Highlights
- Albus, on by default - Lumos AI now on across your account
- NHI Threat Hunter for AWS [BETA] - Hunt risky AWS machine identities
- Access Policy Insights - See whether each grant belongs
- Access Policy Owner - Hand policy upkeep to the right people
- Integrations API - Manage your integrations as code
- Identities Table Revamp - Filter and sort every identity attribute
- Sync Observability - See every sync, stage by stage
- AppStore Configuration MCP [BETA] - Configure the AppStore with AI agents
Now in Beta - opt in
Most of this release is generally available. A few items are launching in Beta - available now to customers who opt in. Reach out to your CSM to participate.- NHI Threat Hunter for AWS - requires the AWS IAM Identity Center connector
- AppStore Configuration MCP - scoped to approval-change configuration
Intelligence and AI
Albus, On by Default
Albus, the Lumos AI assistant, is now enabled and synced automatically for existing customers - no per-account request. It also reads more of your data and answers with interactive, exportable charts. What’s new:- Albus enabled and synced across existing accounts by default (a short exclusion list aside*)
- Reads more data, including access-request and approver data
- Access matrix now considers every attribute automatically, not a hand-picked few
- Inline interactive charts - bar, line, area, and donut - in Lumos styling
- Export answers and charts to PDF or markdown reports
- Get answers from Albus without waiting on enablement
- Act on visuals instead of walls of text
- Share exec-ready reports without rebuilding them in a spreadsheet
NHI Threat Hunter for AWS [BETA]
A security agent that scans your AWS environment for the non-human identity (NHI) exposures an attacker could actually use and delivers them as prioritized, owned issues. What’s new:- Scans the full AWS IAM authorization graph - users, roles, groups, policies, and trust
- Flags risky service principals, weak federation, and over-broad iam:PassRole / sts:AssumeRole chains
- Enriches IAM Access Analyzer and GuardDuty findings with graph and ownership context
- Resolves privileged identities to their owning app or team
- Surfaces a short, high-confidence set of findings as Lumos Issues
- Catch exploitable AWS identity risks that native tools miss
- Cut noise - a few defensible findings, not another dashboard
- Route each finding to an owner for remediation
Platform
Access Policy Insights
Every app and permission in an access policy now carries a plain-language insight, the assignment and usage numbers behind it, and a short explanation - so you can tell whether each grant belongs. What’s new:- One insight per grant: Essential, Widely Used, Rarely Used, Widely Assigned, Rarely Assigned
- Assignment and usage percentages for each app and permission
- A plain-language reason on every insight, so no number-crunching is required
- Freshness timestamp; insights refresh on draft, on publish, and at least every 7 days
- Refreshed layout with search and permission descriptions
- Confirm access is appropriate before you publish
- Catch over-granted access at a glance
- Give reviewers the evidence on the page, not in a spreadsheet
Access Policy Owner
Assign an owner to each access policy so the people closest to an app or team can keep it current, while admins keep control of what goes live. What’s new:- Owner field on every policy - one or more users, or a group
- Assign at creation or any time after, including in bulk
- Owners can view and edit access on the policies they own
- Publishing and activating stay with admins
- Owner shown in list and policy views; ownership changes are logged
- Delegate policy upkeep to app owners and team leads
- Keep policies current as the policy count grows
- Show clear, auditable accountability for every policy
Identities Table Revamp
The Identities page is now a full table on the Lumos Table Platform, with filtering, sorting, and column controls - and the custom attributes you sync from Okta and other apps are finally visible and filterable in one place. What’s new:- Filter, sort, and search across identities
- Show, hide, and reorder columns
- Custom synced attributes (Okta and other apps) visible and filterable in the table
- Consistent with Apps, Access Reviews, and other updated tables
- Find the identities you need without exporting to a spreadsheet
- Slice by the attributes your team actually uses
- Work on a surface that matches the rest of Lumos
AppStore Configuration MCP [BETA]
Configure your Lumos AppStore programmatically or through any Model Context Protocol (MCP) compatible AI agent, instead of clicking through every record. This scoped beta covers approval-change configuration. What’s new:- Read and update AppStore configuration over the Lumos MCP server
- Scoped beta: approval-step changes across apps and permissions
- Works with MCP-compatible AI tools, authenticated via OAuth
- Changes take effect immediately and appear in the Admin UI
- Update many permissions in the time it took to do one
- Run Lumos configuration from the AI tools your team already uses
- Cut manual configuration errors
Access Reviews
Admin-Configured Restricted Review Table Views
Admins can define the table views reviewers see in a User Access Review (UAR), keeping each reviewer focused on the information that matters for their decision. What’s new:- Admins configure the table views and columns available to reviewers
- Restricted views apply across the review
- Keep reviewers focused and reduce review errors
- Standardize what each reviewer sees
Ad Hoc Reminders in Permission Reviews
Send a reminder to reviewers at any point during a Permission Review, without waiting for the next scheduled nudge. What’s new:- Trigger an on-demand reminder to outstanding reviewers
- Works alongside the existing scheduled reminders
- Close out stalled reviews faster
- Reach the right reviewers at the right moment
Integrations
Integrations API
A public REST API, plus a newlumos_integration Terraform resource, to manage the full integration lifecycle - connect, reconnect, disconnect, read, and sync - without the UI.
What’s new:
- REST endpoints to connect, reconnect, disconnect, get, list, and trigger sync
- New
lumos_integrationTerraform resource over the same API - Credentials are write-only - never returned by reads
- Connect and reconnect emit audit-log events regardless of origin
- Uses your existing API token and “modify integrations” permission
- Manage integrations as code in your Terraform or CI/CD
- Script operations like disconnect-all or scheduled re-syncs
- Keep integration configuration version-controlled and auditable
Existing Connector Improvements
Ongoing enhancements to existing connectors so you can model more use cases on the integrations you already run. What’s new:- Incremental syncs for Workday, Okta, and UKG Pro
- Workday: implementers and Workday-owned accounts sync
- SAP Concur: Spend user provisioning
- Okta: standard admin role provisioning
- Sync faster and more efficiently on high-volume connectors
- Model more of your real business requirements
Sync Observability (V1)
A Sync Status view on each integration’s Integrations tab that shows every sync from the last 7 days - with live progress, stage timing, and record counts - so you can answer “did the sync run?” without filing a ticket. What’s new:- Last 7 days of syncs on each integration’s Integrations tab
- In-progress runs update live with elapsed time
- Toggle between Entity view and Pipeline (stage) view
- Stage timing and record counts for each entity
- Self-serve answers on sync status and where a run is stuck
- Diagnose stale data in seconds instead of escalating
- Trust data freshness for reviews, access requests, and audits
Coming soon
- NHI - Identities & Ownership View [BETA] - See and assign owners for every machine identity
- Microsoft Teams - Request and manage access from Teams
- Access Request Agent in Slack - Request access with an @mention
- Lumos API V1 [BETA] - A broader public API for your Lumos data
- Standardized Access Changes (UACM) - A consistent model for access changes