Release Notes

Version history and notable changes for PAM-Pro, covering both pam.huntoso.ai (production) and demo.huntoso.ai (demo environment). SaaS customers are always running the latest version automatically - there is nothing to install or schedule.

Releases are grouped by minor version. Entries prior to Version 3.5 predate formal version tagging, so their numbering and dates are reconstructed from the engineering change log rather than from a published release record.

Version 3.13.2 - Live Tenant Verification, Table Pagination & UI Polish

September 2026. Current production version. Enhances multi-tenant operational safety with live tenant verification, improves administrative data density with responsive table pagination and dropdown row actions, and refines credential check-in and auto-approval workflows.

New

• Live Tenant Verification in Settings -> System: automated real-time verification confirms Microsoft Graph API token reachability (/organization), target Service Principal Object ID resolution, and active assignment of required directory roles (Global Reader and Privileged Authentication Administrator) without relying on cached assumptions.
• Table pagination: Audit Logs and Background Jobs tables now feature responsive page navigation with a configurable 25, 50, or 100 rows-per-page selector, backed by an expanded 500-entry audit fetch.
• Admin Dashboard row actions menu: account actions (Assign, Rotate now, View policy details, JIT Approve/Deny) are consolidated into a clean kebab dropdown menu, preventing table overflow.
• Tenant and Domain visibility on Admin Dashboard: a dedicated Tenant / Domain column resolves account tenant IDs and on-premises Active Directory domains or UPN suffixes at a glance.
• Prominent Checked-Out account indicators: accounts with active holds display an amber accent bar, time-remaining countdown badge, and are summarized in a standing banner above the administrative table.

Improved

• Auto-approved JIT elevations now seamlessly transition the reveal action button to ready without requiring manual page reload or leaving the button in a pending state.
• Credential reveals now immediately expose the Check In action within both the account card and Policy Modal, allowing holders to release holds conveniently.
• Exclusive checkout duration reporting: Policy Modal accurately reports the configured exclusiveCheckoutHours rather than defaulting to unlimited display.
• Hardened PowerShell role assignment script: generates tenant-guarded Azure CLI commands using idempotent filters (az ad sp list --filter) that prevent script termination and cross-tenant misassignment.

Fixed

• Fixed consent callback handling for additional onboarded tenants by passing a signed tenant state parameter, ensuring Microsoft consent callbacks complete reliably.
• Eliminated horizontal table scroll across Admin Dashboard, Settings, and Background Jobs by enforcing fixed table layouts with structured column widths.

Version 3.13.0 - Exclusive Checkout, Single-Holder Locks & Import Groups

September 2026. Introduces strict single-holder credential locks to prevent simultaneous access, mandatory check-in rotation, and Import Discovery Groups for external vault migrations.

New

• Exclusive Checkout: policies can enforce single-holder locks (exclusiveCheckoutHours, defaulting to 8 hours). Second checkouts during an active hold are rejected with an HTTP 409 conflict, identifying the current holder and release time.
• Mandatory Rotation on Check-In: releasing a credential hold via Check In immediately triggers an automated password rotation, ensuring credentials revealed during an administrative session are never standing.
• Administrator Force-Checkout: allows authorized administrators to override an active hold in emergency situations; automatically rotates the password before notifying the displaced holder.
• Checked-Out Conflict Dialog: user-friendly modal detailing the active holder's identity and scheduled release time when a checkout conflict occurs.
• Import Discovery Groups: adds a third discovery group type allowing organizations to govern accounts migrated from external legacy vaults (e.g., Delinea, CyberArk) via explicit Entra Object ID lists that are re-resolved through Microsoft Graph on every scan.

Improved

• Per-account concurrency locks: all checkouts, check-ins, and scheduled rotations run under strict per-account locks, eliminating race conditions during simultaneous requests.
• Import group resilience: Graph lookup chunk failures preserve previously verified group members rather than pruning them during discovery cleanup cycles.
• Strict GUID validation on import group member inputs prevents malformed entries from degrading discovery scans.

Version 3.12 - Continuous Compliance Monitoring & Hybrid Directory Visibility

August 2026. Compliance moves from a point-in-time export to always-on monitoring - a live compliance score, automatic violation detection, and scheduled report delivery - alongside new visibility into hybrid Active Directory accounts and the domains they actually come from.

