Intelligence and AI
Identity Intelligence (Security Agents) [BETA]
A new Lumos product surface powered by always-on AI agents that continuously scan your identity environment for security risks — from dangerous non-human identity (NHI) configurations to terminated users who still have access — and surface prioritized findings with full evidence and specific recommended fixes. Two agents are available at launch, with more to follow. What’s new:- NHI Security Analysis Agent scans Microsoft Entra ID for high-risk service principal, app registration, and managed identity patterns (e.g., privileged access + multi-tenant + long-lived credential + no owner)
- Terminated User Account Agent cross-references HRIS termination data against active accounts across downstream apps to flag post-departure access and privileged gaps
- Agent Catalog to browse and install pre-built agents in one click
- Knowledge Hub integration so agents reflect your org’s policies, runbooks, and exception lists
- Dismiss-with-feedback loop that teaches the agent what’s a real risk vs. a known exception in your environment
- Issues dashboard where every finding comes with an AI-generated narrative, evidence, severity rationale, and a recommended action
- Catch compound-risk NHI patterns (long-lived credentials, multi-tenant + privileged + ownerless service principals) that sit undetected in Entra ID for years
- Close offboarding gaps in days, not at the next annual audit
- Calibrate the agent to match your org’s risk tolerance in a single session
- Act on findings immediately — each one ships with specific, actionable fix steps
Albus Chat: Deep Thinking
Albus just got a major upgrade. It now plans multi-step investigations, runs sub-agents in parallel, executes code on the fly, and delivers structured answers with inline diagrams and downloadable artifacts — all automatically, tuned to the depth of what you ask. What’s new:- Deep Thinking agent architecture with adaptive reasoning depth
- Sub-agents for parallel multi-domain investigation
- Code execution for on-the-fly aggregation and analysis
- Inline Mermaid diagrams, survey artifacts, and downloadable file and text outputs
- Full reasoning trace for auditability
- Get complete answers to complex, multi-hop questions in a single ask
- Collapse long, manual investigations into a single prompt
- Drop visual output directly into decks, tickets, or Slack
- See exactly how Albus arrived at every answer — auditable end to end
Access Reviews
New Permission Reviews Table
Entitlement Access Reviews have an upgraded table format with per-user view persistence, quick filters, and major bulk-action performance gains. What’s new:- Personal view persistence across filters, columns, and sorts
- In-header quick filters (Review Decision, AI Suggests, My Tasks Only)
- Complete CSV exports independent of UI state
- Bulk accept/reject at 5k+ rows in seconds instead of minutes
- UI consistency with Apps, Access Policies, and LCM
- Stop rebuilding filters after every scroll or reload
- Give each reviewer a tailored view without affecting others
- Hit audit SLAs with a single, complete CSV export
- Finish bulk actions reliably at enterprise scale
Create UAR API
Access Review campaigns can now be created, read, updated, and deleted programmatically through the Lumos REST API. What’s new:- Create, read, update, and delete endpoints for UAR campaigns
- One POST scopes a full campaign — apps, reviewers, deadlines, and more
- Sensible defaults for every optional field
- Campaigns created via API behave identically to UI-created ones
- Auto-generated API reference docs
- Stand up a 200-app review in one script run instead of a day of clicks
- Version and diff UAR configs alongside the rest of your stack
- Promote configurations from test to production without manual rework
- Foundation for agent-initiated reviews in future milestones
Lifecycle Management
Standardized Provisioning and Reusable Workflows
One unified workflow layer for managing provisioning and deprovisioning across every Lumos product. What’s new:- Centralized workflow table on every single-app page
- Reusable workflow definitions assignable across products
- Intent classification (Provision vs. Deprovision) with save-time validation
- Auto-generated defaults on new app connection
- Linked execution history back to the driving workflow
- Define once, run everywhere — no more duplicating logic across 10+ UI surfaces
- Eliminate configuration drift with a single source of truth
- Cut app setup time with default workflows ready to go
- Trace every access change back to a specific workflow definition
Offboarding and Movers Table Upgrades
Offboarding and Movers tables migrate to the new table platform, unlocking bulk cancel and self-serve workflow cleanup. Onboarding follows in early Q2. What’s new:- Bulk cancel for in-progress and scheduled workflows
- Column customization and saved custom views
- Safety rules that skip non-cancellable rows gracefully
- Consistent table UX across LCM, Apps, and Access Reviews
- Stop misconfigured workflows in seconds without a support ticket
- Reduce on-call burden during large configuration migrations
- Triage faster with custom views and filters
- Consistent behavior across every Lumos table
Platform
Resource Roles [BETA]
A new role type in the Custom Roles system where permissions apply per-resource instead of org-wide. What’s new:- Resource Role type in the Role Builder, distinct from Custom Org Roles
- Apps as the first supported resource type
- Per-resource assignment to users or groups
- Bulk ABAC-based assignment using condition rules
- Full audit trail of every role assignment
- Delegate app management without over-provisioning
- Reduce org admin sprawl with scoped permissions
- Improve least-privilege posture for security and compliance
- Track which users have elevated access to which resources
Activating and Deactivating Policies
Access policies can now be toggled Active or Inactive, letting admins draft and finalize provisioning rules in Lumos before they take effect on real onboardings. What’s new:- Active / Inactive status toggle on each access policy
- Newly created policies default to Inactive; existing policies remain Active
- Status changes apply only to future onboardings
- Build and review new policies before they affect new hires
- Pause a policy temporarily without losing its configuration
- No retroactive impact on users already onboarded
Integrations
New Integrations with Provisioning Actions
New integrations with direct provisioning capabilities are now available. New integrations:- Looker (Beta)
Existing Connector Improvements
Enhancements across existing integrations continue to deepen flexibility and support real-world use cases. Updates include:- Drata: additional Role Type synced
- StrongDM ICS: EU / UK API endpoint support
- Tableau: group provisioning
- Active Directory: MoveADObject action support
- Okta: sync Admin Roles, OAuth Apps, and Scopes for fuller privileged-access visibility
Integrations Page Enhancements
A usability refresh to the Integrations page for faster discovery and troubleshooting. What’s new:- Clearer error surfacing for failing integrations
- Filter and search across Connected, Available, and On-Prem tabs
- Enriched context signals on integration tiles
- Cleaner navigation between integration states
- Faster discovery of the right integration
- Less time triaging integration failures
- Easier targeted adoption across admin teams