CoreView Release Notes

October 13 enhancements

IN THE SPOTLIGHT

[CONFIGURATION RESILIENCE] Configuration Resilience now available: Configuration Resilience provides visibility into Microsoft 365 tenant configurations and their behavior over time, helping organizations detect unexpected changes and remediate them when needed. Configuration Resilience continuously monitors tenant configurations and highlights signals that require attention via the Configuration Resilience Dashboard. The dashboard identifies unexpected changes, deployment requests awaiting review, and configuration differences from a selected baseline. Administrators can act on signals directly from the dashboard by restoring configurations to a previous state, aligning the tenant with its selected baseline, or applying configuration values from another trusted environment, reducing recovery time after incorrect or malicious changes.

New interactive courses are now available to learn the end-to-end Configuration Resilience workflow through practical use cases:

• Restore configurations
• Baseline alignment
• Tenant alignment

OTHER IMPROVEMENTS

[COREY] Automation explanations and Workflow execution: Corey can now explain the purpose and configuration of a specific Workflow, Custom Action, or Management Action directly in the chat. For Workflows, operators can also request a detailed explanation of an individual step, including the action it performs. This allows operators to understand an automation’s effect before using it without opening its configuration. After explaining a Workflow, Corey asks whether to run it. Operators can start or decline the Workflow directly from the conversation.

[COREY] Export full report results from chat: Corey responses that include a report table now provide an "Export” card for downloading the complete result set. The card appears below the table and shows the number of items included and the generated file type. Selecting the "Export” button creates the full report in the background and saves it as a file. While processing, the button displays an “Exporting” status. If an export runs longer than 30 seconds, the card indicates that large files can take several minutes to generate. The same card supports downloading the generated report again or retrying an export if it fails.

[SHAREPOINT REPORTS] Report filters for Site Groups and Site Members reports: SharePoint Site Groups and Site Members reports now include the Report filter option to narrow report results to specific data. Filters support more targeted investigation and reporting when working with SharePoint site group and membership data. This enhancement was inspired by a customer request.

[SHAREPOINT REPORTS] “File archive status” column for item-level reports: SharePoint item-level reports now include a “File archive status” column that identifies files as Active, Archived, or Reactivating. The column is available in reports such as SharePoint Item Level and Items with Unique Permissions. It helps administrators distinguish archived files from active files when reviewing SharePoint content. Archived files are excluded from storage totals, SharePoint dashboards, and inactivity-based policies. Management Actions for archived files, including “Delete”, “Remove access”, and “Re-archive”, are unavailable. This feature is only available with the CoreView Control for SharePoint add-on.

[ADD-ONS] Updates in add-ons nomenclature: CoreView add-ons now use updated names across the product:

• Scoped Access Control, formerly Delegation
• Extended M365 Logs, formerly Audit
• Hybrid Connector, formerly Hybrid
• Identity Resilience, formerly User Rewind
• SIEM Connector, formerly Data

ANNOUNCEMENTS

[MAILBOX AUDITING] Mailbox audit Action and Playbook deprecation: The “Enable Mailbox Audit” Management Action and the “Mailboxes with Audit disabled” Playbook have been retired, per Microsoft guidance:

• Customers must remove the “Enable Mailbox Audit” Action from affected Workflows, as it no longer performs any operation and will soon be permanently removed. Workflows that still reference the Action after its removal may fail. An in-product alert identifies uses of the deprecated Action.
• The “Mailboxes with Audit disabled” Playbook has been removed so that it no longer creates remediation tasks for this setting.

[COREY] Query result layout

Corey now displays single-record query results as a card and multi-record results as a table within the chat message. Single-record results use a vertical key/value layout consistent with the existing mailbox card. Results with two or more records use a table with updated typography, spacing, row height, and border radius. Tables remain inside the chat message container and support horizontal scrolling for wider columns. An expand control opens the table in full-screen view for reviewing larger result sets before confirming an action.

