Bug Fixes

• KA-3692: "get_available_bridges" command fails for an MSP logged in as an MC

• KA-3687: Keeper DNA push notifications are not appearing on Apple Watch for 2FA

Improvements

• TRAN-3497: ARAM event added: Enterprise is out of seats

• TRAN-3498: ARAM event added: Admin approved a device

• KA-3654: Keeper removes pending users when SCIM provider patches user to inactive status

• KA3610: Improved performance impacts due to API throttling

• KA-3592: Allow Admins to provision invited users into Teams

Bug Fixes

• KA-3625: MSP Keeper Admin is unable to approve SSO Cloud users from managed companies

• KA-3560: SCIM email change issues

• KA-3615: Broken Access Control - Change permission of other users in the same sharing record

• KA-3614: Broken Access Control - Remove user in the same sharing record

• KA-3624: Keeper Push fails for Cloud SSO users with DUO enabled

• KA-3585: 2FA code duration preference fails for SSO Cloud users

• KA-2558: Team folders are not being pushed to users upon login

• KA-3637: Unable to login to Web Vault using Alternate Master Password and 2FA

• KA-3235: Changed Email Address event isn't displayed in ARAM

• KA-3641: Attempting to save empty shared folder record key

• KA-3663: Cloud SSO accounts require two Admin approvals

Bug Fixes

• KA-3782: Change SCIM GROUP PATCH implementation to return 204 Status

• KA-3588: Support for SSO Connect On-Prem alias checking on email changes

• KA-3578: Turning on Stay Logged In did not work the very first time

• KA-3756: Stay Logged In setting not honored on particular login flows

• KA-3626: Syslog push fails in EU

• KA-3638: Adding ARAM event causes throttling

• KA-3725: Various issues with record sharing

• KA-3718: User is unable to set alternate Master Password

• KA-3582: ARAM is missing the event "Removed User from Team"

• KA-3607: SSO does not send SessionIndex on SAML logout

• KA-3628: Entity ID fails to update when moving configuration

• KA-3674: Records fail to appear in shared folder after a team is added

• KA-3661: "Offline Master Password" role enforcement fails

• KA-3548: Error message appears when login to US SSO Cloud account in EU region

• KA-3514: Event is not triggered when delete command is used

• KA-3701: MSP Admin is unable to approve SSO Cloud users from Managed Companies

• KA-3719: File usage is not properly updated

• KA-3726: A server error is generated when deleting a team

• KA-3730: "Account Recovery Requested" ARAM event is not triggered

• KA-3741: Cloud SSO users that are also admins, require Master Password to export

• KA-3746: Errors are generated when deleting a record in a team shared folder

• KA-2654: Backend APIs for Admin Console login for customers with over 100k users

• KA-2837: Addition of new APIs for upcoming Record Types feature

• KA-3316: Create user event not reported in ARAM

• KA-3728: Sending hyperlink to invalid domain in some scenarios

Improvements

• EM-4399: BreachWatch events now include the record UID to inform Admins what records trigger BreachWatch Events

Bug Fixes

• KA-3580: Re-trying an Admin Device Approval for pre-approved devices must reply success and send push

• KA-3582: ARAM is missing "Removed User from Team" event

• KA-3493: Log Error - users with region issues

• KA-3586: File download for Enterprise users currently looks at file_plan_expiration

Improvements

• KA-3553: Improved performance for SCIM filter by external ID

• KA-2571: Validate a user's domain when an enterprise is created or when an enterprise user is added

• KA-3583: Restrict Admins from adding teams with missing encrypted_team_key

Bug Fixes

• KA-3448: Admin is able to invite a user to an enterprise when the user exists in a different region

• KA-3464: "Forgot Password" flow generates error message

• KA-3533: 404 error appears after logout from US SSO Cloud account

• KA-3534: Log Error - NPE in SharedFolderUpdateCommand

• KA-3491: A server error is generated while editing MSP user's name and email

• KA-3493: User with region issues generates log error

• KA-3407: Android users are prompted twice for code during 2FA setup

• KA-3540: Cloud SSO IdP-initiated login URL is not displayed as expected

• KA-3549: Cloud SSO does not return an error to the user if a bad IdP metadata XML file is uploaded

