Release notes — October 2026

Access reviews

Share a completed review's summary and detailed evidence

Organization owners and administrators can download a PDF summary and the detailed CSV from a completed review's Summary. The summary brings its scope, decisions, reviewers, application owners, identity matches and required-change evidence together. Both filenames carry the same review reference, including when the browser exported the CSV before this update.

The PDF states when it was generated and distinguishes decisions, requests, declarations, historical records and verified removal. It is not a signed or certified attestation. Keep the English detail CSV and supporting application evidence with it. See Complete and export an access review.

Integrations

Resume a stopped Google Chat connection

Google Chat now explains the step that stopped a connection from Communications or Settings → Integrations. Interrupted sign-in, missing permission, Workspace administrator requirements, a busy Google service and a Workspace already connected elsewhere have distinct explanations. Unrecognized failures include a support reference when available.

When Google has not authorized the app, Authorize access opens the Google Admin console step. Elba checks the authorization while its page stays open and shows Connected once Google accepts. Connecting alone leaves your current employee communication channel unchanged; changing the default remains a separate Communications choice. Google Workspace policy may still refuse access. See Connect Google Chat and recover a stopped connection.

Recover an MSP customer connection

In the MSP dashboard's GDAP tab, a canceled, expired or unmatched Microsoft consent now returns to the customer list with an explanation and a usable restart through Connect. A customer already linked to an Elba organization outside the MSP has a support path. Waiting for Microsoft confirmation is bounded, with Check again and a way back to the list.

The return remains tied to the selected customer and the MSP user who started it, including when another customer is opened through Log In in another tab. Repeating the same confirmed return does not create another customer or send another welcome email. See Connect a GDAP customer as an MSP.

Find the right GDAP customer

The MSP dashboard's GDAP tab keeps your own partner's customer list and Connected states when you open a customer through Log In. All 25 customers on each page are accessible, and name search handles punctuation as ordinary text.

An incomplete or unavailable list now shows an explanation and Try again instead of presenting a partial list or suggesting that customers are disconnected. A tab left open before the update may need a page reload to show these controls. See Find and connect your GDAP customers.

Trainings

Keep proof of a document acknowledgement

Custom training can require employees to acknowledge an explicitly selected PDF. The recorded acknowledgement belongs to its exact version and date, with individual proof downloads and batches from existing Training reporting. Selecting or publishing the document does not send training.

Organizations already eligible for the Charter module also have document versions and an explicit renewal choice, with preserved history. Older acknowledgements remain marked as unknown version. See Document acknowledgement and its limits, including retrieval limits for former people and earlier Charter versions.

Keep your program running

Owners and administrators can turn on Keep the program running in Training → Program → Settings. When an active program is about to run out for some employees, elba adds the next two library modules suitable for every employee. The existing program schedules them at its usual frequency. Modules show Added by elba, and the notification center links back to the program so an administrator can review or remove them.

Existing organizations keep this option off until an administrator enables it; new organizations start with it on. Paused programs and programs whose modules all target specific groups are not continued. elba does not re-add modules that were already in the program, including ones an administrator removed. See Keep the program running for selection and batch limits.

See when assigned training is due

Pending modules in the member portal now show Due before or Overdue since, using the assignment's existing deadline. Training messages in chat and email also state the due date. Reminder frequency and completed training history stay the same.

Administrators can see the date and past-due state in each person's training details. Trainings → Reporting shows a Past due count and a Past due only filter to find people with overdue assignments.

An assignment is past due when an enrolled person's available training has a known deadline that has passed and has not been completed. This is separate from the existing training status and statistics. The update does not let administrators set deadlines or create campaigns. See Follow due dates and Sam reminders.

Follow overdue training across the reporting line

Managers can open Your team → Overdue training to review overdue courses, see their reporting relationships, filter by branch and export the training-only list. Counts distinguish people from courses. Direct reports remain the default; an organization owner or administrator can explicitly allow indirect follow-up in the training program settings.

Manual reminders show the exact recipients before confirmation. Cancelling sends nothing; if eligibility changes, the manager must review the updated list before another confirmation. Existing reminder limits, indirect score boundaries and automatic direct-report updates remain unchanged. See Follow overdue training as a manager for the setup and limits.

Playbooks and training

Connect a detection to a relevant lesson

Owners and administrators can choose Assign a training in supported security playbooks, select an existing lesson and set a due period. Starter templates connect external sharing, Google application access and browser findings to a relevant lesson.

Only new matching detections can assign training. Already-covered lessons are skipped, and a person can receive at most one playbook assignment within seven days across your organization's playbooks. This uses the existing employee training and reporting journey without resetting the recurring program. Keep remediation or blocking in a separate playbook. See Assign a training after a detection.

Bring a planned lesson forward after a detection

If a playbook assigns a lesson that the person's program only schedules for later, elba now makes that same lesson available immediately with the playbook's due period. The program does not assign a second copy. Lessons already pending, started or completed remain skipped, and the seven-day playbook assignment limit still applies.

Other planned lessons keep their dates at that moment. At the next program recalculation, those that followed the lesson brought forward come one program period earlier. Follow the assignment, deadline and completion in the existing training details and reporting. See Training assigned by a playbook for scheduling and continuation limits.

Assign a lesson after a phishing credential submission

From Awareness → Phishing → Playbooks, owners and administrators can use Train people who enter their credentials in a phishing simulation. The template assigns the existing fake-login refresher with a 14-day deadline; review the lesson, deadline and Member or Group conditions before activation. It reacts to credential submission, rather than an email open or link click, and follows the existing eligibility, already-covered and seven-day assignment limits.

The employee uses the existing Training page and configured communication channel. The simulation result page links to the lesson only after confirming the assignment; pending, skipped and failed outcomes have distinct feedback. Assignment does not establish message receipt or training completion. A draft runs no action, and earlier submissions are not replayed. Active playbooks currently have no test-campaign exclusion. See Phishing playbooks for setup, administrator notifications and result-page limits.

Data protection

Investigate observed sharing by domain

From Radar → Frequent data recipients → Sharing by domain, owners and administrators can follow a Google Drive recipient domain through its addresses to files, owners and existing alerts. Professional, personal, public and unclassified sharing stay separate. Search and pagination preserve the investigation context.

The view is read-only and shows stored observations with explicit source, age, coverage and count limits. It does not certify current access or a complete drive scan, and does not remove permissions. See Investigate observed Google Drive sharing by domain.