Release notes — September 2026

User management

Keep administrators enrolled

Organization owners and administrators stay enrolled when an admin changes users individually, in bulk, or through group enrollment. This prevents an admin from losing access through an unenrollment action. To unenroll an administrator intentionally, first demote them to a member. Removing a person from the identity provider can still remove them from Elba. This change does not automatically re-enroll people who were unenrolled earlier. See User management.

Communication preferences

Let each employee choose their notification channel

Every organization can now let employees choose where they receive Elba messages: email, or a connected Slack, Microsoft Teams, or Google Chat. Employees select Communication preferences in the member portal user menu; the option appears once a chat app is connected. Administrators can review and change each person's channel in Settings → Team → Users with the Notification channel column, the Communication preference filter, and the Set communication channel bulk action.

The channel selected in Communication Preferences becomes the default for employees without their own choice. Messages go to the employee's channel, then the default channel, then email when the person cannot be reached. When you send a training manually, employees with their own channel receive it there; the channel in Send via applies to everyone else. See Sam.

Integrations

Connect Workday Learning in any organization

Workday Learning is now available to every organization. Organization owners and administrators can connect it from Settings → Integrations → Workday Learning to publish Elba-managed courses, enrollments, progress, completion, and quiz scores to Workday. Because Workday tenants are configured differently, validate the integration end to end in a Workday sandbox or implementation tenant before connecting production learners. See Connect Workday Learning.

Security leaderboard

Respect anonymized member visibility

When the leaderboard is set to Anonymized, members can view their own ranking and score without seeing other members' scores. Managers can still review their direct reports in the dedicated team view, and administrators retain the admin leaderboard. See Security leaderboard for the setting.

Public API

Read the last recorded elba sign-in for each user

GET /v1/users now returns last_login_at: an ISO 8601 timestamp when elba has recorded a sign-in, or null otherwise. The existing has_logged_in field and pagination remain available. This is an elba sign-in date, not a last-activity date; a managed browser extension can sign in silently, and sign-ins before June 2023 were not backfilled. See Public API for the precise meaning.

CSV reports

Keep exported text as text in spreadsheets

CSV reports in the Elba admin dashboard now mark text that a spreadsheet could interpret as a formula as text. You may see a leading apostrophe in those cells, for example when an activity detail begins with + or -. Report columns and the underlying values are unchanged.

Export Phishing results in one CSV

In Phishing → Reporting, Export CSV downloads simulations across all four result tabs, using the current campaign, scenario and action filters. Each simulation includes its recorded actions and its campaign's sent count and rates. See Phishing reporting.

Export all filtered Training users

In Trainings → Reporting, Export CSV includes every employee in the filtered view when no rows are selected. Selecting employees limits the export to that selection. For each exported employee, the CSV includes all their training assignments and recorded completion history, not only assignments matching a training filter. Employees without assignments have no CSV row. See Training reporting.

Data Protection

Find all alerts for a Google Drive file

In Data Protection → Issues, paste a Google Drive file link or ID to find its alerts, including completed ones. A link matches that file exactly; a bare ID can also match a file name. The default issue-status filter pauses during a file search so older alerts remain visible. You can select a status to narrow the results, then remove the search to restore the previous filter.

Completed alerts with no recorded closer are now available under Completed by admin → Changes made or Ignored, matching the status shown in the issue list. This does not identify who completed them or recheck historical sharing. See Work with issues.

Keep ignored file alerts closed for allow-listed recipients

When a later source scan sees an allow-listed recipient on a file whose alert was ignored, that recipient alone no longer causes another alert. A newly detected sharing permission that is not allow-listed can still raise an issue. This change does not initiate a new scan or modify sharing permissions. See Work with issues.

Verify Google Drive sharing-removal outcomes

For new Google Drive removal requests, Elba checks whether direct sharing permissions were actually removed. If access remains or the result cannot be confirmed, the issue stays open or reopens. Sharing inherited from a parent folder cannot be removed on the file; review that folder in Google Drive instead.

Earlier removal requests are not automatically retried or rechecked by this update. For previously completed high-risk issues, verify current access in Google Drive. See Data Protection.

Keep unverified older Google sharing out of automatic playbooks

An older Google Drive issue can remain visible when Elba cannot verify the outcome of a previous sharing removal. Playbooks now skip automatic distribution and remediation for that issue, including any newer sharing on the same issue. Review current access and choose a manual action if needed; simply opening the issue does not restart its playbook. Issues already distributed to employees remain assigned and existing reminders may continue. Other newly detected sharing continues through the normal playbook flow. See Data Protection.

Detect sensitive content inside Google Drive documents

Elba now analyzes document text alongside Google Drive sharing permissions, helping you identify sensitive files and prioritize exposure risks even when filenames give no indication of their contents.

Supported formats include Google Docs, Sheets and Slides, plus uploaded text files, PDFs, DOCX, XLSX and PPTX. Multiple document tabs and worksheets are included.