• KA-3394: BreachWatch and Security Audits reports are not updating as expected

• KA-3555: Log Error - ArrayIndexOutOfBounds in CreateAccountController

• KA-3556: Log Error - NPE in ManagedNodePrivilegeRemoveCommand

• KA-3554: Network error calling kinfo when user already exists locally

• KA-3568: KeeperApp should prevent active SSO connections from being deleted

• KA-3571: Errors are generated when a user attempts to approve existing devices via Keeper Push

• KA-3573: Requests are not removed from Approval Queue once approved by Admin

Bug Fixes

• KA-3485: Fix to change Enterprise storage expiration to license expiration date

• KA-3430: Inviting a reserved domain user triggers an incorrect error message

• KA-3433: iOS devices do not receive "device_locked" push notifications from admin tool

• KA-3436: When providing the 6-digit code from an account that is using DUO, the response displays an error

• KA-3460: SAML validation errors are incorrectly being logged

• KA-3447: A log error is generated when deleting a role or privilege

• KA-3464: Forgot Password flow is generating several error messages

• KA-3477: SQL error is generated in "ChangeMasterPasswordCommand"

• KA-3480: Command returns an invalid session token type for expired Unlimited account

• KA-3281: Enterprise tool search functionality is not working as expected

• KA-3489: Login fails for SSO On-Prem users when IP auto-approval is turned off, or if it's ON and new IP / Device

Improvements

KA-15.0.29: Server communication improvements made

Improvements

• KA-2836: Support for new Record Types feature

• KA-3862: Support for Node Isolation

• KA-3857: Provide free Family Plan to all linked personal accounts

• KA-2517: An audit event is created when a user is removed from a role or team

• KA-3909: Support for automatic enterprise invite re-sends on the backend

Bug Fixes

• KA3873: Enforcement values missing from get_enterprise_data_for_user_response

• KA-3693: API requests to the backend are slow to turn on 2FA

• KA-3870: IP blocked events are not being reported in Reporting & Alerts Module

• KA-3880: Extending the share expiration of a user, fails to save new expiration date

• KA-3869: Shared Records Report returns unwanted data

• KA-3894: Admin Console crashes when the last user of a team deleted

Bug Fixes

• KA-3328: Using KeeperDNA for device approval does not work as expected

• KA-3442: Log error is generated when deleting a revision

• KA-3460: SAML validation errors are incorrectly being logged in the KeeperApp error log

• KA-3464: Forgot Master Password flow generates error messages

• KA-3508: start_login returns error after biometric login attempts to Cloud SSO accounts

• KA-3512: Keeper Push does not work in attempt to enable 2FA in EU SSO Cloud account

• KA-3513: A user is unable to login with SSO Cloud after being moved to an SSO node with the precondition that the user has not first logged in with their Master Password

• KA-3519: A pending Enterprise user in an attempt to login to the vault receives an invalid account creation email

• KA-3520: Recent Activity in account summary is missing iOS sync

• KA-3521: The browser extension logout timer uses the timeout value set within the vault

• KA-3509: Log Error, NPE in getManagedEnterpriseInfo

Bug Fixes

• KA-3459: ARAM alerts read "unknown event" instead of the event name

Bug Fixes

• KA-3454: Fix for IP auto-approval broken in production

Older release note content is still available, but anything older than the last 10 updates is placed here.

Enhancements & Benefits

• KA-3387: Logic changed for session persistence

• KA-3381: Biometric count and date enforcement removed

• KA-3207: Various Enterprise customer invite fixes

Benefits & Enhancements

• KA-3443: Support for SAML 2.0 IsPassive option in Cloud SSO

Bug Fixes

• KA-3434: Deleting an enterprise does not release the kinfo.domain

• KA-3438: Biometric login to wrong region generates "DEVICE_ACCOUNT_LOCKED" message

• KA-3415: User unable to update an existing push token for a new device using device SNS registration service

• KA-3393: Creation of a new user fails to trigger an ARAM event

• KA-3388: Cloud SSO loses configuration parameters

• KA-3377: Error message fails to appear when a user selects RSA option during 2FA setup and RSA has not yet been configured

Enhancements & Benefits

• KA-3423: The server will allow all access currently reserved to restrict and sync down

Bug Fixes

• KA-3448: Fix to allow Admin to invite a user to an enterprise when the user exists in a different region

• KA-3436: When a user provides the 6-digit code for DUO 2FA, the response displays an error message

• KA-3420: When a user creates a Business trial and switches regions, they receive and error message when attempting email verification

Enhancements & Benefits

• KA-3362: KeeperFill Enforcement Policies - Role policies, implemented via checkboxes to enforce each of the various features and settings of the KeeperFill Browser extension.