[SHAREPOINT ITEM-LEVEL] Site Archive

CoreView Control for SharePoint now supports archiving SharePoint sites into Microsoft 365 Archive from CoreView. Admins can select one or more supported SharePoint sites and run the new "Archive site" Management Action without using PowerShell or the SharePoint admin center. Archived sites no longer consume active SharePoint storage and are removed from active reports, dashboards, and policies. The "Inactive sites in a selected period" policy can also use Archive as its automated remediation instead of Delete. The Archive remediation follows the existing approval Workflow before execution. The Archive site action and policy remediation option appear only when Site Archive is enabled for the tenant in the SharePoint admin center. These features are only available with the CoreView Control for SharePoint add-on.

[SHAREPOINT REPORTS] Created from column in SharePoint Sites report

The SharePoint Sites report now includes a "Created from" column that shows each site's provisioning source. The column reflects how the site was created, such as manually, through Microsoft Teams, from a template, through self-service group creation, or through CoreView. This enhancement was inspired by a CoreVoice idea.

[COREY] Workflow execution in conversations

Corey now shows Workflow descriptions and can run suggested Workflows directly inside the conversation. When a Workflow is selected, Corey opens a preview of its run form. Inputs already provided in the prompt are prefilled, so administrators do not need to re-enter the same information. Workflows can be run immediately or scheduled from the conversation. Execution progress is tracked through CoreView task notifications.

[COREY] Navigate between response versions generated by retry

Retrying a completed Corey response now keeps each generated answer as a separate version instead of replacing the previous result. The response toolbar shows a version counter, such as 2/2, and lets users move between responses generated from the same prompt. Failed or incomplete attempts are not saved as versions. Copy, download, and feedback actions apply to the response version currently displayed, so you can compare results and export or rate the selected answer.

[SHAREPOINT REPORTS] Add Site Name column to SharePoint Group Members report

The SharePoint Group Members output now includes a Site Name column. The new column provides site context when reviewing SharePoint group memberships across multiple sites. This enhancement was inspired by a customer request. This feature is only available with the CoreView Control for SharePoint add-on.

[SHAREPOINT ITEM-LEVEL] File Archive

CoreView Control for SharePoint now supports archiving inactive SharePoint files instead of deleting them. Admins can select one or more files from Actions or supported item-level reports and archive them into Microsoft 365 Archive. Archived files no longer count toward storage consumption, remain visible, and cannot be opened or downloaded until reactivated outside of CoreView. The “Inactive files in a selected period” policy can also use archive as its automated remediation. The Archive remediation follows the existing approval workflow before execution. The Archive action and policy remediation option appear only for sites where File Archive is enabled in Microsoft 365. These features are only available with the CoreView Control for SharePoint add-on.

[SHAREPOINT REPORTS] Improved Item-Level Report: Decouple item count from data display to reduce perceived load time

SharePoint item-level reports now show available data before the total item count finishes calculating. Users can begin reviewing report results while the item count continues to process. This reduces wait time for tenants with a consistent volume of SharePoint items. This enhancement was inspired by a customer request. This feature is only available with the CoreView Control for SharePoint add-on.

[SHAREPOINT DASHBOARD]

Delete files from the SharePoint recycle bin: a new “Delete files from recycle bin” action is available for both SharePoint management actions and SharePoint workflows. The Management Action lists files in the SharePoint recycle bin and lets users select one or more files for permanent deletion. The Workflow Action permanently deletes targeted recycle bin files as part of an automated workflow. Both actions capture and store the storage reclaimed by each deletion for the “Storage reclaimed over time” widget in the SharePoint dashboard. These actions are only available with the CoreView Control for SharePoint add-on.

[SHAREPOINT IMPORT]

First import progress widget: when SharePoint item-level data is imported into CoreView for the first time, a progress widget is now displayed across all SharePoint item-level reports, dashboards, and out-of-the-box policies. The widget shows the number of sites in the current batch, total items to import, items already imported, progress percentage, estimated days remaining, and overall ETA. The widget is displayed only during the first import batch, which includes Critical and High priority sites. It is automatically removed after that batch is complete. This feature is only available with the CoreView Control for SharePoint add-on.

