Findings and Decoys docs

.claude/skills/docs-writing.md

@@ -111,6 +111,7 @@ Sidebar grouping in `docs.json` is independent of folder structure. You can visu
 - **Optional sections**: Use `## Optional: Section name` for entire optional tasks or sections
 - **UI elements**: Bold formatting (**New profile**)
 - **Navigation paths**: **Admin** > **Access profiles** > **New profile**
+- **Kebab/overflow menus**: Always write as the **...** (more actions) menu — e.g., "click the **...** (more actions) menu and select **Delete**." This is the established pattern across the docs; don't substitute "kebab menu," "more options," a middle-dot glyph (···), or a vertical ellipsis (⋮).
 - **Terminology**: Use product-specific terms consistently (access profile, entitlement, campaign)
 - **Clarity**: Be specific, cite sources, avoid vague claims
 - **Simplicity**: Keep examples practical, avoid excessive options

docs.json

@@ -141,7 +141,8 @@
                 "group": "Credentials & vaulting",
                 "pages": [
                   "product/admin/vaults",
-                  "product/admin/secret-sharing"
+                  "product/admin/secret-sharing",
+                  "product/admin/decoys"
                 ]
               },
               {
@@ -307,7 +308,8 @@
             "pages": [
               "product/admin/query",
               "product/admin/inventory",
-              "product/admin/external-insights"
+              "product/admin/external-insights",
+              "product/admin/findings"
             ]
           },
           {

product/admin/decoys.mdx

@@ -0,0 +1,88 @@
+---
+title: "Decoys"
+og:title: "Decoys"
+og:description: "Plant tripwire credentials that look real but grant no access, and turn any attempt to use one into a Critical finding."
+description: "Plant tripwire credentials that look real but grant no access, and turn any attempt to use one into a Critical finding."
+---
+{/* Editor Refresh: 2026-08-13 */}
+
+<Warning>
+**Early access.** This feature is in early access, which means it's undergoing ongoing testing and development while we gather feedback, validate functionality, and improve outputs. Share feedback with the C1 Support team.
+</Warning>
+
+Plant a credential that looks real but grants no access. Any attempt to use it is a high-confidence signal that someone has stolen access. Decoys are tripwire credentials. Plant them where an attacker would look — env files, CI variables, secret managers. Using one raises a [Critical finding](/product/admin/findings).
+
+Managing decoys requires the **Super Administrator** role in C1. Go to **Settings** > **Security** > **Decoys** to get started.
+
+## Plant a decoy
+
+C1 supports five decoy types, each shaped to sit alongside a different kind of real credential:
+
+| Decoy type | What it plants |
+| :--- | :--- |
+| Human user credential | Client ID + secret planted under an existing human user. |
+| Service principal credential | Client ID + secret planted under an existing service principal. |
+| Connector client credential | Client ID + secret shaped like a connector credential. C1 places it under your tenant's C1 app — there's no app or connector to choose. |
+| Workload federation trust | A trust under an existing workload federation provider. Any signature-valid JWT matching its condition triggers a finding. |
+| Access token | A long-lived API access token issued for an existing user. |
+
+Every decoy type except a connector client credential plants under an existing object — a human user, a service principal, or a registered workload federation provider. C1 places connector client credentials automatically, with nothing to choose. For every other type, make sure the object you need already exists before you start.
+
+<Steps>
+<Step>
+Go to **Decoys**.
+</Step>
+<Step>
+Click **Add decoy**.
+</Step>
+<Step>
+Choose a decoy type.
+</Step>
+<Step>
+For a workload federation trust, also set a **Condition expression** — a CEL expression evaluated against the presented JWT's claims. For example: `claims.sub.startsWith("repo:acme/fake-infra:")`.
+</Step>
+<Step>
+Set a **Display name**.
+</Step>
+<Step>
+**Optional.** Set a **Description** to remind yourself where you planted it.
+</Step>
+<Step>
+**Optional.** Add **Annotations** — key/value tags for filtering, reporting, and integrations, for example `team = platform` or `owner = alice`. Annotations carry over onto the finding a decoy produces. A [routing rule](/product/admin/findings#routing-rules) can then condition on them.
+</Step>
+<Step>
+Click **Plant decoy**.
+</Step>
+</Steps>
+
+C1 shows the decoy's credential material — a client ID and secret, an access token, or a workload federation trust ID, depending on the type. It also shows a fingerprint.
+
+<Warning>
+This is the only time C1 shows this credential material. Save it now: copy each value or download the `.env` file. You'll need to confirm you've saved it before this screen closes. If you lose it, rotate the decoy to get a new one.
+</Warning>
+
+Save the fingerprint alongside wherever you place the secret. It's how you'll recognize which planted copy fired when you see the resulting finding.
+
+## Manage a decoy
+
+Open a decoy from the list to edit its display name, description, or annotations, or to take one of the following actions from the **...** (more actions) menu:
+
+- **Disable** — stops the decoy from triggering findings without deleting it. Past findings stay in history. You can re-enable it at any time.
+- **Rotate** — mints a new secret for the decoy and invalidates the old one. C1 shows the new credential material once, the same as when you first planted it.
+- **Delete** — removes the decoy from the list and stops it from triggering findings. Past findings stay in history.
+
+## What happens when a decoy is used
+
+Any attempt to authenticate with a planted decoy credential triggers two things. Whoever presented it gets an ordinary authentication failure — there's no way to tell a decoy apart from a real bad credential. C1 also records the attempt.
+
+If the **Decoy credential used** [finding type](/product/admin/findings#turn-on-finding-types) is turned on, C1 raises a Critical finding the moment the decoy is used. Repeated use of the same decoy doesn't create duplicate findings — it's tracked as recurrences of the same finding. If the finding had been resolved, it reopens.
+
+<Note>
+Turning off the **Decoy credential used** finding type stops the finding from being created. C1 still records every use to your audit log regardless. Quieting the finding doesn't cost you the trail.
+</Note>
+
+The resulting finding includes an **Attempts** table with the forensic detail you need for incident response — timestamp, source IP, user agent, and endpoint for every attempt. Each row also includes the raw event detail behind it.
+
+If a decoy's secret turns up published somewhere public — a paste site, a public repository — C1 raises a separate **Decoy publicly exposed** finding. The finding includes the scanner that found it, where it was found, and when.
+
+See [Findings](/product/admin/findings) for how to turn on these finding types and build rules around them.

