Skip to content

Changelog

Updates to Oblique.

Request to update owners of groups, teams, and listings

Section titled “Request to update owners of groups, teams, and listings”
New
  • Entitlement drawer on user, group, and team detail pages showing all entitlements that grant access to a given resource
  • Access change indicator in the requests inbox shows shows the scope of change of each request at a glance
  • Access table shows entry counts on each tab, to understand how many listings and resources a user, group or team has on their detail page
  • Okta groups with associated group rules have a group rule badge, with group rule names shown in the resource hovercard
  • Organization owner shown with a badge in admins table on the admins page
Changed
  • Update owners for groups, teams, and listings by making a request
  • If a request is approved with an auto-approval policy, that's more clearly shown on the request detail page and in the request timeline
  • Changes to listing roles update automatically
Fixed
  • Issue with profile attributes section displaying incorrect values when multiple integrations share the same attribute key

View resource-based access for users and groups

Section titled “View resource-based access for users and groups”
Changed
  • Resource-based access visible to admins on user, group, and team detail pages
Fixed
  • Issue with audit log entries for listing role policies linking to the wrong resource

Auto-approval policies allow members of a group to claim access to a listing role without requiring a human approval. An auto-approval policy also specifies a duration for the access, and whether or not a justification is required when claiming access.

Admins can add auto-approval policies to a listing from the listing detail page, by selecting Manage listing, and then under Auto-approved groups, selecting Add auto-approved group.

New
  • Auto-approval policies
New
  • See exactly who will review a request and why, when creating the request
Changed
  • Request access directly from a listing detail, not from the overall access catalog
  • Updated filtering on the Requests page, allowing you to filter requests that are waiting on you to take action
  • Request includes full listing description
Fixed
  • Issue with adding or removing a role with overlapping resources
  • Bug report dialog not submitting
  • Audit log for expired entitlements reads "revoked access as it expired" instead of showing the expiration date
New
  • See the events affecting the access for a listing on the listing detail page
  • Search for listings on the Access page
  • A syncing indicator shows on listings whenever effective access is updating
Changed
  • Redesign of request detail page to display checks, approvals, and apply status cohesively
  • Access previews always show unchanged access, alongside changes
  • Non-admin users can see suggested reporting groups when creating listings
  • Login page remembers the email address from your most recent login
  • Auto-apply request option is hidden when the requester cannot automatically approve the request
  • Users are consistently sorted by display name throughout the app
Fixed
  • Bug with resetting and overriding selected reviewers for team join requests
  • Bug with displaying long content dialogs, while still keeping headers and footers visible

Search by secondary email in command palette

Section titled “Search by secondary email in command palette”
New
  • Command palette search matches users by secondary email addresses
Fixed
  • Duplicate audit logs no longer written for creating a request
  • Reviewers who approved a request are listed even when none were explicitly requested
  • Switching tabs on a request no longer scrolls to the top of the page
New
  • See listings a user is the owner of on their profile
  • Navigate to Access page from command palette
Changed
  • Resources page moved to a tab under Integrations page
  • Timeline events distinguish between expired and revoked access
  • Reporting chain sorted by number of direct reports
  • Listing detail page shows resources associated with roles
  • Resource-based events hidden from non-admin users in the event timeline
  • Auto-applied requests attributed to Oblique in request timeline
Fixed
  • Access change badges count reflects number of unique users affected
  • Listings containing deleted resources no longer requestable
  • Incorrect event summary for entitlement removal

See access path details in user profile table

Section titled “See access path details in user profile table”
New
  • User profile access table shows how access granted via groups
  • Reporting groups that can be created appear when searching for subjects in listing access requests
  • Search listing access table for roles
Changed
  • Any user can create reporting groups, not just admins
  • Reporting group icon in event timeline
Deprecated
  • Resources no longer have owners. Use listings and listing owners instead
Fixed
  • Admin self-approval recorded in request timeline
  • Unclear error when creating a reporting group that already exists
  • Incorrect grouping of 'lost access' events in the event timeline
  • Long log lines overflowing in the log side panel

Reporting groups define users who have the same manager, or are part of the same organization. These can then be granted access to resources or role assignments in Oblique.

There are two types of reporting groups: a user’s direct reports only, and a user’s organization, including their direct and indirect reports. The manager themselves is not included in the reporting group.

You can create a reporting group from the Groups tab, by selecting Add group, then Reporting group.

