CoreView Release Notes

[COREVIEW APP] Per-user MFA property deprecation

The “Per-user MFA” property has been deprecated. The following capabilities are no longer available:

• The “Per-user MFA status” field in reports and User Cards
• The “Manage MFA” management action and workflow action
• The “Users without MFA” and “Admins without MFA” Playbook policies

Automation based on this property no longer works. This includes workflows, custom actions, and custom Playbooks.

[COREVIEW APP] Conditional Access IP update required

Thanks to recent infrastructure optimizations, including the removal of some Windows Machines now that PowerShell 7 is mature enough to handle M365 Modules, we have reduced the number of IPs required by our platform.

Please review the updated IP list and remove any outdated IPs from your Conditional Access policies:

• Guide on how to update the IPs in your Conditional Access policies

[COREY REPORTING] Report merging by User Principal Name

Corey can now merge data from two separate reports when a question requires information from both sources. When a merge is required, Corey identifies the relevant reports, matches records by User Principal Name, and returns:

• A preview of the merged table.
• The complete merged report as a downloadable Excel file.

Report merging is supported for two reports at a time. Both reports must include the User Principal Name attribute.

[SETTINGS] Organization-level password criteria

Tenant Admins can now use the new “Password criteria” tab in Settings > Organization Settings to set organization-level password length. Passwords must meet the configured length and include at least 3 of 4 character groups: uppercase, lowercase, digit, and special character. To support validation before submission, password fields display a live checklist that updates as each requirement is met. The organization-level criteria apply to management actions and newly created workflows. Existing workflows retain their current criteria, while “Set criteria” remains available within workflows for specific overrides. This enhancement was inspired by a CoreVoice idea.

OTHER ANNOUNCEMENTS

[COREVIEW CONTROL FOR SHAREPOINT] Storage reclaimed over time widget

a new “Storage reclaimed over time” widget has been added to the “Activity & Storage” tab of the SharePoint dashboard. The widget displays reclaimed storage in GB for the last 7, 30, 90, or 180 days. Hovering over the chart shows day-by-day reclaimed-storage details. This feature is only available with the CoreView Control for SharePoint add-on.

[COREY HISTORY] Session content saved and restored

Corey now saves session content and restores it when a session is reopened. Reasoning content is restored in full and remains visible, so users can resume without re-running the conversation. Cards and files are restored as placeholders. Use “Regenerate” to recreate a card, or “Download” to retrieve a file.

[MANAGEMENT ACTIONS] Company attribute added to “Invite guest user” action

users can now set the “Company” attribute when running the “Invite guest user” management action. For V-Tenants segmented by company, invited guests are scoped to the specified company without requiring additional post-invitation steps.

[USER REWIND] User Card “Changes” tab redesign

the log components on the “User Rewind” page now align with platform standards for icons, tags, and typography. In the “Revert” panel, the current state is shown in grey and the state to be restored is shown in blue. Notes are now added from a button in the panel footer. This feature is only available with the User Rewind add-on.

COREVIEW CONTROL FOR SHAREPOINT

SharePoint recycle bin files report: a new “SharePoint files in recycle bin” report lists deleted SharePoint files currently in the recycle bin. It includes item details, storage usage, versions, deletion details, and recycle bin stage. This feature is only available with the CoreView Control for SharePoint add-on.

COREVIEW LOG IN

Login page visual updated: the CoreView login page has been redesigned. The login button has also been updated to align with the new page layout.

COREVIEW APP

Tech Pills available in app and CoreUniversity: short technical video guides are now available in the CoreView app and in CoreUniversity. Users can open Tech Pills from the “Learn more” button in the top-right corner of supported pages. The videos cover Reports, Playbooks, Management Actions, Workflows, User Templates, Operators, and Permissions. Content is role-based. Operators see videos relevant to operator tasks, while Tenant Admins see videos focused on Tenant Admin activities. This update was introduced in response to customer feedback.