New

• Continuous compliance scoring: a live 0-100 score computed across audit-log immutability, credential rotation coverage, managed-account coverage, and critical-account rotation, replacing the old point-in-time-only export.
• Automatic violation detection shows exactly which accounts and controls are currently out of policy, with drill-down detail on what each control checks, its current value, and the specific accounts flagged.
• Scheduled compliance report delivery: the same evidence PDF available on demand can now be emailed to stakeholders on a recurring cadence, with no manual export required.
• New-violation email alerts notify the configured recipient only when something newly falls out of compliance, rather than re-alerting on the same outstanding issue every cycle.
• Compliance score history: a trend chart shows how your compliance posture has moved over time, not just where it stands right now.
• Domain Inventory in Settings -> System: every discovered Active Directory domain is grouped and named, showing which Entra tenants each domain appears in and which verified UPN suffixes were seen on it - giving hybrid customers real visibility into where their accounts actually originate.
• Hybrid account badges: accounts synced from an on-premises directory are now visibly marked as hybrid on both the account list and account detail, naming the source domain.
• Directory Connectivity panel now shows, where Microsoft Graph makes it available, whether Password Hash Sync and Password Writeback are actually enabled for your synced directory - a live read that supplements the existing self-attestation checkbox rather than replacing it.

Improved

• A tenant with only a small amount of measurable compliance data no longer displays a misleadingly high "Compliant" score. Below a minimum coverage threshold, the score is now labeled "Provisional" until enough controls can be measured.
• The compliance report and the live score now share a single source for audit-log immutability status, so the two can no longer disagree about whether a tenant's evidence is tamper-proof.

Fixed

• Scheduled compliance reports and violation alerts could previously be recorded as "delivered" in the audit trail even when the underlying email failed to send - for example, when no SMTP relay was configured. Delivery status is now recorded accurately.
• Corrected a case where an account that had lost live sync with Active Directory but retained its on-premises identity data could be misreported as cloud-native - telling an administrator a password reset would apply directly in the cloud, when in fact it would never reach the on-premises directory. Such accounts are now flagged distinctly with an explicit warning.
• Accounts discovered before domain visibility shipped are no longer defaulted to "cloud-native" by omission; they now show as unscanned until the next discovery cycle determines their true origin.

Security

• On-premises domain details (domain identifiers, SAM account names, distinguished names) are no longer included in account data returned to non-administrator users.

Version 3.11 - Checkout Reliability & Hybrid Visibility

August 2026. A correctness-focused release: a concurrency fix in the credential checkout path, an honest compliance report, and visibility into a silent hybrid-directory misconfiguration.

New

• Directory Connectivity panel in Settings -> System: a live check confirming Microsoft Entra Connect is actually syncing your on-premises accounts. Discovery runs entirely through Microsoft Graph, so if on-prem sync is disabled, those accounts are invisible to PAM-Pro even though a worker is registered and online - this surfaces that condition immediately instead of as a support ticket.
• Blocked checkout now explains itself: an in-app panel shows your administrator exactly which Conditional Access step is missing when a checkout is blocked for lacking an MFA claim, instead of a bare error.
• Every checkout attempt, successful or blocked, now leaves an audit trail entry evidencing whether MFA was present - so a lockout is visible to support without a customer needing to describe it.

Improved

• The compliance report's MFA section now shows measured evidence from your own checkout history rather than a flat confirmed/unconfirmed flag - and correctly distinguishes "no evidence recorded" (older activity, predating this release) from "MFA absent," so it no longer understates a compliant tenant's posture.
• Strengthened the deployment pipeline to verify a new build actually starts successfully before it ever reaches production, closing the gap that let a prior release ship with a startup defect.

Fixed

• Resolved a rare race condition in the credential checkout path: under concurrent load immediately following a scale-out or cache expiry, two simultaneous checkouts for the same account could intermittently fail. Checkout is now correct under concurrency with no change in normal-path performance.

Version 3.10 - Vault Encryption Hardening

August 2026. Raises the encryption parameters protecting every tenant's credential vault to the current OWASP-recommended floor, and clears every open dependency security advisory across the platform. Fully automatic - no customer or administrator action required.

Security

• Tenant Root Key envelope encryption now uses Argon2id parameters at the OWASP-recommended minimum, up from the platform's original 2026 launch values. Existing tenants are converged automatically and transparently on their next credential access; no downtime, no re-authentication, no key regeneration visible to end users.
• Cleared all 15 open dependency vulnerabilities across the platform (8 high, 4 moderate, 3 low severity), including an upgrade to the email delivery library that closes a high-severity advisory. No application behavior changed as a result.

Improved

• Platform stability and deployment reliability hardening.

