancements and updates for this release are:

• The Imprivata FTP client is now enabled for Linux (Alma, CentOs and Ubuntu) for FPT and SFTP services.

• Improvements were made to the self-upgrade process for an overall better user experience, including enabling the self-upgrade dashboard by default.

• An issue was resolved in the VPAM new UI that prevented users from launching RDP within the RSSRDP client.

• An issue was resolved which allowed disabled non-admin users to log in to the mobile app and approve access requests.

• An issue which was causing unintended side effects by checking then unchecking the "Require MFA validation from iDP for SSO users" setting has been resolved, and the customers experiencing this issue should not experience further inconsistencies when configuring this setting.

We are releasing all available VPAM functionality in the new UI, including: Application & Vendor Management, Gateway Management, Vendors & Internal users can connect to applications, a new and refreshed view of History and Audit Data, and the Admin Log.

Not only does the new UI have a beautiful new look, it also provides an improved, more streamlined experience for all users of VPAM. Each component has been thoughtfully redesigned to quickly surface relevant information with less clicks and page loads, and to minimize the need to reference external product documentation.

As requested by one of our most enthusiastic customers, custom form fields that are filled out by vendors who are requesting access to an application will now appear in the notification emails that administrators and approvers receive.

Showing the custom form fields in the notification email provides even more detail and context to the person who is approving access to an application so they can make informed decisions on granting access without having to log in via the web portal.

Other enhancements and updates for this release are:

• Continued updates and bug fixes for the new Connection Manager are available in this release for sites who have enabled the beta of this from System Settings.

• If any issues arise while executing the self-upgrade option, a “reason for failure” will be logged in the Admin Log within the UI as well as via CLI output notification sent to the user.

• Resolved an issue that prevented Vendor Approval Request forms from displaying on Nexus connections.

• Resolved an issue that prevented copy/paste from working correctly on RDP sessions.

This release includes session management for ending sessions or disconnecting users, creating Gateway Instances and access to HD Audit (video) for RDP sessions through the new UI.

This release is another milestone on our path to making the new UI default for all customers deploying on, or upgrading to, new versions of VPAM in the coming months. This further reduces the need for an admin user within the new UI to revert to the former UI to retrieve specific content or make specific changes.

A change in the Windows 11 24H2 (released 10/1) MSTSC client affected the rendering of audited RDP sessions. This release contains a property that changes how bitmap information is sent in those RDP sessions to address this issue without the need for previously available workarounds which included disabling audit or using a separate client.

Users rely on MSTSC for capabilities such as drive sharing which cannot be delivered by the available workaround client. This ensures that users on the latest version of Windows can continue making connections as they did before Windows updates.

Other enhancements and updates for this release are:

• Continued updates and bug fixes for the new Connection Manager are available in this release for sites who have enabled the beta of this from System Settings

• Added a property for additional license management for vendors on VPAM

• Resolved an issue that prevented the search function on the report distribution list page from working as intended

• Improved the reliability of launching the SFTP/FTP client

• The available memory line when viewing a Gateway Instance now properly shows available memory rather than used memory

This release includes admin log (system and user messages) as well as the ability to view Gateway Instances and the Active Session List within the new UI.

This release is another milestone on our path to making the new UI default for all customers deploying on, or upgrading to, new versions of VPAM in the coming months. This further reduces the need for an admin user within the new UI to revert to the former UI to retrieve specific content or make specific changes.

Updates to tunneled services to provide clarity around which Gateway a service is routed through and resolve a problem state that can prevent tunneled service connections from resuming after network connectivity issues.

This helps ensure that tunneled services can be easily used and relied upon for customers with complex network deployments and customers that need to route to on-prem services for authentication, SMTP or integrations when deployed in Imprivata cloud.

Other enhancements and updates for this release are:

• Resolved an issue on CPAM that would result in usability issues when the user’s browser is set to German.

• Resolved an issue that caused the login page to be difficult to read with the login page design.

• Created API endpoints for managing sessions.