IN THE SPOTLIGHT

[PLAYBOOKS] New policies for permanent active role assignments and email-exposed admins: two new out-of-the-box policies are now available in Governance Center > Security & Identity: “Permanent Active Role Assignments” and “Permanent Active Admins Using Email”. The first policy identifies users with permanent active role assignments and flags them for review. The second identifies users with a permanent active admin assignment who have used email in the last 90 days. These accounts may present higher phishing exposure because they combine persistent privileged access with active email usage. For both policies, the related report can be scheduled as a remediation action.

OTHER IMPROVEMENTS

[COREVIEW CONTROL FOR SHAREPOINT] Warning for long-running filters on large SharePoint datasets: when filtering string columns across large datasets in the “Items with Unique Permissions” and “SharePoint Item Level” reports, a warning is displayed if the filter takes more than 10 seconds to run. The warning recommends narrowing the dataset first by filtering by “Site ID”.

[USER CARD] Mailbox access widgets available to delegated operators: the mailbox access widgets in the “Exchange” tab of the User Card are now visible to operators who have access to the user. These widgets show: the mailboxes the user can access the users who can access that user’s mailbox.

ANNOUNCEMENTS

[REPORTS] Aggregated monthly sign-in reports removed: the following aggregated sign-in reports have been deprecated and removed:

• Monthly sign-ins by user
• Monthly sign-ins by app

For broader sign-in investigation, use the “Sign-in events” pivot.

For user-level checks, use the “Sign-ins” tab in the User Card.

[WORKFLOWS] Workflow actions now support extension attributes: the “Edit user properties” and “Edit user properties (on-prem)” workflow actions now support CoreView extension attributes. This aligns workflow-based user updates with the corresponding native CoreView management actions.

[REPORTS] Invitation State and Sponsor attributes added to guest user reports

two Entra ID attributes 6 Invitation State and Sponsor 6 are now available in the Active Users report and other guest-based reports, including Guest Users and Inactive Guest Users. Tenant Admins can use these columns to monitor whether a guest invitation is pending or accepted and to identify who is responsible for each guest account. This enhancement was inspired by a CoreVoice idea.

[WORKFLOWS] Audit logging for workflow and template creation

CoreView now generates audit log entries when workflow governance assets are created. Tenant Admins and authorized auditors can trace who created an asset, when it was created, and from which source Workflow. Audit log entries are generated for the following events:

• Creation of a draft Workflow, capturing the user, timestamp, and relevant identifying details.
• Creation of a Workflow template from a draft workflow, recording the originating draft as the source.
• Creation of a Workflow template from a non-draft workflow, recording the originating workflow as the source.

[ACCESS REVIEWS] Default template content now available in French

the default content of Access Review templates is now translated into French, including Title, Description, Why is it important, Email subject, and Email body. Customization of these fields is still supported where needed.

[DATA CONNECTOR] New export collections: Security Group members, Device data and M365 Service Health

three new datasets are now available for export through the Data Connector add-on, enabling reporting and analysis in external tools such as Power BI and Excel.

• Security Group members export group membership data to support access reviews, identify overprivileged accounts, and assist compliance reporting.
• Device (Microsoft-related columns) export device data including all supported Microsoft-managed columns to build inventory, lifecycle, and security posture dashboards.
• M365 Service Health (raw table) export raw service health data to report on outages, trends, and service performance over time.

All three collections support scheduled and triggered exports and are available to Data Connector customers. However, collections must be configured on your environment: contact your Technical Account Manager to proceed.

ANNOUNCEMENTS

[V-TENANTS] Virtual Tenant segmentation for Call Queues and Auto Attendants without a resource account

Call Queues and Auto Attendants with no linked resource account are now excluded from V-Tenant visibility. Operators see only objects associated with resource accounts within their authorized scope, protecting sensitive telephony configurations from unauthorized access. Tenant Admins without a V-Tenant assignment retain full visibility across all objects.

This applies to the following reports: Teams Holidays, Routing Numbers, Auto Attendant, and Call Queues.

