Lumos Release Notes

This is a preview of the September release. Scope and timing can change before it ships. Final release notes will follow once the release is live.

Theme: Governing the Action, Not Just the Access

Lumos has always governed who has access. This release extends that to what happens after access is granted, starting with the tool calls your employees' AI agents make.

Expected highlights

• MCP Governance [BETA]: See and control every tool call your AI agents make
• Remediation Workflows: Fix Identity Intelligence findings from the issue itself
• Jira Service Management Assignable Lumos Agent: Assign access tickets to Lumos
• Account Finder Performance: Faster syncs, especially for large tenants
• Connector updates: Six improved connectors and two new beta connectors

🛡 Intelligence & AI

MCP Governance [BETA]

MCP Governance sits in the path of every tool call an employee's AI agent makes. It logs each call against the person who ran it and returns allow or deny before the call runs.

What's new:

• Support for Claude Code (including in Claude Desktop) and Codex
• Inventory of every MCP server in use, including ones added locally
• Per-tool allow or deny policies, including one-click Allow reads or Block writes
• Albus answers questions about call history and drafts policies for your approval

Benefits:

• See which agents touch which systems, and who is behind each call
• Block a risky tool without blocking the whole server

Beta access is expected to open at the end of October through your CSM. The default policy is Allow, so nothing is blocked until you add a policy. Lumos never stores prompts, model responses or tool results.

Remediation Workflows

Each Identity Intelligence issue can now carry a fix that the agent builds for you. You review it, edit it if needed, and run it from the issue.

What's new:

• Work status for each remediation, with cancel and retry
• One run that fixes every open sub-issue under a parent
• Manual task and notification steps for apps Lumos can't write to

Benefits:

• Go from finding to fix in one place
• Keep a person in every decision: the agent drafts, you launch

Available behind a feature flag. Reach out to your CSM to turn it on.

🔌 Integrations

Jira Service Management Assignable Lumos Agent

Assign an access ticket in Jira Service Management to Lumos. Lumos submits the request and keeps the ticket updated through approval and provisioning.

What's new:

• Lumos Agent in the Jira Service Management assignee dropdown
• Status comments on the ticket, and the ticket closes automatically when the request is done
• Ticket link on the request, so approvers see where it came from

Benefits:

• Stop re-entering access tickets in a second tool
• Keep the ticket as your audit record

Available now in preview, with the announcement expected October 7. It requires the Lumos Forge app and the Lumos Jira integration.

Account Finder Performance

Account Finder, the sync step that finds the accounts in your connected apps, now saves results in bulk. Large tenants see processing drop from hours to minutes, with fewer failed runs.

This is already live for every customer, with no setup and no change to results. Google Cloud and Microsoft Entra ID see the biggest drop in total sync time.

Existing Connector Improvements

• Microsoft Entra ID: deprovision a user from all groups in one action
• Lucid: detailed user roles
• Snowflake: sync emails and names with read-only permissions
• GitHub: support for OAuth refresh tokens
• SAP ECC [BETA]: write capabilities
• Tableau [BETA]: multiple authentication methods

The Entra, Lucid, Snowflake and GitHub updates apply to existing connections automatically. For SAP ECC and Tableau beta access, reach out to your CSM.

New Connectors [BETA]

• Anthropic and Active Directory (AD) integrations for your non-human identity inventory

Available in Beta once the release ships. Reach out to your CSM to participate.

Original source

Theme: One Governance Model for Every Identity

Governance now sits under every identity and every access change in Lumos. The non-human identity inventory shows you what is actually out there, ownership and IT service management routing turn that visibility into accountability, and one shared access change model means a revocation or a provisioning run works the same way in every product.

Highlights

• Non-Human Identity Inventory [BETA]: See and own every service account in one place
• Standardized Access Changes: Configure one workflow per app, reuse it everywhere
• ITSM Configuration: Route access tickets to the right queue, per team
• Sync Circuit Breakers: Stop bad upstream sync data at the door
• Entitlements Tab on the Identity View: See every permission a person holds
• Pre-Approval Rules on Conditions: Auto-approve with the platform's full condition language
• Draft Versions for Access Policies: Edit a live policy behind a draft
• August Connectors: SAP ECC, AWS, Entra ID, and OpenAI inventory

🛡 Intelligence & AI

Non-Human Identity Inventory

• BETA
• Target Availability: First rollouts start September 4, 2026. No general availability date confirmed yet.
• Enablement: Requires your non-human identity sources (AWS, Entra ID) connected to Lumos. Ask your CSM to participate.

A dedicated inventory of every non-human identity (NHI) in your environment: service accounts, service principals, API identities, and workload roles. You set an owner and a business justification on each one, and that ownership carries through to the security agents, remediation, and access reviews that read from the same inventory.

What's new:

• Single table of every non-human identity, with source, type, last activity, and status
• Owner and Business Justification fields you set directly on any identity
• Per-identity detail view showing that identity's accounts and entitlements
• Filter and sort the full inventory instead of checking each connected system
• Ownership set once is reused by the security agents and remediation
• AWS, Entra ID, and OpenAI non-human identity inventory Betas

Benefits:

• See every non-human identity in one place instead of piecing it together
• Make accountability explicit rather than tribal knowledge
• Act on an agent finding without first hunting for an owner
• Give non-human identity reviews a real substrate to read from
• Feed the non-human identity inventory from your AWS, Entra ID, and OpenAI estates

🧱 Platform

Standardized Access Changes

• Target Availability: August 31, 2026
• Enablement: No setup required. Existing configurations migrate automatically.

