To improve API security, Non-Employee Risk Management will begin requiring an explicit Non-Employee Risk Management scope on Personal Access Tokens (PATs) starting September 15, 2026.
Today, administrator accounts can access Non-Employee Risk Management APIs with the default sp:scopes:default scope. After this change, Non-Employee Risk Management API access must be granted explicitly via the nerm:general:manage scope.
Required Action
Review your PATs and ensure the required nerm:general:manage scope is enabled. If the scope is enabled,no further action is needed.
In Identity Security Cloud, open User Preferences by clicking the person icon in the top-right corner, then select Preferences.
Hi @mwoodberry, thank you for the clear announcement (including a pop-up in the solution itself).
While making the changes, I noticed a bug in your UI.
If the PAT already has an end date, and you then change the scope and hit save, you will lose a day in this end date.
Just in case this issue is related to errors in rounding down to days and timezones are relevant: I have observed this using CEST.
Ahh and a second bug, observed on a different tenant: If I create a new PAT, and I leave the expiration date alone (keep the value suggested by SailPoint), it won’t be displayed on the UI afterwards. If I do give it a different value, it will also not display it. In both cases I am not getting a “Are you sure you mean to have no end date?” warning.
Hi Angelo. Thank you for reporting those issues. Can I ask are you on the new admin page trying to create a PAT when you see this or on your profile submenu page under preferences? And if on the admin page, how many pats do you currently have that are created by you? I’m going to pass this along to our engineering team for troubleshooting.
Right now you can do both. You can use the API key which is displayed (in plain text) in NERM side, but you can already use the PAT from ISC to call the NERM APIs.
Thank you for looking into it @BobCrosley! I was only doing this from the preferences menu.
Just checked it:
The admin page seems broken. It only shows the first 25.
It does not allow me to go to the next pages.
I can’t filter on identity or search by name (for example searching for all PATS whose name/description contains the word Postman.)
I can’t sort by the timestamps created, updated, expiration and last used.
The client id and owner id are missing the copy button that you are seeing when you search for identities in search.
The owner name column has static text and no clickable links to immediately open the identity (or scroll-click/middle-mouse-click if you want to open the identity in a new tab).
Changing the page size from 25 to 50 or 100 does not work either.
The owner name specifies the uid of the user (which looks neat in the default instance used by SailPoint when testing functionality, but is missing a nice displayName for tenants where the uid is a number instead, which should perhaps be there as well).
The scopes column is way too wide, just because we have PATS that have many granular scopes (best practice) rather than the sp:scopes:all one. Perhaps a better way can be made here, where it either wraps, or breaks with dots, allowing us to slide the column size as desired, or double click it to expand it to max size ourselves.
Can’t filter on scope (for example to find all the ones that point to sp:scopes:all).
Bulk edit only seems to work on adding/changing the expiration date. Not on adding/removing scopes.
How can you delete others Personal Access Tokens as admin in the UI? Note that this is already possible through the API.
Hello @mwoodberry Thanks for the update. Could you please clarify whether this change also impacts IdentityIQ (IIQ) to NERM integrations? Specifically, if IIQ is invoking NERM APIs using Personal Access Tokens, will those integrations also require the nerm:general:manage scope to be added to the PAT, or is this change applicable only to Identity Security Cloud (ISC) integrations?