• SMTP server response codes of 250 will now be correctly treated as successful.

• Security updates in response to our annual penetration testing.

The beta new connection manager is available to all users on Windows, Mac or Linux as of this release when enabled from the settings in the system admin module. This is available on both VPAM and CPAM.

The new connection manager significantly reduces the time it takes to go from clicking ‘connect’ on an application or Gatekeeper to having access to the endpoints. Additionally, previous requirements that periodically resulted in the need to clear temp files for some users have been addressed to provide a more consistent and reliable experience for all users. Finally, the new connection manager enables our new Containerized Network functionality.

The Containerized Network feature allows users on Windows to map services to new interfaces outside of the 127.X.Y.Z loopback addresses. This feature is for Windows users only and is automatically enabled when the Next-Gen Connection Manager is used.

VPAM and CPAM have always used an alternate port process for granting access when the local port selected is unavailable. For most use-cases this is unnoticed and allows users to connect without issue. In select use cases such as SMB access or access to PLCs with certain thick clients – alternate ports result in an inability to connect. This new feature allows an alternate interface to be used to ensure the required port is available and makes the connection process for these types of services significantly easier for the end user.

The History section has been added to the new UI and allows a new service access level view of history.

This is a major milestone for the new UI and brings a significantly improved experience to reviewing history. Users can now view history at the service level without the need to drill into multiple sessions to get the data needed. Additionally, the history table can be filtered by any available column or columns including the user, vendor, host, port, access time and more.

Other enhancements and updates for this release are:

• Initial components to allow administrators to initiate upgrades from within the product have been added

• API endpoints for access details, session details, Gateway management and others have been added

• Resolved an issue that prevented custom application access request forms from being properly used for Nexus connections

Approval requests that previously would notify only the users with the proper permission and department settings needed to handle the approval can now optionally notify system administrators as well.

This new option will make it easier for system administrators who would like a higher level of notifications for approval processes or those who would also be responsible for handling the approvals or may consider themselves an escalation point for those approvals.

Additional workflows for managing vendor reps including information updates, password resets and the deletion, undeleting and erasing processes are now available in the new UI.

This continues to extend the new UI to include commonly used features and functionality. We’ll continue to provide updates for each release as the beta expands to cover more aspects of the product and approaches availability for customers to run in production.

Updated versions of the C#, Java and Python SDKs have been released which contain additional functionality and bugfixes.

This release coincides with our regular SDK update. SDK capabilities have been expanded and these updates require the new version of the SDK along with 24.1.6 or newer.

Other enhancements and updates for this release are:

• Resolved an issue that could prevent the system from properly establishing tunnels for Gateway tunneled services

• Resolved an error that would occur when users without local accounts, such as SAML users, attempted to use the password reset functionality

• Resolved an issue that could cause a users’ service access event to not appear on the session history page for access to a web service when a stored credential was used

• VPAM and CPAM servers deployed in Imprivata Cloud will now have Crowdstrike AV installed

The workflows for both creating and viewing vendor reps are now available in the new UI beta as of this release.

This continues to extend the new UI to include commonly used features and functionality. We’ll continue to provide updates for each release as the beta expands to cover more aspects of the product and approaches availability for customers to run in production.

Other enhancements and updates for this release are:

• Resolved an issue that could prevent deletion of applications in some cases.

• Users will no longer be able to inadvertently set the session timeout to zero minutes in the UI which would result in users unable to maintain sessions

• Non-admin users that can create external credential providers (PAM Integration) can now properly see the created objects on the list view

• Sorting choice for the list roles table will now persist for users

• Pre-connection notifications on VPAM will now be properly labeled as Application Pre-Connection Notes rather than “Site” Pre-connection Notes.

• Removed the ‘reason for access’ prompt automatically included when using a custom application access request form with other fields.

The new UI is available as a beta with release 24.1.4! This includes a number of workflows and functionality including authentication, managing vendors or applications and making connections. Anyone using the new UI can toggle to the old UI from the menu in the top right.

