Cloud Access Service and Authenticators Historical Release Notes (July 2026 - April 2026)
Last Modified: 2026-11-02

July 2026 – Cloud Access Service Updates

Cloud Access Service Updates

The following subsections outline the new and enhanced features of the Cloud Access Service (CAS).

 

Hardware OTP Credential Information Report Now Includes Username

In addition to the existing user details, the Hardware OTP Credential Information report now includes the user's logon name in the Username column, which is the attribute mapped to your identity source. This enhancement enables you to identify users and correlate Hardware OTP credentials with the identity source.

 

 

Local Groups Renamed to Global Groups in the Cloud Administration Console

The term Local Groups previously suggested that only users from a local identity source could be members. However, users from any identity source can be added to these groups. To better reflect this capability, the name has been updated to Global Groups across all pages. This is a terminology change only and has no functional impact.

 

Note: In this release, the attribute name continues to appear as localGroup in the policy and application user attribute selection dropdowns. This naming will be updated to align with the Global Groups terminology in a future CAS release.

 

 

Share Authentication Method Information with Connected Applications 

Authentication methods can now be sent as a statement attribute, enabling the sharing of authentication details with connected applications, such as Salesforce. This feature applies to My Page SSO SAML and OIDC applications, as well as SAML and OIDC relying party connectors.

For My Page SSO SAML applications, a new System option has been added to the Attribute Source drop-down. You can find this setting on the Connection Profile tab, under the Connection Profile Advanced Configuration section within Statement Attributes. Previously, only Identity Resource and Constant were available.

For My Page SSO OIDC applications, navigate to Access > OIDC Settings, where you can add a claim with the Source set to System. Then, on the OIDC application’s Connection Profile tab, you can add or select that claim.

 

 

Use of Company-Specific URLs Required

As a follow-up to the November 2024 Release Announcement, support for non-company-specific URLs will be permanently shut down on July 30, 2026. You must update all affected service URLs to use your designated company-specific URLs before this date. For more information, see the Company-Specific Administrative URLs Update Instructions and Permanent Shutdown of Non-Company-Specific URLs. You must use your designated company-specific URLs for all access, including API interactions, Authentication Manager (AM) configurations, SCIM configurations, and redirected URLs from identity providers (IdPs). Access through non-company specific URLs is not yet blocked; however, when it is blocked on July 30, it will result in loss of functionality (for example, https://access.securid.com or https://na2.access.securid.com).

To ensure uninterrupted access, you should promptly verify that all connectivity is routed through the appropriate company-specific URLs and update their configurations as needed. If your Identity Router (IDR) software version is earlier than 12.22.0.0.32, you must delete and reinstall Identity Router software using a newly downloaded IDR image (upgrade is not supported for v12.22 and earlier) to avoid any disruptions when non-company-specific URLs are permanently shut down.  

Starting with the June 2025 release, a banner warning appears for 24 hours whenever a non-company-specific URL is used for the following:

  • Logging in to the Cloud Administration Console via password or third-party IdP.
  • Accessing the Cloud Administration REST APIs.

In addition, an audit event is logged once per day whenever a non-company-specific URL is used for third-party IdP login and Cloud Administration REST API. You can view this event from the Cloud Administration Console by navigating to Platform > Admin Event Viewer.

As part of the effort to permanently shut down non-company-specific URLs, the Software and Adapter Repository URLs used by IDRs will be updated to company-specific URLs starting with the June release. As a result, customers are advised to review their network configurations and ensure that the new URLs are whitelisted, if applicable.

Old URL format:

New URL format (Whitelisted):

GOV Deployment

Old URL format:

New URL format (Whitelisted):

A Status Monitor is already available to validate connectivity. If the status is healthy, no action will be required after the change.

You can verify this from the Cloud Administration Console by navigating to Platform > Identity Router and expanding the Identity Router section to view the status indicators. For more information, refer to this IDR Advisory.

 

 

Common User Schema Migration Dashboard – Coming Soon (September 2026)

In August 2026, all RSA Cloud Access Service (CAS) deployments will start migrating from using each Identity source’s native user schema in policies, applications, and other CAS features, to a Common User Schema, which will make CAS deployments easier to manage. If there are no issues in a deployment that prevent migration, the migration process will be automatic, similar to an Identity Router (IDR) update. You will also be able to manually trigger the schema migration before the scheduled migration date.