New
  • Reporting groups
New
  • Selectively ignore users from an Okta integration, based on attribute value
  • Search for listing roles in the user and group access table
Changed
  • Draft listings are only visible to owners and admins
  • Access graphs collapse subgraphs for cleaner visualization
Deprecated
  • Removed per-user resource graphs
Fixed
  • Issue with editing listing roles from the resource detail page
  • Case-insensitive sorting of listings
New
  • Access graphs for users now display listing roles
  • Access graphs are now implemented for listings, displaying how users have access to roles
  • Previews of user access are now displayed when editing a listing role
  • Resources can now be searched by integration
Changed
  • Computed user access to listings on the listings page now shows expiry
  • Slack integration now displays the Workspace URL
Fixed
  • The subject picker for access requests to roles is now significantly faster
  • Draft listings are now correctly hidden from the access timeline
New
  • User access to listings better displays when a user has that access through teams or groups
  • Gaining and losing access to listing roles now appears on timelines for users, teams, and groups
  • Draft listings can now reference resources not managed by Oblique to help better preview listings before publishing
  • When publishing a draft listing, admins are given the option to convert reference resources to be managed by Oblique
  • Listings can now be created directly from a resource page
Changed
  • Slack now supports sending notifications to multiple public channels
  • Multiple subjects can now be granted access to a listing role in a single request
Fixed
  • Reworked the displayed access expiry when a user has entitlements through multiple groups and teams
  • Fixes sporadic issues with frontend asset fetching during system updates
  • Slack integrations that are incompletely configured now more accurately display that status
New
  • Edit expiry of a listing role assignment
  • Start a request for a listing role assignment from the command palette
  • Start a request for a specific listing role from the roles table of the listing detail page
  • Filter resources by associated listings
  • See more information about a listing in hovercard
  • See more information about a listing role in hovercard
Changed
  • Add Slack integration without enabling direct messages
  • Admins can see unlisted listings associated with a resource on the resource detail page
  • Roles on listings detail show description and number of users with the role
Fixed
  • Attribute-based group membership counts update immediately after creating the group
  • Incorrect count of users in the access table of the listings detail page
  • Bug when changing selected subject for an access request

You can see your access to a listing, and which role(s) you have, anywhere listings appear: the listing detail page, the request access form, and the command palette.

If you have access to a listing role through multiple paths, all of those roles show up on the listing detail page under the Users tab, grouped by user. This makes it easy to scan all the roles someone has at a glance.

Changelogs will now be posted weekly instead of daily.

New
  • Existing roles shown on listing detail page
  • Existing roles shown on request access form
  • Existing roles shown in command palette
  • Multiple entitlements for a user grouped on listing detail page
  • Copy audit log timestamp
  • Attribute detail drawer shows count of users with any value set and with no value set for the attribute
Changed
  • Expired entitlements are more explicit
  • Slack app joins channel when test notification is sent
Fixed
  • Team membership counts update immediately after creating the team
  • Deleted listings and roles are soft deleted so that they remain in audit logs
  • Slack app can be installed in a Slack workspace with a larger number of channels

The Oblique Slack app sends request notifications to individuals who are requestors or reviewers as direct messages. Reviewers are notified when they need to approve a request, and requestors are notified when the status of their request changes. Users can disable DMs in their notification settings.

The Oblique Slack app still sends notifications about all requests to a public Slack channel.

New
  • Send Slack DMs for request notifications
  • User notification settings
Changed
  • Update Slack channel using channel selector instead of channel ID
Section titled “Create listings to group and display related resources”

Listings are groups of related resources, typically used to present multiple access levels for the same application. These listings are presented to users in the access catalog, where they can request access. Resources are no longer visible to end users. Instead, listings are the primary way that users see, understand, and request access in Oblique.

Each listing has one or many roles, which represent a set of permissions. This often maps to an application role, like Admin or Editor.

Instead of requesting access to resources, users request access to roles in listings. When a user is assigned a role, they are automatically granted access to all resources mapped to that role.

New
  • Create listings and roles to group related resources
  • Access catalog in the Access tab
Changed
  • Users request listing roles, instead of requesting resources directly
  • Users no longer see resources

When creating a request that has a check, automatically select all reviewers for that check, instead of one at random. For example, if a check requires the team owner’s approval, either a team owner or an Admin must approve the request.

Oblique now auto-selects all object owners defined for a team or resource for review. Only one reviewer is required. An Admin can still jump into any request and make the approval, even if they are not selected for review.

Changed
  • Automatically select all reviewers for a check
Changed
  • When adding a Slack integration, pick the Slack channel from a dropdown
Changed
  • Slack app message tags requestor
New
  • Slack app supports platform notifications
Changed
  • Select domain from dropdown when adding a Google integration
New
  • User profile email is copyable
Changed
  • Preview of access changes shows change in expiry
Changed
  • Request summary for access change shows specific users and resources affected
  • Request summary for team membership change shows specific team and users affected
New
  • Filter audit logs for events from an integration
  • See most recent audit logs for an integration on the integration detail page
New
  • Access change events due to a request link to the request that made the change
Changed
  • Entitlements with indefinite access do not show the expiry

Multiple access change events are batched into a single line item in the access history timeline. These can be expanded to see the full list of events affecting access.