product/admin/findings.mdx

@@ -0,0 +1,161 @@
+---
+title: "Findings"
+og:title: "Findings"
+og:description: "Detect and act on the things you care about in your organization's access data, from unowned service accounts to exposed credentials."
+description: "Detect and act on the things you care about in your organization's access data, from unowned service accounts to exposed credentials."
+---
+{/* Editor Refresh: 2026-08-13 */}
+
+<Warning>
+**Early access.** This feature is in early access, which means it's undergoing ongoing testing and development while we gather feedback, validate functionality, and improve outputs. Share feedback with the C1 Support team.
+</Warning>
+
+Stop hunting for risk by hand. Point C1 at the conditions you care about — unowned service accounts, exposed credentials, misclassified identities, and more. It surfaces them as findings the moment they occur, and rules let you triage, escalate, or resolve them automatically. C1 checks for these conditions every time a connector syncs. It reports back the moment it detects a match.
+
+Go to **Identity security** > **Findings** to get started.
+
+## Turn on finding types
+
+C1 ships with a catalog of built-in finding types, grouped by category. None are required — you choose which conditions matter to your organization.
+
+<Note>
+Findings don't appear until you turn on the finding types you want C1 to detect. There's no separate "create" or "new" control — everything starts from **Findings settings**.
+</Note>
+
+<Steps>
+<Step>
+From any tab in **Findings**, click the **settings** (gear) icon in the top right.
+</Step>
+<Step>
+In **Findings settings**, toggle on the finding types you want C1 to detect. Each type shows a short description of what it looks for.
+</Step>
+<Step>
+Click **Save changes**.
+</Step>
+</Steps>
+
+C1 starts creating findings of the types you turned on the next time each connector syncs.
+
+<Note>
+Turning off a finding type stops C1 from creating new findings of that type. Findings of that type that are already open stay open — nothing re-checks them, so they won't resolve automatically.
+</Note>
+
+### Finding catalog reference
+
+The following finding types are available today, grouped by category:
+
+| Category | Finding type | Detects |
+| :--- | :--- | :--- |
+| Ownership | Unowned non-human identity | Non-human identities with no assigned owner. |
+| Ownership | Unowned service account | Service accounts with no assigned owner. |
+| Ownership | Deactivated owner | Accounts and resources whose owner has been deactivated. |
+| Identity resolution | Similar username match | App accounts that look like they belong to a known identity. |
+| Identity resolution | Service account misclassification | Accounts labeled human that behave like service accounts. |
+| Credentials | Decoy credential used | A planted [decoy credential](/product/admin/decoys) was used to attempt access. |
+| Credentials | Unused secret | Secrets that have gone unused past the inactivity threshold. |
+| Credentials | Credential publicly exposed | Credentials found published outside your organization. |
+| Credentials | Decoy publicly exposed | A planted [decoy credential](/product/admin/decoys) was found published publicly. |
+| Credentials | Expiring credential | ConductorOne's own service principal credentials that are within 30 days of expiring, or have already expired. |
+| Configuration | Anomaly detection disabled | Connectors running with sync anomaly detection turned off. |
+
+## Work with a finding
+
+Click a finding from the **Overview** or **All findings** tab to open its detail view, which includes:
+
+- **Evidence** — why C1 flagged this finding, including any confidence score.
+- **Activity** — an audit trail of everything that's happened to the finding, including when it was created, when routing rules evaluated against it, and any evidence updates.
+
+From the detail view, you can take one of the following actions on a finding:
+
+- **Accept risk** — formally acknowledge the finding as a known risk. Requires a justification and an expiration date. The finding reopens automatically when the acceptance period ends.
+- **Suppress** — permanently hide the finding from the default view and exclude it from posture scores. Requires a reason.
+- **Snooze** — temporarily hide the finding. Requires a duration (1, 7, 30, or 90 days, or a custom date) and a reason. The finding automatically returns to open status when the snooze period ends.
+- **Remediate** — resolve and close the finding. This action only appears for finding types that support it. Its label also varies by finding type — for example, a service account misclassification finding offers **Confirm human** and **Mark as service** instead of a generic remediate button.
+
+### Act on multiple findings at once
+
+From **All findings**, select multiple findings with the checkbox column, or use **Select all N in filter** to apply an action to every finding matching your current filters — including filters that couldn't previously be bulk-acted on, like finding type, owner, app resource, and connector. Choose **Snooze**, **Suppress**, **Accept risk**, or **Reopen** from the bulk action menu.
+
+Because these four actions apply to different finding states, the menu shows how many of your selected findings each one can actually change (for example, "Reopen — 3 of 12"), and the confirmation dialog restates that split before you commit. Only eligible findings are changed. Bulk actions require the same permission as changing a single finding's state, so read-only users don't see the selection controls.