[SHAREPOINT REPORTS]

New item-level access reports: three item-level reports have been added:

• Sharing links: one row per sharing link.
• Direct access (people): one row per person with direct access to an item.
• Groups with direct access: one row per group with access to an item.

All three reports support item-level filtering, custom policy and report creation, and V-Tenant filtering. The “SharePoint site drilldowns” report now includes a “Total sharing links” count that links to the “Sharing links” report scoped to the selected site. In the same report, the “Total people with access” and “Total groups with access” counts now link to the corresponding “Direct access” and “Groups with direct access” reports scoped to the selected site. These reports are only available with the CoreView Control for SharePoint add-on.

[COREVIEW APP] Per-user MFA property deprecation

The “Per-user MFA” property has been deprecated. The following capabilities are no longer available:

• The “Per-user MFA status” field in reports and User Cards
• The “Manage MFA” management action and workflow action
• The “Users without MFA” and “Admins without MFA” Playbook policies

Automation based on this property no longer works. This includes workflows, custom actions, and custom Playbooks.

[COREVIEW APP] Conditional Access IP update required

Thanks to recent infrastructure optimizations, including the removal of some Windows Machines now that PowerShell 7 is mature enough to handle M365 Modules, we have reduced the number of IPs required by our platform.

Please review the updated IP list and remove any outdated IPs from your Conditional Access policies:

• Guide on how to update the IPs in your Conditional Access policies

[COREY REPORTING] Report merging by User Principal Name

Corey can now merge data from two separate reports when a question requires information from both sources. When a merge is required, Corey identifies the relevant reports, matches records by User Principal Name, and returns:

• A preview of the merged table.
• The complete merged report as a downloadable Excel file.

Report merging is supported for two reports at a time. Both reports must include the User Principal Name attribute.

[SETTINGS] Organization-level password criteria

Tenant Admins can now use the new “Password criteria” tab in Settings > Organization Settings to set organization-level password length. Passwords must meet the configured length and include at least 3 of 4 character groups: uppercase, lowercase, digit, and special character. To support validation before submission, password fields display a live checklist that updates as each requirement is met. The organization-level criteria apply to management actions and newly created workflows. Existing workflows retain their current criteria, while “Set criteria” remains available within workflows for specific overrides. This enhancement was inspired by a CoreVoice idea.

OTHER ANNOUNCEMENTS

[COREVIEW CONTROL FOR SHAREPOINT] Storage reclaimed over time widget

a new “Storage reclaimed over time” widget has been added to the “Activity & Storage” tab of the SharePoint dashboard. The widget displays reclaimed storage in GB for the last 7, 30, 90, or 180 days. Hovering over the chart shows day-by-day reclaimed-storage details. This feature is only available with the CoreView Control for SharePoint add-on.

[COREY HISTORY] Session content saved and restored

Corey now saves session content and restores it when a session is reopened. Reasoning content is restored in full and remains visible, so users can resume without re-running the conversation. Cards and files are restored as placeholders. Use “Regenerate” to recreate a card, or “Download” to retrieve a file.

[MANAGEMENT ACTIONS] Company attribute added to “Invite guest user” action

users can now set the “Company” attribute when running the “Invite guest user” management action. For V-Tenants segmented by company, invited guests are scoped to the specified company without requiring additional post-invitation steps.

[USER REWIND] User Card “Changes” tab redesign

the log components on the “User Rewind” page now align with platform standards for icons, tags, and typography. In the “Revert” panel, the current state is shown in grey and the state to be restored is shown in blue. Notes are now added from a button in the panel footer. This feature is only available with the User Rewind add-on.

