v6.1.0

Changes since v6.0.3

Account Linking

• Surname, Initials names: accounts from sources that show a person as "Surname, Initials" (common in ERP, finance and payroll exports, with no address or employee number) can now be attached to their owner. All initials count, so Buskes, L.R. reaches the Laura Renée Buskes it singles out rather than the Lars Buskes who shares only the first letter. Where initials fit more than one person, the account is held for review with the rival named. A department or manager can settle a choice the name leaves open.
• Admin logins read as names: an account logging in as adm-fhogenbirk is attached to the Fay Hogenbirk it names, even if her mailbox follows another convention. This also covers logins that a convention writes shorter than the person's name (adm-ddongen for Daniëlle van Dongen, adm-wvelde for a double surname) and numbered logins (adm-svisser2). A login that fits more than one person is held for review with the other candidates named. A shortened login never outranks a person actually called that name, and a numbered account is never given to the owner of the un-numbered address.
• Unique full names link on their own: an account whose full name exactly one person is spelled links even when others share the surname and first initial ("Youssef El Mahdi" no longer waits for review because a Yasmina exists). Real namesakes are still held. The first run after upgrading re-links accounts the previous behaviour held or detached, and the run summary says how many.
• Safer name-only matching: an account is no longer linked on a display name that somebody else answers to, including near-identical namesakes such as Jan Jansen and Johannes Jansen. A new Name-only matches (held for review) card in Admin → Account Linking lists each held match with the confidence, signals, reason and who else answers to the name, and says which name the rivals share. A new Link on a name match alone setting (on by default) lets installations hold back every name-only match. Earlier name-only links are re-examined on the next run; analyst-confirmed and crawler-supplied links are never touched.
• Better name parsing: academic titles (drs., dr., ir., ing., prof., MSc, BSc, MBA, LLM, PhD and similar) and surname particles are no longer read as names, and multi-word surnames such as "van den Berg" are matched in full. A person is now matched on every name they are known by (name fields and display name), so birth surnames and partner names no longer block a unique match. Accounts are still held for review where people have an equal claim to a name. Links that were already written to the wrong person are not corrected automatically; reject or move them from the identity's Linked Accounts.
• More honest confidence: the same name is no longer counted twice, confidence reflects the corroboration a match actually has, and the recorded signals say so. A link made on a unique full name is now recorded at 70 instead of 60 and lists the name's uniqueness among its signals. The certainty slider remains the control for how much evidence a link needs.
• Settings upgrades: newly shipped match signals are now merged into tenants that have saved their Account Linking settings, so they no longer miss signals added in later versions. Your saved values are never overwritten and signals you added are kept. To switch a signal off, set its weight to 0; deleting it no longer disables it. The editor shows the effective dictionary, and the Orphaned Accounts report and context use the same one as a run. Setting a weight to 0 now also releases the links made on that signal.
• Removed accounts: accounts removed from their source system are no longer scored, newly linked, counted as orphans or listed in the Orphaned Accounts report and context, so a leaver's account can't be handed to a colleague with the same name. Accounts already linked stay linked as history, and an account that reappears becomes linkable again. A run's "links removed" figure counts only links to accounts that still exist.
• A link settled by a department or manager is no longer detached and re-created on every run.

History, Diff and deleted items

• New Diff tab on user, resource, business role, identity and context detail pages. Pick a moment in the past (1 day to 1 year ago, or any date) and compare the item then and now, side by side: every attribute and every relationship. Changed values are highlighted, additions show in green, removals in red, and "Only show differences" hides what stayed the same.
• Timeline fixes: the Timeline now shows removed access ("Removed from …"), access that comes back, roles or resources deleted in the source, and "Deleted in source" / "Restored in source" for the entity itself. It no longer hangs on "Loading timeline…" for tenants with a large change history, and no longer shows "Removed from …" for a relationship that was only updated.
• Deleted items kept apart from current access: relationship lists on user, resource, business role and identity pages show anything deleted in the source as "Historical" with its deletion date, collapsed under "Show N historical", and leave it out of the relationship graph. CSV exports include historical rows only when expanded, with a Status column. Counts behind these relationships include only what still exists. A deleted business role shows a "Deleted in source" badge, and a user's Business Roles no longer list deleted roles (or the same role twice after a re-create).
• Business Roles page hides roles deleted in the source; an "Include deleted" option shows them with a badge, and the Excel export follows it with a "Deleted At" column.
• Consistent totals: Systems, the dashboard, the daily Trends snapshot, matrix totals, scope figures, nested-group expansion, risk score lists, context members and counts, generated contexts (manager hierarchy, departments, account types, AD OUs, resource types, group categories, scope hierarchy, resource clusters), the matrix's business-role columns and governance review-compliance figures no longer include users, resources, roles or assignments deleted in the source. An identity's linked accounts show a "Deleted in source" badge on accounts that no longer exist.