The Cloud Administration Console will include a Common User Schema Migration Dashboard, available from the homepage, that will show you when the deployment will be scheduled for automatic migration and all the user schema attribute name changes in every CAS feature. If there are any issues that block migration, a list of all required administrator actions to unblock migration will be displayed.

 

 

Third-Party Integrations from RSA Ready

The following integrations were recently completed or certified by RSA through the RSA Ready Technology Partner Program. For the complete catalog of Implementation Guides, see RSA Ready Integrations on the RSA Community.

  • New and Updated Integrations for ID Plus
    • AWS IAM Identity Center (SAML)
    • Citrix Netscaler (SAML)
    • Lexmark eSF Application (API/Authentication Manager)
    • PingFederate (SAML, OIDC, API/Authentication Manager)

 

 

Upcoming End of Primary Support (EOPS) Details

The following table provides a summary view of the RSA products reaching the end of support within the next six months:

 

Product

Version

EOPS Date

Authenticator for iOS & Android

4.5

October 2026

MFA Agent for Microsoft Windows

2.3.3/2.3.4/2.3.5

December 2026 

 

 

Fixed Issues

The following table lists the issues that are fixed for this release:

 

Fixed Issue

Description

NGX-237077

Resolved an issue where a customer received the partial success message "Failed to publish to cloud service. Successful publish to identity router." when trying to publish their changes.

NGX-235002

Resolved an issue affecting SAML authentication for Prisma Access Browser on iOS devices. Users can now successfully authenticate using SAML on iOS, and the authentication flow now completes successfully after users share their location. Authentication events are also correctly logged in the User Event Monitor, providing a consistent experience across supported platforms.

NGX-231956

Resolved an issue where the overall Publish Status and IDR Status were incorrectly displayed as Partial Success instead of Success for some customers with previously successful publish status.

NGX-235568

Resolved sign‑in errors in federated authentication caused by the RSA session cookie being blocked as a third‑party cookie due to browser security restrictions.

 

 

June 2026 - Cloud Access Service 

Cloud Access Service Updates

The following subsections outline the new and enhanced features of the Cloud Access Service (CAS).

Agent Inventory Report Accuracy Improvements

The Agent Inventory report has been enhanced to improve reporting accuracy in environments with pre-installed Windows MFA agents. Updated logic now recognizes systems that share the same software ID, ensuring more complete and accurate inventory visibility across deployments. This enhancement provides more reliable inventory data for improved operational visibility and reporting accuracy.

 

Migrated to a New Device Option for Credential Recovery

The Credential Recovery list now includes the Migrated to new device option. You can now accurately report Migrated to new device as the reason for Credential Recovery, making it easier for administrators to audit Credential Recovery usage related to device upgrades. 

 

ID Verification Support for User Authentication

ID Verification methods are now supported for user authentication. This enhancement enables you to authenticate during primary authentication or step-up authentication, including Live Verify scenarios. This capability helps improve authentication flexibility and provides an additional verification option for users who can and cannot access their registered authenticator device. You can configure and view this feature while creating or editing a policy in the Primary Authentication section by navigating to the Cloud Administration Console > Access > Policies.

 

Note: This feature is available in private preview. To request access to this feature, contact your RSA account manager or customer support.

 
 

Simplified User Attribute Synchronization UI for Active Directory (AD) and LDAP Identity Sources

Legacy configuration options for synchronizing user attributes from AD and LDAP identity sources required an administrator to enable synchronization through three separate configuration settings. With this enhancement, synchronization settings are condensed.
In the Cloud Administration Console, the following options are now enabled automatically:
  • Identity Source > User Attributes tab> Synchronize the selected attributes with the Cloud Authentication Service (required for CAS to function)
  • Identity Source > Synchronize User Attributes tab> Synchronize user attributes (these attributes are now controlled by the checkbox in the Policies column. )
Note: These changes are applied automatically  when no pending publish changes exist. 
 

Event Monitor Navigation Updates

Event Monitor pages are now consolidated under Users > Reports to simplify navigation and improve accessibility within the Cloud Administration Console.

The following navigation items are removed:

  • Users > User Event Monitor
  • Platform > Admin Event Monitor
  • Platform > System Event Monitor

You can now access all three Event Monitors from Users > Reports.