Every access change in Lumos now runs through one workflow model. Provisioning and deprovisioning workflows become standalone objects you configure once per app or per entitlement, then reuse across the App Store, Onboarding, Movers, Offboarding, and Access Reviews. Existing configurations migrate automatically, and behavior stays the same by default.

What's new:

• One Account Workflows table per app, with a "Used In" column per product
• Every app ships with working default provisioning and deprovisioning workflows
• Access Reviews can pick any deprovisioning workflow as its removal method
• Entitlement-level workflows in the App > Entitlements side panel
• Editing a shared workflow warns you which products it affects
• Identical behavior across the product, the API, and MCP

Benefits:

• Configure provisioning once instead of once per product
• Hand an auditor a step-level workflow record for any removal
• Start a new app with working defaults and no setup
• Skip the migration work, because current setups carry over unchanged

IT Service Management (ITSM) Configuration

• Availability: Now live
• Enablement: Ask your CSM for setup support on multi-system configurations

Connect more than one ITSM system to a single Lumos tenant and route access tickets to the queue that owns them. Routing rules run at the tenant, app, workflow, or task level, and Lumos validates your status mappings before they reach production.

What's new:

• Multiple ITSM connections per tenant, including ServiceNow, Jira, Zendesk, and Freshservice
• Priority-ordered routing rules at the tenant, app, workflow, or task level
• Configurable status transition mappings between Lumos states and ITSM statuses
• Transition validation that surfaces ITSM error codes in admin settings
• Two instances of the same ITSM system supported side by side

Benefits:

• Route engineering and HR requests to different systems without custom code
• Catch a bad mapping in settings instead of in production
• Retire the webhook workarounds built to get per-app routing
• Keep ITSM behavior consistent across approval, provisioning, and deprovisioning

Pre-Approval Rules on the Conditions Framework

• Target Availability: September 4, 2026
• Enablement: No setup required. Existing rules migrate automatically.

Pre-approval rules are rebuilt on the same conditions framework that flexible approvals already use. You get the full attribute set, condition grouping, and Lumos Expression Language, plus one rule model whether you configure it in the product, through MCP, or through the API. Existing rules migrate with no change in behavior.

What's new:

• Full condition expressiveness, including grouping and Lumos Expression Language
• Updated condition builder for pre-approval rules
• Same rules readable and writable through GraphQL, MCP, and the public API
• Terraform-compatible, so pre-approvals live alongside approvals in config as code
• Existing rules migrate automatically, verified for identical outcomes

Benefits:

• Auto-approve the policies your old rules could not express
• Learn one condition language instead of two
• Manage pre-approvals in the same Terraform files as approvals
• Keep every existing rule working through the migration

Draft Versions for Published Access Policies

• Target Availability: Rolling out September 10 through September 15, 2026
• Enablement: No setup required

Access policy drafts now extend to policies that are already live. Create a draft from a published policy, refine and review it while the current version keeps enforcing, then publish when it is ready. Every published version is archived, and deleting a policy disables it rather than destroying its history.

What's new:

• Create one draft from any published policy without touching live enforcement
• Draft states of Work in Progress and Ready to Publish
• Comments and sharing on drafts, with a link to the published version
• Publishing archives the prior version and checks conditions for conflicts
• Soft deletion, so a deleted policy stops evaluating but keeps its versions
• Edits by anyone other than an IAM admin create a draft automatically

Benefits:

• Refine an enforced policy with zero impact until you publish
• Catch a mis-scoped edit in review instead of in production
• Answer audit questions from version history rather than memory
• Move policy review into Lumos instead of screenshots and threads

Entitlements Tab on the Identity View

• Target Availability: September 4, 2026
• Enablement: No setup required

Open a human identity and flip to a new Entitlements tab to see every active entitlement that person holds across every connected app. This is the list an auditor asks for first, and it no longer takes a query or a walk through each account.

What's new:

• Entitlements tab beside Accounts on the identity view
• Columns for entitlement name, display name, description, type, source, and tags
• Search and filter on every column
• Active entitlements only, with entitlements from deactivated accounts excluded

Benefits:

• Answer "what does this person have access to" in one click
• Cut incident response time when you need a full permission list
• Skip the per-account walk through a person's access

🔄 Lifecycle Management

Onboarding, Movers, and Offboarding on Account Workflows

• Availability: Now live
• Enablement: No setup required. Existing offboarding workflows migrate automatically, and the change reaches each domain as its rollout segment is enabled.

All three lifecycle products now resolve their per-app provisioning and deprovisioning workflows from the same Account Workflows table the rest of Lumos uses. Offboarding moves off its own engine, so it gains workflow records, error tasks, and retries. The set of apps that get offboarded does not change.