IN THE SPOTLIGHT

[COREVIEW CONTROL FOR SHAREPOINT] CoreView Control for SharePoint now available: CoreView Control for SharePoint provides visibility into SharePoint Online sites, items, permissions, sharing exposure, storage usage, and version growth. The feature includes progressive item-level import, dashboards for sharing and storage analysis, reports for site- and item-level investigation, and out-of-the-box Playbook policies for sharing, permissions, and storage governance. The CoreView Control for SharePoint feature is available as an add-on.

[COREY] Official knowledge sources used for unsupported requests: when Corey cannot execute a requested action natively, it can now reference official knowledge sources in its response. The sources are the Knowledge Center and CoreUniversity. Responses may include step-by-step guidance, documentation links, course references, and SKU-specific information.

OTHER IMPROVEMENTS

[SETTINGS] Operator and permission export in Settings: the “Export” button in Settings > Operators now downloads an Excel file with two sheets. The “Operators” sheet lists operators and operator groups with all assigned objects. The “Permissions” sheet shows permission contents, along with the related assignments for each permission. This enhancement was inspired by a customer request.

[USER CARD] Mailbox delegation and forwarding visibility: The User Card now provides additional mailbox delegation and forwarding details in the “Info” and “Exchange” tabs: The “Info” tab shows permissions granted to the user, permissions granted on the user’s mailbox, and internal and external forwarding. The “Exchange” tab includes new widgets for mailboxes the user can access and users who can access that mailbox, with counters for Full Access, Send As, and Send on Behalf. These widgets are visible only to Tenant Admins. A third widget displays counters for Internal and External forwarding. This enhancement was inspired by a CoreVoice idea.

[COREY ACTIONS] Remove mailbox delegates: Corey can now remove delegate access from a mailbox upon request.

ANNOUNCEMENTS

[TEAMS VOICE] Voice App and Resource Account search paths separated: CoreView now treats Voice App objects and Resource Account objects separately, in line with Microsoft behavior for Auto Attendants and Call Queues. Search and selection now support two paths: one for Auto Attendants or Call Queues by Voice App name, and one for the related Resource Account.

[ACCESS REVIEW] PIM reviews for Microsoft Entra role assignments

Access Review now support Microsoft Entra Privileged Identity Management (PIM) admin role assignments, including both eligible and permanent assignments, after the required Microsoft consent and configuration are completed. Assigned reviewers can review active and expired PIM assignments. Based on the assignment type, reviewers can remove, extend, or renew the assignment. The Access Review feature is available as an add-on.

[REPORTS] Last sign-in and logon date columns in Exchange Email Activity

the “Exchange email activity” report now includes two selectable columns: “Last interactive sign-in (UTC)” and “AD last logon date”. These columns help correlate mailbox activity with user sign-in and logon history. This enhancement was inspired by a customer request.

[MANAGEMENT ACTIONS] “Manage phone authentication method” management action

following the deprecation of the “Manage MFA” management action, a new “Manage phone authentication method” management action is now available. It allows operators to add, edit, or remove a user’s phone authentication method.

[COREY UI] Updated loading messages

Corey now shows messages both while analyzing the requests and while running backend steps. This provides clearer feedback during processing.

[COREVIEW CONTROL FOR SHAREPOINT] “Different from inherited” column

a new “Different from inherited” column is available in the “Items with unique permissions” and “SharePoint item-level” reports. This column indicates whether an item’s current permissions differ from the permissions inherited from its parent. “True” when an item has unique permissions. “False” when the item uses the same permissions as its parent, even if inheritance is broken. This feature is available only with the CoreView Control for SharePoint add-on.

[COREVIEW CONTROL FOR SHAREPOINT] Restore inheritance for redundant unique permissions

in the “Items with unique permissions” and “SharePoint item-level” reports, the “Restore inheritance” management action is available for items with unique permissions. This action removes unique permissions that duplicate access already granted through inheritance. For example, if inheritance was broken only to grant access to a user who already has access through SharePoint group inheritance, “Restore inheritance” removes that redundant permission. If no other unique permissions remain, the item is no longer listed as having unique permissions. This feature is available only with the CoreView Control for SharePoint add-on.