Use of Company-Specific URLs Required

As a follow-up to the November 2024 Release Announcement, support for non-company-specific URLs will be permanently shut down on July 30, 2026. You must update all affected service URLs to use your designated company-specific URLs before this date. For more information, see the Company-Specific Administrative URLs Update Instructions and Permanent Shutdown of Non-Company-Specific URLs. You must use your designated company-specific URLs for all access, including API interactions, Authentication Manager (AM) configurations, SCIM configurations, or redirected URLs from identity providers (IdPs). Access through non-company specific URLs is not yet blocked; however, when it is blocked, it results in loss of functionality (for example, https://access.securid.com or https://na2.access.securid.com).

To ensure uninterrupted access, you should promptly verify that all connectivity is routed through the appropriate company-specific URLs and update their configurations as needed. If your Identity Router (IDR) software version is earlier than 12.22.0.0.32, you must Update Identity Router Software to the latest version to avoid any disruptions when non-company-specific URLs are permanently shut down.  

Starting with the June 2025 release, a banner warning appears for 24 hours whenever a non-company-specific URL is used for the following:

  • Logging in to the Cloud Administration Console via password or third-party IdP.
  • Accessing the Cloud Administration REST APIs.

In addition, an audit event is logged once per day whenever a non-company-specific URL is used for third-party IdP login and Cloud Administration REST API. You can view this event from the Cloud Administration Console by navigating to Platform > Admin Event Viewer.

As part of the effort to permanently shut down non-company-specific URLs, the Software and Adapter Repository URLs used by IDRs will be updated to company-specific URLs starting with the June release. As a result, customers are advised to review their network configurations and ensure that the new URLs are whitelisted, if applicable.

Old URL format:

New URL format (Whitelisted):

GOV Deployment

Old URL format:

New URL format (Whitelisted):

A Status Monitor is already available to validate connectivity. If the status is healthy, no action will be required after the change.

You can verify this from the Cloud Administration Console by navigating to Platform > Identity Router and expanding the Identity Router section to view the status indicators. For more information, refer to this IDR Advisory.

 

Upcoming End of Primary Support (EOPS) Details

The following table provides details of the RSA products reaching the end of support within the next six months:

ProductVersionEOPS DateExtended Support Level 1/Level 2
RSA Authentication Manager 
8.7 SP1 
June 2026June 2027/ June 2028 

 

Authenticator for iOS & Android

 

4.4

June 2026

 

4.5

October 2026

 

MFA Agent for Microsoft Windows

2.3.3/ 2.3.4/ 2.3.5

December 2026 

 

 

Fixed Issues

The following table lists the fixed issues for this release:

Fixed IssueDescription
NGX-227053Fixed an issue where customers received a 403 response when attempting to save updates to an Identity Source. 
NGX-228626Fixed an issue where DS100 FIDO registration failed in My Page.
NGX-228798Fixed an issue where incorrect encoding of the FreshestCRL extension in the provided CRL prevented Microsoft Entra ID from successfully validating agent certificates against the CRL.
NGX-228900Fixed an issue where a customer was unable to edit or modify attributes for local users.
NGX-229025Fixed an issue where customers received email notifications to upgrade Identity Routers (IDRs) even though their IDRs were already upgraded. 
NGX-230207Fixed an issue where passwordless authentication failed on Entra-joined Windows 11 devices due to a certificate provisioning error.

 

May 2026 – Cloud Access Service Updates

The following subsections outline the new and enhanced features of the Cloud Access Service (CAS).

IP Address in User Event Monitor Logs

User Event Monitor logs now include the IP address for authentication events. In the User Event Monitor, REMOTE_IP is available in the authentication details for the following events:

  • 20300 (error): Multifactor authentication failed to initiate.
  • 20301 (notice): Multifactor authentication initiated.

 

Allow and Configure iShield Authenticators

You can allow or deny specific FIDO2 authenticators that users can register and use for authentication. Previously, iShield authenticators were always whitelisted and automatically allowed for authentication, and you could not manage it.
Swissbit iShield Key 2 is now available as a new authenticator option under Access > FIDO Authentication, where you can allow access and configure conditions.

