Important
New Features
CLI Elevation
Elevate24 is now available via command-line, this feature allows users to request privilege elevation directly from the terminal. This is most useful for SSH sessions, automation, and scripted workflows where the GUI isn't practical. This is only available for primary account elevation and is not support on secondary account elevation.
Blocked Event Notifications
Introducing real-time notifications when a security policy blocks an action (process execution, file operations, process signals).
Disable User Elevation Mode
New DisableUserElevation key prevents users from self-elevating while keeping the app and session monitoring active. Useful for monitoring-only deployments, or for toggling elevation on/off via MDM Self Service without uninstalling.
Improvements
- Microsoft Sentinel: Timestamps now use ISO 8601 UTC with
en_US_POSIXlocale, matching Sentinel's expected format. NewSentinelLogToFilekey writes payloads to/tmp/Elevate24/SentinelUploads/for debugging and a fix has been added where a crash may happen certain Sentinel configurations when an admin account not managed by Elevate24 is demoted. - Event Processing: Username filtering now supported on process execution rules.
- UI: Improved window height handling when toggling settings.
- Full Disk Access: Backend fixes to resolve the full disk access alert appearing on first boot when it shouldn't.