What's new:

• Onboarding, Movers, and Offboarding all resolve workflows from one shared table
• Offboarding configuration moves from the Integrations tab to Account Workflows
• Failed removals surface as error tasks with workflow records and retries
• Offboarding dialog shows the workflow that will run, with a per-account override
• Lifecycle-driven changes no longer notify the affected employee

Benefits:

• Update one workflow and have every lifecycle stage pick it up
• Catch a failed offboarding removal instead of finding it later
• Stop maintaining offboarding apart from your other access workflows
• Keep joiners, movers, and leavers out of notification noise

✅ Access Reviews

Access Review Removals on Account Workflows

• Target Availability: Rollout starts September 4, 2026 and continues through end of September.
• Enablement: Requires the ITSM integration enabled for Access Reviews where you want ticket linkage

Account and entitlement removals in User Access Reviews (UARs) now run on the same workflow engine as the rest of Lumos. During campaign setup you pick from the deprovisioning workflows already configured for the app or entitlement, and failures and manual steps become tasks you can resolve inside the review.

What's new:

• Workflow picker replaces the single default removal method in campaign setup
• Each entitlement removes through the workflow matching its source, even in merged apps
• Failed removals become error tasks you can action individually or in bulk
• Manual steps surface as tasks in the review and the Task Center
• Evidence capture by file, link, or auto-linked ITSM ticket, including bulk add
• Workflow Record drawer showing live removal state inside the review

Benefits:

• Reuse the deprovisioning workflows you already configured elsewhere
• Stop losing failed removals to silence
• Resolve manual steps and attach evidence without leaving the review
• Hand auditors an ITSM ticket and a workflow record per removal

User Access Review Table: My Tasks Filter

• Availability: Now live
• Enablement: No setup required

The My Tasks filter that reviewers use inside an individual app review now works two levels up, on the Access Reviews campaigns page and within each campaign. Admins who also review can separate their own work from everything they oversee.

What's new:

• All and My Tasks toggle on the Access Reviews campaigns page
• Same toggle within a campaign, filtering across its reviews
• Default stays All, so oversight views are unchanged

Benefits:

• Find the reviews waiting on you without opening each app review
• Keep the program-wide view one toggle away
• Use one filtering pattern at every level of Access Reviews

🔌 Integrations

Sync Circuit Breakers

• Availability: Now live
• Enablement: On by default. Turn off the empty account response rule for any app that legitimately returns zero accounts.

The four sync circuit breakers are generally available and on by default for every customer and every connected app. A sync that would deactivate, remove, or wipe a large share of your accounts or identities is halted before the change is installed, and you configure the thresholds yourself.

What's new:

• Mass account deactivation breaker, on at 50% of active accounts
• Mass account absence breaker, on at 50% of active accounts absent
• Empty account response breaker, on for any response of zero accounts
• Mass identity deactivation breaker, on at 50% of active identities
• Domain-wide defaults in settings, with per-app overrides on each integration
• Every settings change requires a reason and is written to the audit trail

Benefits:

• Stop bad upstream sync data before it reaches your accounts
• Tune thresholds yourself instead of filing a request
• Prevent a truncated or empty payload from reading as a mass removal
• Show auditors who changed a threshold and why

August Connectors: New Integrations

• Target Availability: August 31, 2026
• Enablement: Connect from the Available tab on the Integrations page

One new integration is available on the Integrations page.

What's new:

• SAP ECC 6.0 [BETA]

Benefits:

• Extend coverage to SAP ECC without a custom integration
• Bring more provisioning actions directly into Lumos

August Connectors: Existing Integration Improvements

• Target Availability: August 31, 2026
• Enablement: Available on your existing connections. The Gong last activity sync is an optional setting.

Six connectors you already run gained capabilities customers asked for, from broader organization coverage to entitlement provisioning.

What's new:

• GitHub: connect every organization inside an enterprise
• AWS Identity and Access Management: script to connect multiple accounts programmatically
• SAP Concur: choose a primary or secondary approver for spend management
• HashiCorp Vault: provisioning now supported for entitlements
• 1Password: human-readable entitlement descriptions now sync
• Gong: optional setting to sync last activity

Benefits:

• Model more of your access in the connectors you already run
• Cut the manual setup for multi-account and multi-organization estates
• Read entitlement names your reviewers can actually interpret

Coming soon

• Remediation Workflows: Close an identity finding with a guided fix
• Multiple Workflows for Manual Offboardings: Match the exit process to the situation
• User Access Review Admin MCP: Run and monitor reviews from an AI agent
• September Connectors: More new integrations and connector improvements

Original source

Theme: Governing the Action, Not Just the Access

Lumos has always governed who has access. This release extends that to what happens after access is granted: an AI agent calling a tool, a workflow running a fix, or an agent handling a request on someone's behalf. A person still decides, and every action lands in the same audit trail.

Highlights

• MCP Governance [BETA]: See and control every tool call AI agents make
• Remediation Workflows: Run the agent's drafted fix right from the issue
• Access Request Agent: Full Request Lifecycle [BETA]: Check, cancel, and file requests for others in chat
• Access Request Agent in Slack [BETA]: Request access by mentioning Lumos in Slack
• Jira Service Management Agent: Assign an access ticket to Lumos and move on
• Approval by Entitlement Owner: Route every request to the permission's owner automatically
• Anthropic NHI Connector [BETA]: Inventory Claude agents, service accounts, and API keys

🛡 Intelligence & AI

MCP Governance

• BETA
• Availability: Now live as a design partner beta. No general availability date confirmed yet.
• Enablement: Ask your CSM to join the design partner beta

MCP Governance puts Lumos in the path of every tool call your employees' AI coding agents make. Lumos logs each call against the person who triggered it and answers allow or deny per tool before the call runs, based on what that person holds in Lumos. It ships set to Allow, so nothing is blocked until you add a policy.