Reports

• Risky Applications (Entra ID): every enterprise application, managed identity and AI agent gets a 0–100 risk score with the findings behind it, including apps on a public list of malicious apps, Microsoft look-alikes, high-risk app-only permissions, admin and user consent, public-client flows (ROPC), wildcard or http redirect URIs, secrets that never expire or are hidden on the enterprise application, departed or guest owners, and unused apps that keep powerful permissions. The report says which checks it could not run because a crawler option was off, and leaves Microsoft's own apps out unless asked.
• High-risk Application Permissions (Entra ID): one row per app-only permission a service principal actually holds that reaches SharePoint/OneDrive content, mailboxes or directory control tenant-wide, with API, category and severity. You can widen the list with further permissions from your tenant or use only your own picks, and save the choice as a view.
• Access Review Adoption: lists each business role with when a person last really reviewed it, longest ago first. Reviews completed by the default decision because nobody responded don't count. Never-reviewed and too-new roles are their own categories, and roles without a review requirement are left out unless included.
• Access Reviewer Response: lists each reviewer with how many reviews they were asked to do, how many they answered themselves and how they decided.
• Summaries on screen: reports with charts or pivots in their Excel download (Access Review Adoption, Access Reviewer Response, Entitlement Pivot) now show that breakdown above the table. Clicking a status, verdict or pivot group narrows the table; Show all rows brings everything back. The download is now one main Download XLSX button, with CSV and JSON in a menu next to it, and Excel downloads can open with pie charts.
• Entitlement Pivot (formerly Application Access Review) now works for any context of resources and any resource type. You choose the columns (including any attribute the contexts carry, with counts) and the rows and filters of the Excel pivot tables, and the report tells you when a picked attribute has no value in scope. The built-in "requestable" sections, certification-frequency summaries and fixed catalogue columns were removed; their values remain available as attributes. Existing links still open. See the new documentation page.
• Saved views: save a standard report's settings as a named view that everyone can open from the new Saved views section of the Reports page. Save as view walks through the settings step by step; Edit view changes it for everyone or saves a copy. Saving, changing and deleting views needs the Build custom reports permission.
• Report builder and assistant:
  • The assistant now recognises "I" in lower case ("groups i'm in") and "assigned to me" / "van mij", and "all groups with the group owner" lists the owners' names.
  • Group, resource, user and person reports can show and filter on the contexts each row is part of (for example "groups in no context"), including from the Ask box.
  • Attributes with spaces, dashes, dots or accented letters (such as "CMDB Reference") now work as filters on the Users and Resources lists, as matrix filters and groupings, and in the report builder.
  • The Context entity now offers its External ID.
  • Users who may build custom reports but not ask in plain language now get the builder without the "Describe it" panel.
  • The "Describe it" box says when the model server is starting up and can take a few minutes.
  • Fixed two question patterns that slowed down sharply on long runs of spaces.
• Fixed the Reports page intermittently failing with "Error loading reports (HTTP 500)" on deployments with many custom reports and a large dataset.
• Clicking an app in the Risky Applications and High-risk Application Permissions reports opens the app's service-principal detail page instead of showing "HTTP 404".

Search and tagging

• Extended search: an "All attributes" checkbox on the Users, Identities and Resources lists (remembered per list) also matches phone numbers, CMDB references, HR numbers and every other attribute a source sends, and a "Matched on" column shows where each result was found. Phone numbers match however they are written, and Identities are also found through their linked accounts.
• A new "Find a context" box on the Contexts page searches every level of every tree.
• The Users search also finds employee ID and external ID, and the Resources, Groups and Contexts searches also match the external ID.
• "Tag all N matching" now tags exactly what the list shows: it follows "Include deleted" on Users and Resources, no longer tags business roles on the Resources list, and uses the same search as the Identities list.

Entra ID crawler

• Fast delta syncs: a delta run reads only what changed (users, service principals, groups and membership/owner changes), so it takes minutes instead of hours. PIM eligibility, governance, app roles, OAuth2 grants, app permissions, directory roles, nested memberships and sign-in activity refresh on full runs only, so keep at least one full run a day. A delta on a crawler that has never completed a sync runs as a full sync.
• Scheduling: schedules can run every 5, 10, 15, 20 or 30 minutes ("Every few minutes"). A new Entra ID crawler proposes a delta every 15 minutes plus a daily full sync. A full run that comes due while another run is going now waits (up to an hour) instead of being skipped, and the full goes first when both are due. Recent Jobs always includes each crawler's last full and last delta run.
• App registrations: a new "App Registrations & Credentials" option reads every app registration with secret and certificate dates (never the values), public-client flows, redirect URIs, implicit grant settings, requested permissions and federated credentials. Service principals now carry their own credentials, verified publisher, sign-in audience, reply URLs and whether assignment is required. Tenant-wide admin consents are now recorded and marked admin-consented, per-user consents are labelled, and application permissions record when they were granted and the tenant-independent IDs of the holder and target API.
• Access reviews: the crawler records the reviewers each review contacted, the "if reviewers don't respond" setting and who applied each decision. Run a full sync to fill these in.
• Enterprise applications with only consent grants (such as PnP Management Shell) no longer disappear after a full crawl, and every enterprise application now has a resource.
• Fixed delta syncs always running as full syncs on Azure App Service deployments.
• Connectors can remove individual assignments in a delta sync by naming them (deletedKeys on the ingest API).