+
+## Transformation rules
+
+Transformation rules reshape a finding's data — for example, escalating its severity or adding annotations — before a routing rule acts on it. Use them to make sure the findings that matter most are marked that way consistently. Your routing rules can then act on severity or annotations directly, instead of re-deriving that context from scratch.
+
+Go to **Findings** > **Transformation rules** to create or manage them. Each rule has:
+
+- **A match condition** — narrow the rule to a specific app, finding type, or a [CEL expression](/product/admin/expressions) referencing `finding.severity`, `finding.state`, `finding.risk_score`, or `finding.annotations`. Leave everything unset to match every finding.
+- **One or more transforms** — set severity, add annotations, or remove annotations.
+
+For example, to flag every finding on a sensitive app as more urgent, create a rule matching `finding.app_id == "<app-id>"` that sets severity to Critical. A routing rule can then match on that Critical severity and escalate automatically.
+
+You can create as many transformation rules as you need. Every rule whose condition matches a finding is applied, in ascending order by the rule's **Order** value — later rules override earlier ones where they conflict.
+
+## Routing rules
+
+Routing rules turn triage into automation. Instead of someone opening every finding to decide what happens next, a routing rule matches on a condition and immediately suppresses, snoozes, accepts, remediates, or dispatches it. No manual review is required unless nothing matches.
+
+Go to **Findings** > **Routing rules** to create or manage them. Each rule has:
+
+- **A match condition** — the same app, finding type, or CEL expression matching used by transformation rules.
+- **An action** — No action, Suppress, Snooze, or Accept risk. Remediate is also available for finding types that support it.
+- **Dispatchers (optional)** — fire a webhook, invoke a function, or trigger an automation every time the rule matches.
+
+For example, suppress low-severity noise automatically with a rule matching `finding.severity == FINDING_SEVERITY_LOW` and action Suppress. Escalate anything Critical with a rule matching `finding.severity == FINDING_SEVERITY_CRITICAL` that triggers an [automation](/product/admin/automations) to notify your team or open a ticket.
+
+Unlike transformation rules, routing rules stop at the first match. C1 evaluates rules in ascending order by **Order** and applies only the first one that matches.
+
+### Order rules effectively
+
+Transformation rules and routing rules order in opposite directions, and mixing up the two is the most common way a rule set stops working as expected.
+
+- **Transformation rules apply cumulatively** — every matching rule runs, and later rules override earlier ones. Put your general, default-setting rules early and your specific overrides later.
+- **Routing rules stop at the first match** — only one rule ever runs. Put your specific, narrow rules early and your general, catch-all rules last. A broad rule placed too early will catch findings a later, more specific rule was meant to handle.
+
+A few other tips for keeping a rule set maintainable:
+
+- Test a routing rule's match condition with the **No action** action first, which matches the finding without changing its state. Confirm it's catching the right findings before wiring up Suppress, Snooze, or a dispatcher.
+- Leave gaps between **Order** values (10, 20, 30 instead of 1, 2, 3) so you can insert a new rule later without renumbering the rest.
+- If you want a default outcome for anything your specific rules don't catch, add a broad rule with no match condition (**Match all**) at the end of your routing rules.
+
+## Example: catch and escalate decoy credential use
+
+This walkthrough combines a finding type, a transformation rule, and a routing rule to automatically flag and escalate decoy credential use. It's a strong signal of compromise that shouldn't wait for someone to notice it in the findings list. See [Decoys](/product/admin/decoys) for how to plant a decoy credential.
+
+<Steps>
+<Step>
+In **Findings settings**, under **Credentials**, turn on **Decoy credential used**.
+</Step>
+<Step>
+Save your changes.
+</Step>
+<Step>
+Go to **Transformation rules** > **Create rule**.
+</Step>
+<Step>
+Set **Finding type** to **Decoy credential used**, and leave **App** and the expression unset to match every app.
+</Step>
+<Step>
+Add a **Set severity** transform and set it to **Critical**.
+</Step>
+<Step>
+Save the transformation rule.
+</Step>
+<Step>
+Go to **Routing rules** > **Create rule**.
+</Step>
+<Step>
+Set **Finding type** to **Decoy credential used**.
+</Step>
+<Step>
+Set **Action** to **No action**, so the finding stays open for review.
+</Step>
+<Step>
+Add a **Trigger automation** dispatcher to notify your security team immediately.
+</Step>
+<Step>
+Set this rule's **Order** so it runs before any broad catch-all routing rules. A general rule like "suppress low severity findings" could otherwise match first and prevent this one from running.
+</Step>
+</Steps>
+
+From now on, every decoy credential finding is marked Critical, and your security team is notified the moment it's created. No one has to find it in the findings list first.

