Release history

Added Google Drive support to the existing OneDrive/SharePoint sync-provenance and lineage-tagging feature: a file synced by Google Drive for Desktop's Shared Drives is now attributed back to its Shared Drive name the same way OneDrive files are attributed to a SharePoint site, including the ability to tag a specific Shared Drive with a standing DLP sensitivity rule. Strengthened inbound email phishing detection with three additions to the authenticity scoring engine: a fix so newly-registered-domain detection correctly evaluates the sender's actual registered domain rather than a subdomain of it; a new signal for links that serve a full HTML page directly from public cloud storage (Google Cloud Storage, S3, Azure Blob, and similar), a known technique for evading domain-reputation checks; and a new signal for messages whose plain-text part is trivial boilerplate while the real content only exists in the HTML part. Added a warning when a block-action DLP rule is scoped by a field that only resolves asynchronously after a transfer completes, since such a rule can silently never block. Added JA3 as an independently selectable scope condition on firewall and DLP rules, alongside JA4/Mercury/HASSH, and fixed the admin UI so the existing source-IP/CIDR scope condition is actually visible and editable on both the firewall and DLP rule pages.

Full changelog · 4153be53bd7caf75f30f6aabfa10b634530b32be8eedfa8964b1a34dd213bc19

Added SourceIP as a new scope condition on firewall and DLP rules - restrict any rule (domain, category, IP, region, ZTNA access, or content-inspection rule) to traffic from a specific source IP or CIDR range, alongside the existing device, user, and group scoping. Also improved ZTNA device-to-device access: a single-node deployment can now route directly to another enrolled device's exposed local port via its virtual IP, without requiring a separate connector daemon.

Full changelog · 59688fc67dd283022c56ede39a630650c5b9cd68ad912bc80c09f956e26c07ec

Added LDAP/Active Directory as a login option - no external OIDC or SAML identity provider required. Applies uniformly to admin console login, step-up SSO, just-in-time access approval, device identity verification, and the allodswg-ctl CLI. Reuses your existing Directory Sync connection settings, so there's nothing new to configure beyond selecting LDAP as the login backend under Settings. Also includes correct handling of Active Directory's default 1,000-account search limit for larger directories.

Full changelog · e60be37fd4cfd407f2eda5a73ef64d144f73dc762919c0d7e6f4476302c000b9