Application Build 3.10 and UC 3.3.13

October 2026

Overview / Summary

This release expands ObserveID capabilities across authentication, privileged access management, identity governance, and workflow automation. Passkey, passwordless authentication modernize sign-in options, while self-service SSO configuration increases administrative autonomy. Privileged access management is enhanced through browser-based remote access, expanded External Account management, and flexible connection routing across distributed Guacamole infrastructure. Role cloning, role-based access notifications, and session activity-based violation detection improve access governance, risk visibility, and administrative efficiency. New workflow monitoring capabilities and automated change-based data imports further strengthen operational oversight and help maintain more current identity and access information. Together, these enhancements enable organizations to manage identity and privileged access more efficiently while strengthening security and governance.

Key feature enhancements include:

  • Passkey and Passwordless Sign-In: Phishing-resistant authentication with flexible support for synced and device-bound passkeys
  • Self-Service SSO Application Configuration: Administrator-managed OIDC and SAML application onboarding without support-assisted registration
  • Enhanced External Account Management: Remote Connect support, and improved governance visibility for externally managed accounts
  • ObserveID PAM Browser Extension: Streamlined browser-based privileged access with automated authentication
  • Role Cloning: Faster role engineering through reusable configurations and controlled role creation workflows
  • Active Workflow Queue Widget: Configurable monitoring of scheduled workflows, execution queues, and upcoming automated operations
  • Role-Based Assigned Access Notifications: Targeted notifications with visibility into access granted through IT and Birthright Roles
  • Audit Log-Based Violation Detection: Session activity analysis with identity risk scoring and improved governance visibility
  • Guacamole Connection Routing: Configurable routing across multiple Guacamole daemons for flexible, centrally governed privileged access
  • Automated Change-Based Data Import: More timely data aggregation through change-triggered imports, reducing unnecessary processing and improving access governance visibility

New Features & Enhancements

Passkey and Passwordless Sign-In

ObserveID now supports passkey-based authentication, providing users with a secure and convenient alternative to traditional password-based sign-in. Passkeys can be used as an additional authentication factor in supported sign-in flows or as a passwordless authentication method.

  • Administrators can configure available authentication methods through ObserveID's MFA policies. The sign-in options presented to users depend on the applicable authentication policy, registered authenticators, and supported authentication flow.

  • ObserveID supports both synced and device-bound passkeys, allowing users to authenticate through compatible platform authenticators, password managers, or hardware security keys, subject to browser, operating system, and authenticator compatibility.

  • Passkeys use public-key cryptography to authenticate users without transmitting reusable passwords. Depending on the authenticator, users can complete authentication using biometric verification, a device PIN, or a hardware security key, simplifying the sign-in experience.

    Sign-in with a passkeySign-in with a passkey

Self-Service SSO Application Configuration

Building on the OIDC and SAML 2.0 Single Sign-On capabilities introduced in the previous release, ObserveID now provides a dedicated administrative interface for configuring applications that use ObserveID as their authentication provider.

  • Previously, registering OIDC clients and configuring SAML Service Providers required assistance from the ObserveID support team. Administrators can now manage these configurations directly in ObserveID, registering applications as OIDC Clients (Relying Parties) or configuring them as SAML Service Providers, with ObserveID acting as the OpenID Provider or SAML Identity Provider, respectively.

    Example configuration of an OIDC clientExample configuration of an OIDC client

Enhanced External Account Management

External Account management has been enhanced with Remote Connect support and expanded administrative capabilities in governing accounts that are not associated with a configured integration.

  • External Accounts added directly to an identity can now be used to initiate remote connections to their corresponding target systems, provided the required connection settings are configured.

  • External Accounts created by users are now visible in the administrative interface, allowing administrators to review account ownership, classifications, and associated information. This provides greater oversight of externally managed accounts and supports more consistent account governance.

    Remote Connect through an External AccountRemote Connect through an External Account

ObserveID PAM Browser Extension

ObserveID introduces a new browser extension, ObserveID PAM, that enables users to establish authenticated browser-based sessions with target applications without manually entering or viewing the target account credentials.

  • When Remote Connect is configured for the corresponding integration, an identity can check out an account and initiate a remote connection from My Access. The ObserveID PAM extension opens the target application in a new browser window and completes the configured authentication process, providing access to an authenticated application session without requiring the user to enter the target credentials.

    PAM extensionPAM extension

Role Cloning

Role Management now supports role cloning, allowing administrators to create new roles using existing roles as configuration templates.