[COREVIEW CONTROL FOR SHAREPOINT] “External people with unique permissions” column

a new “External people with unique permissions” column is available in the “Items with unique permissions” and “SharePoint item-level” reports. It shows the number of distinct external users who have access to each item. The column supports sorting and filtering. This feature is available only with the CoreView Control for SharePoint add-on.

[SETTINGS] Service account management modes in Admin Read Only

In “Organization Settings > Admin read only”, service account management is now split into “Manual” and “Automatic” modes through a dedicated toggle. “Manual” mode lets Tenant Admins update service account usernames and passwords. “Automatic” mode lets Tenant Admins create or recreate service accounts. The selected mode can be changed at any time after onboarding.

[COREY REPORTING] Tenant configuration alignment reporting

Corey can now return tenant configuration alignment data against the CIS baseline. It reports configuration status, baseline values, current values, deviations, and related compliance context.

[COREY ACTIONS] Remove mailbox forwarding

Tenant Admins can now remove both internal and external mailbox forwarding from one or more email addresses by chatting with Corey.

[COREY UI] CSV and Excel file upload for prompt targets

A new file upload option is available in the Corey prompt box. Users can upload CSV and Excel files by clicking the “+” button or by dragging and dropping a file. Corey validates the file format, reads the uploaded identifiers, and uses them as target inputs for the management action or reporting request specified in the prompt.

[COREVIEW APP] Per-user MFA property deprecation

the “Per-user MFA” property will be deprecated on 26 May 2026. Starting on this date, the following capabilities will no longer be available:

• The “Per-user MFA status” field in reports
• The “Per-user MFA status” field in User Cards
• The “Manage MFA” management and workflow action
• The Playbook policies “Users without MFA” and “Admins without MFA"

Automation that depends on this property will also stop working. This includes workflows, custom actions, and custom Playbooks.

COREY ACTIONS

Convert user mailbox to shared mailbox: Corey can now convert an eligible user mailbox to a shared mailbox through chat. It validates the mailbox and asks for confirmation before running the action.

Revoke user sessions: Corey can now revoke active user sessions through chat in both CoreView and Microsoft 365. After confirmation, Corey executes the action directly.

COREY REPORTING

In-chat result limit increased to 25: Corey reporting previews shown in chat now return up to 25 results. This change supports quicker investigations without leaving the conversation. This enhancement was inspired by a CoreView customer.

Sorting added to report queries: sorting is now a standard step in Corey’s reporting flow. When supported, Corey builds report queries by selecting columns, applying filters, applying sorting, and then returning results. Requests for top, bottom, largest, smallest, newest, and oldest results are now handled more reliably across supported workloads. This enhancement was inspired by a CoreView customer.

COREY UI

Chat management and modal UI updates: chat management in the Corey modal was updated. Users can now favorite chats, access them from a “Favorites” section, and delete chats.

REPORTS

Additional columns in App Registrations and Service Principals reports: the “Internal notes” property is now available as a column in the “App registrations” report. The “Note” and “Assignment required” properties are now available as columns in the “Service principals” report. These columns support report visibility and, where applicable, filtering. This enhancement was inspired by a CoreVoice.

COREY REPORTING

Additional license reporting sources available in Corey: Corey can now retrieve data from these license reporting areas: License Pool Center: License Costs License Pool Center: Licenses by Tenant Optimization Center: Licenses Optimization Center: Duplicated Plans This update expands Coreys license reporting coverage, adding visibility into license costs, tenant-level license distribution, and duplicated plan data.

PERMISSIONS

Corey controls in Permissions: a new Corey section is available in the Permissions wizard. It contains two separate sections: Reporting and Management. Reporting permissions are read-only. Management includes a tri-state control with Off, Inherited, and Custom options. Tenant Admins can use this control to block Corey management actions, apply existing delegated permissions, or restrict the delegated actions Corey can run.

