Release notes — August 2026
Product updates released in August 2026.
Microsoft 365
Limit directory synchronization to one Entra security group
During Microsoft onboarding, an organization owner can now choose between importing the entire directory and importing one security-enabled Microsoft Entra group. Group scope imports only that group's metadata and its eligible direct members. Nested-group members, guests, disabled accounts, and users without either an email address or user principal name are excluded.
Elba reconciles group membership on a schedule, with directory changes reflected within 24 hours when synchronization completes successfully. If a user leaves the selected group, Elba removes and unenrolls that user after the next completed synchronization. If the group becomes unavailable or no longer contains the organization owner as an eligible direct member, Elba aborts stale-user cleanup. Existing synchronized users are not removed, and the import never expands to the full directory.
Import scope and Microsoft permissions are different
The group selection limits the directory data Elba queries and stores. Microsoft application permissions remain tenant-wide.
See Connect Microsoft 365 for setup instructions and OAuth scopes and permissions for the permission model.
Browser Security
Understand private-window coverage before rollout
The Browser Security Deployment experience now explains private and incognito coverage separately for Chrome, Edge, Firefox, and Safari. It distinguishes managed-policy support, explicit user-consent requirements, settings that Elba cannot observe, and the unsupported current Safari path. The status view also makes clear that force installation, enrollment, and an active heartbeat describe normal browsing only and do not prove private-window protection.
See Deploy the browser extension for the browser-specific policies, minimum versions, limitations, and validation steps.
Prioritize extensions by permission exposure
Compatible Chrome and Edge observations now support explainable Low / Medium / High / Not assessed permission-exposure levels in Third-Party Apps. Filter and sort the inventory, review the reasons, and inspect affected installations in Users. Incomplete evidence remains Not assessed, never implicitly Low. This is not a malware or reputation verdict and does not trigger automatic blocking. Safari does not support peer-extension inventory.
See Browser extension capabilities for the workflow and coverage limits.