What's new:

• Support for Claude Code and Codex, including Claude Code in the Desktop app
• Coverage for MCP calls, Bash commands, and file operations
• Inventory of every MCP server in use, including servers added locally
• Call history you can filter by person, server, or tool, with volume over time
• Per-tool allow or deny policies, ordered so the first match wins
• One-click Allow reads or Block writes on any server
• Albus answers usage questions and drafts policies for your approval
• Prompts, model responses, and tool results are never stored

Benefits:

• See which MCP servers and tools your teams actually use
• Stop risky writes before they run without blocking reads
• Tie every agent action back to the person behind it
• Roll out at your own pace, then flip the default to Block

Remediation Workflows

• Availability: Now live
• Enablement: Ask your CSM to turn it on for your organization

Identity Intelligence issues now come with a remediation workflow the agent assembled from Lumos Flows. You review the steps, edit them for that issue if needed, and run the fix from the issue itself. The agent drafts and a person launches, so nothing runs unattended.

What's new:

• Agent-built remediation workflow attached to the issue
• Work status column: In Progress, Completed, Failed, Cancelled, or Manual
• Cancel a running remediation, or retry a failed or cancelled one
• Per-issue step editing that leaves the shared workflow untouched
• Sub-issues per entity, remediated together from the parent issue
• New Manual Task and Send Notification steps

Benefits:

• Close findings without leaving the issue page
• Keep a person in every remediation decision
• Cover apps Lumos can't write to with assigned manual tasks
• Fix a batch of findings in one run, with status per entity
• Keep an audit trail through the same Flows engine that runs provisioning

Access Request Agent: Full Request Lifecycle

• BETA
• Availability: Now live. General availability targeted for November 4, 2026.
• Enablement: Requires the Access Request Agent. Existing intake fields work as-is. Ask your CSM to participate.

The Access Request Agent now stays with a request after it is submitted. Requesters can check status, cancel, and answer the intake questions your admins configured, and IT admins can submit requests on someone else's behalf, all in the same conversation.

What's new:

• Status checks on any pending request, from approval stage to provisioning
• Cancel a pending request from the conversation
• Configured intake fields asked conversationally and written onto the request
• On-behalf-of requests, with requester and target confirmed by name before submitting
• Asks for more detail instead of guessing when several people match a name

Benefits:

• Cut "where is my request?" tickets to IT
• Let requesters clear duplicate or stale requests themselves
• Keep approver context on apps with intake fields
• Let IT file for employees without re-typing their request

Access Request Agent in Slack

• BETA
• Target Availability: October 12, 2026. General availability targeted for November 4, 2026.
• Enablement: Requires the Lumos Slack integration. Ask your CSM to participate.

Employees can mention the Lumos app in any Slack channel where it is present, or send it a DM, to request access. The agent clarifies what's needed, shows a request card to confirm, and submits it with the same policy enforcement and audit trail as the web.

What's new:

• Mention Lumos in a channel, or DM it, to start a request
• Follow-up question when the request is missing details
• Request card for the employee to review and confirm
• Confirmation with a request ID and a link to track status
• Same approval workflow as requests made in the web app

Benefits:

• Turn Slack access asks into tracked, governed requests
• Stop routing Slack messages into Lumos by hand
• Let employees request access without needing to know Lumos

🧱 Platform

Approval by Entitlement Owner

• Availability: Now live
• Enablement: Add Entitlement Owner to a stage in each app's approval workflow. Permissions need an owner set.

Entitlement Owner is a new approver you can add to any stage of an App Store approval workflow. Lumos looks up who owns the requested permission at the moment of the request and sends them the approval task, so one workflow per app covers every permission under it.

What's new:

• Entitlement Owner approver option for any approval workflow stage
• Owners resolved from Lumos Owner (set in the UI or by CSV) and Synced Owner
• Multi-permission requests split so each owner approves only their own
• Both owners get the task when the two owner fields differ
• Org admins notified when no owner resolves and no other approver exists
• New permissions inherit the app's workflow on their next sync

Benefits:

• Set up one workflow per app instead of one per permission
• Cover new groups on day one with no admin work
• Send approvals to the person who owns the access
• Catch ownership gaps instead of letting requests stall

Account Finder Performance

• Availability: Now live
• Enablement: On by default. No setup required.

Account Finder, the sync step that discovers which accounts exist in each connected app, now saves discovered accounts in bulk. For large tenants this cuts processing time from hours to minutes, with the biggest drop in total sync time for Google Cloud and Microsoft Entra ID. Okta customers will see a smaller change in total sync time for now.

What's new:

• Discovered accounts saved in large parallel batches instead of one user at a time
• Each discovered app created once instead of once per user
• Lower memory use, so large tenants no longer fail partway through a run
• Applies to Okta, Entra ID, Google Workspace, Google Cloud, OneLogin, JumpCloud, Atlassian, and custom connectors

Benefits:

• Get fresh account data sooner after each sync
• Reduce failed sync runs on large tenants
• Get the improvement with no configuration changes

🔌 Integrations

Jira Service Management: Assignable Lumos Agent

• Availability: Now live
• Enablement: Install the Lumos app from the Atlassian Marketplace. Requires the Lumos Jira integration.

Lumos is now an assignable agent in Jira Service Management. When a service desk agent assigns an access ticket to Lumos, Lumos reads the ticket, resolves the user, app, and permission against your App Store catalog, submits the request, and keeps the ticket updated until it closes.