Bug Fixes

• KA-3440: User invite fails when the domain is reserved by multiple enterprises

• KA-3439: EU SSO Cloud user who attempts to login from the Desktop App with their email address is routed to Device Approval screen rather than their IdP

• KA-3435: In an attempt to switch account after an account logout prompts user to update their password

Bug Fixes

• KA-3350: Alternate Master Password login 500 internal server error

• KA-3351: user_account_summary error

Features & Enhancements

• KA-2906: Service Logger implemented as short term in-database logger

• KA-2873: DAO layer implemented for new Cloud SSO data objects

• KA-3314: Significant Cloud SSO logging improvements

• KA-3273: Implemented prefix-based SCIM role mapping

• KA-3214: Support signature embedded in the SAML response

• KA-3210: Role enforcement created to disallow v2 clients

• KA-3133: Without recovery data, removing a user from Cloud SSO node is prevented

Bug Fixes

• KA-3343: Azure email formatting causes SSO to throw exception

• KA-3332: Database error received during enterprise_delete

• KA-3329: In attempt to delete SCIM user, user is locked instead of deleted

• KA-3301: Master Password re-entry fails for biometrics

• KA-3284: get_user account_information fails to return pending devices

• KA-3264: Prevent account enumeration via 2FA throttle

Bug Fixes

• KA-3310: Request to create a user fails due to ECC validator; emails not received

Enhancements & Benefits

• KA-3283: Support for deleting invited user via SCIM PUT

• KA-3263: Role enforcement policy created to disable account recovery

• KA-3237: ARAM event created for "Enterprise is out of seats"

• KA-3263: ARAM event created for Admin approved a device"

• KA-3182: Endpoint created that allows a support tool user to verify a user's 2FA code

Bug Fixes

• KA-3304: SAML Logout returns 404 with no IdP logout endpoint configured

• KA-3294: Logout timer enforcement on Desktop logs user out at max duration instead of max idle

• KA-3274: Email change landing page contains incorrect string

• KA-3242: SSO logout doesn't redirect to IdP to perform logout from mobile client

• KA-2994: Throttled re-authentication enforcement in vault is persistent on next log in.

Bug Fixes

• KA-3307: Account summary returning null for Family Plan admin

• KA-3300: 2FA users who enter a "0" leading their area code during setup, don't receive SMS messages

• KA-3267: SCIM PATCH add username exception in production log

Bug Fixes

• KA-32632: Web app version 15.0.1 is receiving errors upon login

• KA-3259: DUO IP-based bypass mode generates 500 error

• KA- 3257: 2FA approval method produces error and enumeration

Bug Fixes

• KA-3265: EU users logging into US are not properly routed to the appropriate region

Bug Fixes

• KA-3359: Correct SSO accounts transition from pending_enterprise_user to enterprise_user

• KA-3358: send_email_verification link is being rejected

• KA-3271: Deleting user from v10 admin tool doesn't fully delete user

• KA-3233: Error message is received when a new user attempts to accept and create a family account via email invite's deep link.

Bug Fixes

• KA-3255: 2FA is bypassed when alternate Master Password is used

• KA-3252: RSA SecurID fails with Login_v3

Bug Fixes

• Fixed: Domain name not provided in login error message for SSO.

• Fixed: Error message received when attempting the "Forgot Password" flow.

• Fixed: Internal server error on add users for SCD Provisioning

The Backend API version 15.0.9 release is focused on Login V3 and SSO Cloud APIs.

Features & Benefits

• Cloud SSO Connect General Availability (GA) More information available here: https://docs.keeper.io/sso-connect-cloud/

• Login V3 General Availability (GA) More information available here: https://docs.keeper.io/enterprise-guide/login-api-v3

• KA-3173: Support for session persistence

• KA-3079: IdP-initiated login for Cloud SSO accounts

• KA-3086: New Enterprise role policies (disable_onboarding, disable_commander)

• KA-2468: Support for 24-hour logout timer period

• KA-3177: Added ARAM event for "Device requires Admin approval".

