Highlights
- Admin Elevation Policy for Windows
- Complete Event Export to Logging Adapters
- Consistent Event Views Throughout the Admin Console
- Safeguards Before Biometric Enrollment Deadlines Take Effect
- Certificate Rotation for Entra ID Federation
- Fewer Unexpected Un-Enrollment Emails
- Graceful FIDO2 Cleanup for Departed Users
- Optional 6-Digit Access Code
- Device Detection for PingFederate
- Bug Fixes
Enhancements
Admin Elevation Policy for Windows
- You can now define an Admin Elevation policy in the Admin Console so administrators can approve UAC, Run As, and RDP on any Windows machine without enrolling a second account on it. The policy lives on its own tab alongside Shared Workstation, and you control who it applies to by computer entitlement group, network, and authorized users or directory groups. Admins verify themselves with the same factors you already use for Shared Workstation — user identifier and PIN, TruFace, badge, the TruU mobile app, or a workflow. Elevation is refused with a clear error when the computer or the user falls outside the policy. (Coming in version 26.4 of Windows Authenticator)
Complete Event Export to Logging Adapters
- Your S3, Azure Blob, Webhook, and Secure Download logging adapters now export every event and audit log entry, so nothing is silently dropped because a type was never selected or was missing from the list. The event type selector has been removed from the adapter forms, and existing adapters start exporting everything after the upgrade regardless of what they had saved.
Consistent Event Views Throughout the Admin Console
- Every embedded event list now uses the same table as the Events AI page, filtered to whatever you are looking at. Columns, event labels, status badges, row expansion, and pagination all behave identically, so the events you see for an object match the Events page exactly. Previously these views were built from separate components and could show different data for the same object.
Safeguards Before Biometric Enrollment Deadlines Take Effect
- When you enable TruU Biometrics Permission on a policy whose enrollment deadline has already passed, you now get a warning and an explicit confirmation step before anything happens. This prevents users from being un-enrolled the moment the toggle is switched on, and prompts you to re-upload the policy with a workable deadline instead.
Certificate Rotation for Entra ID Federation
- Entra ID adapters running in manual mode can now stage a new certificate and complete the rollover from the Admin Console. Staging the certificate before cutting over means your federation keeps working throughout the rotation. Adapters in automatic mode are unchanged.
Fewer Unexpected Un-Enrollment Emails
- Users are no longer emailed when one of their devices is removed by automatic inactivity cleanup. Previously someone who reinstalled or re-enrolled the authenticator could receive a message saying the device they were actively using had been un-enrolled, which looked like a fault.
Graceful FIDO2 Cleanup for Departed Users
- When a user no longer exists in your Entra tenant, TruU now stops attempting to delete their FIDO2 keys and marks the record as cleaned up. Cleanup for existing users is unchanged, and transient directory errors are still retried. This respects your off-boarding process instead of retrying indefinitely.
Optional 6-Digit Access Code
- You can now request TruU to turn off the 6-digit access code that mobile users can enter as an alternative to scanning a QR code. When it is disabled, the code is removed from the sign-in page entirely rather than hidden, and the matching endpoint stops responding. The code remains available by default.
Device Detection for PingFederate
- TruU has released a new PingFederate component that can check whether a user’s computer has a TruU authenticator present before deciding how to sign them in, so users with TruU installed get the seamless path and everyone else falls through to your configured alternative. You can configure which ports are scanned, and the adapter ships with a generic loading screen you can restyle.
Bug Fixes
- Fixed an issue where Windows computers enrolled with the FIDO2 option were not reporting as enrolled.
- Fixed an issue where the authentication request always reported biometrics as required, regardless of the authentication policy configured in the Admin Console, so clients prompted for a biometric even when the policy specified PIN.
- Fixed an issue where face sign-in on a Shared Workstation could hang indefinitely on the “Preparing face detection” screen.
- Fixed an issue where the Enroll TruU Face window could shrink during the video check, preventing the user from completing registration.
- Fixed an issue where a user whose face image matched more than one account generated a misleading “multiple users” event and no event for the successful sign-in that followed.
- Fixed an issue where no failure event was recorded when a user attempted face authentication that the policy did not allow.
- Fixed an issue where Factor Create and Factor Delete events stopped appearing in the Admin Console.
- Fixed an issue where registration, application, computer, and server policies could be saved without an entitlement or directory group assigned.
- Fixed an issue where entitlements already assigned to a policy would disappear from it intermittently.
- Fixed an issue where the client update policy defaulted to the oldest available version of the desktop authenticator instead of the newest.
- Fixed an issue where users signing in to Outlook, Teams, and other integrated applications were told to finish authentication in the TruU app, but no approval request appeared. An action card is now placed in the app.
- Fixed an issue where a single sign-in through a mobile browser prompted the user to approve it twice.
- Fixed an issue where the “My Computer” option displayed an endless spinner the first time it was used in a Shared Workstation session.
- Fixed an issue where single sign-on through the “My Computer” option was recorded as a certificate sign-in on the Events page.
- Fixed an issue where a Windows computer without a TruU desktop authenticator could not reach any authentication method choices when the user had a desktop enrollment on another machine.
- Fixed an issue where the “Not you?” link on the sign-in page looped back to the cached user instead of letting a different user sign in.
- Fixed an issue where an “Invalid credentials” error could appear during authentication because a user’s display name had overwritten their user principal name.
- Fixed an issue where appending biometrics to an existing enrollment reported that the required authentication method could not be found.
- Fixed an issue where signing in with a passkey still awaiting approval failed without showing the user any explanation.
- Fixed an issue where the Continue button on the “Enroll with TruU” screen appeared unresponsive after a network interruption. A retry screen is now shown instead.
- Fixed an issue where enrollment QR codes shown in the User Portal were too dense to scan reliably from a phone. The code is now larger.
- Fixed an issue where Mac computers could not re-register when more than one record existed for the same serial number, which created a duplicate record on each attempt.
- Fixed an issue where a device in a locked state received a stale error on authenticated calls instead of the status response that tells the client what to do next.
- Fixed an issue where clearing the gzip compression option on a Webhook Event Logging adapter left the compression header in place.