What's new:

• Lumos Agent in the Jira assignee dropdown through the Lumos Forge app
• Resolves user, app, permission, duration, and justification from the ticket
• Requests run through your existing approval and provisioning workflows
• Status syncs to the ticket; comment to ask for status or cancel
• Ticket closes when the request is completed, denied, cancelled, or expired
• Each request carries the ticket ID and link for approvers

Benefits:

• Replace manual re-entry with a single assignment
• Keep employees in the ticketing workflow they already know
• Link the ticket, request, and approval in one audit trail

New NHI Inventory Connectors

• BETA
• Availability: Anthropic is now live. Active Directory is coming soon. No general availability date confirmed yet.
• Enablement: Ask your CSM to participate

Two new integrations bring non-human identities (NHIs) into your Lumos inventory. Anthropic covers the agents, service accounts, and API keys teams create in the Claude Console. Active Directory covers the service accounts and computer accounts in on-prem and hybrid environments.

What's new:

• Anthropic: every Managed Agent, service account, and API key in your Claude Console org
• Anthropic: the workspaces and roles each one can reach
• Anthropic: flags keys with no expiry and keys tied to a person
• Active Directory: service accounts, computer accounts, and managed service accounts
• Active Directory: the hosts, services, and groups each one can reach, including Domain Admins

Benefits:

• Find AI agents and API keys nobody inventoried or owns
• Spot NHIs sitting in privileged AD groups
• See NHIs from more of your environment in one inventory

Existing Connector Improvements

• Availability: Now live
• Enablement: No setup required for generally available updates. SAP ECC provisioning and Tableau multi-auth are in early access; ask your CSM.

Several existing connectors gain new capabilities this release. Generally available updates apply to existing connections automatically.

What's new:

• Microsoft Entra ID: Remove a departing user from all their groups in one offboarding step
• Snowflake: Emails and names sync with a least-privilege role, so accounts match in access reviews
• GitHub: Expiring OAuth tokens refresh automatically
• Lucid: Detailed role data, such as Account Owner, Billing Admin, and Team Admin
• SAP Concur: Primary Expense approver updates automatically when a manager changes
• AWS NHI: Connect every AWS account at once with a CloudFormation StackSet
• SAP ECC (beta): Provisioning support for accounts and role assignments
• Tableau (beta): Connected Apps authentication alongside personal access tokens

Benefits:

• Remove a user from every Entra ID group in one action
• Give Snowflake only the read-only access Lumos needs
• Keep SAP Concur approvers current without manual updates
• Onboard every AWS account in one step instead of one at a time

Coming soon

• Agent Runs via API & MCP: Start Lumos agent runs from pipelines and integrations
• Bulk Access Changes [BETA]: Request access for a whole team in one submission
• RBAC Agent in the Catalog: Start role mining with one-click enrollment

Original source

Theme: Policy Coverage Without the Manual Slog

Scaling access policy coverage by hand doesn't work past a few dozen apps. This month's release cuts the manual steps out of creating policies, getting them reviewed, and acting on access requests, wherever your team already works.

Highlights

• Access Policies MCP: Create policies in bulk by asking Albus
• Access Policy Sharing and Commenting: Get sign-off on a policy, inside Lumos
• Offboarding REST API: trigger offboardings programmatically
• MS Teams: Approve access requests inline, without leaving Teams
• Agent Skills: One playbook every Lumos agent can use
• Access Request Agent in Slack [BETA]: @mention Lumos, describe what you need
• Lumos API V1 [BETA]: Define approval and provisioning workflows
• Activity Log: Search a large tenant's log in seconds
• Resource Roles: Delegate admin per app, not org-wide
• NHI Threat Hunter (GitHub) [BETA]: Machine-identity threat hunting extends to GitHub

🛡 Intelligence & AI

Access Policies MCP

Albus can now create and manage access policies for you. Model Context Protocol (MCP) tools let Albus handle the AppStore prerequisites and permission setup that policy creation depends on, so scaling role-based access control (RBAC) from a pilot to hundreds of apps no longer means clicking through the UI one app at a time. Every write action waits for your confirmation.

What's new:

• Create, read, update, and delete access policies through Albus chat
• Albus adds missing apps to the AppStore and configures referenced permissions
• Prerequisite and conflict validation before any policy is written
• Admin confirmation required on every write action
• Reports which apps were included, which were excluded, and why

Benefits:

• Scale RBAC from a pilot to hundreds of apps without clicking through each one
• Turn role-mining output and access matrices into live policies
• Skip the AppStore prerequisite work before a policy can exist
• Keep an audit record of every change Albus makes

Available to Albus for RBAC customers. Reach out to your CSM to get started.

Agent Skills (Coming 8/3)

A Skill is a reusable playbook for how an agent does something: a SKILL.md file plus any reference files and scripts it needs. Skills now live in the Knowledge Hub as first-class content that any Lumos agent can use, so an agent's know-how is something you can see and attach rather than something buried in code.

What's new:

• Skills tab in the Knowledge Hub to browse and manage Skills
• Lumos default Skills for NHI threat hunting and RBAC role mining
• Agent Builder multi-select replaces the single Specialization picker
• Slash-command invocation of a Skill in Albus chat
• Directory structure with reference files and bundled scripts

Benefits:

• See exactly what an agent knows how to do
• Edit a playbook without waiting on an engineering deploy
• Stop maintaining the same know-how in five places

No configuration required. Lumos default Skills appear in your Knowledge Hub automatically.