COREVIEW CONTROL FOR SHAREPOINT

SharePoint recycle bin files report: a new “SharePoint files in recycle bin” report lists deleted SharePoint files currently in the recycle bin. It includes item details, storage usage, versions, deletion details, and recycle bin stage. This feature is only available with the CoreView Control for SharePoint add-on.

COREVIEW LOG IN

Login page visual updated: the CoreView login page has been redesigned. The login button has also been updated to align with the new page layout.

COREVIEW APP

Tech Pills available in app and CoreUniversity: short technical video guides are now available in the CoreView app and in CoreUniversity. Users can open Tech Pills from the “Learn more” button in the top-right corner of supported pages. The videos cover Reports, Playbooks, Management Actions, Workflows, User Templates, Operators, and Permissions. Content is role-based. Operators see videos relevant to operator tasks, while Tenant Admins see videos focused on Tenant Admin activities. This update was introduced in response to customer feedback.

IN THE SPOTLIGHT

[PLAYBOOKS] New policies for permanent active role assignments and email-exposed admins: two new out-of-the-box policies are now available in Governance Center > Security & Identity: “Permanent Active Role Assignments” and “Permanent Active Admins Using Email”. The first policy identifies users with permanent active role assignments and flags them for review. The second identifies users with a permanent active admin assignment who have used email in the last 90 days. These accounts may present higher phishing exposure because they combine persistent privileged access with active email usage. For both policies, the related report can be scheduled as a remediation action.

OTHER IMPROVEMENTS

[COREVIEW CONTROL FOR SHAREPOINT] Warning for long-running filters on large SharePoint datasets: when filtering string columns across large datasets in the “Items with Unique Permissions” and “SharePoint Item Level” reports, a warning is displayed if the filter takes more than 10 seconds to run. The warning recommends narrowing the dataset first by filtering by “Site ID”.

[USER CARD] Mailbox access widgets available to delegated operators: the mailbox access widgets in the “Exchange” tab of the User Card are now visible to operators who have access to the user. These widgets show: the mailboxes the user can access the users who can access that user’s mailbox.

ANNOUNCEMENTS

[REPORTS] Aggregated monthly sign-in reports removed: the following aggregated sign-in reports have been deprecated and removed:

• Monthly sign-ins by user
• Monthly sign-ins by app

For broader sign-in investigation, use the “Sign-in events” pivot.

For user-level checks, use the “Sign-ins” tab in the User Card.

[WORKFLOWS] Workflow actions now support extension attributes: the “Edit user properties” and “Edit user properties (on-prem)” workflow actions now support CoreView extension attributes. This aligns workflow-based user updates with the corresponding native CoreView management actions.

[REPORTS] Invitation State and Sponsor attributes added to guest user reports

two Entra ID attributes 6 Invitation State and Sponsor 6 are now available in the Active Users report and other guest-based reports, including Guest Users and Inactive Guest Users. Tenant Admins can use these columns to monitor whether a guest invitation is pending or accepted and to identify who is responsible for each guest account. This enhancement was inspired by a CoreVoice idea.

[WORKFLOWS] Audit logging for workflow and template creation

CoreView now generates audit log entries when workflow governance assets are created. Tenant Admins and authorized auditors can trace who created an asset, when it was created, and from which source Workflow. Audit log entries are generated for the following events:

• Creation of a draft Workflow, capturing the user, timestamp, and relevant identifying details.
• Creation of a Workflow template from a draft workflow, recording the originating draft as the source.
• Creation of a Workflow template from a non-draft workflow, recording the originating workflow as the source.

[ACCESS REVIEWS] Default template content now available in French

the default content of Access Review templates is now translated into French, including Title, Description, Why is it important, Email subject, and Email body. Customization of these fields is still supported where needed.

[DATA CONNECTOR] New export collections: Security Group members, Device data and M365 Service Health

three new datasets are now available for export through the Data Connector add-on, enabling reporting and analysis in external tools such as Power BI and Excel.

