Version 2.1.2606.2210
Release date: Mon 22nd June 2026
------------------------------------------------------------
- Added the token deletion action to group subscriptions. This is currently only supported for members being added to an Entra groups.
Version 2.1.2606.1811
Release date: Thu 18th June 2026
------------------------------------------------------------
- Entra OATH sync function amended so that is works with the new column names in the header for activation and time interval in Entra tenants. Fallback in place in case this change has not been made to GCC high tenants
Version 2.1.2606.1213
Release date: Fri 12th June 2026
------------------------------------------------------------
-Restored HTTPS redirect in Admin console
Version 2.1.2605.2917
Release date: Mon 1st June 2026
------------------------------------------------------------
-Added ability to restrict the number of fingerprints that can be enrolled on select models of FIDO2 tokens
-Added ability to disable the removal of fingerprints after enrolment on select models of FIDO2 tokens
-Added ability to disable reset for select models of FIDO2 tokens
-Added ability to disable get assertion with a client PIN with a FIDO2 token on select models of FIDO2 tokens. This essentially forces users to use biometric for authentication with no fall back to PIN permitted
-FIDO2 PIN email is now a customisable template. Both body and subject can be modified.
-FIDO2 PIN email can now be enabled or disabled by default. In addition to this the ability for the operator to override this setting can be set in the policy
-Multiple FIDO2 policies can now be created, and these can be scoped to certain groups and/or users. An all users policy can also be created if required.
-Notes column added to token inventory page to indicate the number of notes, if any, present for a given token.
Version 2.1.2605.2715
Release date: Wed 27th May 2026
------------------------------------------------------------
-Fixed issue with origin when assigning FIDO2 tokens to users in Entra GCC High tenants
Version 2.1.2605.1916
Release date: Tue 19th May 2026
------------------------------------------------------------
-Added support for PingAM user directories
-Added support for correcting time drift of tokens in Entra via a sync function
-Added support for assigning and unassiging tokens to/from correlated identities
Version 2.1.2605.1513
Release date: Fri 15th May 2026
------------------------------------------------------------
-Fixed issue with getting stuck on loading screen when trying to login to Entra via a WAM web browser.
Version 2.1.2604.2314
Release date: Thu 23rd Apr 2026
------------------------------------------------------------
-Fixed issue with token assignments not loading if token is assigned to a deleted OKTA user. This is now automatically cleaned up in the same manner as Entra deleted users. When an OKTA token assignment is deleted its logged in the activity log.
Version 2.1.2604.0212
Release date: Thu 2nd Apr 2026
------------------------------------------------------------
-Tokens can now be deleted without a license
Version 2.1.2603.1113
Release date: Wed 11th Mar 2026
------------------------------------------------------------
-Entra FIDO2 assignment now automatically removed if the token has been unassigned in Entra OR the user has been deleted. Previously a FIDO2 token sync was required to resolve these issues.
-Activity log entries are now created when FIDO2 tokens are assigned and unassigned from Entra users.
Version 2.1.2602.1317
Release date: Fri 13th Feb 2026
------------------------------------------------------------
- Fixed two issues with Entra bulk oath token assignment using the Graph API. 429 too many requests HTTP code is now handled properly when making bulk assignment API calls. Also, each request is now limited to 50 users to avoid the 504 gateway timeout error returned by Entra when the PATCH request contains larger numbers of tokens.
- Entra EAM metadata path now ends in.well-known/openid-configuration Microsoft is now rejecting path that end with anything else. Metadata issuer has now been changed to API controller path as microsoft now requires this. Finally the EAM identity token now has the issuer set to aforementioned path as this is required by Microsoft. Old metadata and JWKS left in place until EAM customer has migrated.
- Fixed issue with activating tokens from the Entra Users page.
Version 2.1.2512.2216
Release date: Mon 22nd Dec 2025
------------------------------------------------------------
- Corrected wording of status updates when processing Entra group membership changes.
- Fixed issue caused by duplicates (same UUID and TokenID for a given row) in the Entra Hardware OATH tokens CSV.
