Skip to main content
Version: 7.x

User Portal version 7.0.4-2.8.0 release notes

App Gateway and Safous Agent​

  • App Gateway 7.0.4 and Safous Agent 2.20.4.

New Features​

New Operational Dashboards​

Safous introduces new dashboards that provide administrators with immediate, actionable visibility into platform activity, enabling faster insights and improved operational control. The Active Sessions tile displays which applications (assets) users are currently connected to, along with active sessions, pending supervision approvals, and open remote assistance requests. It also includes a global map view showing active sessions by country of origin. The Users tile provides real-time insight into user status across the platform, including currently connected users, enrolled users, and users awaiting enrollment. It also displays enabled groups by type (Safous, external, and dynamic), as well as enabled users by identity source, offering clear visibility into user distribution across connected IdPs. The Applications tile presents configured applications by type or protocol (for example, RDP, HTTPS, and others) and shows how many applications are published per site, giving administrators a consolidated view of application distribution across the environment.

User Interface Updates​

This release introduces enhanced table capabilities, including quick search, filtering, and pagination, improving usability and data navigation for administrators and end users. The UI infrastructure has been migrated from custom legacy components to a standardized framework, aligned with Safous’s commercial color theme and refreshed styling. This delivers a more consistent, modern experience and enables faster rollout of future UX improvements.

Enhancements​

Introduction of Access Groups for Access Control​

This release introduces Access Groups as a new concept, separating organizational structure from access control responsibilities to improve clarity and flexibility. Categories are now UI-only and are used solely to organize applications in the Applications Portal through static administrative assignment. Access control is now managed through Access Groups, which can be either static (explicit application assignment) or dynamic (automatic assignment based on asset and application attributes). Applications inherit their access rules from the assigned Access Group, enabling clearer policy management and more scalable access governance.

Malware Detection Policy​

Admins can configure a global malware detection policy that includes file hash checks, ICAP deep scanning, or both, and define how unknown file hashes are treated by the system (benign or malicious). The policy applies across SMB-based file sharing and File Transfer, ensuring consistent protection. Action policies can be used for exceptional cases where specific files are trusted and require different handling.

Authentication-Level Condition Policies​

Platform access is hardened with the ability to assign Condition Policies directly to Users, Groups, and IdPs. During authentication, conditions are validated hierarchically (User → Group → IdP) before application-level policies are evaluated, ensuring consistent enforcement at login. Activity logs indicate which Condition Profile triggered a block, improving visibility and troubleshooting.

Timed and Scheduled Access Requests​

This release introduces Timed Access, enabling users to request access starting immediately for a defined duration, subject to approval. Immediate Access begins once approved and remains active until logout or one hour elapses, whichever occurs first. Scheduled Access can be initiated only within the approved start and end timeframe. Once initiated within that window, access remains active even if the timeframe expires, but users cannot initiate a new session after the timeframe ends. Timed Access begins upon approval and remains active across logouts for the full approved duration. Similar to Scheduled Access, users must initiate access within the approved timeframe and cannot initiate access after it expires.

Remote Assistance​

Remote Assistance includes several enhancements to improve visibility, control, and auditability. Administrators can view all Assistant-to-Recipient assignments in a single centralized table with accurate counts of users and groups, making it easier to understand who can assist whom, simplify audits, and reduce the risk of outdated or misconfigured access. Assignments can also be created, edited, and removed directly from the table for faster day-to-day management. Remote Assistance sessions can now be recorded and played back to provide a reliable audit trail for compliance, investigations, and knowledge-sharing. In addition, Elevation Mode lets authorized admins choose whether sessions run as the signed-in user (limited permissions) or as System (full privileges for User Account Control prompts and locked screens), with the setting stored per tenant, pushed to agents, and fully audit-logged. Multi-monitor support is also available, enabling assistants to switch between remote displays, optionally view them in a combined layout, and, when supported, place each remote monitor on a separate local screen.

Admin-Defined User Validity Timeframe​

Safous now enables administrators to define a user’s validity period directly within the user profile by configuring “Valid From” and “Valid Until” dates. This allows organizations to enforce time-bound access for temporary users, contractors, and project-based roles without requiring manual deactivation. By automatically restricting access outside the defined timeframe, the feature strengthens least-privilege enforcement and improves overall access governance. In addition, a new IdP-level setting allows administrators to suspend user accounts after a defined period of inactivity automatically. This ensures dormant accounts do not remain active indefinitely, reducing the attack surface and supporting compliance requirements. Together, time-bound access and inactivity-based suspension provide stronger lifecycle management and tighter control over user access across the organization.

User Enumeration Protection in Authentication Flow​

Enhanced authentication security by requiring full credential submission before error feedback to prevent user enumeration.

Device Posture​

Safous Agent device posture includes updated capabilities to support OS data fetching with native support for Windows on ARM (ARM64) endpoints. This update expands visibility and posture assessment to modern ARM-based devices, ensuring consistent policy enforcement and uniform access decisions across heterogeneous Windows environments.

Configurable Screen Resolution for RDP​

Administrators can now define a fixed screen resolution for RDP applications, preventing blank-screen connection failures when users with high-resolution or ultra-wide monitors access legacy RDP servers. In Web RDP sessions, the configured resolution is enforced to ensure stable rendering.

Configurable Approval Window for Immediate Requests​

Admins can configure the approval time window for immediate access requests, replacing the fixed 15-minute default. Approvers can approve requests via the Supervision page, SMS, or email within the configured timeframe.

RDP, VNC, and SSH session initiators can generate a one-time, view-only guest link so others can join the session in read-only mode with no mouse/keyboard input, clipboard access, file actions, or session commands.

Direct Contact Testing from User Profile​

Administrators can now send a test SMS or email directly from the user page to validate newly added contact details. This capability helps quickly verify that phone numbers and email addresses are configured correctly when users report not receiving messages. If a phone number or email address exists for the user, a corresponding action icon is displayed next to the relevant field, allowing administrators to easily trigger a test message.

Last updated on