This allows us to get the new UI into customer hands for feedback and testing. We'll continue to release additional functionality into this UI with each release going forward with general availability for the new UI targeted for an end of year release.

Notifications can now be defined on a per-application basis to appear to users and require acknowledgement before they can complete the connection process.

This was available previously for Gatekeepers on CPAM only but can be a useful tool for communicating important information to vendor reps on VPAM. This was a direct ask from multiple customers and identified as a key process improvement during multiple test drives.

Custom Application Access Approval Profiles are now functional over the Nexus, ensuring that vendor reps connecting through Nexus relationships can be prompted for the same information as local vendors when determining approval.

An important piece of any new features brought to VPAM or CPAM is to ensure that, if applicable, those features work across the Nexus. This work closes that gap on a recent feature release both to ensure Nexus does not create any loss in functionality and to meet a direct request by an existing customer.

Other enhancements and updates for this release are:

• The new Linux SCM is available in beta form and can be enabled with the 24.1.4 release. When the Windows and Mac versions of the SCM are made available we will announce this as a major release highlight.

• Resolved an issue with a previous release version resulting in renaming Gatekeepers that were hosted on a Gateway

• The logout.action will now properly forward to the SAML logout for SAML users

The success@imprivata.com email has been removed from the login page text and default settings placeholder for support contact information.

After reviewing the emails that we receive at this address, the vast majority are issues where Imprivata cannot help the end user (anything from accounts being disabled to endpoints not online). The support contact information in system settings should be set with a proper contact for the customer site to ensure users can quickly get to a resource that can help them.

Nexus vendor reps enabled/disabled status will now be determined by the CPAM side of the Nexus connection by default and update the status on the VPAM side during the connection process if needed. Multiple customers ran into issues where local settings on the VPAM side unintentionally affected the ability of Nexus users to connect and requested an update to allow Nexus users to proceed with connecting if their account was in an enabled state on the CPAM server. This resolves an issue that would require manual actions from an admin to re-enable a disabled account. Settings options for the related property allow other behaviors that include rejecting the connection or allowing the user to request to be enabled when the local VPAM account is disabled.

Other enhancements and updates for this release are:

• Resolved an issue that prevented updated Gateway names from showing on specific pages

• Resolved an issue that could result in tunneled services going offline due to a hung scheduled tasks thread

• Updated Best Practices Checklist Password Length to 12 characters to better align with best security practices

• Updated instances of "Access Restrictions" settings headers to "Authentication Requirements" to better reflect the purpose of those settings

• Added a UI option for toggling the dynamic HTTP(S) service proxy on and off. When enabled, the proxy is dynamically enabled only for connections with stored credentials.

• Removed instances of "SecureLink" from certain emails and the "unavailable" page text.

The UI has received a branding update to ensure the new name is visible in the top left and color elements have been updated from the former SecureLink color scheme to Imprivata colors. This update also applies the new naming within the UI and emails to replace former instances of “SecureLink”.

This is a major step towards the unified solution naming across the Imprivata portfolio and ensures we can start getting this in front of customers immediately rather than coordinating this with the availability of the new UI.

Instances in a Gateway pool can now be drained to prevent new sessions from beginning on that instance.

It is also now possible to see what sessions are through a given instance. This request came from multiple customers as a means to isolate Gateway instances when there is a need to bring them offline for updates or other maintenance without impacting user connections.

Users can now set a preference for their preferred tunneling method for the Connection Manager.

Having the option to set a preferred tunneling method ensures faster connectivity for users who do not use the standard SSH tunnel by not requiring them to wait while an SSH attempt times out.

Other enhancements and updates for this release are:

• The “Launch via” setting for services can now be defined upon service creation instead of only on editing the service

• Gateway CRUD actions will now properly generate admin log entries

• Resolved an issue that prevented updates to audit retention settings from taking effect

Approval profiles grant customization to the questions a user must fill out when requesting access. This feature allows that same customization in a new area where requests previously only had a "reason for access" prompt.