- Added the ability to set specific action because of members being added and/or removed from an Entra group.
- Fixed the issue with the OKTA error not being passed to the front end when setting up a webhook fails.
Version 2.1.2512.1215
Release date: Fri 12th Dec 2025
------------------------------------------------------------
- Fixed issue with download tokens when using the new Entra API. Previously assumed status other than available meant the token was assigned. Now filtering by assigned not being equal to null. The GetAzureTokens made the same assumption as above, and now the same null check is being used instead. It is however still presumed that a token with the status of activated must be assigned.
Version 2.1.2511.2812
Release date: Fri 28th Nov 2025
------------------------------------------------------------
- AuditLog.Read.All and Directory.Read.All removed from list of required permissions for Entra user directory as they are no longer required.
- Added validation Entra for the application id and secret
- Added Graph API permissions check for Entra application registration
Version 2.1.2511.2510
Release date: Tue 25th Nov 2025
------------------------------------------------------------
- Fixed issue with deleted Entra users resulting in an error when loading assignments on inventory page
- Entra tokens unassigned externally will no longer cause token already assigned errors in the console as token assignments are validated if they are about to block assignment. This works wether using the old or the new API
- If a token is unassigned in Entra this will now be reflected on the token inventory page automatically. This works wether using the old or the new API
- If a token is assigned in Entra this will now be reflected on the token inventory page automatically. This only applies if using the new Graph API
- If a user is deleted then any assignment records will be deleted automatically on the inventory page
- If a user is deleted then any assignment records will be deleted automatically on the Entra Tokens page
- Fixed issue with updating the ApplicationID for an Entra Identity Source.
- Report plugin feature added
- Task plugin feature added
- Operator locale added
- Operator time zone added
Version 2.0.2509.1013
Release date: Wed 10th Sep 2025
------------------------------------------------------------
- Fixed issue with assigning tokens that have an underscore in the serial number. The underscore is used for tokens that have multiple secret slots. I.e. the QR Pro.
- Fixed issue with checkbox being disabled when multiple user directories are present for token registration in the user console.
Version 2.0.2508.1415
Release date: Thu 14th Aug 2025
------------------------------------------------------------
- Fixed API throttling issues when checking if Entra user is allowed to have a temporary access pass
- Improved handling of throttling when looking up Entra user authentication methods. These changes combined should greatly reduce the chance of a spinning wheel getting "stuck" on the Entra users page.
- If a token is deleted from the system, it will now be removed, if present, from any Entra directory token inventory if the new API is enabled regardless of whether any token assignments are present or not.
- The user deletion monitor now removes Entra Token Inventory records if the user has been deleted from an Entra directory that is configured to use the new API. This is a workaround for a Microsoft bug where inventory tokens still have the assigned to property set even when the user has been permanently deleted. This prevented the token being assigned to a new user.
- Fixed issue with sign-in preference change in bulk unassignment and unassign all user tokens not checking for errors in auth method lookup or sign-in preference change before proceeding to reattempt unassignment.
- Workaround for issue with Entra token unassignment failing as the users have OATH set as the default sign in method when only one OATH token and other methods are available. This has only been implemented for the new Entra Graph API at the moment.
- Added AAGUID 96c1f0c9-5648-4edd-91a5-c3e692c7031e for the SafeKey Classic Pro (NFC-C) PX to the SafeID bridge
Version 2.0.2508.0512
Release date: Tue 5th Aug 2025
------------------------------------------------------------
- Added the ability to set the default sign in method to OATH when registering a hardware OATH token in the User Console.
Version 2.0.2507.2513
Release date: Fri 25th Jul 2025
------------------------------------------------------------
- Added the ability to force pin change and set minimum pin length for FIDO2 keys that support the 2.1 specification.
Version 2.0.2507.1515
Release date: Tue 15th Jul 2025
------------------------------------------------------------
- FIDO2 Assignment now waiting for unplug and plug events if token is being reset rather than using a timeout. This provides a much better user experience.
- Entra FIDO2 assignment errors are now shown to the operator in the front end during FIDO2 enrolment.
