Virtual Appliance Release Notes - October 15, 2026

Connectivity - HashiCorp OnPrem

The HashiCorp Vault (On-Premise) connector is now available. You can discover and aggregate non-human identities from on-premises HashiCorp Vault (Community version), including Vault token and userpass account metadata. This is a source connector and is not the HashiCorp Vault Credential Provider.

For more information, refer to Integrating SailPoint with HashiCorp Vault NHI (On-Premise).

Connectivity - GitHub Enterprise Server

The GitHub Enterprise Server connector is now available. You can aggregate users, teams, roles, and repositories, and discover non-human identities including GitHub App installations, GitHub workflows, GitHub Action runs, and environment secrets. For more information, refer to Integrating SailPoint with GitHub Enterprise Server.

Connectivity - SAP SuccessFactors

The SuccessFactors connector now generates SAML assertions using native Java APIs instead of the ESAPI library.

Connectivity - Okta

The Okta connector now includes default identity profile mappings. When you create a new identity profile on an Okta source, identity attributes are automatically mapped from the account schema. You can edit or remove these mappings as needed. Existing identity profiles remain unchanged. For more information, refer to Identity Profile Mapping.

Connectivity - Microsoft Entra ID

The Microsoft Entra ID connector now includes default identity profile mappings. When you create a new identity profile on a Microsoft Entra ID source, identity attributes are automatically mapped from the account schema. You can edit or remove these mappings as needed. Existing identity profiles remain unchanged. For more information, refer to Identity Profile Mapping.

Connectivity - Delimited File

The Delimited File connector now supports SMB file transport to aggregate account and entitlement files from SMB2 or SMB3 shares on Windows File Server or Samba using Kerberos authentication.

Connectivity - Delimited File

The Delimited File connector now supports IAM role-based authentication for AWS S3, so sources can read from S3 without storing a long-lived access key and secret. For more information, refer to Connection Settings.

Connectivity - Oracle Database

The Oracle Database connector now supports Kerberos authentication, including Keytab and Password credential modes. For more information, refer to Connection Settings using Kerberos Authentication.

Connectivity - Siebel

The Oracle ERP – Siebel connector now supports Oracle Siebel CRM versions 25.\* and 26.\*.

Connectivity - SAP Sybase ASE

The SAP Sybase ASE connector now supports SAP Sybase 16.1 as a certified managed system. For more information, refer to Supported Managed Systems.

Connectivity - Active Directory

The Active Directory connector now supports moving and renaming user accounts across domains within the same forest when TLS is enabled.

Connectivity - Snowflake

The Snowflake connector now supports connecting to Snowflake databases in a virtual private cloud using private links for secure connectivity.

Connectivity - SAP SuccessFactors

CONETN-5612

The SuccessFactors connector no longer fails full account aggregation with a StackOverflowError, when the account schema includes multi-valued custom navigation attributes.

Connectivity - REST WebServices Connector

CONETN-5649

Resolved an issue where the Web Services connector’s long-running account aggregations failed during token renewal with a java.net.SocketException: Connection reset error or an HTTP Error Code: 0 error.

Connectivity - JDBC

CONETN-5687

The JDBC connector now logs the update SQL query in the connector logs at the DEBUG level.

Connectivity - SAP GRC

CONETN-5497

The SAP GRC connector no longer overwrites the configured requesterId with the source UUID when Credential Provider is enabled on the source. GRC tickets now display the correct requester ID instead of a truncated source ID in the Submitted by field.

Connectivity - Oracle HCM Cloud

CONETN-5484

The Oracle HCM Cloud connector now disables accounts and preserves the termination date during REST and Atom feed delta aggregations for workers terminated before the aggregation date.

Connectivity - SAP SuccessFactors

CONETN-5611

The SuccessFactors connector now resolves attribute labels across paginated user account aggregation results. Previously, some accounts received a code instead of the mapped label. This happened when the label was not on the first page of results. This issue affected attributes such as positionTitle.

Connectivity - Amazon Web Services (AWS) IAM Identity Center

CONETN-5637

The AWS IAM connector now continues provisioning subsequent valid groups in a request even if a single group assignment fails.

