SaaS

SaaS Release Notes - October 30, 2026

Release notes cover new features, enhancements, and fixes that have been released to production.

SailPoint Identity Security is SailPoint’s next-generation identity security solution. The release notes cover both SailPoint Human Fabric and SailPoint Agentic Fabric features.

New features

Product	What's new
SaaS Connectors - Quick Compliance	SailPoint Human Fabric now supports the following connectors as Quick Compliance connectors: Birdview PSA BlazeMeter* MeisterTask Onpipeline* OpenRouter* Starburst* Supabase* ZenML Cloud* You can now expediently configure read-only connections to these sources for account and entitlement aggregation. Connectors marked with an asterisk (*) identify Quick Compliance connectors that support non-human identity (NHI) discovery through Dataset Management. For a full list of supported Quick Compliance sources, refer to Quick Compliance.
Connectivity - GitLab	The SailPoint GitLab connector is now available. The connector aggregates users, groups, and projects and self-managed GitLab instances, including Dedicated deployments. The connector discovers personal, group, and project access tokens, and the bot users behind those tokens. The connector also discovers group and project service accounts and security policy bots. The connector is read-only and does not support provisioning. For more information, refer to Integrating SailPoint with GitLab.
SailPoint Human Fabric - SoD	Admins now have the option to configure a tenant to automatically cancel access requests when the access would result in a separation of duties (SoD) violation. This can be set either globally as a system setting or individually on SoD policies.

Enhancements

Product	Feature enhancements
SaaS Connectors - SAP SuccessFactors SaaS	The SuccessFactors connector now supports Metadata Framework locale picklists. The default value is `en_US`. Set the locale value used by the SuccessFactors tenant under Picklist Settings on the source, such as `en_GB` or `fr_FR`.
SaaS Connectors - Zendesk SDIM SaaS	The Zendesk Service Desk SaaS integration now supports OAuth 2.0 client credentials authentication. Use this option to migrate from Zendesk API token authentication before Zendesk deactivates API tokens on April 30, 2027.
SaaS Connectors - Zendesk SaaS	The Zendesk SaaS connector now supports OAuth 2.0 client credentials authentication. Use this option to migrate from Zendesk API token authentication before Zendesk deactivates API tokens on April 30, 2027.
SaaS Connectors - Slack SaaS	The Slack SaaS connector now supports aggregating and provisioning `startDate`. You can set the start date during account creation and update it later. For more information, refer to Account Attributes.
Connectivity - Slack	The Slack connector now supports aggregating and provisioning `startDate`. You can set the start date during account creation and update it later. For more information, refer to Account Attributes.
Connectivity - Zendesk	The Zendesk connector now supports OAuth 2.0 client credentials authentication. Use this option to migrate from Zendesk API token authentication before Zendesk deactivates API tokens on April 30, 2027.
Connectivity - Zendesk SDIM	The Zendesk Service Desk integration now supports OAuth 2.0 client credentials authentication. Use this option to migrate from Zendesk API token authentication before Zendesk deactivates API tokens on April 30, 2027.
Non-Employee Risk Management	API tokens generated within SailPoint Human Fabric to authenticate Non-Employee Risk Management API requests can now be scoped to specific permissions. These tokens can only call APIs included in their scoped permissions. Existing API tokens that grant full access will continue to work. For more information, see Authorization.
Connectivity - SAP GRC	The SAP GRC connector now supports aggregating and provisioning user attributes that contain the configured delimiter. Add `alternateDelimiterUserSplit` to the source configuration with an alternate delimiter that does not appear in your user attribute values. For more information, refer to Troubleshooting.
SaaS Connectors - Oracle HCM Cloud SaaS	The Oracle HCM Cloud SaaS connector now supports Secure Shell (SSH) public-key authentication for Secure File Transfer Protocol (SFTP) file transport.
SaaS Connectors - Microsoft Entra SaaS	The Microsoft Entra SaaS connector now supports excluding inherited app role assignments during account aggregation. For more information, refer to Aggregation Settings.
Connectivity - BeyondTrust Password Safe OnPremise	The BeyondTrust Password Safe (On-Premise) connector now supports BeyondInsight version 26.1.0.878.
SailPoint Human Fabric - Identity Graph	The browser back and forward buttons can now be used to go back and forward through graph history.
Connectivity - Microsoft Entra ID	The Microsoft Entra ID connector now supports owner information in string format. For more information, refer to Service Principal as Accounts Attributes.
Connectivity - Microsoft Entra ID	The Microsoft Entra ID connector can now sign users out of all active sessions when their account is disabled. To turn this on, select Revoke Session after Disabling User Account under Feature Management. This option is cleared by default and must be selected to revoke sessions. For more information, refer to Revoke Session after Disabling User Account.
SaaS Connectors - Microsoft Entra SaaS	The Microsoft Entra SaaS connector can now sign users out of all active sessions when their account is disabled. To turn this on, select Revoke Session after Disabling User Account under Feature Management. This option is selected by default on new sources and cleared on existing sources. For more information, refer to Revoke Session after Disabling User Account.
Connectivity - Microsoft Entra ID	The Microsoft Entra ID connector now assigns and removes license service plans faster, especially for users with many licenses. Large license updates are also more reliable, with fewer timeouts and failed removals. If one license in a request can't be updated, the connector still updates the others.
Connectivity - Oracle HCM Cloud	The Oracle HCM Cloud connector now supports Secure Shell (SSH) public-key authentication for Secure File Transfer Protocol (SFTP) file transport.
SaaS Connectors - AWS SaaS	The AWS SaaS connector now supports agent discovery and aggregation of AWS Agent Registry. For more information, refer to Integrating SailPoint and Amazon Web Services SaaS.
Connectivity - SAP SuccessFactors	The SuccessFactors connector now supports Metadata Framework locale picklists. The default value is `en_US`. Set the locale value used by the SuccessFactors tenant under Picklist Settings on the source, such as `en_GB` or `fr_FR`.