• KA-3188: Backend support for device linking (auto-login of resumable sessions)

Bug Fixes

• KA-3061: Better handling of invalid email addresses

• KA-3130: Login V3 support for SSO-Master-Password logins

• KA-3141: Ignore password expiration for SSO users

• KA-3128: Do not redirect users to incomplete SSO Cloud configuration

• KA-3134: Support for Region Redirect on SSO Domain login

• KA-3088: Resolve missing Sign On URL in Cloud SSO metadata file for Azure

• KA-3147: Throttling configuration for SSO Domain name

• KA-3161: Duo Push web socket message not received by vault during account recovery

• KA-3163: Changing Keeper SAML SP endpoint from kepr.co to keepersecurity.com

• KA-2516: Master Password regex causing loop on iOS devices

• KA-3175: Improved throttling on email verification codes

Bug Fixes

• KA-3270: New JIT Cloud SSO users are prompted for device approval during onboarding

• KA-3269: Uninvited Cloud SSO users receive region_redirect error message

• KA-3268: Non-JIT Cloud SSO users receive error message at login

Subsequent releases 14.12.7 - 14.12.13 are also included in the following release notes.

Bug Fixes

• Fixed: Unable to run custom reports in ARAM.

• Fixed: Device verification must be forced on.

• Fixed: SCIM group provisioning is unsuccessful.

Subsequent release 14.11.1 is also included in the following release notes.

Features & Benefits

• API implementation allowing Enterprise Admins to disable 2FA for their users so they no longer have to contact support to do so.

• Admins able to set a role enforcement preventing users of the browser extension to enable Auto Submit and Prompt to Fill features.

Bug Fixes

• Fixed: DUO 2FA experiencing intermittent failures.

• Fixed: Push server is not re-registering after a fail to connect to database and is removed from database table too quickly preventing users to successfully login.

• Fixed: Error received when converting nodes to Managed Company if user data is present.

• Fixed: MSPs unable to pause Managed Companies as expected.

• Fixed: Issue causing the new push servers to incorrectly handle the DNA push token.

• Fixed: "auth_failed" appearing in Admin Console due to invalid session token detection when outbound IPs are load balanced.

• Fixed: Spaces in 2FA backup code result in "server_failure".

Bug Fixes

• KA-3094: Improved handling of SSO data for users when moved out of SSO node and back into SSO node (retains data).

• KA-3103: Editing a shared folder name or color changes default permissions.

• KA-3093: Very slow login when thousands of shared folders are present in the vault.

• KA-3099: Improved handling of migration from US to EU data centers

• KA-2960: Addition of alias_add event for adding alias username/emails

• KA-3097: Improved handling of login to US SSO account from EU vault

• KA-3074: Added events for Device Approval

• KA-3110: Prevent admin from moving user from on-prem SSO to Cloud SSO

• KA-3022: Submitting verification code for pending invited user returning 403 error

Features

• Backend support for Keeper SSO Connect Cloud

Subsequent releases 14.12.2 - 14.12.4 are also included in the following release notes.

Bug Fixes

• Fixed: Unable to register new users on current chat clients.

• Fixed: SSO (pre version 14.2.1) is not validating IP and device link for Enterprise.

• Fixed: Transferred direct shared records do not show up in both root and transferred folders.

• Fixed: Adding a 2FA duration to an enforcement generates server errors.

Features & Benefits

• Team Roles - This release introduces a major improvement geared toward increasing the efficiency of managing role enforcements. Enterprise Admins now have the ability to manage enforcements more precisely by assigning teams to roles. Furthermore, a user who is a member of a team assigned to a role will assume the enforcement of that given role.

• Master Password Re-entry Enforcement - This role enforcement allows Admins to further enhance their security policies by requiring users to re-enter their Master Password in order to unmask or copy a password. Once unmasked, the password will be re-masked after 30 seconds have passed.

• Account Transfer Improvement - A transferred account will be replicated in its structure and content and all data will be housed in a dedicated transfer folder that includes deleted records and record history.

• Web Vault & Desktop App Import Prevention - This role enforcement allows Admins to restrict users from importing data from the Web Vault and Desktop App.

Bug Fixes

• Fixed: Issue requiring an update of Google's phone number parser library to v8.11.3.

• Fixed: Users are denied access when moving a record within a shared folder containing restricted team sharing capabilities.