product/release-notes.mdx

@@ -6,7 +6,21 @@
 rss: true
 sidebarTitle: Release notes
 ---
-{/* Editor Refresh: 2026-08-07 */}
+{/* Editor Refresh: 2026-08-13 */}
+
+<Update label="Findings and Decoys">
+
+### Early access: Findings and Decoys
+
+Catching an unowned service account, an exposed credential, or a misclassified identity has usually meant someone remembering to go looking for it. Findings does the looking for you. Turn on the conditions you care about, and C1 checks for them on every connector sync. From there, transformation and routing rules let you triage, escalate, or resolve what it finds automatically instead of reviewing every finding by hand.
+
+Stolen credentials usually only surface after they've already been used for real damage. Decoys get ahead of that. Plant a tripwire credential that looks real but grants no access — any attempt to use it raises a Critical finding. Whoever's using it just sees an ordinary authentication failure, with nothing to tell them they tripped a wire.
+
+Findings also show up on the Identities & NHI dashboard — every inventory table can filter to just the identities with open findings.
+
+See [Findings](/product/admin/findings) and [Decoys](/product/admin/decoys) for details. Share feedback with the C1 Support team.
+
+</Update>
 
 <Update label="August 7, 2026">
 
@@ -1091,7 +1105,7 @@
 
 * **Reviewer performance:** Track reviewer decision rates and average review time. See who's holding up the queue and remind them to finish their reviews.
 * **Progress by app:** Gain clarity by precisely tracking review completion status broken down by application.
 * **Workflow visualization:** A campaign burndown chart lets you visualize the campaign's remaining open reviews over time.
 
 You'll find the updated dashboard on every running and completed campaign.
 
@@ -1115,7 +1129,7 @@
 
 C1 now supports custom user avatars! To change your own user avatar, open your profile menu in the upper right corner of the screen, click your name, then click the edit icon on your current avatar image. 
 
 Not content just updating your own avatar? On on the user details pages, managers can also upload avatars for their direct reports, and Super Admins can upload avatars for any user.  
 
 ### New bulk actions 
 
@@ -1143,7 +1157,7 @@
 
 * To make it easier for users to understand exactly what they're reviewing in a campaign, the by-user reviews view now shows the exact entitlement under review instead of the parent resource. 
 
 * We've consolidated entitlement provisioning and deprovisioning settings into a single new **Access management** section on an entitlement's details page. 
 
 * When clicking to the next or previous page of a table, the view now automatically scrolls to the top, improving the navigation experience.
 
@@ -1183,13 +1197,13 @@
 
 * We've added a new query to the **Access explorer** page: **Active external accounts**. This list can be downloaded as a CSV for easy sharing and analysis.
 
 * You can now create fine-grained revoke entitlement steps in your automations. Use criteria such as the entitlement risk level or compliance framework to zero in on which entitlements to revoke or to exclude from revocation. 
 
 * The task report you can generate and download on the **Task log** page now includes details on who approved each task and the approver's email address, making it easier to track and audit approval workflows.
 