Version 3.9 - Enterprise Integration & Compliance Depth

July 2026. Focused on getting PAM-Pro data into the tools your security and audit teams already use.

New

• SIEM audit log export: forward every audit event to Splunk, Microsoft Sentinel, Elastic, a custom webhook, or a Syslog collector over UDP, TCP, or TLS.
• Syslog output can be formatted as RFC 5424, RFC 3164, or JSON to match your collector.
• SIEM authentication tokens are stored in your dedicated Key Vault rather than in configuration, preserving the zero-secret model.
• Forwarding runs asynchronously, so a slow or unreachable SIEM endpoint never delays a checkout or a rotation.
• Compliance control mapping: each policy setting and platform control is now mapped to named controls in NIST 800-53, SOC 2 Type II, HIPAA, and PCI-DSS v4.0, with a link to the official published control text.
• Per-framework risk scorecard showing your live compliance posture before you apply a standard.
• Anticipated system impact analysis: preview exactly how many accounts would require immediate rotation or lockout before committing to a framework.
• Auditor-grade compliance export now includes the full control mapping matrix.
• Real-time Just-In-Time approval notifications: live count badges in navigation, banner alerts that deep-link straight to the request, and inline approve or deny.
• Requesters now see a pending-approval badge on their own account cards while a request is outstanding.

Improved

• Edge certificate handling rebuilt on long-lived origin certificates, removing the annual renewal window and the web application firewall downtime that came with it. TLS is enforced end to end in strict mode.
• Compliance framework control links now point to the correct official standards repositories.

Fixed

• Policy approver lists are now cleared correctly when Just-In-Time or approval requirements are switched off, so a disabled workflow can no longer leave stale approvers behind.
• Compliance impact wording corrected to reference checkout users rather than administrators.
• Corrected the version number shown on the Settings About tab, which could drift from the running build.

Version 3.8 - Analytics & Governance

May 2026. Deeper visibility into your security posture, finer-grained Just-In-Time controls, and a round of security hardening ahead of general availability.

New

• IP allow-listing so sign-in can be restricted to your corporate network ranges.
• TLS 1.3 enforcement with automated edge bypass detection surfaced on the Security Scoreboard.
• Rotation history upgraded to a stacked chart showing successful rotations, failed rotations, and remaining managed capacity.
• 7-day rotation forecast showing upcoming scheduled password rotations before they happen.
• Just-In-Time access duration (how long approved access lasts) is now a separate setting from post-checkout auto-rotation timing, giving administrators finer policy control.
• Pending Just-In-Time requests now surface inline on the Dashboard with one-click approve or deny for authorized approvers.
• New interactive Policy Help Drawer with contextual guidance for every policy setting.
• Governance Scorecard completion metrics now surface directly on the Analytics overview.
• Consolidated user menu bringing Sign Out and Docs under a single profile dropdown.

Improved

• Analytics is now restricted to administrators to keep organization-wide risk data limited to those who need it.
• Risk trend charts now aggregate real historical snapshots instead of point-in-time estimates.
• Faster load times on the Dashboard and My Accounts pages for organizations with large account inventories, achieved by batching policy lookups rather than fetching per account.
• Stronger at-rest protection for stored credentials via AES-256-GCM envelope encryption under your Tenant Root Key.
• Terminology standardized on Tenant Root Secret and Tenant Root Key throughout setup and settings.
• Dashboard now defaults to Managed accounts, with skeleton loading states across data-heavy pages.
• Charts and controls now render correctly in light mode across Discovery, Governance, and Security.
• Refined contrast and readability across Discovery, Policy, and onboarding screens in both light and dark mode.
• Clearer language and layout on the Billing page and throughout Setup Wizard steps.
• Wider modals across the platform for a more comfortable editing experience.
• Product documentation moved to this hosted documentation site, with a health status link added to the Settings About tab.

Fixed

• Resolved a policy configuration issue where some approval and access-window settings would not persist correctly.
• Fixed a rare timing issue that could interrupt API calls immediately after signing in.
• Corrected time picker and dropdown legibility issues in the Discovery Group setup flow.
• Restored the Re-run Setup Wizard action in Admin settings.

Version 3.7 - Billing Reliability & Branding

May 2026. Hardening the subscription lifecycle and the compute layer behind it.

New

• Responsive PAMPro logo: a compact icon on mobile, full wordmark on desktop.