This gives customers more control over the information they're gathering and in turn allows for more informed decision making when granting approval for individual vendor reps to access applications. For some customers this enables them to bring workflows into VPAM that previously were completed outside of the product.

A new custom field for Terms and Conditions that applies to recipients of Quick Connect sessions has been added and will now allow capturing those users' approval of these terms in logs.

This request was completed to fulfill a specific CPAM site's needs, however, it has broad applicability for any site using Quick Connect to manage access to end users at their customer's sites.

Other enhancements and updates for this release are:

• MFA via Mobile Authenticator is now available for Gatekeeper Users on CPAM.

• Updating a credential will no longer allow duplicate usernames in the same credential pool.

• MSDP port type has been added.

A new feature has been added to allow exporting information directly out of the admin log to csv. This allows exporting the full content or content filtered by search terms and/or a date range. Many customers ask for custom reporting to gather information either not in the reports module or not easy to gather from the admin log. Syslog integration addresses this for some customers, but adding this functionality addresses it for many more. This will help reduce requests for custom reports and redirect those into upgrade opportunities.

Other enhancements and updates for this release are:

• Fixed an internal error that occurred when creating tunneled services while no gateways were available.

• Fixed errors that would occur when deleting applications or Gatekeepers via the SDK.

• Updating credentials in a credential pool will no longer unintentionally allow multiple credentials to share the same name.

Resolved connectivity issues that impacted users connecting both to and from systems on the latest version of Windows 11.

This issue impacted only systems on the latest version of Windows. Addressing this now helps ensure the impact is minimal and resolution is available before more broad adoption of the latest Windows updates.

We now support proxy configurations for pull upgrade connectivity, a requirement for a small number of sites.

Enabling this ensures that the pull upgrade model, required for upgrading to modern versions, is available to customers with proxy requirements.

We’ve implemented an about page within the previous debug page to provide information on component versions.

This is intended to quickly confirm component versions that may assist in resolving issues not related to the VPAM/CPAM server version. Above all, this should help our support team with easier access to information they need frequently.

Other enhancements and updates for this release are:

• Hosts may now be enabled via the SDK

• SDK connection failures will now see an accurate error

Multiple reports generated from the reports module have been updated to display the hierarchical departments rather than the legacy department field.

This update makes reporting clearer for sites that utilize the departments hierarchy for managing users and their permissions.

The credential and credential category list pages will now include paginated tables the same way many other list tables in the UI are displayed.

This will improve performance when loading these pages on sites that heavily utilize these features. Additionally, this allows column-based sorting.

Updated versions of the C#, Python and Java SDKs have been released and include support for Quick Connect, credential tokens and other fixes.

Customers using the SDK can begin using the latest versions (2.6.0 for C#, 2.3.0 for Python and Java) along with this release to utilize the new endpoints and updates.

Other enhancements and updates for this release are:

• Added support for Gatekeeper registration codes without expiration dates

• Added the Gatekeeper registration code to the Gatekeeper downloads page

• Resolved an issue that resulted empty upgrade commands being sent to Gatekeepers

• Departments will now appear in order when bulk editing applications

Connections to HTTP and HTTPS services will no longer have our man-in-the-middle component for HTTPS enabled by default. This will only be enabled for a connection if there is a credential that needs to be injected for the user.

This component can slow down connections and break specific HTTP(S) services. Ensuring it’s not running when it isn’t needed allows for more connections to work without requiring workarounds to disable this manually. This should decrease the number of HTTP(S) related cases opened for our support team.

Gatekeepers that are duplicated either through manual means of copying keys to use the same registration code or through the cloning of an entire VM that has an installed Gatekeeper will now be properly displayed to the user.

This is an important change for CPAM customers who had little insight into this before. This information can be helpful in identifying Gatekeeper connectivity issues, particularly intermittent issues, and sites that require separate Gatekeeper installations.

Changes have been made to improve performance with our built-in desktop sharing components. This should help resolve latency and framerate issues seen in recent versions.

