A Bulk publish action has been added to the business rules overview, allowing administrators to publish multiple draft business rules at once. This makes it easier to efficiently publish large numbers of draft business rules, such as those created from a rule mining report.

Target snapshots can now be created independently of other processes such as creating rule mining or reconciliation reports or importing target system entitlements. This makes it possible to refresh snapshot data on demand, for example, after making changes in the target system.

• Approval workflows cannot be updated when an approval scope is corrupted (e.g. a specified user account has been deleted)
• Cannot edit a HelloID user when their delegated approver has been deleted

The product expiration date for a specific product request is now available in PowerShell tasks through the new $request.timeLimitDate property. This means the configured expiration date can be incorporated into notifications, tickets, and workflow logic. The value represents the expiration date and time of the requested product. It may change if the product’s time limit is overridden during the request lifecycle.

Provisioning

• Manually create target snapshots
• Publish business rules in bulk

Service Automation

• Expose product request expiration date in $request variable for PowerShell tasks

• System icons are not correctly shown when you’ve created an new rule mining report and the new one fails to create and the previous rule mining report is shown.
• Active Directory account isn’t removed when an Exchange mailbox creation fails on the create account action of an Built-in Active Directory target system. This results in an unmanaged Active Directory account. We fixed this so the created Active Directory is deleted on rollback when Exchange fails.

Service Automation

• PowerShell 7 support for local Service Automation Agent

• No agent pool selection results in a random pool selection instead of default pool
• Delegated form tasks stay in running state
• Search results in ordered dropdown isn’t ordered anymore

We have released a hotfix to resolve an issue that prevented images from being uploaded on the Company Settings page. Uploading an image resulted in a 400 Bad Request error. The issue has been identified and resolved, and image uploads are now working as expected.

We’ve released a hotfix to address an issue affecting Automation Variables used in the new Product Actions, PowerShell data sources, and Delegated Form tasks. In some cases, newly created Automation Variables and recent updates to existing variable values were not reflected during execution, causing scripts to continue using previous values. Scheduled Automation Tasks were not affected. This issue has now been resolved.

Previously, rule mining used a fixed Maximum amount of exceptions threshold of 20%. This setting determines how many people within the scope of a condition may be missing an entitlement before that entitlement is excluded from the report. The threshold is now configurable between 0% and 20%. This provides greater control over the quality of rule mining results, especially in organizations with unevenly sized subgroups or divisions. With a 20% value, entitlements that are shared by more than 80% of the people within a condition scope will be reported as common across the entire group. As a result, a recommended rule may incorrectly assign those entitlements to a smaller subgroup. Lowering the threshold helps prevent this and improves the accuracy of rule mining recommendations. Setting the value to 0% ensures that only entitlements assigned to every person within the condition scope are included. This can be particularly useful when creating an initial set of business rules.

The requestGUID is now included in Elastic audit log records for custom audit messages related to product requests. This makes it possible to establish a direct relationship between a product request and its corresponding audit messages, improving traceability. This change also ensures a clear distinction between custom audit messages related to product requests and those related to delegated form submissions, improving filtering, reporting, and overall insight into audit data.

The preview of grant and revoke permissions scripts now uses cached permission values from a target snapshot. This makes permission values available instantly in the Preview window when selecting a permission, even when a target has a large number of permissions. Cached entitlement data can be refreshed directly from the Preview window using the Sync button. In addition, the permission display name is now available in preview through the actionContext.PermissionDisplayName variable. Previously, this value was only available when the script was executed in production.

• Can not save a Dynamic Form using a form component with ‘dependency on URL query parameter’
• Can not save or edit a Self Service Product resource owner if the old resource owner group is deleted from HelloID

• It wasn’t possible to add new tags to an incident webhook or email to limited when an webhook or email is triggered

• Rule mining report shows no results for system when person.accounts fields are used for correlation and the fieldname & value exists for multiple target systems.
• Rule mining report shows no results for system when person.accounts fields are used for correlation and PascalCasing is used in the field name.
• SMTP with capital letters is not used as primary for Active Directory with Exchange integration enabled. The first value in array was used as primary instead of the value with capital SMTP.
• The same subpermission reference in an entitlement will break the reconciliation report. Altough we do not advise to use the same reference twice it was not blocked when granting sub permissions therefore we now support having duplicate subpermission references in an entitlement. We still recommend removing dublicates and/or prevent getting dublicates in the granting (all-in-one) script.
• The fallback company icon (in case no icon is set in company settings) wasn’t working in the menu

• Delegated form job execution stuck in running state
• Don’t mark failed Delegated form tasks executions as finished

Starting with this release, product request deletions are included in audit logs (Elastic). This prevents gaps in the audit trail when user accounts and related product requests are automatically removed. The full product request lifecycle is now traceable for compliance and investigation purposes.

A new overview shows all entitlements in all target systems, the business rules where each entitlement is configured, and the persons who currently have the entitlement. This helps you quickly find and replace entitlements, remove them from business rules, and answer audit questions about when an entitlement is granted. The overview also indicates whether an entitlement still exists in the target system. If entitlements are still referenced in business rules but no longer exist in the target system, a warning badge is shown. The overview can be found under Business > Rules > Entitlements. Toxic policy is now available on a separate tab (the button has been replaced).

Business rules can now be created directly from rule mining report entries, making it easier to build the most efficient set of business rules based on existing entitlements in a target system. When creating a business rule from an entry in a rule mining report you can set its name, categorize the rule, select the entitlements the rule must assign, and choose a condition (if multiple conditions can identify the same group of people). Note: Rule mining is a beta feature included in the Governance module. It is available upon request.