• Security Group members export group membership data to support access reviews, identify overprivileged accounts, and assist compliance reporting.
• Device (Microsoft-related columns) export device data including all supported Microsoft-managed columns to build inventory, lifecycle, and security posture dashboards.
• M365 Service Health (raw table) export raw service health data to report on outages, trends, and service performance over time.

All three collections support scheduled and triggered exports and are available to Data Connector customers. However, collections must be configured on your environment: contact your Technical Account Manager to proceed.

ANNOUNCEMENTS

[V-TENANTS] Virtual Tenant segmentation for Call Queues and Auto Attendants without a resource account

Call Queues and Auto Attendants with no linked resource account are now excluded from V-Tenant visibility. Operators see only objects associated with resource accounts within their authorized scope, protecting sensitive telephony configurations from unauthorized access. Tenant Admins without a V-Tenant assignment retain full visibility across all objects.

This applies to the following reports: Teams Holidays, Routing Numbers, Auto Attendant, and Call Queues.

IN THE SPOTLIGHT

[COREVIEW CONTROL FOR SHAREPOINT] CoreView Control for SharePoint now available: CoreView Control for SharePoint provides visibility into SharePoint Online sites, items, permissions, sharing exposure, storage usage, and version growth. The feature includes progressive item-level import, dashboards for sharing and storage analysis, reports for site- and item-level investigation, and out-of-the-box Playbook policies for sharing, permissions, and storage governance. The CoreView Control for SharePoint feature is available as an add-on.

[COREY] Official knowledge sources used for unsupported requests: when Corey cannot execute a requested action natively, it can now reference official knowledge sources in its response. The sources are the Knowledge Center and CoreUniversity. Responses may include step-by-step guidance, documentation links, course references, and SKU-specific information.

OTHER IMPROVEMENTS

[SETTINGS] Operator and permission export in Settings: the “Export” button in Settings > Operators now downloads an Excel file with two sheets. The “Operators” sheet lists operators and operator groups with all assigned objects. The “Permissions” sheet shows permission contents, along with the related assignments for each permission. This enhancement was inspired by a customer request.

[USER CARD] Mailbox delegation and forwarding visibility: The User Card now provides additional mailbox delegation and forwarding details in the “Info” and “Exchange” tabs: The “Info” tab shows permissions granted to the user, permissions granted on the user’s mailbox, and internal and external forwarding. The “Exchange” tab includes new widgets for mailboxes the user can access and users who can access that mailbox, with counters for Full Access, Send As, and Send on Behalf. These widgets are visible only to Tenant Admins. A third widget displays counters for Internal and External forwarding. This enhancement was inspired by a CoreVoice idea.

[COREY ACTIONS] Remove mailbox delegates: Corey can now remove delegate access from a mailbox upon request.

ANNOUNCEMENTS

[TEAMS VOICE] Voice App and Resource Account search paths separated: CoreView now treats Voice App objects and Resource Account objects separately, in line with Microsoft behavior for Auto Attendants and Call Queues. Search and selection now support two paths: one for Auto Attendants or Call Queues by Voice App name, and one for the related Resource Account.

[ACCESS REVIEW] PIM reviews for Microsoft Entra role assignments

Access Review now support Microsoft Entra Privileged Identity Management (PIM) admin role assignments, including both eligible and permanent assignments, after the required Microsoft consent and configuration are completed. Assigned reviewers can review active and expired PIM assignments. Based on the assignment type, reviewers can remove, extend, or renew the assignment. The Access Review feature is available as an add-on.

[REPORTS] Last sign-in and logon date columns in Exchange Email Activity

the “Exchange email activity” report now includes two selectable columns: “Last interactive sign-in (UTC)” and “AD last logon date”. These columns help correlate mailbox activity with user sign-in and logon history. This enhancement was inspired by a customer request.

[MANAGEMENT ACTIONS] “Manage phone authentication method” management action

following the deprecation of the “Manage MFA” management action, a new “Manage phone authentication method” management action is now available. It allows operators to add, edit, or remove a user’s phone authentication method.