 * When creating [attribute mappings](/product/admin/attributes) in the new directory UI, you can use a mix of direct mappings and CEL expressions for each source. This allows you to set up complex fallback logic, which is especially useful for attributes that accept multiple values, such as Additional Usernames.
 
 * You can now configure the deprovisioning process to be used for an entitlement on the entitlement's details page, providing more granular control over resource clean-up. 
 
 * The Microsoft Teams app now sends notifications to the relevant admins when a connector experiences a sync error or detects an anomaly in the synced data.
 
@@ -1253,7 +1267,7 @@
 
 ### Usability updates 
 
 * You can now require that a different user approves each step in request and review policies. Enable **Require distinct approvers** on a step to prevent users who approved previous steps from approving the current one.  For full details, visit the docs on [Policies](/product/admin/policies). 
 
 * Need a report of all the access granted to a certain application account? You can now create and download one by navigating to **Requests** > **Accounts** > **View access** and clicking the **Generate CSV** button. 
 
@@ -1322,7 +1336,7 @@
 
 ### Fixed! 
 
 * We fixed issues that were preventing users with either the **Connector Administrator** user role or both the **Read-Only Admin** and **Basic User** user roles from completing their assigned tasks. 
 </Update>
 <Update label="October 3, 2025">
 
@@ -1348,7 +1362,7 @@
 
 ### Fixed! 
 
 * When a limited-duration grant has expired, it is now shown on the user's **App catalog** page as requestable, rather than granted. 
 </Update>
 <Update label="September 19, 2025">
 
@@ -1406,13 +1420,13 @@
 
 ### Fixed! 
 
 * We fixed the names of the bulk actions used for marking multiple grants deprovisioned. 
 </Update>
 <Update label="August 29, 2025">
 
 ### System management controls
 
 On the new **System management** page in the **Settings** section, we've added controls that allow Super Admins to disable all Slack and email notifications, access profile membership automations, and automations for your C1 tenant. 
 
 Use one or all of these controls when a temporary pause in regular C1 operations is necessary for testing, to prevent unintended consequences, or to perform critical maintenance. Check out [Temporarily disable system features](/product/admin/global-settings#temporarily-disable-system-features) for all the details. 
 
@@ -1430,7 +1444,7 @@
 
 ### Request forms 
 
 If you need requestors to answer questions or provide additional information when requesting certain entitlements, you can now create custom request forms that gather this data. Build request forms to gather precisely the information you need, and set them on one or many entitlements. Check out [Collect additional information from requestors using request forms](/product/admin/customize-requests#collect-additional-information-from-requestors-using-request-forms) to learn more and get started. 
 
 ### Automations updates 
 
@@ -1454,7 +1468,7 @@
 
 * Good news for anyone heading out on vacation this month: When [setting your own out-of-office delegate](/product/admin/delegate#set-your-own-delegate) you can now select a **Permanent** (ongoing) delegate or a **Temporary** delegate with specified start and end dates for the delegation period. 
 
 * Assigned access request approvers and users with the **Super Admin** user role can now change the duration of a requested grant before approving the request. The change in duration will be noted in the task's audit log. 
 
   <Frame>
   <img src="/images/product/assets/release-notes-15-aug-25.png" alt="A screenshot of a request task in the C1 UI, showing the duration field in its active edit state."/>
@@ -1516,11 +1530,11 @@
 
 We're in the process of upgrading our older connectors from [v1 to v2](/baton/migration) to improve performance and enable long-term support. While your existing v1 connectors might be marked as deprecated, they are still supported. No action is needed at this time unless you encounter a non-critical issue, in which case we may guide you to migrate. 
 
 ### Unused access automations
 
 The new **Unused access** section on each app's details page lets you see and manage app accounts that have not been used recently, and that might be good candidates for revocation. Click **Account unused > 30 days** to view the list of accounts in that state. 
 
 You can also set up tailored unused access automations from this section to notify, revoke, or perform the actions of your choice when access is not used within a specified timeframe. Go to [Unused access automations](/product/admin/automations#unused-access-automations) to learn more. 
 
 ### Usability updates 
 
@@ -1542,7 +1556,7 @@
 
 * The edit button for an application's description is now visible even when the description is extremely long. 
 
 * When automatically deprovisioning an account, all steps in the policy are performed. 
 
 * Clicking **Next user** in a by-user campaign correctly loads the next set of reviews.
 </Update>
@@ -1552,11 +1566,11 @@
 
 * We've added a new automation step option: **Grant entitlements**. Use an automation to grant a user one or more entitlements when the automation's conditions are met. 
 
 * App-specific automations can be created and managed by application owners who also have the **App Admin** user role. You can create, view, and manage these automations on the application page's **Automations** tab. Go to [App-specific automations](/product/admin/automations#app-specific-automations) to learn more. 
 