- Fixed issues with PIN email for FIDO2 assignment causing the assignment to not be recorded in the DB and the PIN not shown.
Version 2.0.2507.1410
Release date: Mon 14th Jul 2025
------------------------------------------------------------
- Entra tenants with the US government cloud type (GCC High) are currently unable to download hardware OATH tokens (US Government only has access to old API) so as a workaround for now the option to provide a CSV for the sync has been added for US Government tenants.
- Added SafeID Enterprise to on-prem token product seed data.
- Added OKTA User deletion monitor
Version 2.0.2507.1110
Release date: Fri 11th Jul 2025
------------------------------------------------------------
- Removed P1/P2 license check as this is not required when using the new Entra Graph API methods for OATH token management.
- Autocomplete off on users, azure users, tokens inventory and azure tokens pages.
- Fixed issue for assigned token count on homepage was previously using number of token assignment which is incorrect as one token could be assigned to multiple accounts
Version 2.0.2507.0911
Release date: Wed 9th Jul 2025
------------------------------------------------------------
- Fixed issue with deleting tokens that have a assignment(s) created via the old Entra API. Added a null check (old API token doesn’t exist in the inventory) and then an unassign operation in the delete method to deal with old API token assignments.
- Fixed issue with adding an origin on the SafeID Bridge Service caused by the switch to.NET 8.
Version 2.0.2507.0814
Release date: Tue 8th Jul 2025
------------------------------------------------------------
- OKTA group member subscription added. This is used with the permission group scope feature as OKTA does not support query group users.
- Removed.NET Core 6 hosting bundle check from installer.
- Merge branch 'master' into BugFix/FixBridge
Version 2.0.2506.0615
Release date: Fri 6th Jun 2025
------------------------------------------------------------
- Fix for live tokens page and token sync caused by token user id returned by Entra being for a user that does not exist.
Version 2.0.2505.2813
Release date: Wed 28th May 2025
------------------------------------------------------------
- SafeID Token Service updated to check for .NET 8 hosting bundle.
- SafeID Bridge Service installer updated to look for.NET 8 publish folder for Bridge Service.
Version 2.0.2505.2110
Release date: Wed 21st May 2025
------------------------------------------------------------
- Entra hardware OATH Tokens sync now has the option to select a CSV. This allows legacy tokens to be synced as well as tokens assigned in the new system.
Version 2.0.2503.0412
Release date: Tue 4th Mar 2025
------------------------------------------------------------
- Azure application secret was previously not updated BEFORE the p1/p2 license check. If the secret had expired this would cause it to always fail to update. This has now been fixed.
- P1/P2 check now always gets a new access token. This is to fix the issue with a cached value being used which would prevent the new credentials being tested.
Version 2.0.2502.2717
Release date: Thu 27th Feb 2025
------------------------------------------------------------
- Removed unnecessary calls to get ad user authentication methods during Entra FIDO2 token assignment.
- Added key vault to request when getting ad authentication methods as KV may be required if using old API to get hardware OATH tokens.
- Added Deepnet GUID for SafeKey Classic USB-A to the bridge.
- Added code to retrieve serial number from tokens using alternative method if the APDU command fails to the bridge. This should only be required for small number of tokens that do not have the correct firmware.
Version 2.0.2502.2111
Release date: Fri 21st Feb 2025
------------------------------------------------------------
- Added AAGUID for Safekey Classic NFC and Safekey Classic fingerprint.
- Serial number of a token can now be entered manually if the get serial number command fails for a FIDO2 token
Version 2.0.2502.1215
Release date: Wed 12th Feb 2025
------------------------------------------------------------
- The SafeID Bridge now returns an array of attestation certificates from keys. This fixes attestation issues in Entra if the FIDO2 key has a CA chain.
- Added PIN policy, RFID token policy and activation policy.
- RFID tokens can now be self-registered.
- Added default admin user information to the organisation details page.
- Added Okta sync OATH tokens function. This will remove token assignment records for user who have been either deleted or deactivated.
- MFA workflow option added to local user.