[COREY UI] Updated loading messages

Corey now shows messages both while analyzing the requests and while running backend steps. This provides clearer feedback during processing.

[COREVIEW CONTROL FOR SHAREPOINT] “Different from inherited” column

a new “Different from inherited” column is available in the “Items with unique permissions” and “SharePoint item-level” reports. This column indicates whether an item’s current permissions differ from the permissions inherited from its parent. “True” when an item has unique permissions. “False” when the item uses the same permissions as its parent, even if inheritance is broken. This feature is available only with the CoreView Control for SharePoint add-on.

[COREVIEW CONTROL FOR SHAREPOINT] Restore inheritance for redundant unique permissions

in the “Items with unique permissions” and “SharePoint item-level” reports, the “Restore inheritance” management action is available for items with unique permissions. This action removes unique permissions that duplicate access already granted through inheritance. For example, if inheritance was broken only to grant access to a user who already has access through SharePoint group inheritance, “Restore inheritance” removes that redundant permission. If no other unique permissions remain, the item is no longer listed as having unique permissions. This feature is available only with the CoreView Control for SharePoint add-on.

[COREVIEW CONTROL FOR SHAREPOINT] “External people with unique permissions” column

a new “External people with unique permissions” column is available in the “Items with unique permissions” and “SharePoint item-level” reports. It shows the number of distinct external users who have access to each item. The column supports sorting and filtering. This feature is available only with the CoreView Control for SharePoint add-on.

[SETTINGS] Service account management modes in Admin Read Only

In “Organization Settings > Admin read only”, service account management is now split into “Manual” and “Automatic” modes through a dedicated toggle. “Manual” mode lets Tenant Admins update service account usernames and passwords. “Automatic” mode lets Tenant Admins create or recreate service accounts. The selected mode can be changed at any time after onboarding.

[COREY REPORTING] Tenant configuration alignment reporting

Corey can now return tenant configuration alignment data against the CIS baseline. It reports configuration status, baseline values, current values, deviations, and related compliance context.

[COREY ACTIONS] Remove mailbox forwarding

Tenant Admins can now remove both internal and external mailbox forwarding from one or more email addresses by chatting with Corey.

[COREY UI] CSV and Excel file upload for prompt targets

A new file upload option is available in the Corey prompt box. Users can upload CSV and Excel files by clicking the “+” button or by dragging and dropping a file. Corey validates the file format, reads the uploaded identifiers, and uses them as target inputs for the management action or reporting request specified in the prompt.

ANNOUNCEMENTS

[COREVIEW APP] Per-user MFA property deprecation

The “Per-user MFA” property has been deprecated. The following capabilities are no longer available:

• The “Per-user MFA status” field in reports and User Cards
• The “Manage MFA” management action and workflow action
• The “Users without MFA” and “Admins without MFA” Playbook policies

Automation based on this property no longer works. This includes workflows, custom actions, and custom Playbooks.

[COREVIEW APP] Conditional Access IP update required

Thanks to recent infrastructure optimizations, including the removal of some Windows Machines now that PowerShell 7 is mature enough to handle M365 Modules, we have reduced the number of IPs required by our platform.

Please review the updated IP list and remove any outdated IPs from your Conditional Access policies:

• Guide on how to update the IPs in your Conditional Access policies

[COREVIEW APP] Per-user MFA property deprecation

the “Per-user MFA” property will be deprecated on 26 May 2026. Starting on this date, the following capabilities will no longer be available:

• The “Per-user MFA status” field in reports
• The “Per-user MFA status” field in User Cards
• The “Manage MFA” management and workflow action
• The Playbook policies “Users without MFA” and “Admins without MFA"

Automation that depends on this property will also stop working. This includes workflows, custom actions, and custom Playbooks.

[COREY ACTIONS] Convert user mailbox to shared mailbox

Corey can now convert an eligible user mailbox to a shared mailbox through chat. It validates the mailbox and asks for confirmation before running the action.