Azure deployment

• Every release now includes IdentityAtlas-azure-<version>.zip, the Azure template at that release, set to deploy exactly that release's images. Keep it in your own repository to manage the deployment as code.
• New imageTag parameter (for example 6.0.2.0) deploys an exact release across the web app, worker and report generator, making upgrades and rollbacks a one-value change.
• New containerRegistryResourceId parameter pulls images from your own Azure Container Registry, such as a pull-through cache of ghcr.io.
• Sign-in can be configured in the template itself (entraTenantId / entraClientId), so redeploying no longer clears it.
• Redeploying no longer issues a new report generator API key and restarts both containers; the key is generated once and kept in Key Vault.
• New guide "Managing the Azure deployment as code" with ready-to-copy workflows that propose each stable release as a pull request and deploy after merge.
• Fixed the Deploy to Azure button failing on fresh installs with "The specified KeyVault … could not be found". Existing deployments are unaffected.

Improvements

• The Reports tab is now shown to every user by default. Contexts and Identities are optional tabs, hidden by default; switch them on per user under Settings → Visible Tabs (Identities only while account linking is enabled). The pages stay reachable by link.
• The SCIM 2.0 crawler is no longer experimental and always appears in Admin → Crawlers → Add Crawler.
• Excel export now works in the rotated matrix layout (subjects as rows, resources as columns), matching the on-screen grid with a Legend sheet and shareable link.
• CSV import: Users.csv has official EmployeeId, GivenName and Surname columns, so the employee number can finally be used by Account Linking. Existing imports that carry these columns pick them up on the next run; the earlier copy under Extended Attributes is left in place until cleared. The template, upload wizard hint and schema documentation are updated.
• The portable launcher (Start-IdentityAtlas.ps1) has a new -WithLLM option so custom reports can be described in plain language without Docker. Required files are downloaded once and checksum-verified, or taken from a folder you copy in for offline machines (-LlmRoot). Also fixed the report generator's startup warm-up, which never ran in the portable build.
• The demo data now includes about 20 admin accounts using an adm-<first initial><surname> login convention, with one deliberately ambiguous, so Account Linking's login signal is visible on the stock demo. Existing demo data is unchanged.
• The Excel Power Query workbook now explains the "Information is required about data privacy" prompt and walks you through the required "Ignore the Privacy Levels" step; the export guide documents it.

Security fixes

• Updated bundled dependencies in the API and web UI to clear newly published advisories, including high-severity fixes for denial-of-service and request-handling issues in file upload (multer), HTTP parsing (body-parser), the HTTP client (undici) and schema validation (zod), plus moderate fixes in fast-uri, ip-address, iconv-lite and qs.

Full Changelog: v6.0.3...v6.1.0

Dependency updates

API runtime

• body-parser 2.3.0 → 2.4.0
• content-disposition 1.1.0 → 2.0.1
• content-type 1.0.5 → 2.1.0
• express 5.2.1 → 5.3.0
• express-rate-limit 8.7.0 → 8.7.1
• fast-uri 3.1.8 → 3.1.9
• iconv-lite 0.7.2 → 0.7.3
• ip-address 10.7.2 → 10.7.4
• multer 2.4.0 → 2.5.0
• qs 6.16.0 → 6.16.1
• undici 8.11.2 → 8.12.3

Frontend

• @azure/msal-browser 5.24.0 → 5.25.0
• @tanstack/react-virtual 3.14.13 → 3.14.15
• react 19.3.0 → 19.3.1
• react-dom 19.3.0 → 19.3.1

Portable Windows downloads

Two portable ZIPs for running Identity Atlas on Windows without Docker. Unzip and run Start-IdentityAtlas.ps1 with PowerShell 7.

File	Pick it when
IdentityAtlas-portable.zip	The default. Runs on PGlite, a database inside the app. node.exe, the only executable in the zip, is code-signed, so it runs on locked-down laptops whose application control trusts signed publishers.
IdentityAtlas-portable-postgres.zip	Large data sets that outgrow PGlite. Embeds a real PostgreSQL 16 server; start it with .\Start-IdentityAtlas.ps1 -Database Postgres. The PostgreSQL binaries are not code-signed (application control needs hash or path rules for them) and need the Microsoft Visual C++ runtime (VCRUNTIME140.dll).

See Portable Windows Launcher for details.