General

Route approval workflows and notifications to Slack channels in a single thread Slack channels can now be configured as approvers or notification targets in JIT approval workflows, allowing teams to review requests and coordinate decisions directly in Slack.Notifications for each access request are consolidated into a single Slack thread, making it easier to follow the full decision history. Updates clearly show who approved a request, when it was approved, and how the request progressed, improving visibility and auditability for teams managing approvals in Slack.Continue reading here Customer Case Studyivision: How ivision Simplifies and

CIEM Security Best Practices: 5 Steps to Success 5 CIEM Security Best Practices for Cloud Infrastructure SuccessA successful CIEM approach focuses on depth and breadth: discovering, managing, and protecting identities, and seamlessly working alongside other identity security technologies to gather and apply context about the entire IT estate. Here are some best practices to adopt: 1. Assess & Map (Cloud Identity Visibility)Start by understanding which identities exist and how access actually works. Visibility starts by inventorying human, machine, workload, AI agent, and third-party identities across cloud environments. Additionally, map roles, policies, keys, and secrets, then visualize relationships and

Allow Changing Account Permissions When managing integrations in Entitle, permissions to access to them are given in a controlled or restricted way:Entitle sets up a temporary account for a user once, adding and removing permissions as needed. This saves users time and admins the task of setting up a new connection every time a temporary user is created in the integrated development environment (IDE). If it's preferred to set up a temporary account for the user each time they make an access request, the setting Allow changing account permissions can be turned off in the integration settings. If Allow changing account permissions is: On (checked): The first time a user requests access, a single account is created. Future requests will use this same account and login cred

Manually Revoking Access Requests in Entitle There are instances where you may need to revoke a user’s permission early. This article explains how to revoke permissions for users who have already been approved.Steps Navigate to the Users page in Entitle  Find the user that needs their permissions revoked and the permission that should be revoked. Click Permissions Table Click the Revoke button for the integration access that should be revoked Repeat this for every permission that should be revoked.  Furt

Entitle Agent - Network Access Requirements The following topics will be discussed in this article. DNS Datadog Entitle Agent image repository AWS MSK  AWS S3 (Amazon) Agent Remote settings Kubernetes Internal Resources Kubelet Kubernetes API Server DNSFor both EU and US RegionsAllow access to the DNS ServerAllow access to the following ports: 53 DatadogFor both EU and US RegionsAllow access to the following endpoints: Cloud Monitoring as a Service | Datadog *.datadoghq.com (this will allow all s

Entitle Security Frequently Asked Questions - FAQs The following provides answers to frequently asked questions about Entitle security. Does Entitle have security compliance? Yes. Entitle is SOC2 Type 2 compliant. A range of security measures to protect the systems and data are in place, including: Physical security measures to protect servers and data centers Network security measures to protect against cyber threats Access controls to ensure only authorized personnel access sensitive data Encryption of data in transit and at rest Regular security testing and monitoring to identify any potential vulnerabilities Strict policies to ensure that BeyondTrust's employees are

Entitle Frequently Asked Questions - FAQs How is the seat usage determined? After purchasing the product, it's mentioned that the instance will allow x amount of users or seats as per the agreement signed. The user count is based on every user that is affected by Entitle. This would include both active and passive use. If a birthright policy is in use, the access given to the user counts as 1 seat. (passive) If a user creates an access request on a specific integration on behalf of someone else, that would count as 1 seat. (active) Refer to the Birthright policies and

Setting up a Virtual Application in Entitle A virtual application is a mechanism which streamlines the end-user experience in scenarios where access requests to an application are implemented indirectly in the background. For example, by joining an IdP group which triggers IdP provisioning flow. Instead of navigating technical steps, the end user simply selects the application from a list and submits an access request, without needing to understand the underlying process. This feature is designed to simplify the end-user experience by renaming resources, such as Okta groups, to something more intuitive for different environment scenarios. The user will see a recognizable name and icon in the search results which they can request access to, without being aware of the complex implementation. Learn more and watch the demo video

Allowing Users Edit Accounts Setting The checkbox “Allow users to edit accounts” has now been added. This checkbox allows admins to control whether users can request accounts other than their own. The option to allow or prevent users from editing the account used within an access request provides tighter control and follows the principle of least privilege. Before this addition, any user could change the account for any access request they made. By default, this checkbox is deactivated (unchecked) for security, and admins will need to check it for the integrations that users will need to change their accounts for. This setting is activated or deactivated per integration by Entitle admins.   When unchecked, only an Entitle admin can cha