• Fixed: Business to MSP conversion fails for nodes that contain account transfer roles.

• Fixed: "Added Shared Folder" events only appear under the "Added Folder" event type in ARAM.

Subsequent release 14.10.1 is also included in the following release notes.

Bug Fixes

• Fixed: SSO Connect JIT flag turns off when SSO settings for a node are saved.

• Fixed: Issue causing Master Password complexity requirement in French to appear truncated.

Subsequent release 14.9.13 is also included in the following release notes.

Bug Fixes

• Fixed: Issue preventing MSP admin from logging into Managed Company if assigned a role that enforces 2FA at every log in.

• Fixed: Some EU users unable to successfully login after updating their email address.

• Fixed: Priority setting issue preventing successful SMS delivery method in Japan.

Subsequent releases 14.9.1, 14.9.2, 14.9.3, 14.9.4, 14.9.5. 14.9.6 14.9.7, 14.9.8, 14.9.9, 14.9.10 and 14.9.11 are also included in the following release notes.

Features & Benefits

• Enabled IP range based MFA prompt rules (NCINO).

• KeeperApp now responds to "/api" prefaced commands.

• Support for LogRhythm SIEM provider.

• API implementation for node to Managed Company conversion.

Bug Fixes

• Fixed: "Bad_request" error message received on login containing ".con" in email field.

• Fixed: Error occurs when user links a record from one shared folder to another.

• Fixed: Text key visible in error message when a user attempts to add a record to the same shared folder it already resides in.

• Fixed: An issue blocking clients that don't send in a user agent.

• Fixed: An issue causing BreachWatch API to reject IE submissions.

• Fixed: Crash occurs during login to various Managed Company accounts.

• Fixed: User receives an SSO error message after they are moved out of an SSO for the purpose of recovering their Master Password.

• Fixed: SSO new user/device access check initiates for SSO Connect >14.1.3.

• Fixed: When enabling account transfer permissions and enforcement, the MSP loses the ability to launch into the Managed Company.

• Fixed: Unable to move Managed Company to sub nodes without errors.

• Fixed: Issue preventing imported records from inheriting the default folder settings.

• Fixed: MSP receives "missing_keys" error when attempting to assign a user to a role with administrative permission.

• Fixed: Error message displaying key values is received in Enterprise Console when a user attempts to add SCIM provisioning method to the Bridge.

• Fixed: Support for enterprise client tool version.

• Fixed: Managed Companies are duplicated when filtered by node.

• Fixed: Some users in SSO nodes are unable to login as expected.

Features & Benefits

• Creation of new API to send email verification link.

Bug Fixes

• Fixed: Root Admin receives intimate spinner in attempt to log into Managed Companies located in a sub node.

• Fixed: Body of Japanese and German welcome emails for Keeper Business accounts are not translated.

• Fixed: Records that are deleted from a shared folder are displaying incorrect deletion dates in Deleted Items folder.

• Fixed: Adding a user to a shared folder does not send record meta data.

• Fixed: Translation keys visible in some Enterprise customer email invitations.

Bug Fixes

• Fixed: Various visual updates to email verification messages.

• Fixed: Japanese record sharing popups are not translated.

• Fixed: Issue causing push notification of email change to not be received by client.

Bug Fixes

• Fixed: The verification link to change a user's email generates an error message

• Fixed: The "record_add" command does not specify which file ID's are invalid in its response.

• Fixed: When moving a record from the root into a shared folder, it is not observing the default folder settings.

• Fixed: When added to a team, users do not immediately see shared folders until their next login. to the vault.

Features & Benefits

• Support for import of extra-large record notes

Features & Benefits

• Text Message 2FA codes now include the platform requesting the code (Web Vault, Desktop App, iOS, Android, Console, etc...)

• Updated template content for default Enterprise invitation

• Support for Yubikey 5Ci Hardware Security Key

Bug Fixes

• Fixed: Account recovery flow when customer attempts recovery in wrong geographic data center

• Fixed: Admin is unable to delete a user having many record revisions

• Fixed: Cannot create a family plan if once was admin of a family plan

• Fixed: User is member of a Team and can receive shares in Shared Folder, but not add the Team to a Shared Folder.

• Fixed: Shared folders in Account Transfer do not retain permissions.