 ### Usability improvements
 
 * On the **Applications** page's **Unmanaged apps** tab, we've made two key improvements: 
 
   * Use the new **Parent app** filter to show only the child apps of a particular IdP, SSO, or federation provider. 
 
@@ -1566,19 +1580,19 @@
 </Update>
 <Update label="July 11, 2025">
 
 ### Introducing automations 
 
 We're thrilled to introduce [automations](/product/admin/automations), a powerful new feature designed to dramatically streamline your operational processes within C1. Build custom workflows to handle repetitive tasks, reduce manual effort, improve compliance, and achieve greater efficiency. 
 
 Automations are ideal for:
 
 * Kicking off critical processes based on employee status changes
 * Providing seamless onboarding experiences
 * Ensuring secure and efficient offboarding
 * Managing role transfers with ease
 * Automating timely access reviews
 
 Explore these new capabilities on the **Automations** page!
 
 ### Inventory page 
 
@@ -1602,9 +1616,9 @@
 
 * When you replace a file, you'll now see information on the name of the previously uploaded file and the date when it was uploaded.  
 
 ### camelCase CEL expressions
 
 We are adopting camelCase for all [CEL expressions](/product/admin/expressions), and moving away from snake_case. This change will make writing and reading CEL expressions in C1 more consistent, and is intended to improve the overall developer experience. You don't need to modify any expressions you're using today, but new expressions should be written in camelCase. 
 </Update>
 <Update label="June 27, 2025">
 
@@ -1622,9 +1636,9 @@
 </Update>
 <Update label="June 20, 2025">
 
 ### App account deprovisioning
 
 By default, C1 automatically sets the account deprovisioning process based on your app's provisioning configuration. To customize deprovisioning, go to the app's **Controls** tab and [set how app accounts are deprovisioned](/product/admin/access-requests#set-how-app-accounts-are-deprovisioned).
 
 ### Usability improvements
 
@@ -1666,7 +1680,7 @@
 
 ### Streamline access request configuration
 
 The new [standard audience](/product/admin/access-requests#set-the-standard-audience-for-an-app-and-select-requestable-entitlements) setting on an application lets Application Admins and Super Admins quickly make specific entitlements within the application requestable to everyone in your organization or to select groups, without the need to set up an access profile. 
 
 ### Usability improvements
 
@@ -1684,7 +1698,7 @@
 
 ### Fixed!
 
 * The names of unmanaged apps are now automatically updated when the corresponding apps' names change in the IdP. 
 
 * Deleted access profiles are no longer included in the access summaries shown on an app's **Entitlements** tab. 
 
@@ -1709,7 +1723,7 @@
 
 * The full list of an app's linked entitlements is shown, instead of only the first 50. 
 
 * You can now successfully delete steps in an account provisioning or deprovisioning configuration. 
 
 </Update>
 <Update label="May 23, 2025">
@@ -1746,9 +1760,9 @@
 
 ### Usability improvements 
 
 * You can now set a SLA (service-level agreement) fallback step on a policy. If no action has been taken on a task step when the SLA timeframe you set elapses, the task can be automatically redirected to use a new policy or reassigned to a different user. 
 
 * On an application's **Entitlements** tab, access controls information is now shown in the **Requests** column, where you'll find a tooltip with info on which access profiles each entitlement is part of.
 
 ### Fixed! 
 
@@ -1773,11 +1787,11 @@
 
 * New this week: [Microsoft Azure DevOps](/baton/azure-devops) and [Workday Account (WQL)](/baton/workday-wql). 
 
 * The new [Zendesk v2](/baton/zendesk) connector adds support for syncing roles and provisioning roles, orgs, and groups. Learn more about [connector versions and migration](/baton/migration). 
 
 * You can now specify which [user attributes](/product/admin/attributes) a connector syncs to C1. Go to [Select which attributes a connector syncs](/baton/configure) to get started.
 
 * A new configuration field on the [Snyk](/baton/snyk) connector adds support for users who use regional hostnames other than `api.snyk.io`.  
 
 * We've added a configuration field to the [Okta AWS Federation](/baton/okta-aws-federation) connector that opts into the conversion of user assignments to direct assignments. 
 
@@ -1815,9 +1829,9 @@
 
 * The Greenhouse connector now supports account provisioning. You can also use the connector to revoke Site Admin user permissions from accounts. We've added a new configuration field to support this feature. Check out the [Greenhouse connector docs](/baton/greenhouse) to learn more.   
 
 * The Grafana connector now supports organization provisioning. 
 
 * The Asana connector now syncs licenses and supports license provisioning. We've added a new configuration field to support these capabilities. Check out the [Asana connector docs](/baton/asana) to learn more.   
 