 

Network Zone Replaces Trusted Network Attribute in Policies

As part of the condition attributes for access policies, the Trusted Network attribute is no longer available and has been replaced by the Network Zone attribute, which supports assigning one or more network zones. Your existing Trusted Network rules are now migrated to Network Zone attribute rules. Additionally, in the Cloud Administration Console, go to Access > Networks to manage Access Policy and IDR Network Zones. These network zones are no longer system defaults and can now be edited or deleted.

 

Use of Company-Specific URLs Required

As a follow-up to the November 2024 Release Announcement, non-company-specific URLs will soon be removed. You must update the affected service URLs immediately. For more information, see the Company-Specific Administrative URLs Update Instructions. You must use your designated company-specific URLs for all access, including API interactions, Authentication Manager (AM) configurations, SCIM configurations, or redirected URLs from identity providers (IdPs). Access through non-company specific URLs is not yet blocked; however, when it is blocked, it may result in loss of functionality (for example, https://access.securid.com or https://na2.access.securid.com ).

To ensure uninterrupted access, you should promptly verify that all connectivity is routed through the appropriate company-specific URLs and update their configurations as needed. If your Identity Router (IDR) software version is earlier than 12.22.0.0.32, you must Update Identity Router Software to the latest version to avoid any disruptions when non-company-specific URLs are deprecated.  

Starting with the June 2025 release, a banner warning appears for 24 hours whenever a non-company-specific URL is used for the following:

  • Logging in to the Cloud Administration Console via password or third-party IdP.
  • Accessing the Cloud Administration REST APIs.

In addition, an audit event is logged once per day whenever a non-company-specific URL is used for third-party IdP login and Cloud Administration REST API. You can view this event from the Cloud Administration Console by navigating to Platform > Admin Event Viewer.

As part of the effort to deprecate non-company-specific URLs, the Software and Adapter Repository URLs used by IDRs will be updated to company-specific URLs starting with the June release. As a result, customers are advised to review their network configurations and ensure that the new URLs are whitelisted, if applicable.

Current URL format:

New URL format (to be whitelisted):

GOV Deployment

Current URL format:

New URL format (to be whitelisted):

A Status Monitor is already available to validate connectivity. If the status is healthy, no action will be required after the change.

You can verify this from the Cloud Administration Console by navigating to Platform > Identity Router and expanding the Identity Router section to view the status indicators. For more information, refer to this IDR Advisory.

 

Upcoming End of Primary Support (EOPS) Details

The following table provides details of the RSA products reaching the end of support within the next six months:

ProductVersionEOPS DateExtended Support Level 1/Level 2
Authenticator for Windows

6.2.2

May 2026

 
MFA Agent for Microsoft Windows 
2.3.1/ 2.3.2 
May 2026No
RSA Authentication Manager 
8.7 SP1 
June 2026June 2027/ June 2028 

 

Authenticator for iOS & Android

 

4.4

June 2026

 

4.5

October 2026

 

 

 

Identity Router (IDR) 12.25.0.0.9 Now Available

The IDR 12.25.0.0.9 release is now available. We recommend that all customers upgrade to this version.

Identity Router Update Schedule and Versions

Identity routers will be updated according to the following schedule. Downloading the new identity router image when you deploy new identity routers ensures that you benefit from the latest security improvements.

DateDescription

ANZ /CND / SGP: May 26, 2026  
EU/ JPN: May 27, 2026  

US/ GOV/ IN: May 28, 2026  

Updated identity router software is available to all customers.

Default: Saturday, June 20, 2026 

Default date when identity routers are scheduled to automatically update to the new version unless you modify the update schedule or update manually.

Last: Saturday, July 18, 2026 

If you have postponed the default date, this is the final day on which updates can be performed.

Enforced: July 25, 2026

If the Identity Router (IDR) is not upgraded after the last permitted date for any reason, RSA will automatically initiate a mandatory upgrade seven days later. You will receive an email notification and a Cloud Administration Dashboard alert with the scheduled update date.

April 2026 - Cloud Access Service

Cloud Access Service Updates

The following subsections outline the new and enhanced features of the Cloud Access Service (CAS).