Identity Intelligence Agent Chat

Identity Intelligence agent runs are no longer one-shot. A chat interface inside the agents experience lets you question a finding, ask for the evidence behind it, and carry them into later runs instead of resetting each time.

What's new:

• Ask follow-up questions about a specific finding or the overall analysis
• Probe a finding to see the evidence behind it
• Agent memory, so later runs account for what you already reviewed

Benefits:

• Investigate a single finding instead of re-running the whole analysis
• Track actions taken in chat as an audit trail

Available to invited accounts to start. Reach out to your CSM to participate.

NHI Threat Hunter (GitHub) [BETA]

Non-human identity (NHI) threat hunting extends to GitHub, alongside the existing Amazon Web Services (AWS) and Microsoft Entra ID coverage. The agent scans your GitHub environment for risky machine-identity configurations and surfaces them as prioritized findings.

What's new:

• GitHub added as a scan target for NHI threat hunting
• Findings surface in the Identity Intelligence issues dashboard

Benefits:

• Extend machine-identity coverage to your source-control environment
• Review GitHub NHI risk alongside AWS and Entra ID findings

Available in Beta. Reach out to your CSM to participate.

Access Request Agent in Slack, @Mention [BETA]

Employees already ask for access in Slack. This makes those messages do something. @mention the Lumos app or send it a direct message, describe what you need, and the agent walks you through confirming and submitting the request, with the same policy enforcement and audit trail as the web app.

What's new:

• @mention the Lumos app in any channel, or send it a direct message
• Agent classifies the request and asks at most one follow-up question
• Structured request card to review before submitting
• Confirmation with a request ID and a status link
• Same approval workflow and audit trail as the web app

Benefits:

• Capture access requests employees already make in Slack
• Stop routing Slack messages into Lumos by hand
• Skip the browser entirely for a routine request

Available in Beta starting August 14. Requires the Lumos Slack integration. Reach out to your CSM to participate.

🧱 Platform

Access Policy Sharing and Commenting

Policy review moves into Lumos. Owners and admins share a policy with the users or groups who need to sign off, and those reviewers comment directly on the policy version. Comments resolve in place and commenters stay with the policy as new versions publish, so the review conversation follows the policy through its lifecycle.

What's new:

• Assign users or groups as commenters on a policy
• Bulk share multiple draft policies from the drafts table (admin only)
• Comment directly on a policy version
• Resolve comments, collapsed behind a "See Resolved" toggle
• Commenters persist across newly published versions

Benefits:

• Get stakeholder sign-off before a policy goes live
• Keep the review attached to the policy instead of a Slack thread
• Scope review access to one policy without granting broad permissions
• Record who reviewed a policy and what was resolved

No configuration required. This release does not include notifications, so let reviewers know directly when you share a policy with them.

Offboarding REST API (Coming 8/3)

Offboardings normally start when an end date passes or an account status changes in your HRIS. The Offboarding API lets another system trigger one directly, so an urgent termination doesn't wait on the next sync to remove access.

What's new:

• Create a manual offboarding and run it immediately or schedule it for a future time
• Fetch an offboarding's status by its UUID
• Cancel an offboarding that is scheduled or in progress
• API-created offboardings behave the same as manual offboardings created in the app

Benefits:

• Remove access the moment a termination happens instead of waiting for a sync
• Trigger offboarding from whichever system learns about the termination first
• Automate urgent terminations rather than handling them by hand

Activity Log

The Activity Log is fast and searchable enough to use mid-investigation. Page loads meet their target latency on large tenants, and real search and filter let you scope to the events you care about instead of scrolling.

What's new:

• Page load times have improved by an average of 100x, making Activity Logs significantly faster to load, review, and troubleshoot.
• Net-new integration event logging (Coming 8/7)
• Improved failure messaging
• Sync success breakdowns, similar to the new Integration Sync Observability views
• Notification success and failure events, with detailed information to help explain and troubleshoot issues

Benefits:

• Open the log mid-investigation without waiting through timeouts
• Scope to the exact events you need in one search
• Answer operational questions without filing a support ticket

Available to all customers, with no setup required. Event coverage is unchanged apart from the new integration logs; broader coverage expansion comes later.

Resource Roles

Resource Roles are generally available. Where a Custom Org Role grants permissions across every resource of a type, a Resource Role applies only to the specific resources you assign it to, so a team lead can manage two apps without becoming an org admin.

What's new:

• Resource Role type in the Role Builder, scoped to Apps
• Assign a role to a user or group per app
• Bulk condition-based assignment across multiple apps
• Assignments recorded in the audit log

Benefits:

• Delegate app management without granting org-wide admin
• Reduce org admin sprawl and enforce least privilege
• See which users hold elevated access to which apps

Turned on for all customers, with no impact on existing roles. Apps is the first resource type; Vendors and Access Reviews follow.

Lumos API V1 [BETA]

The V1 API exposes the workflow engine that powers the Lumos interface. Define approval workflows, configure provisioning and deprovisioning steps, and manage entitlements from code without opening the app.