 ### Usability improvements 
 
@@ -1861,13 +1875,13 @@
 
 * If a connector has failed three syncs following a successful sync, the connector owner (or the application owner if a connector owner is not set) will receive a email notification about the connector sync error. 
 
 * The Grafana connector now supports account provisioning. 
 
 * The Asana connector now supports account provisioning and has a new configuration option to add the ID of the workspace where newly created accounts should be added. 
 
 * The Incident.io connector now syncs basic and custom roles. 
 
 * To improve performance, the Okta-AWS Federation connector now requires that identities be pulled from an Okta connector. See the [Okta AWS Federation connector docs](/baton/okta-aws-federation) for more information. 
 
 ### Usability improvements 
 
@@ -1927,7 +1941,7 @@
 
 * **Last login** is now a default account attribute when [mapping data values from a file connector](/baton/file-connectors#map-data-values). For existing file connectors, refresh the connector's data to view and set this new mapping option. 
 
 * When setting up a policy that allows reassignment of tasks, you now have the option to limit which users a task can be reassigned to. Only the members of the reassignment allowlist will be available when a user reassigns a task.
 
 * You can now set a default access review view on a campaign or template. The default view setting (by app, by user, or unstructured) will open every reviewer's access reviews in the view you select, but reviewers can switch to a different view, if desired. 
 
@@ -1979,7 +1993,7 @@
 
 * The Workday connector now syncs security groups, and can be configured with a custom report in JSON format.  
 
 * You can now configure the Asana connector using a service account token. 
 
 * The AWS connector now syncs information on each account's last login. 
 
@@ -2025,7 +2039,7 @@
 
 ### Connectors 
 
 * The Jamf connector now syncs dynamic roles.  
 
 * The Google Cloud Platform connector now syncs organizations. 
 
@@ -2053,18 +2067,18 @@
 
 * New this week: [SAP SuccessFactors](/baton/successfactors), [Notion](/baton/notion), and [Jenkins](/baton/jenkins). 
 
 * The Tailscale connector now syncs roles, devices, and invites. 
 
 * The Dayforce connector now syncs roles and groups. 
 
 * The Google Workspace connector now syncs Google custom attributes.
 
 * These connectors received updates and fixes:
 
   * Azure Infrastructure (fixed sync errors when a mailbox fetch fails and errors when optional values were unset)
   * Entra ID (captures enterprise application usage)
   * Google BigQuery (fixed the cause of a sync error loop)
   * Okta (fixed errors that occurred when expected data was absent)
   * Workday (adds support for multiple roles in a custom report)
 
 ### Usability improvements 
@@ -2073,7 +2087,7 @@
 
 * You'll now find a **Created between** date range option when filtering tasks on the **Task log** page. 
 
 * Entitlement details are now shown in tooltips on the **Task log** page. 
 
 ### Fixed! 
 
@@ -2091,11 +2105,11 @@
 
 * New this week: [Redis](/baton/redis) and [Galileo Financial Technologies](/baton/galileo-ft).  
 
 * You can speed up the provisioning of Entra groups and roles by enabling the new **Schedule SCIM provisioning** option when configuring the Entra connector. This option forces a SCIM sync in Entra whenever new access is provisioned in C1. 
 
 * The Concur connector now supports role provisioning.  
 
 * The Litmos connector now supports course provisioning. 
 
 * The Azure Infrastructure connector now syncs storage accounts and storage account containers. 
 
@@ -2114,7 +2128,7 @@
 
 * To make it faster and easier to complete provisioning tasks, we've added the subject user's email address with a click-to copy button to the task assignment pane. 
 
 * Entitlement details are now shown in tooltips in tasks and when completing access reviews by app. 
 
 </Update>
 
@@ -2128,7 +2142,7 @@
 
 We're rolling out the ability to track usage data for key connected applications. Use this data to scope a UAR campaign to review grants that have gone unused lately.   
 
 * Opt into tracking Microsoft Entra usage data by enabling **Fetch user sign-in activity** on the Entra configuration page. 
 
 * The Okta v2 connector now collects usage data for Okta and the applications that Okta users SSO into. No configuration is needed.  
 
@@ -2144,10 +2158,10 @@
 
 * These connectors received updates and fixes:
 
   * Snyk (fixed an issue with provisioning organizations)
   * Zendesk (added additional error messages)
   * Snowflake v1 (fixed an issue with syncing users)
   * Databricks (fixed an issue with group provisioning)
   * Workday (added support for reporting user statuses)
 
 ### Usability improvements
@@ -2166,7 +2180,7 @@
 
 * Very large conditional expressions in policies can be successfully saved. 
 
 * Ownerless accounts are displayed correctly when reviewing campaign tasks by user. 
 