  • When a role is cloned, ObserveID initiates a new Role Creation request with a prepopulated form. The source role's access assignments, ownership, and other applicable properties serve as the starting point for defining the new role. Administrators can review and modify the proposed configuration before submitting the request for processing, including any applicable approvals.

  • This enhancement streamlines role engineering by reducing repetitive configuration, promoting consistency across related roles, and simplifying the creation of roles with similar access requirements.

    Role CloningRole Cloning

Active Workflow Queue Widget

The new Active Workflow Queue widget provides administrators with visibility into scheduled workflows awaiting execution, including their position in the execution queue and next scheduled execution time.

  • Administrators can filter scheduled workflows by request type and configure multiple independent widget instances on the Dashboard. Each widget can display a different selection of workflows, allowing administrators to monitor specific automation processes and prioritize visibility into critical operations.

  • By displaying the execution queue and upcoming execution times, the widget helps administrators track scheduled activities, anticipate workflow execution, and maintain visibility into automated identity governance and access management processes.

    Active Workflow QueueActive Workflow Queue

Role-Based Filtering for Assigned Access Notifications

ObserveID now supports role-based filtering for Assigned Access email notifications, allowing organizations to report access assignments resulting from selected request types and associated with specific IT or Birthright Roles.

  • When a selected role is provisioned, the notification can include the individual access assignments granted through that role, providing recipients with a clear view of the access associated with the role assignment.

  • Administrators can configure notifications based on applicable request types and roles, helping ensure that recipients receive relevant information about role-driven access changes without unnecessary details about unrelated assignments.

    Role access notificationRole access notification

Audit Log-Based Violation Detection

Violation reporting now supports Audit Log data as an additional source for detecting potentially risky user activities and evaluating identity risk. This enhancement expands ObserveID's violation detection capabilities from access-based analysis to activity-based risk assessment.

  • Administrators can create Violation reports based on Audit Log records and define conditions determining selected session activities as risky. Detected violations can contribute to the associated identity's Risk Score, allowing organizations to incorporate session activity findings into identity risk assessments alongside existing access-based risk indicators.

  • By correlating session activity with identities and defined risk conditions, administrators and auditors can identify potentially risky behavior, prioritize identities for further review, and investigate access usage in the context of established governance policies.

    Audit Log Violation SourceAudit Log Violation Source

Guacamole Connection Routing

ObserveID now supports centralized configuration of multiple Apache Guacamole daemon (guacd) instances, allowing administrators to define how Remote Connect sessions are routed across distributed remote access infrastructure. When enabled through tenant deployment settings, the new Guacamole Configuration area becomes available in Administration.

  • Administrators can register multiple external guacd instances and configure routing rules that determine which instance handles a remote connection. This enables Remote Connect traffic to be directed to the appropriate connection proxy based on the configured routing criteria.

  • Centralized routing configuration helps organizations align remote connection routing with their network architecture, operational requirements, and infrastructure boundaries while retaining ObserveID as the central point for initiating and governing Remote Connect sessions.

    Guacamole ConfigurationGuacamole Configuration

Automated Change-Based Data Import

ObserveID now supports automated, change-based data imports for integrations with supported change detection capabilities.

  • When this feature is enabled for an integration, the Universal Connector monitors the connected target system for changes, and a new Data Import request is automatically triggered when relevant changes are detected. ObserveID maintains a snapshot of the previously aggregated dataset and uses it as a reference to identify changes that require refreshing the aggregated data.

  • Automatically triggering imports in response to detected changes helps keep aggregated accounts, entitlements, and other supported integration data aligned with the current state of connected systems. This reduces the need for unnecessary import executions when no relevant changes have occurred, optimizing integration processing and minimizing avoidable data retrieval and aggregation workloads.

    Change-based data importChange-based data import

Affected Components & Modules

  • ObserveID SSO
  • Remote Connect
  • External Accounts
  • Local Authentication
  • MFA
  • Roles
  • Dashboard
  • Email Notification
  • Violations
  • Data Import
  • Universal Connector
  • Guacamole
  • PAM Extension

Note:

The release will be deployed during non-business hours to minimize disruption. Downtime is expected to be less than five minutes, and users are unlikely to experience any noticeable interruption.

References & Support

For detailed instructions or additional technical assistance, please contact your ObserveID support representative at [email protected].

Thank you for choosing ObserveID!