RECONCILE

Custom alerts for configuration types: custom alerts can now be created at the configuration type level in Reconcile. In the configuration type row, select More > Create custom alerts for all. This creates a separate drift alert for each configuration in the selected category.

REPORTS

Local-time sign-in columns added to Active users and Sign-in events: in the Active users report, the Last Entra logon column has been renamed to Last interactive sign-in. This data comes from Microsoft sign-in data and Microsoft Unified Audit Log data. A new Last interactive sign-in (local time) column has been added. It shows the time in the operators local time zone. This column is updated as soon as a new event is received and processed. As a result, its value may differ from the corresponding value shown in Microsoft 365. In the Sign-in events report, a new Sign-in date time (local time) column has been added. It shows the sign-in time in the operators local time zone.

WORKFLOWS

Scheduled workflow executions now show scheduler identity: a new Scheduled by property has been added to the Overview section of the Execution detail panel. It shows the identity of the operator who scheduled the workflow execution. The existing Executed by property is unchanged. For scheduled executions, it continues to display Platform.

UI

Organization logo upload for light and dark mode: in Settings > My organization , separate logos can now be uploaded for light and dark mode. The Light theme logo is displayed to operators using the platform in light mode. The Dark theme logo is displayed to operators using the platform in dark mode. A preview is shown as soon as a logo is uploaded. If only one logo is uploaded, that logo is used in both light and dark mode. If no logo is uploaded, the default CoreView logotype is displayed.

Tag design consistency across the platform: tag padding and visual styling have been standardized across the platform to improve consistency.

[COREVIEW APP] Per-user MFA property deprecation

the Per-user MFA property, and features based on this property, will be deprecated by the end of May 2026, following Microsoft guidance. Please review any existing automation that uses this property, such as workflows, custom actions, and Playbooks.

[RECONCILE] CIS Microsoft 365 Foundations baseline updated to v6.0.1

the CIS Microsoft 365 Foundations Benchmark v6.0.1 baseline is now available in Reconcile.This baseline reflects the latest CIS benchmark version, published on 2026-02-26.

[SHAREPOINT ITEM-LEVEL] Access and link counters in item-level reports

The "SharePoint item-level" and "Items with unique permissions" reports now include filterable, sortable, and, in some cases, clickable counters for each item's access and sharing footprint. The following counters are available:

• People with permissions
• Groups with permissions
• Shared link count
• Links shared with anyone
• Link shared with external members
• Guests with unique permissions

This feature is available only with the SharePoint item-level add-on.

[SHAREPOINT ITEM-LEVEL] SharePoint Site Drilldowns report

A new "SharePoint site drilldowns" report summarizes site-level unique permissions, external exposure, and storage indicators. It provides one-click drilldowns into the files and folders listed in the "Items with unique permissions" and "SharePoint item level" reports. All indicators can be filtered and sorted to identify higher-risk sites.

This feature is available only with the SharePoint item-level add-on.

[COREY ACTIONS] Remove user from Microsoft 365 group

Corey can now remove a user from a Microsoft 365 group within a single session. This completes the full group member removal flow without requiring the operator to switch context.

[COREY REPORTING] Guest user queries now support active and inactive user details

Corey can now query both active and inactive guest users. Supported results include properties such as creation date, inactivity, department, license assignment, and admin role presence, and more.

[COREY UI] Stop button for response generation

a “Stop” button is now available in the “Ask Corey” chat box while Corey is generating a response. Clicking the button interrupts the current response and returns the chat box to its idle state.

[COREY UI] Configurable display mode and chat history access

Corey can now be opened in three display modes: modal, panel, or browser tab, with side panel set as the default. A different default mode can be selected from the “More” menu item. Chat history is now collapsed by default. Previous conversations can be accessed from the “Chats” menu item.