 * You can successfully duplicate any completed campaign. 
 
@@ -2184,7 +2198,7 @@
 
 ### Usability improvements
 
 * You can now mark tasks as provisioned or deprovisioned in bulk on the **Task log** page and your **Tasks** page.
 
 * We've added pagination to very long lists of entitlements on the **Manage access** page's **Browse** tab. 
 
@@ -2208,7 +2222,7 @@
 
 * These connectors received updates and fixes:
 
   * Okta
   * Google Workspace 
   * Azure Infrastructure 
 
@@ -2225,9 +2239,9 @@
 
 ### Connectors 
 
 * New this week: [Microsoft Azure Infrastructure](/baton/azure-infrastructure), [VictorOps](/baton/victorops) (aka Splunk On-Call).
 
 * When configuring the Microsoft Entra ID connector, you can now specify your Microsoft Graph API domain. 
 
 * These connectors received small updates and fixes:
 
@@ -2263,8 +2277,8 @@
 * These connectors received small updates and fixes: 
 
   * Salesforce (now only syncs accounts with a `UserType` value of `Standard`)
   * Databricks (fixed `failed to expand grant` error)
   * Coupa (fixed provisioned roles being deleted on the next sync)
   * Confluence (fixed group provisioning error)
 
 ### Usability improvements 
@@ -2283,17 +2297,17 @@
 
 <Update label="February 14, 2025">
 
 ### Automated unenrollment from access profiles  
 
 We're excited to launch automated unenrollment for access profiles, complementing our previously released enrollment functionality.  Now, when a user no longer meets the membership conditions of an access profile, C1 automatically initiates the unenrollment process you've configured.
 
 To learn more about unenrolling users, check out [Automate onboarding & offboarding access changes](/product/admin/dynamic-access-control).
 
 ### Connectors 
 
 * New this week: [PingFederate](/baton/pingfed).
 
 * The Asana connector now supports provisioning of teams and workspaces.
 
 * These connectors received small updates and fixes: 
 
@@ -2301,13 +2315,13 @@
   * Google Workspace 
   * Slack
   * GitHub
   * Databricks 
 
 ### Usability improvements 
 
 * We've added click-to-copy controls to the tooltips that show user and account information, making it easier to grab an email address or other info for use elsewhere. 
 
 * If you're a manager or have the Access Request Helpdesk, Access Request Admin, or Super Administrator user roles in C1, you can now request an access profile for another user on the **Request access** form. 
 
 ### Fixed!
 
@@ -2335,7 +2349,7 @@
 
 ### Connectors 
 
 * The Jira connector now supports syncing project roles. 
 
 * We made updates and fixes to these connectors: 
 
@@ -2345,7 +2359,7 @@
 
 * The by-app access review experience has been revamped. This sleek, streamlined new design features expandable info panels, bulk actions, and clearer indicators of your progress through your assigned access reviews.
 
 * When you click on a task number, a drawer now opens containing the tasks's details, next steps, related tasks, and audit log. Score one for team #no-more-modals.
 
 * You now have the option to scope a campaign by resource type within an app. This option is especially helpful when used in a campaign template, allowing you to automatically generate, for example, a quarterly review of all the teams in GitHub.   
 
@@ -2363,16 +2377,16 @@
 
 * We made updates and fixes to these connectors: 
 
   * Okta v2 
   * Workday
   * Salesforce
 
 ### Usability improvements
 
 * We've redesigned the tooltips that show user and account information to make them more relevant and helpful. 
 
   <Frame>
   <img src="/images/product/assets/release-notes-31-jan-25.png" alt="The tooltip on a user account showing the new design, which includes a summary of the account information and profile attributes."/>
   </Frame>
 
 * When setting up an access review campaign template, you can now include instructions that will be displayed to each reviewer in campaigns created from that template. 
@@ -2393,7 +2407,7 @@
 
 * When completing access reviews by user, you'll now see an icon if the user's last login to the app was more than 30 days ago. 
 
 * If a revocation task has errored, the task's outcome is now shown as "Revocation errored" on the campaign's **Access reviews** page and in the campaign report.
 
 ### Fixed! 
 
@@ -2439,7 +2453,7 @@
 
   * Snowflake v2 (fixed the connector's behavior when lists return no results)
   * AWS v2 (fixed sync failures when an SSO user's status could not be fetched)
   * Temporal Cloud (fixed issues with namespace permission grants and extraneous role grants)
 
 ### Usability improvements
 
@@ -2459,7 +2473,7 @@
 
 * You can now set up the Workday connector using either a custom report or an API client. 
 
 * The Databricks connector now includes the option to pass in the hostnames needed to configure the connector for use with Google Cloud Platform or Azure Databricks. 
 
 ### Usability improvements