 

Credential Recovery Support for Multi-Credential Authenticators

CAS now supports credential recovery for authenticators that store multiple credential types for a single user on the same device. Examples include OTP and FIDO credentials in the RSA Authenticator app, SecurID OTP and FIDO credentials in the DS100, and HOTP and FIDO credentials in the iShield and Yubikeys. If you use supported combinations of FIDO and OTP authenticators, you can now replace your device through Credential Recovery self-service. This enhancement allows you to recover multiple credentials tied to a single device without manual intervention, reducing help desk dependency and associated administrative costs.

 

Configurable Live Verify Session Time Limit

The Live Verify configuration is now enhanced to allow the session time limit to be set from 5 to 15 minutes, in 1-minute increments, giving users additional time to successfully complete the verification process. The configured time limit applies to sessions initiated from the User Management page and via the API. To configure the time limit, navigate to Cloud Administration Console > My Account > Company Settings > Sessions & Authentication.

 

User-Initiated Unified Logout for My Page SSO Applications (General Availability) 

User-initiated Unified Logout is now supported for My Page SAML and OIDC SSO applications, allowing you to sign out of all active participating Unified Logout application sessions with a single action. CAS centrally manages active sessions, simplifying session management, improving security, and supporting compliance with industry standards.

  • To manage session lifetime for My Page, navigate to Cloud Administration Console > Access > My Page, select the Applications tab, and update the settings in the User Sessions section. The Session Duration setting in this section controls the session duration for all SAML and OIDC SSO applications managed by the My Page SSO Session Manager. In SAML, the session timeout is defined by the SessionNotOnOrAfter attribute. In OIDC, the session timeout is defined by the session_expiry claim in the ID token.
  • To configure Unified Logout for SAML applications, navigate to Cloud Administration Console > Applications > Applications, select the SAML application, and update the SAML Unified Logout Configuration section on the Connection Profile tab.
  • To configure Unified Logout for OIDC applications, navigate to Cloud Administration Console > Applications > Applications, select the OIDC application, and update the Unified Logout Configuration section on the Connection Profile tab.

Note: The My Page session duration centrally controls the session lifetime for both OIDC and SAML applications.

 

Common User Schema Preparation and Attribute Refresh Updates

CAS now automatically performs a Refresh Attributes action on all existing AD and LDAP identity sources to ensure the user schema (list of user attributes) is available in CAS. When creating a new AD or LDAP identity source, CAS attempts to automatically perform a Refresh Attributes action on the User Attributes tab in Cloud Administration Console > Users > Identity Sources, and the action must succeed before the identity source can be saved. If network, credential, or other issues prevent connection to the identity source, you must go to the Identity Source Details tab and resolve the issue.

Note: CAS will transition to a common user schema (a consistent set of user attributes) in a future release. This update prepares for that change by introducing enhancements to how Active Directory on-premises and LDAP identity sources are configured.

 

Upcoming End of Primary Support (EOPS) Details

The following table provides details of the RSA products reaching the end of support within the next six months:

ProductVersionEOPS DateExtended Support Level 1/Level 2
MFA Agent for Microsoft Windows 
2.3.1/ 2.3.2 
May 2026No
Authenticator for Windows 
6.2.2 
May 2026 
Authenticator for iOS & Android 
4.4 June 2026No
RSA Authentication Manager 
8.7 SP1 
June 2026June 2027/ June 2028 

 

Fixed Issues

The following table lists the fixed issues for this release:

Fixed IssueDescription
NGX-222581Customer requests to CAS for administrative operations (for example, looking up a user or retrieving user devices) were intermittently blocked with a 429 response during periods of high load.
NGX-223465In IDR Audit Logging, when selecting the Output Type as Send to syslog, the Protocol selection is reversed. Selecting TCP applies UDP, and selecting UDP applies TCP. 
NGX-225890

Resolved an issue where users intermittently encountered "UNKNOWN USER" errors when one directory server was unavailable, even though other directory servers were healthy to serve the request. The identity router (IDR) now correctly continues validation against available directories, and customers need to publish the IDR to apply the fix. 

Known Issue

The following table lists the known issue in this release:

Known IssueDescription
NGX-226702When a network zone includes a trusted or restricted network with a blank CIDR and is used by application access policies evaluated via IDR, access may be incorrectly allowed or blocked respectively. This issue is fixed in the June release. For earlier releases, publishing resolves the issue. 

 

Previous Release Notes: Cloud Access Service and Authenticators Historical Release Notes

Related Articles

Trending Articles

Don't see what you're looking for?