Improved

• More resilient handling of subscription upgrades, downgrades, and cancellations.
• Reduced risk of duplicate or missed billing event processing.
• Rebuilt the tenant identity model behind the scenes so a single compute instance can serve hundreds of customers, removing a hard platform ceiling that previously capped instances at 20 tenants.
• API traffic now routes through the content delivery and firewall edge on a dedicated hostname per region.
• Version numbering standardized across the entire platform.

Fixed

• Resolved a sign-in redirect mismatch that occurred when the application was reached through an alternate hostname.

Version 3.6 - Governance Hub & Role-Based Discovery

April 2026. A large functional release covering discovery, analytics, approvals, and a reorganization of the administration experience.

New

• Role-based discovery: find privileged accounts by their Microsoft Entra ID directory role rather than by naming pattern alone, with one-click deployment of ten standard privileged role groups.
• Analytics dashboard with 30-day password rotation history, compliance score trending, Just-In-Time activity charts, and top activity heat maps.
• Continuous background snapshotting into a dedicated history store, powering genuine long-term trend charts.
• Just-In-Time access request and approval interface: an approval panel for administrators, a request modal for users, and status-aware account cards.
• Background Jobs monitoring with drill-down into the accounts each job touched.
• Per-account email notification toggles for Just-In-Time activation, credential reveal, and rotation events.
• Contextual help tooltips across Account Discovery and group setup.

Improved

• Settings reorganized into a single Admin area with Billing and Background Jobs as tabs; Compliance and Scoreboard combined into one Governance hub.
• Applying a compliance framework now persists, updates the default policy rotation and justification settings, and records an audit entry.
• Audit coverage extended to discovery groups, Just-In-Time access, alert delivery, Tenant Root Secret resets, and immutable storage governance changes.
• Discovery redesigned to a single-column layout with real-time scan progress.
• Discovery matching is now case-insensitive and matches display names in addition to sign-in names.
• Security Scoreboard items that can be verified automatically now self-attest instead of waiting on a manual checkbox.

Fixed

• Resolved errors when updating immutable storage retention settings.
• Fixed audit log writes being blocked by the immutability policy itself.
• Corrected layout overlaps in the compliance PDF export.
• Fixed policy creation and Governance page errors.
• Removed a horizontal scrollbar on full-screen views.

Version 3.5 - Scale & Visibility

April 2026. Platform scalability and clear visibility into which version you are running.

New

• Application version is now displayed on the login screen and throughout the authenticated app.
• Automated branded welcome email sent as soon as a new environment finishes provisioning.

Improved

• Improved request routing performance to support horizontal scaling as customer volume grows.
• Hardened internal naming conventions to safely support multiple production environments.
• Automated capacity monitoring so new compute capacity is prepared before the existing pool fills.
• Customer resources are now tagged with their assigned infrastructure instance for clearer operational visibility.

Fixed

• Improved reliability of new tenant provisioning, resolving intermittent delays during environment setup.
• Fixed a provisioning retry issue that could create duplicate resources for a single purchase.
• Resolved a "no organization found" sign-in error caused by provisioning stopping short of registering the tenant.

Version 3.4 - Onboarding Diagnostics

April 2026. Making setup failures explain themselves.

New

• Setup Wizard now reports the specific reason an identity federation check failed instead of a generic status badge.
• Secondary tenant onboarding with a generated role assignment script and a direct admin consent link.

Improved

• Provisioning and deployment automation hardened against transient network failures with automatic retry.
• Managed user list surfaced directly in Admin settings.
• Pro tier default account limit raised to 1000.

Fixed

• Federation checks no longer report success when configuration is missing or invalid.
• Resolved consent script errors when run from Azure Cloud Shell.

Version 3.3 - Simplified Tenant Consent

April 2026. Cutting the manual steps out of connecting your directory.

New

• One-click admin consent replaces the previous copy-and-paste PowerShell onboarding step, and consent completion is now detected automatically.
• Microsoft Graph email delivery as an alternative to an SMTP relay, selectable during onboarding.

Improved

• Cross-tenant authentication rebuilt on a per-customer application registration model, removing a Microsoft platform restriction that blocked federated sign-in for some directories.

Fixed

• Resolved API calls failing immediately after sign-in due to a token audience mismatch.
• Fixed cross-origin request rejections between the web app and the API.
• Fixed a browser security policy that silently blocked API calls after dynamic routing.

Version 3.2 - Subscriptions & Billing

April 2026. Self-service purchase through to a running environment.