Desktop Sharing performance has impacted several customers, and multiple steps have been taken to resolve the issues. This should drastically improve the experience for customers who rely heavily on desktop sharing.

Other enhancements and updates for this release are:

• Resolved an issue where email links for RDP2 audit conversions would be invalid

• Resolved an issue where in-browser notifications for completed audit conversions would lead to a “Page not Found” error

• Resolved an issue where disabling audit at the Gatekeeper Group level would prevent credential injection

• Multiple API Updates

• Updated the concurrents report in the ReportsV2 module to use our weekly_concurrents table for data

Users can now see additional Gatekeeper Information in the UI in relation to the JVM memory and threads.

This will help quickly identify and resolve Gatekeeper issues that can occur for Gatekeeper deployments on systems with low or minimal specifications.

Sessions created for Gateway tunneled services such as AD/LDAP or PAM integration connections will no longer generate any empty session data visible in the session history

Users and administrators reviewing audit will no longer have unnecessary data visible in the session history and can more quickly find user audit.

Other enhancements and updates for this release are:

• Resolved an issue where reports that included data in or out information with large values could result in emailing a blank report

• Resolved an issue that resulted in the Vendor Connection Report on VPAM being unable to show preview data in the UI

• Editing multiple scheduled reports without refreshing the page will no longer result in applying the initial report’s filters to subsequent reports

• Updated SSHD to fix a bug that could result in SSHD processes using an amount of memory exponentially higher than expected

As of this release we now have updated VHDs for deployments in Azure that are based on AlmaLinux 8 and support our pull model for upgrades. This is available for new deployments in Azure or migrations to Azure.

We’ve updated how our SSH audit is captured and stored in order to capture raw data with headers. This ensures more data is captured in the audit file to help resolve an infrequent issue that could cause SSH audit to be captured but not linked in the UI on session history.

With this release we've both created the credential token endpoint and updated our SDK versions. This will allow the credential tokens we use for injection to be available to the SDK as they are for users via the UI for endpoints such as HTTP/HTTPs services.

We’ve updated the Java and Jetty versions used by the PAS appliance. While the previously used versions posed no security risks, this upgrade ensures we’re using any security and performance fixes while addressing any concern with older versions appearing on scans.

Previously the local audit conversion on the SecureLink appliance could fail when creating a file larger than expected, preventing admins from viewing particularly long RDP sessions. We’ve adjusted the default limitation to prevent this issue in most, if not all circumstances.

VPAM is now available in German and will display in German for any user with German language settings set as default in their browser. This is dynamic based on the browser setting and does not require users to navigate menus to find language settings within PAS.

Administrators may now configure AD integration to sync roles for users on authentication. This previously was limited to user information including groups

Resolved an issue that had prevented admins or other users with appropriate permissions from being able to delete applications under specific circumstances.

Resolved an issue that prevented credential injection with telnet services in Putty and could degrate telnet connection performance.

Resolved an issue that could prevent admins from being able to use the "Move GK" option in CPAM.

This release enables UI controls over audit retention and archival settings. Previously any changes to these settings required our Technical Operations team to make configuration changes.

In addition to mounted storage for audit files, customers will now be able to configure S3 buckets for audit. This also opens up availability for this to our cloud environment and reduces the cost for long term audit retention in cloud.

Latency issues in our desktop sharing provided both by the Gatekeeper and in Quick Connect that were introduced in a prior release have been resolved.

This release resolves multiple connectivity issues with Universal Gatekeeper that could occur during Gatekeeper upgrades or routine connectivity key rotation.

Resolved an issue that resulted in session chat not allowing separate users connected to the same Gatekeeper to use the feature.

Resolved an issue that resulted in a "request is malformed" error when requesting access to a Gatekeeper with an ID greater than or equal to 1000.

Relocated the directory for temporary file storage during audit conversion to prevent conversion failures related to a lack of disk space.

For services that have had HD audit disabled by admins, rather than showing an empty space where the audit link would appear in session history, we will now show an indicator that HD audit has been disabled.