[COREY ACTIONS] Revoke user sessions

Corey can now revoke active user sessions through chat in both CoreView and Microsoft 365. After confirmation, Corey executes the action directly.

[COREY REPORTING] In-chat result limit increased to 25

Corey reporting previews shown in chat now return up to 25 results. This change supports quicker investigations without leaving the conversation. This enhancement was inspired by a CoreView customer.

[COREY REPORTING] Sorting added to report queries

sorting is now a standard step in Corey’s reporting flow. When supported, Corey builds report queries by selecting columns, applying filters, applying sorting, and then returning results. Requests for top, bottom, largest, smallest, newest, and oldest results are now handled more reliably across supported workloads. This enhancement was inspired by a CoreView customer.

[COREY UI] Chat management and modal UI updates

chat management in the Corey modal was updated. Users can now favorite chats, access them from a “Favorites” section, and delete chats.

[REPORTS] Additional columns in App Registrations and Service Principals reports

the “Internal notes” property is now available as a column in the “App registrations” report. The “Note” and “Assignment required” properties are now available as columns in the “Service principals” report. These columns support report visibility and, where applicable, filtering. This enhancement was inspired by a CoreVoice.

ANNOUNCEMENT

[COREVIEW APP] Per-user MFA property deprecation

the “Per-user MFA” property will be deprecated on 26 May 2026. Starting on this date, the following capabilities will no longer be available:

• The “Per-user MFA status” field in reports
• The “Per-user MFA status” field in User Cards
• The “Manage MFA” management and workflow action
• The Playbook policies “Users without MFA” and “Admins without MFA”

Automation that depends on this property will also stop working. This includes workflows, custom actions, and custom Playbooks.

COREY REPORTING

Additional license reporting sources available in Corey: Corey can now retrieve data from these license reporting areas: License Pool Center: License Costs License Pool Center: Licenses by Tenant Optimization Center: Licenses Optimization Center: Duplicated Plans This update expands Coreys license reporting coverage, adding visibility into license costs, tenant-level license distribution, and duplicated plan data.

PERMISSIONS

Corey controls in Permissions: a new Corey section is available in the Permissions wizard. It contains two separate sections: Reporting and Management. Reporting permissions are read-only. Management includes a tri-state control with Off, Inherited, and Custom options. Tenant Admins can use this control to block Corey management actions, apply existing delegated permissions, or restrict the delegated actions Corey can run.

RECONCILE

Custom alerts for configuration types: custom alerts can now be created at the configuration type level in Reconcile. In the configuration type row, select More > Create custom alerts for all. This creates a separate drift alert for each configuration in the selected category.

REPORTS

Local-time sign-in columns added to Active users and Sign-in events: in the Active users report, the Last Entra logon column has been renamed to Last interactive sign-in. This data comes from Microsoft sign-in data and Microsoft Unified Audit Log data. A new Last interactive sign-in (local time) column has been added. It shows the time in the operators local time zone. This column is updated as soon as a new event is received and processed. As a result, its value may differ from the corresponding value shown in Microsoft 365. In the Sign-in events report, a new Sign-in date time (local time) column has been added. It shows the sign-in time in the operators local time zone.

WORKFLOWS

Scheduled workflow executions now show scheduler identity: a new Scheduled by property has been added to the Overview section of the Execution detail panel. It shows the identity of the operator who scheduled the workflow execution. The existing Executed by property is unchanged. For scheduled executions, it continues to display Platform.

UI

Organization logo upload for light and dark mode: in Settings > My organization , separate logos can now be uploaded for light and dark mode. The Light theme logo is displayed to operators using the platform in light mode. The Dark theme logo is displayed to operators using the platform in dark mode. A preview is shown as soon as a logo is uploaded. If only one logo is uploaded, that logo is used in both light and dark mode. If no logo is uploaded, the default CoreView logotype is displayed.

Tag design consistency across the platform: tag padding and visual styling have been standardized across the platform to improve consistency.