New

• Self-service checkout that automatically provisions a dedicated environment on payment.
• Billing page for administrators with subscription overview, plan detail, invoice history, and a link to the billing portal.
• Automated welcome and cancellation emails.
• Seat usage synchronized to your subscription once per billing cycle, with no mid-cycle proration.
• Tenant activation switch: a disabled tenant is stopped at sign-in with a clear message, before any identity provider redirect occurs.

Improved

• Compute capacity now scales out automatically as customer volume grows.
• Automated daily backups of the tenant registry.

Version 3.1 - Automated Provisioning

April 2026. Removing every manual step between a purchase and a working environment.

New

• End-to-end automated provisioning: a completed purchase creates the isolated resource group, Key Vault, storage account, and identity with no manual intervention.
• Infrastructure defined as code with scripted lifecycle orchestration.
• Scheduled maintenance automation covering capacity checks, registry backups, and cleanup of orphaned identities.

Improved

• Provisioning now resumes safely if interrupted, rather than starting over and creating duplicate resources.

Version 3.0 - SaaS Platform

March 2026. The move to a multi-tenant hosted platform, while keeping full parity for self-hosted deployments. Shared application logic, fully isolated per-customer data.

New

• Home Realm Discovery sign-in: enter your work email and you are routed to your own Microsoft Entra ID tenant for authentication.
• A dedicated Key Vault and storage account per customer. No credential store or data store is shared between customers.
• Central tenant registry with license enforcement and a global activation switch.
• SOC 2 evidence export generated in memory, never written to disk.
• Two-phase onboarding that separates infrastructure bootstrap from tenant configuration.

Improved

• Setup Wizard modernized for the hosted model.
• Sign-in lookups are rate-limited to prevent enumeration of hosted customers.

Version 2.0 - Commercial Release

March 2026. The transition from a technical tool to a commercial product, centered on guided onboarding, security assurance, and compliance evidence.

New

• Guided Setup Wizard covering identity provider, tenant topology, storage and secrets, prerequisites, and alert delivery, with a connection test at each step.
• Compliance framework mapping for NIST 800-53, SOC 2, HIPAA, and PCI-DSS, with a before-and-after comparison shown prior to applying a standard.
• Zero Trust Security Scoreboard: a live 0-100 posture score with actionable remediation items.
• Just-In-Time access with approval workflows.
• Multi-factor step-up required at credential checkout.
• Write-once immutable audit storage.
• Dormant account lockout with email alerting.
• SMTP alert delivery with a test-send action.
• In-application documentation.

Improved

• Moved to a cloud-native deployment on Azure Container Apps and Azure Static Web Apps, with managed identity replacing stored deployment credentials.
• Automated build and release pipeline.

Version 1.0 - General Availability

February 2026. The core feature set complete: automated privileged account discovery against Microsoft Entra ID, policy-driven credential rotation backed by Azure Key Vault, secure checkout with justification and ticket capture, and a full audit trail. Deployable single-tenant or on-premises.

Version 0.3 - Assignment & Health Analytics

February 2026.

New

• Account assignment: assign managed accounts to specific users, with a dedicated Admin Dashboard and a My Accounts view for end users.
• Assignment logging with pagination and CSV export.
• Health Analytics covering error accounts, disabled accounts, overdue rotations, and unassigned managed accounts, with a drill-down modal and CSV export.
• Automated discovery on a configurable interval, with optional auto-management of newly discovered accounts.
• Automated rotation scheduler with next-rotation-due tracking and automatic rotation of overdue accounts.
• Justification and ticket ID capture on credential reveal, enforced by policy.
• Multi-select group assignment for policies, replacing manual comma-separated entry.
• Rotate a password from the dashboard without revealing it.
• Searchable account selection with type-ahead and keyboard navigation in the Policy Simulator.

Fixed

• Resolved credential checkout failures when retrieving a stored secret.
• Fixed a policy assignment mismatch between the Discovery and Policy pages.
• Fixed assignment actions returning a not-found error.
• Corrected time picker AM and PM button visibility.

Version 0.2 - Account Assignment

February 2026.

New

• Account assignment workflow with "Save to Managed" functionality.
• Split account views: discovered vs. managed accounts.

Improved

• Secure API token handling.

Fixed

• Password rotation workflow reliability.
• Authentication token timing issues affecting session stability.

Version 0.1 - Early Access

February 2026.

New

• Tenant selection with automatic detection of your primary Microsoft Entra ID directory.
• Live account discovery against Microsoft Entra ID.

Version 0.0.1 - Initial Release

February 2026. The first release of PAM-Pro: automated account discovery, secure credential rotation backed by Azure Key Vault, and a web dashboard secured with Microsoft Entra ID sign-in.