• Resolved: Prevent user from linking a personal license to existing business license from a different data center region.

• Fixed: Removing a favorite from a record does not sync with other platforms.

Subsequent releases 14.7.12, 14.7.13, 14.7.14 and 14.7.15 resolved the following bugs:

• Fixed: Issue decrypting old device session tokens

• Fixed: Custom email templates reverting to default template in certain sub-nodes

• Fixed: Personal license validation link produces 404 error

• Fixed: SCIM provisioning failing with 400 error

• Fixed: Free Data Breach Scan in EU region generating confusing error message

• Fixed: Hyperlink to signup from SSO-provisioned user inside email template generated 404 error

Security Updates

• Prevent external SIEM host connectivity test misuse by enumerating ports on the local network

Bug Fixes

• Free Breach Scan emails not sending to existing paid subscribers. Fixed.

• Enterprise invite re-sending to users on expired licenses. Fixed.

Features & Benefits

• Enterprise end-user invitations are now sent once every 48 hours to maximize user adoption. Previously sent email invitation codes are invalidated by the most recent code.

• Updated the formatting, layout and branding of general email templates sent from the backend API in accordance with Keeper's new corporate branding.

Bug Fixes

• Duo 2FA setup was not fully activated in some end-user scenarios after first setup. Fixed.

• Translations missing in invitations and transfer record dialogs in Admin Console.

• Preventing user from changing email address to the same email.

• IP Allowlisting with overlapping ranges caused errors. Fixed.

Bug Fixes

• IP throttling too aggressive, adjusting to prevent false positive.

• Some customers unable to accept Enterprise invitation. Fixed.

• SCIM messaging from Centrify returning 404 errors. Fixed.

Due to issues experienced with Twilio (EU regulations surrounding delivery of messages using local numbers, confusing user experience around the use of Authy services), we made a migration of Keeper SMS 2FA services to Amazon AWS, our infrastructure provider.

The new backend SMS capabilities of Amazon AWS provide the following benefits:

• Local delivery of phone numbers via Short Codes

• Fast and reliable delivery

• Full integration into Keeper's existing AWS infrastructure

We apologize for any disruption of SMS 2FA services over the past several days as we have completed the migration. If you have any questions or experience any issues receiving SMS messages from Keeper, please contact support or switch to a TOTP-based authentication method, such as Google Authenticator or Duo.

Features & Benefits

• Migrated backend 2FA system from self-managed Twilio numbers to Twilio/Authy APIs

Bug Fixes

• Fixed Azure AD SCIM pushes for user creation

This is a major feature, bug fix, security and performance improvement release.

Features & Benefits

• Admins with Team Management permission will soon be able to add other members to a team, even if the admin is not part of the team. NOTE: Front-end implementation of the feature must still be completed on the Admin Console.

• Users will receive an email notification when a record has transferred ownership to them.

• Vault Transfers performed by the approved administrator will also transfer deleted records. The deleted records will be in the "deleted" section of the destination vault.

• Ability to assign free Personal Licenses to Business Licenses (not available for all Business customers).

• Created API to provide a list of team members, in order to display the information in the Vault. NOTE: The vault update has not gone live yet.

• Created process to periodically ask the customer to review and update their security questions.

• Created Backend APIs to support the Free Data Breach Scan feature on the Keeper Security Website and BreachWatch services. https://keepersecurity.com/free-data-breach-scan.html

• Roles can now be provisioned through SCIM (supported by Okta and other identity providers). The Role ID must be provided by the SCIM message. Notes: - When a new user is created, default roles will be assigned regardless of what provided in "roles" field. - Roles with administrative permissions will cause the operation to fail with status 406 ("not acceptable") and "detail": "A role with Administrative Permissions may not be assigned by SCIM." - To identify the Role ID, this information is will eventually be displayed in the Admin Console, but it can be also seen via Keeper Commander command "enterprise-info":

My Vault> enterprise-info --roles                                                                                                                                                                                                                            
Enterprise name: Craig Lurey LLC

       Role ID  Name                  Cascade?    New User?    Node
--------------  --------------------  ----------  -----------  ---------------------------------------------------------
47377784242422  Administrator                                  Craig Lurey LLC\Finance
47377784242415  Administrator                                  Craig Lurey LLC\Legal
47377784242418  Administrator                                  Craig Lurey LLC\Contractors
47377784242533  Agent Manager                                  Craig Lurey LLC\Agents

• "Last Modified" in record history will be replaced with the date in which the backup of was created (not last modification date)

• Shared records to users outside of the organization will be removed automatically when a "Vault Transfer" of the user account is performed by the admin.