What's new:

• Define multi-stage approval workflows with conditions and assignees
• Configure provisioning and deprovisioning steps, including manual and wait steps
• List, grant, revoke, and audit entitlements at the app or account level
• Manage requestable permissions without an AppStore dependency
• Terraform provider and an expression language for conditional logic

Benefits:

• Deploy access workflows the same way you deploy infrastructure
• Automate entitlement changes instead of clicking through the interface
• Version-control approval logic alongside the rest of your stack

Available in Beta, with enrollment required. V0 credentials carry over with no migration, and general availability is targeted for October. Reach out to your CSM to participate.

Microsoft Teams Support for Access Requests

Access request notifications and approvals work in Microsoft Teams at full parity with Slack. Approvers get the request where they already work and act on it inline, so Microsoft-first organizations no longer need a parallel manual process.

What's new:

• Access request notifications delivered in Microsoft Teams
• Inline approve and deny from the Teams message, with no redirect
• Requester and reviewer communication in-thread through the request lifecycle
• Same policy enforcement and audit trail as Slack

Benefits:

• Stop missing approvals because notifications land in the wrong tool
• Cut the manual workaround for Microsoft-first organizations
• Approve a request without opening the Lumos web app

Set up in Admin Settings → Notifications → Teams. Requires the Lumos App Store and a Microsoft Teams workspace.

🔌 Integrations

Existing Connector Improvements

Provisioning and configuration improvements landed across nine connectors this month, so you can model more of your access use cases on integrations you already run.

What's new:

• HashiCorp: account and entitlement provisioning
• CrowdStrike: account and entitlement provisioning
• Google Play Store and Apple App Store: account and entitlement provisioning
• Adyen: email and SSO provisioning
• LDAP: multiple connections to the same host
• AWS: list all permission set and account combinations
• JDBC: Windows authentication support
• Active Directory: connect using group managed service accounts (gMSA)

Benefits:

• Model more use cases on connectors you already run
• Provision directly into more of your app portfolio
• Cut manual account and entitlement work in these systems

Generally available at launch.

New Connectors

Two new beta integrations, including a generic connector for any REST-based system that doesn't have a purpose-built one yet.

What's new:

• Universal REST Connector [BETA] for REST systems with a simple identity model
• SAP GRC [BETA] surfaces segregation-of-duties (SoD) risk-violating users
• SAP GRC [BETA] links violating access to business roles, technical roles, and applications

Benefits:

• Cover apps that have no purpose-built connector
• Bring SAP SoD violations into your access picture
• Provision directly from Lumos to support pre-IdP work

Reach out to support to enter the beta. Upon entering it will appear on the Available tab on the Integrations page, and note that SAP GRC syncs risk-violating users only, not all SAP GRC users.

Coming soon

• Standardized Access Changes: One consistent path for every access change
• ITSM Configuration: Configure your ticketing integration without support
• Access Reviews and Lifecycle on the new platform: Account and entitlement removals, onboarding, movers, offboarding
• Remediation Workflows: Agent-suggested fixes that run through Flows

Original source

Theme: Identity Infrastructure at Scale

This release builds out the identity stack end to end - AI that's on by default, machine-identity threat hunting for AWS, programmatic control over your integrations and App Store, and access policies that explain and own themselves.

Highlights

• Albus, on by default - Lumos AI now on across your account
• NHI Threat Hunter for AWS [BETA] - Hunt risky AWS machine identities
• Access Policy Insights - See whether each grant belongs
• Access Policy Owner - Hand policy upkeep to the right people
• Integrations API - Manage your integrations as code
• Identities Table Revamp - Filter and sort every identity attribute
• Sync Observability - See every sync, stage by stage
• App Store Configuration MCP [BETA] - Configure the App Store with AI agents

🧪 Now in Beta - opt in

Most of this release is generally available. A few items are launching in Beta - available now to customers who opt in. Reach out to your CSM to participate.

• NHI Threat Hunter for AWS - requires the AWS IAM Identity Center connector
• App Store Configuration MCP - scoped to approval-change configuration

Coming next month: NHI - Identities & Ownership View and Lumos API V1 will both open in Beta.

🛡 Intelligence & AI

Albus, On by Default

Albus, the Lumos AI assistant, is now enabled and synced automatically for existing customers - no per-account request. It also reads more of your data and answers with interactive, exportable charts.

What's new:

• Albus enabled and synced across existing accounts by default (a short exclusion list aside*)
• Reads more data, including access-request and approver data
• Access matrix now considers every attribute automatically, not a hand-picked few
• Inline interactive charts - bar, line, area, and donut - in Lumos styling
• Export answers and charts to PDF or markdown reports

Benefits:

• Get answers from Albus without waiting on enablement
• Act on visuals instead of walls of text
• Share exec-ready reports without rebuilding them in a spreadsheet

*Rest assured, if you've requested Albus to remain off in your tenant, it will not be enabled.

NHI Threat Hunter for AWS [BETA]

A security agent that scans your AWS environment for the non-human identity (NHI) exposures an attacker could actually use and delivers them as prioritized, owned issues.

What's new:

• Scans the full AWS IAM authorization graph - users, roles, groups, policies, and trust
• Flags risky service principals, weak federation, and over-broad iam:PassRole / sts:AssumeRole chains
• Enriches IAM Access Analyzer and GuardDuty findings with graph and ownership context
• Resolves privileged identities to their owning app or team
• Surfaces a short, high-confidence set of findings as Lumos Issues

Benefits:

• Catch exploitable AWS identity risks that native tools miss
• Cut noise - a few defensible findings, not another dashboard
• Route each finding to an owner for remediation

Requires the AWS IAM Identity Center connector. Available in Beta - reach out to your CSM to participate.