In an issue's Data exposure → Content section, you can see the scan status and detected sensitive content, such as an encryption key. This distinguishes completed text analysis from metadata-only or unavailable scans.

Analysis runs asynchronously through your existing Google Drive integration. PDFs require extractable text; OCR is not included. Files that exceed processing limits or cannot be fully read are not reported as clean. Previously detected sensitive findings are preserved when a subsequent scan is unavailable.

See Data protection to investigate findings and manage sharing risks.

See connection errors affecting active playbooks from Home

Organization owners and administrators can now see configured Data Protection sources whose recorded connection error prevents active playbooks from running directly on Home. The notice shows the affected-playbook count and links to the existing source settings. It distinguishes the last successful information read from the recorded error time and warns when information is unavailable or may be out of date.

See Check connection errors from Home for the scope, refresh behavior, and next steps.

Third-Party Apps

Set a usage policy before an application is observed

In Third-Party Apps → Inventory, organization owners and administrators can now use Add application domain to add an application by its domain before Elba has observed it and set its usage policy in advance. With Not approved, an active Browser Security playbook that blocks page access can block the domain and its subdomains. Review browser access previews that consequence before you save. Public suffixes, shared-hosting domains, and publisher-wide domains such as google.com are rejected.

The application is marked Unobserved until Browser Security observes it; observed users and usage then join the same entry, and the policy stays in place. Remove target restores the previous policy and keeps observed evidence. See Add an application domain.

See applications managed in Okta

Organizations that use Okta as their Elba identity provider can see matched application assignments in Third-Party Apps → Inventory after a successful directory sync. Managed in Okta shows assigned applications. Not managed in Okta highlights applications with no Okta assignment and at least five users confirmed by a connected source or observed in the browser; an optional toggle includes email-only applications.

The application's Users view distinguishes Assigned in Okta access from other evidence and identifies federated access as SSO through Okta. An assignment is not proof of a recent login. It does not itself open an issue, change application policy, or modify access in Okta. Unmatched Okta applications may be absent from the inventory.

Rollout update, 23 September: initial production assignment syncs are verified in Europe and the US. The US first run and scheduled repeat completed without creating issues or tags from assignment rows. This entry covers the native identity-provider connection; it does not announce the separately connected Okta source or sign-in-history rollout.

See Applications managed in Okta for supported evidence and filters.

Recover a mistaken Ignore decision

Administrators and organization owners can now reopen an individual Third-Party Apps issue previously ignored by an administrator. Reopen issue asks for confirmation, then returns the issue to Detected for review and normal supported actions.

The application, source, associated member, evidence, and previous decision are preserved, with the reopening actor and time added to the history. Application access and member state stay unchanged. Employee-completed issues and Changes made decisions are outside this recovery path.

See Reopen an issue ignored by an administrator for the steps, eligibility, and recovery guidance.

Access Review

Delegate account approvals in a review

Security can now choose the application owner, the employee's line manager, or both as required approvers for each access-review campaign. A missing directory manager can be assigned for that review without changing the directory. Approvers can answer through a reachable Slack, Teams, or Google Chat connection, or by email; Security retains the final decision.

For an unanswered request at the deadline, the campaign can escalate to Security (the default), keep access marked not reviewed, or record a revoke decision. The revoke policy requires an explicit confirmation before launch and may include accounts with no reachable approver. A decision to revoke is separate from applying the access change. Configuring a scheduled review does not send approval requests; validating its scope does. See Delegate account approvals for setup and checks.

Keep departed employees' connected accounts visible

After a new source sync, an application account can remain in Access Review → Identity gaps when its matching employee has been removed from the identity provider. Elba labels it Former employee only when it has recorded one matching identity that is still deleted, with no conflicting current match. An email domain alone does not prove that someone has left. Unverified or ambiguous matches appear as Unknown.

The table and CSV now show when the source last reported each account. This update does not reclassify previously hidden historical accounts, revoke access, or confirm that an old source observation is still current. Check the account in its source application and confirm the person's status before acting. See Identity and access reviews.

Trainings

Limit repeated manual training reminders

A recent accepted manual reminder request now causes another request for the same person within 24 hours to be skipped, including requests from a different administrator or manager. This applies across the supported email and chat channels. The result distinguishes people queued for delivery from people skipped; if everyone was skipped, it says No reminder sent. Reminders sent before this update are not counted retroactively. Automatic reminder schedules are unchanged. See Send training or reminders manually.

Enable quizzes by default for new organizations

New organizations start with quizzes enabled. Existing organizations keep their previous setting. Administrators can review or change the setting in Training → Program → Settings. Passing a quiz can complete an assignment without following the full training, so check that this rule fits your program before leaving quizzes enabled. See Security awareness training.

Exclude a user from training statistics while keeping their training access

Organization owners and administrators can now use Team → Users to exclude an enrolled user from training statistics and include them again later. The setting changes training rates, statuses, scores, and trends, including displayed historical and group/program results. It does not remove the user's access, enrollment, assignments, reminders, completions, or individual records. Reporting continues to show the user with an exclusion marker, and its CSV retains their records with a Training statistics column. See Security awareness training for the steps and what each figure counts.

