> ## Documentation Index > Fetch the complete documentation index at: https://docs.lumos.com/llms.txt > Use this file to discover all available pages before exploring further. # April 2026 Product Release Notes **Theme: See the Risks You Couldn't Before** This month adds AI agents that find identity risks manual reviews often miss, along with cleaner surfaces for acting on findings. ## Intelligence and AI ### Identity Intelligence (Security Agents) \[BETA] A new Lumos product surface powered by always-on AI agents that continuously scan your identity environment for security risks — from dangerous non-human identity (NHI) configurations to terminated users who still have access — and surface prioritized findings with full evidence and specific recommended fixes. Two agents are available at launch, with more to follow. **What's new:** * NHI Security Analysis Agent scans Microsoft Entra ID for high-risk service principal, app registration, and managed identity patterns (e.g., privileged access + multi-tenant + long-lived credential + no owner) * Terminated User Account Agent cross-references HRIS termination data against active accounts across downstream apps to flag post-departure access and privileged gaps * Agent Catalog to browse and install pre-built agents in one click * Knowledge Hub integration so agents reflect your org's policies, runbooks, and exception lists * Dismiss-with-feedback loop that teaches the agent what's a real risk vs. a known exception in your environment * Issues dashboard where every finding comes with an AI-generated narrative, evidence, severity rationale, and a recommended action **Benefits:** * Catch compound-risk NHI patterns (long-lived credentials, multi-tenant + privileged + ownerless service principals) that sit undetected in Entra ID for years * Close offboarding gaps in days, not at the next annual audit * Calibrate the agent to match your org's risk tolerance in a single session * Act on findings immediately — each one ships with specific, actionable fix steps Requires the new EntraID Graph connector for the NHI Security Agent. Reach out to your CSM to get started. ### Albus Chat: Deep Thinking Albus just got a major upgrade. It now plans multi-step investigations, runs sub-agents in parallel, executes code on the fly, and delivers structured answers with inline diagrams and downloadable artifacts — all automatically, tuned to the depth of what you ask. **What's new:** * Deep Thinking agent architecture with adaptive reasoning depth * Sub-agents for parallel multi-domain investigation * Code execution for on-the-fly aggregation and analysis * Inline Mermaid diagrams, survey artifacts, and downloadable file and text outputs * Full reasoning trace for auditability **Benefits:** * Get complete answers to complex, multi-hop questions in a single ask * Collapse long, manual investigations into a single prompt * Drop visual output directly into decks, tickets, or Slack * See exactly how Albus arrived at every answer — auditable end to end No configuration required — Deep Thinking activates automatically based on query complexity. ## Access Reviews ### New Permission Reviews Table Entitlement Access Reviews have an upgraded table format with per-user view persistence, quick filters, and major bulk-action performance gains. **What's new:** * Personal view persistence across filters, columns, and sorts * In-header quick filters (Review Decision, AI Suggests, My Tasks Only) * Complete CSV exports independent of UI state * Bulk accept/reject at 5k+ rows in seconds instead of minutes * UI consistency with Apps, Access Policies, and LCM **Benefits:** * Stop rebuilding filters after every scroll or reload * Give each reviewer a tailored view without affecting others * Hit audit SLAs with a single, complete CSV export * Finish bulk actions reliably at enterprise scale Phased rollout beginning April 27 for newly-created UARs. [Help Center Article](/kb/access-reviews/preparing-and-completing-an-access-review/reviewing-user-entitlements-in-lumos) ### Create UAR API Access Review campaigns can now be created, read, updated, and deleted programmatically through the Lumos REST API. **What's new:** * Create, read, update, and delete endpoints for UAR campaigns * One POST scopes a full campaign — apps, reviewers, deadlines, and more * Sensible defaults for every optional field * Campaigns created via API behave identically to UI-created ones * Auto-generated API reference docs **Benefits:** * Stand up a 200-app review in one script run instead of a day of clicks * Version and diff UAR configs alongside the rest of your stack * Promote configurations from test to production without manual rework * Foundation for agent-initiated reviews in future milestones [Help Center Article](/reference/createaccessreview) ## Lifecycle Management ### Standardized Provisioning and Reusable Workflows One unified workflow layer for managing provisioning and deprovisioning across every Lumos product. **What's new:** * Centralized workflow table on every single-app page * Reusable workflow definitions assignable across products * Intent classification (Provision vs. Deprovision) with save-time validation * Auto-generated defaults on new app connection * Linked execution history back to the driving workflow **Benefits:** * Define once, run everywhere — no more duplicating logic across 10+ UI surfaces * Eliminate configuration drift with a single source of truth * Cut app setup time with default workflows ready to go * Trace every access change back to a specific workflow definition ### Offboarding and Movers Table Upgrades Offboarding and Movers tables migrate to the new table platform, unlocking bulk cancel and self-serve workflow cleanup. Onboarding follows in early Q2. **What's new:** * Bulk cancel for in-progress and scheduled workflows * Column customization and saved custom views * Safety rules that skip non-cancellable rows gracefully * Consistent table UX across LCM, Apps, and Access Reviews **Benefits:** * Stop misconfigured workflows in seconds without a support ticket * Reduce on-call burden during large configuration migrations * Triage faster with custom views and filters * Consistent behavior across every Lumos table [Help Center Article](/kb/life_cycle_management/how-to-bulk-cancel-offboarding-and-mover-workflows) ## Platform ### Resource Roles \[BETA] A new role type in the Custom Roles system where permissions apply per-resource instead of org-wide. **What's new:** * Resource Role type in the Role Builder, distinct from Custom Org Roles * Apps as the first supported resource type * Per-resource assignment to users or groups * Bulk ABAC-based assignment using condition rules * Full audit trail of every role assignment **Benefits:** * Delegate app management without over-provisioning * Reduce org admin sprawl with scoped permissions * Improve least-privilege posture for security and compliance * Track which users have elevated access to which resources Gated behind a separate feature flag from Custom Org Roles. Reach out to your CSM to participate. [Help Center Article](/kb/ui-ux/resource-roles) ### Activating and Deactivating Policies Access policies can now be toggled Active or Inactive, letting admins draft and finalize provisioning rules in Lumos before they take effect on real onboardings. **What's new:** * Active / Inactive status toggle on each access policy * Newly created policies default to Inactive; existing policies remain Active * Status changes apply only to future onboardings **Benefits:** * Build and review new policies before they affect new hires * Pause a policy temporarily without losing its configuration * No retroactive impact on users already onboarded [Help Center Article](/kb/life_cycle_management/new-hire-onboarding/making-your-policies-active-inactive) ## Integrations ### New Integrations with Provisioning Actions New integrations with direct provisioning capabilities are now available. New integrations: * **Looker (Beta)** Note: Existing customers will need to connect the new integration tile to enable provisioning capabilities. ### Existing Connector Improvements Enhancements across existing integrations continue to deepen flexibility and support real-world use cases. Updates include: * **Drata:** additional Role Type synced * **StrongDM ICS:** EU / UK API endpoint support * **Tableau:** group provisioning * **Active Directory:** MoveADObject action support * **Okta:** sync Admin Roles, OAuth Apps, and Scopes for fuller privileged-access visibility ### Integrations Page Enhancements A usability refresh to the Integrations page for faster discovery and troubleshooting. What's new: * Clearer error surfacing for failing integrations * Filter and search across Connected, Available, and On-Prem tabs * Enriched context signals on integration tiles * Cleaner navigation between integration states Benefits: * Faster discovery of the right integration * Less time triaging integration failures * Easier targeted adoption across admin teams