Bug Fixes & Performance Improvements

• Stop sending share invites between Enterprise users, as this is not needed.

• Repaired the "Change Email Address" flow from certain clients, in which the verification email was not being sent properly.

• Emergency Access not honoring the desired wait time in certain cases.

Features & Benefits

• BreachWatch for Business

• New APIs for BreachWatch Business client apps (retrieving public key)

• Billing support for BreachWatch Business

Bug Fixes

• Improved BreachWatch performance to reduce CPU load

• User with expired personal license was unable to login and accept Enterprise invite.

Bug Fixes

• "Recent Activity" screen has not been displaying the user's custom Device Name setting since the 14.0 release. This is now resolved.

• Resolved SSO login when a user is moved into a subnode within the sub-node of the same tree.

Enhancements & Benefits

• Final release of Advanced Audit & Reporting backend prior to Admin Console release

• ​Improved record history detailed data

• Replace "Recent Activity" data with new enhanced metadata

• Business logic for Audit & Reporting SKU and billing system

• KeeperChat free trial activation from Admin Console

• Increase allowed file upload size on "Custom Logo" from Admin Console

Bug Fixes

• Syncing fix in shared folders related to removing a user from a folder

• Overlapping IP ranges in enforcement restriction caused exception

• "Ownerless" records after vault transfer are automatically corrected

• Translation fixes regarding certain new role enforcement policies

• Record "delete" events not logged when deleted from root user folder

• SCIM triggers email to admin if the max number of licenses has been exceeded

Coming Soon

• ​Version 14.4.0 includes several new features for Master Password login when SSO is unavailable, and offline mode in the Web Vault.

New Features & Benefits

Node Isolation Option for MSP Customers The Keeper Backend now as the ability to enforce Node Isolation for business customers. When "Node Isolation" is activated, users and teams that show within Share screens on the vault are limited to parent and child nodes. This feature is built for MSP customers who configure each node in the Keeper Admin Console as a separate end-customer account. In the example below, if Node Isolation is activated on the West Coast node then: Users in "Developers" are able to see other users and teams up in Developers, West Coast, Regions, Engineering and Craig Lurey LLC. Users in "Developers" are NOT able to see the users and teams in "East Coast" or "Sales", since those nodes are in parallel tree paths.

On the Vault, the screens affected by this change are the "Shared Folder" and "Record Share" screens:

Other Improvements

• Migrating from Google Cloud messaging (GCM) to Firebase Cloud Messaging (FCM) for Android platforms.

• During Vault Transfer / Account Transfer, team permissions are also transferred now.

• Optimization for syncing a large number of folders and records, when team permissions and individual user permissions overlap the same records. Duplicates are removed from the sync down response which decreases the overall encrypted package size.

• Created an optimized "import" backend API for record import

Bug Fixes

• Fixed "record key already encrypted with datakey" error which occurs randomly

• German translation improvement (backend errors and success messages)

Coming Soon

The next Backend API 14.6.0 release will support BreachWatch for Business.

Enhancements & Benefits

• Ability to login to Keeper when offline and SSO is unavailable, on the Web Vault and Desktop App. In this use case, the Keeper Admin enables the feature from the admin console role enforcement policy. This feature is disabled by default. It will only appear as an option within an SSO-enabled node.

• For users who are part of an SSO-enabled node where the Admin has enabled Master Password login, the user will be able to login to the Web Vault and set a Master Password. Note that the Master Password complexity is enforced based on the rules of the role enforcement policy.

• When offline mode is permitted by the Keeper Administrator, users can login to the Web Vault in a fully offline situation, or in a network that has no SSO access. Note that in order to make use of this feature, the user must login to the Web Vault on that particular user account at least one time.

• If an account is available for offline login, an indicator graphic shows on the login screen:

• Keeper Commander can now be utilized on SSO-enabled accounts through the use of the Master Password.

• Security Update: We have added new security updates to prevent enumeration attacks against SSO Customer Enterprise Domain names.

• We have added several new event types in the Advanced Reporting & Alert module to track the following events: