Deprecation Notice: Access Monitoring

[benarent]

Status: Announced. Deprecation begins in Teleport 19
Replacement: Teleport Identity Security (Identity Activity Center + CLI)
Full removal target: Teleport 20.0.0

Summary

We are deprecating Access Monitoring and replacing it with Teleport Identity Security: the Identity Activity Center and a new Identity Security CLI for querying user activity and access. The deprecation notice lands in the Teleport 19 release notes, the UI is removed in a 19.x minor release, and the CLI and backend are removed in 20.0.0, by which point a full replacement will be available.

Why we're making this change

Access Monitoring queries the S3-backed audit log through Athena, and that approach has hit practical limits, both in implementation and in the volume of data it can process. Rather than maintain a separate feature for this, we're consolidating on a single audit log and a CLI that can export data for custom queries. The Identity Security team has already built equivalent capabilities, and the replacement covers all audit events, not just the limited set Access Monitoring supports today.

What replaces it

Teleport Identity Security includes a new CLI, landing in Q2 2026, that queries both user activity and access across the full set of audit events. Planned commands:

• tctl detections (ls, get)
• tctl investigate (exposes both structured filters like --user, --resource, etc... and the raw query --query capability)
• tctl access-changes (ls, get)
• tctl access-review (supports a raw --query based flow where you can specify an access-graph SQL query and get the results in tabular format (or JSON/YAML))

What changes for you: During the transition we won't ship the same built-in charts. Instead we'll give you tools to export the data and build your own visualizations, and SQL-like queries will run through a CLI abstraction. Results also get an expanded tabular view.

Timeline / phases

Phase	What happens	Target
1	Deprecation notice in release notes (no product changes)	19.0.0 - Week of September 14, 2026
2	Identity Security CLI	18.11.0 - week of July 20th, 2026
2	Access Monitoring UI removed from Identity Governance	starting 19.4.0
3	tctl commands + backend removed; full Identity Security replacement available	20.0.0

Timing follows Teleport versions. See the upcoming releases page.

Migration guidance

• Customers with Teleport Identity Security: migrate to the Identity Security CLI and Identity Activity Center as the commands become available.
• Customers without Identity Security: you'll still be able to pull audit data via tctl, or forward it to a SIEM provider for custom querying.
• Automated / unattended workflows: the new CLI is designed to support Machine ID (tbot) execution, JSON output, filtering by event type / protocol / response code, aggregation grouped by user and by resource, and a configurable lookback window. See the Machine ID tctl access guide.

We want your feedback

If you use Access Monitoring today, via the UI or the CLI, please tell us about your workflow so we can validate it against the new CLI design before removal. This matters most for automation-bound query workflows.

Access Monitoring deprecation survey

SQL Editor

Review Access and activity.

Screen.Recording.2026-07-06.at.4.27.54.PM.mov

FAQ

What happens to existing Access Monitoring issues?
Open issues will be triaged and closed as part of the deprecation.

Will there be an equivalent to the built-in charts?
Not initially. We'll provide export tooling and a tabular view; charting can be done in your own visualization tool from the exported data.

How is this being communicated to current users?
We're working with account manager to reach current Access Monitoring users directly, alongside this notice.