Connectivity - SAP SuccessFactors SaaS

CONETN-5647

The SuccessFactors SaaS connector now aggregates accounts with nested EmpJob OData attributes when additional attribute masking is disabled. This change prevents StackOverflowError failures during full account aggregation. Set skipAdditionalAttrMasking to true on the source to apply this fix.

Connectivity - SCIM 2.0

CONETN-5688

The SCIM 2.0 connector now applies extended-schema Uniform Resource Name (URN) fallbacks only on PATCH remove operations and not during create operations.

Connectivity - SCIM 2.0

CONETN-5648

The SCIM 2.0 connector now allows you to skip filters in GET requests prior to PUT operations by setting the skipFilterOnGetObject parameter to true.

Connectivity - SAP HR/HCM

CONETN-5528

Fixed an issue where the SAP HR/HCM connector intermittently returned future-dated position descriptions instead of the currently active value during aggregation.

Connectivity - Workday Accounts

CONETN-5546

Fixed an issue where the Workday Accounts connector aggregated past-effective organization roles for terminated workers. Set skipRolesForTerminatedWorker to true in the application configuration to skip organization roles during terminated account aggregation.

Connectivity - Oracle EPM Cloud - FCCS

CONETN-5554

Fixed an issue where the Oracle EPM Cloud FCCS connector reported Delete Account as successful when the IDCS user was not deleted. Set enableEnhancedAccountDelete to true in the application configuration to validate IDCS responses and confirm the account is removed before returning success.

Connectivity - Cerner

CONETN-5626

The Cerner connector no longer shifts effective dates by one day during Create, Update, and Enable provisioning, and Enable for rehire now moves Suspended accounts to Active. To use this fix, set enableDateFix to true and set cernerTimeZone to your Cerner facility timezone.

For more information, refer to Integrating SailPoint with Cerner Healthcare.

Connectivity - Imprivata EAM

CONETN-5643

The Imprivata Enterprise Access Management connector no longer encounters out-of-memory errors, as it now properly closes HTTP connections after each operation.

Connectivity - Google Workspace

CONETN-5653

The Google Workspace connector no longer repeatedly updates phones, addresses, and organizations during Attribute Sync when the data has not changed. For single-valued account attributes, the connector now stores JSON values as a comma-joined string to match identity attributes. Multi-valued schema attributes remain as a list.

Connectivity - SCIM 2.0

CONETN-5599

The SCIM 2.0 connector now includes a path for complex core sub-attributes in PATCH operations when running in relax configuration with includePathForCoreAttributes set to true.

Connectivity - Coupa

CONETN-5527

Fixed an issue where the Coupa connector failed UPDATE_USER provisioning when the invoicing-user attribute was set because the connector sent null instead of false.

Connectivity - Linux

CONETN-5515

Fixed an issue where the Linux connector failed test connection on Red Hat Enterprise Linux (RHEL) 9.0 and above when bracketed paste mode was enabled on the target system.

Connectivity - Virtual Appliance

PLTCONN-10960

Fixed an issue where importing a VA-based delimited file source configuration incorrectly set the source’s connectorClass to the default SaaS-based connector instead of the VA-based connector. The VA connector class is now correctly detected and applied.

Connectivity - JDBC

CONETN-5591

The JDBC connector now marks an account request as failed when all related attribute requests fail while using provisioning query settings in Identity Security Connectivity.

Connectivity - EPIC

CONETN-5639

The Epic connector now prevents partitioned account aggregation failures by skipping null user IDs during partitioned account aggregation.

Connectivity - SCIM 2.0

CONETN-5545

The SCIM 2.0 connector now supports the extension schema Uniform Resource Name (URN) in the path of PATCH remove operations for simple attributes.

Connectivity - SAP Fieldglass

CONETN-5606

Fixed an issue where the SAP Fieldglass connector failed during access request provisioning when an identity had a Primary Role assigned but no Additional Roles.

Connectivity - REST WebServices Connector

CONJUBILEE-5017

The Web Services connector now preserves literal text surrounding placeholders in form-data request values. Operations like add($plan.nativeIdentity$) retain the add(...) operation after the placeholder is resolved instead of sending only the resolved value. This prevents form-data updates from being interpreted incorrectly by target systems.