Fixes

Product	Issue ID	Fixes
Connectivity - Microsoft Entra ID	CONETN-5705	The Microsoft Entra ID connector now applies your configured Privileged Identity Management (PIM) duration to eligible and active role assignments. You can set how long privileged roles stay assigned, and access expires automatically when that time ends, in line with your organization's policy.
SaaS Connectors - Cursor SaaS	CONETN-5747	The Cursor SaaS connector now displays group entitlements on accounts and provisions group membership changes. On existing sources, rename the account schema entitlement attribute to `groups`, mark it as multi-valued, and run account aggregation. For more information, refer to Account Schema Attributes.
SaaS Connectors - SCIM 2.0 SaaS	CONETN-5680	Fixed an issue where user updates appeared successful in SailPoint Human Fabric even though the changes were not sent to the target system.
SaaS Connectors - Microsoft Entra SaaS	CONETN-5659	The Microsoft Entra SaaS connector now creates a new signed assertion every time it requests an access token.
SaaS Connectors - ISC Cloud Governance Connector	CONETN-5704	The SailPoint Identity Security Cloud Governance SaaS connector no longer skips certification campaign reassignment when you disable an identity whose only owned object is a certification campaign.
SaaS Connectors - Microsoft Entra SaaS	CONETN-5674	The Microsoft Entra SaaS connector now supports the `skipGetObjectOnCreateAccount` configuration attribute to improve account creation performance for large environments.
Connectivity - Microsoft Entra ID	CONETN-5673	The Microsoft Entra ID connector now marks account aggregation as failed if membership retrieval fails for any user.
SaaS Connectors - Microsoft Entra SaaS	CONHOWRAH-7731	The Microsoft Entra SaaS connector now correctly handles shared mailbox names that contain colons(:). You can provision and deprovision shared mailbox entitlements even when the mailbox display name includes a colon.
Connectivity - SAP BTP Cockpit Cloud Foundry SaaS	CONETN-5621	The SAP BTP Cockpit Cloud Foundry SaaS connector no longer requires `userName` to be a valid email address during account creation when you set `skipUserNameEmailValidation` to `true`.
Non-Employee Risk Management	TRIAGE-16332	Fixed an issue where the Related Profiles page in the Portal was not showing the profiles users expected.