🧱 Platform

Access Policy Insights

Every app and permission in an access policy now carries a plain-language insight, the assignment and usage numbers behind it, and a short explanation - so you can tell whether each grant belongs.

What's new:

• One insight per grant: Essential, Widely Used, Rarely Used, Widely Assigned, Rarely Assigned
• Assignment and usage percentages for each app and permission
• A plain-language reason on every insight, so no number-crunching is required
• Freshness timestamp; insights refresh on draft, on publish, and at least every 7 days
• Refreshed layout with search and permission descriptions

Benefits:

• Confirm access is appropriate before you publish
• Catch over-granted access at a glance
• Give reviewers the evidence on the page, not in a spreadsheet

Access Policy Owner

Assign an owner to each access policy so the people closest to an app or team can keep it current, while admins keep control of what goes live.

What's new:

• Owner field on every policy - one or more users, or a group
• Assign at creation or any time after, including in bulk
• Owners can view and edit access on the policies they own
• Publishing and activating stay with admins
• Owner shown in list and policy views; ownership changes are logged

Benefits:

• Delegate policy upkeep to app owners and team leads
• Keep policies current as the policy count grows
• Show clear, auditable accountability for every policy

Identities Table Revamp

The Identities page is now a full table on the Lumos Table Platform, with filtering, sorting, and column controls - and the custom attributes you sync from Okta and other apps are finally visible and filterable in one place.

What's new:

• Filter, sort, and search across identities
• Show, hide, and reorder columns
• Custom synced attributes (Okta and other apps) visible and filterable in the table
• Consistent with Apps, Access Reviews, and other updated tables

Benefits:

• Find the identities you need without exporting to a spreadsheet
• Slice by the attributes your team actually uses
• Work on a surface that matches the rest of Lumos

Rollout note: launching in the June release, with general availability July 6.

App Store Configuration MCP [BETA]

Configure your Lumos App Store programmatically or through any Model Context Protocol (MCP) compatible AI agent, instead of clicking through every record. This scoped beta covers approval-change configuration.

What's new:

• Read and update App Store configuration over the Lumos MCP server
• Scoped beta: approval-step changes across apps and permissions
• Works with MCP-compatible AI tools, authenticated via OAuth
• Changes take effect immediately and appear in the Admin UI

Benefits:

• Update many permissions in the time it took to do one
• Run Lumos configuration from the AI tools your team already uses
• Cut manual configuration errors

Available in Beta - reach out to your CSM to participate.

✅ Access Reviews

Admin-Configured Restricted Review Table Views

Admins can define the table views reviewers see in a User Access Review (UAR), keeping each reviewer focused on the information that matters for their decision.

What's new:

• Admins configure the table views and columns available to reviewers
• Restricted views apply across the review

Benefits:

• Keep reviewers focused and reduce review errors
• Standardize what each reviewer sees

Ad Hoc Reminders in Permission Reviews

Send a reminder to reviewers at any point during a Permission Review, without waiting for the next scheduled nudge.

What's new:

• Trigger an on-demand reminder to outstanding reviewers
• Works alongside the existing scheduled reminders

Benefits:

• Close out stalled reviews faster
• Reach the right reviewers at the right moment

🔌 Integrations

Integrations API

A public REST API, plus a new lumos_integration Terraform resource, to manage the full integration lifecycle - connect, reconnect, disconnect, read, and sync - without the UI.

What's new:

• REST endpoints to connect, reconnect, disconnect, get, list, and trigger sync
• New lumos_integration Terraform resource over the same API
• Credentials are write-only - never returned by reads
• Connect and reconnect emit audit-log events regardless of origin
• Uses your existing API token and "modify integrations" permission

Benefits:

• Manage integrations as code in your Terraform or CI/CD
• Script operations like disconnect-all or scheduled re-syncs
• Keep integration configuration version-controlled and auditable

Existing Connector Improvements

Ongoing enhancements to existing connectors so you can model more use cases on the integrations you already run.

What's new:

• Incremental syncs for Workday, Okta, and UKG Pro
• Workday: implementers and Workday-owned accounts sync
• SAP Concur: Spend user provisioning
• Okta: standard admin role provisioning

Benefits:

• Sync faster and more efficiently on high-volume connectors
• Model more of your real business requirements

Sync Observability (V1)

A Sync Status view on each integration's Integrations tab that shows every sync from the last 7 days - with live progress, stage timing, and record counts - so you can answer "did the sync run?" without filing a ticket.

What's new:

• Last 7 days of syncs on each integration's Integrations tab
• In-progress runs update live with elapsed time
• Toggle between Entity view and Pipeline (stage) view
• Stage timing and record counts for each entity

Benefits:

• Self-serve answers on sync status and where a run is stuck
• Diagnose stale data in seconds instead of escalating
• Trust data freshness for reviews, access requests, and audits

Coming soon

• NHI - Identities & Ownership View [BETA] - See and assign owners for every machine identity
• Microsoft Teams - Request and manage access from Teams
• Access Request Agent in Slack - Request access with an @mention
• Lumos API V1 [BETA] - A broader public API for your Lumos data
• Standardized Access Changes (UACM) - A consistent model for access changes

Original source