We also corrected group completion rates to count each assignment for current enrolled group members. Some previously displayed group percentages may therefore change, usually downward; no training records were removed.

Keep a dated record when a training is completed again

Elba now preserves each genuine repeat completion as a separate dated record, whether the employee completes the training in the member portal or through a supported chat channel. Employee training profiles, Training → Reporting, and its CSV export show recorded completion history while keeping the latest assignment status distinct. Retrying the same completion does not count twice.

Previously retained completion dates remain visible as legacy evidence. Earlier completions that were never recorded cannot be recovered, and this change does not add a per-push recipient or delivery audit. See Security awareness training for how to read the history and its limits.

Find a custom training immediately after saving

After a successful save, a custom training now appears in Program → Edit program → Add training → Custom, even if the library was already open earlier. The return view selects Custom and clears the previous search so the saved training can be found and reopened. Saving a training does not add it to the program. If a save fails, the editor keeps your work so you can retry.

Avoid stale conversation reminders after web completion

When an employee finishes a training in the web portal, Elba now checks that training before sending a delayed Slack, Teams, or Google Chat reminder to resume an earlier conversation. If the training is already complete, the old reminder is skipped. Reminders for unfinished trainings and unrelated conversations continue. This fixes cases where the portal showed no pending training but an earlier conversation still prompted a reminder.

Phishing

Preview repeat simulation failures

In Phishing → Reporting, organization owners and administrators can now preview enrolled employees who have clicked a simulated link or submitted credentials in a chosen minimum number of distinct campaigns during a rolling calendar-month window. The default is two campaigns in 12 months. The preview shows the calculation time and the campaigns behind each match; a click and submission in one campaign count once.

The preview is read-only. It does not save a smart group, change enrollment or recipients, or send a campaign. See Phishing simulations for the rule and how to inspect results.

Combine training and repeat-phishing conditions in the preview

The same read-only preview can now combine repeat simulation failures with one selected training module. Choose Completed or Incomplete 14+ days after its deadline, then Match all (AND) or Match any (OR). Each person shows the campaigns and current training-assignment dates behind the result. Missing or inconsistent training evidence is shown separately when the combined result cannot be determined. No group is saved and no employee action is taken. See Phishing simulations for the steps and limits.

Make repeat-failure click evidence more reliable

For newly sent native simulations, a plain link request no longer records a click; the page attempts a separate browser confirmation. A click recorded at or after the employee reports that simulation remains in its history but no longer qualifies it for the repeat-failure preview. An independent credential submission can still qualify it. Older simulation links remain supported, and their click source may be unknown.

This does not change a campaign's overall success or failure status or rewrite past events. A browser confirmation is stronger than a plain request, but it cannot prove that a person clicked: automated tools that run JavaScript may also send one. See Phishing simulations for the preview rule and its limits.

Record and correct an analyst verdict for reported emails

Organization owners and administrators can now classify an email in Phishing → Email Reports as Safe, Spam, or Phishing, or return it to Unclassified. The saved verdict is separate from Unread/Read, and a correction preserves an attributable, UTC-dated history of previous decisions. Older reports remain Unclassified until an administrator explicitly saves a verdict.

Classification does not modify the reporter's mailbox, notify the reporter, or submit a report to Google or Microsoft. Safe is an analyst opinion, not a protection guarantee. See Set up phishing reporting for the steps and recovery if a save cannot be confirmed.

Browser Security

Reduce low-context download alerts

Browser download detections now use an evidence-backed severity for playbooks, notifications, and Browser Logs. A detection with fewer than 10 distinct files is effective Low, even if its original reported severity was Medium or High. A bulk download with at least 10 distinct files can retain its reported level. The original rating and detection remain visible; no existing playbook is reconfigured.

Playbooks limited to Medium or High download detections may therefore send fewer notifications. The rule does not verify a destination or prove exfiltration. See Review download detections for the evidence and playbook implications.

Sign in managed Chrome extensions using an existing identity session

For elba extension 0.5.0 and later, administrators can deploy a workspace-specific browser policy to attempt sign-in through the user's existing identity-provider session. When a session, account choice, MFA or provider approval needs user interaction, the extension opens a guided sign-in page and can show reminders. This does not provide per-device or per-profile compliance proof.

Rollout update, checked 25 September: Extension 0.5.0 is listed in the Chrome Web Store and Microsoft Edge Add-ons. Check the installed version before a managed Chrome or Edge pilot. Store publication does not confirm deployment or sign-in on a customer's devices. See Deploy the browser extension for setup and limitations.

Remove unwanted Browser playbooks

Organization owners and administrators can now delete paused Browser playbooks from their details panel. Pause an active playbook before deleting it; deletion does not undo its previous actions. Selecting an already-used starter template opens the existing playbook, helping prevent duplicate setup.

See Playbooks for the steps.