Virtual Appliance (VA) release notes might contain references to SailPoint software and Flatcar operating system updates that SailPoint will automatically apply.
SailPoint Software
2026.9.3 - Version 2.35, CCG 1312
Enhancements
| Product | Feature enhancements |
|---|---|
| Connectivity - Delimited File | The Delimited File connector now supports SSH key authentication for SFTP and TLS client certificate authentication for FTPS, in addition to existing Basic (username/password) authentication. |
| Connectivity - Generic SDIM | The Generic Service Desk Integration Module now supports the Client Credentials grant type for OAuth 2.0 authentication. |
| Connectivity - SAP SuccessFactors LMS | The SuccessFactors LMS connector now support OAuth 2.0 with SAML Bearer Assertion authentication when BizX integration is enabled with the SuccessFactors platform. |
| Connectivity - IQService | The IQService GMSAPasswordRetrievalHandler service now only executes over Transport Layer Security (TLS). If TLS is enabled in your environment, you must provide consent to run this service. |
| Connectivity - IQService | The IQService ScriptExecutor service now only executes if user consent has been provided. You must explicitly grant consent to run this service. |
Fixes
| Product | Issue ID | Fixes |
|---|---|---|
| Connectivity - Active Directory | CONETN-5456 | The Active Directory connector now supports retrieving the numeric value of msDS-SupportedEncryptionTypes for gMSA accounts during aggregation. To enable this, set gmsaMsDSSupportedEncryptionTypesInNumeric to true in the source configuration. For more information, refer to Additional Configuration Parameters. |
| Connectivity - SAP HR/HCM | CONETN-5477 | Fixed an issue where the SAP HR connector failed account aggregation when the PersonIDExternalattribute was included in the account schema. |
| Connectivity - Siebel | CONETN-5508 | The Oracle ERP - Siebel connector now supports updating the entitlement responsibilities containing special characters. |
| Connectivity - SAP Analytics Cloud | CONETN-5492 | The SAP Analytics Cloud connector now updates custom.idpUserId to match the email attribute during attribute sync. |
| Connectivity - Oracle HCM Cloud | CONETN-5525 | The Oracle HCM Cloud connector now supports the Published-Min and Published-Max filters derived from lastAggregationDate when the publishForEffTermAssignment parameter is set to true in the application configuration during delta aggregation. |
| Connectivity - SAP Direct | CONETN-5491 | The SAP Direct connector no longer aggregates duplicate role entitlements from SAP Central User Administration (CUA) systems when the same role is assigned with different validity dates. |
| Connectivity - Workday Accounts | CONETN-5410 | Fixed an issue where the Workday Accounts connector restarted aggregation after a Page 1 must be requested first error during account aggregation. The connector now retries the page 1 request and resumes from the point of failure. |
| Connectivity - Microsoft Entra ID | CONETN-5516 | The Microsoft Entra ID connector now skips the associated resources API call when aggregating system-assigned managed identities (SMIs), as SMIs do not support this operation. |
| Connectivity - Microsoft Entra ID | CONETN-5521 | The Microsoft Entra ID connector now respects the CIEM license when aggregating cloud objects such as subscriptions and management groups. |
| Connectivity - Microsoft Entra ID | CONETN-5518 | The Microsoft Entra ID connector no longer returns 400 or 403 errors when aggregating system-assigned managed identities. |
| Connectivity - Okta | CONETN-5543 | The Okta connector aggregation filter fields in the Admin UI now support up to 2028 characters instead of 256. |
| Connectivity - REST WebServices Connector | CONETN-5547 | The Web Services connector now retries failed operations during server-side errors based on the value set in the maxRetries source configuration attribute. |
| Connectivity - Cloud Connector Gateway (CCG) | CONETN-5531 | The Cloud Connector Gateway now retries credential provider source lookup requests to Identity Security Cloud. This prevents transient failures during credential provider name resolution from failing the entire credential fetch operation. |