Changed
  • Batch timeline of events affecting access
Fixed
  • Mobile formatting of timeline of events affecting access

View a timeline of access changes affecting a user, group, or resource on the user profile or attribute-based group, team group, or resource’s detail page.

Each item is an event that affected access, by adding or removing an entitlement. Access changes only include granted or revoked access, and do not include changes that edit entitlements, such as extending an entitlement.

New
  • Timeline of events affecting access for each user, attribute-based group, team group, and resource

If a user is a member of a group or team that is the owner of a resource or another group or team, this indirect ownership is included in their user profile.

Changed
  • Indirect ownership of groups, teams, and resources is shown on a user's profile
New
  • Users can edit the 'About' section on their profile
  • Filter groups by members
Fixed
  • Issue with 'Open in Okta' navigation for some Okta tenants
New
  • Filter groups by group type and member count
  • Filter resources by integration
  • The subjects of requests (including changes that are not yet applied) included in 'Targets' filter for audit logs
  • Service accounts included in 'Author' filter for audit logs
Fixed
  • Issue with previewing requests with no changes
  • Issue with creating some access requests for teams and groups

Filter audit logs by action, author, target, and target type.

Changed
  • More complex filtering options for audit logs
New
  • Sort membership tables alphabetically by name, or by recency of joining the group
Fixed
  • Issue with previewing the impact of access requests that are already applied
Changed
  • More complex filtering options for resource list page
Fixed
  • Issue with email fuzzy matching in filter for user list page

Oblique now syns with Okta every 10 minutes instead of every 5 minutes.

Changed
  • Frequency of Okta syncs
Fixed
  • Issue with detecting some Okta group rules

The ‘People’ page allows you to see all users in your Oblique instance, and filter these by name, email, job title, and manager. You can use multiple filters, including multiple filters of the same type, and filter for users not matching the specified filter.

New
  • People list page with complex filtering
  • Copy button for user attributes
Changed
  • Ordering of content on request detail page
  • Better handling of large dropdown lists
  • Better handling of scroll location when navigating across app
Fixed
  • Issue with 'Open in Okta' navigation for some Okta tenants
Fixed
  • Disable editing individual entitlements for resources in Pull mode
  • Incorrect actor name in audit logs for changes synced from integrations
  • Missing audit log for updating canonical attributes
Fixed
  • Dark mode support for audit logs
  • Issue navigating access graph not closing graph view
New
  • Okta apps include Okta app ID
Fixed
  • Resource hovercard shown in access table
  • Sync built-in Okta groups, including the Everyone group

Oblique automatically imports and syncs custom user attributes from Okta with the data type string. These are included on a user’s profile and can be used for creating attribute-based groups.

New
  • Import custom user attributes from Okta

Enter your email then authenticate to log into the corresponding Oblique instance.

New
  • Login page
Fixed
  • Large access graphs not rendering

Audit logs are redesigned to show summary information directly in the audit logs table, with additional information provided in a drawer. The drawer includes a log diff, which can be copied.

Changed
  • Redesign of audit logs
  • Renamed 'Appearance' to 'Theme' (i.e. dark mode)
Fixed
  • Issue with adding new Google Workspace integrations in the Europe region

Use Okta as an identity provider for single sign-on (SSO) to authenticate to Oblique.

New
  • Okta single sign-on

Oblique is available in an additional region: a Europe region at eu.oblique.security.

Oblique syncs both the managerId and manager user attributes from Okta. If the managerId is an Okta userId, it will be used as the canonical attribute for manager. Otherwise, if the manager attribute is an email, it is used instead. The canonical attribute for manager is used to populate the reporting chain.

New
  • Use Oblique in the Europe region (eu.oblique.security)
  • Sync user attribute division from Okta
Changed
  • Default appearance set to Light theme
  • User attribute manager from Okta opportunistically used as the canonical attribute for manager
  • Additional menu items in navigation header
  • Improved mobile navigation
Fixed
  • Okta integrations can use Okta demo tenants
  • Integration logos showing wrong logo
  • Okta app logos not showing properly
New
  • Okta groups with group rules are discouraged from being put into 'push' mode
Fixed
  • The last Admin in an organization cannot be removed. Each organization must have at least one Admin.
  • Bug with reselecting reviewer when request re-renders
New
  • Okta app group assignment included in user, team, and group access table
  • Link to Google Admin from Google integration detail page
Changed
  • Request titles for 'Create entitlement for...', 'Update entitlement for...', and 'Revoke entitlement for...' are now 'Grant access to...', 'Update access to...', and 'Revoke access to...'
New
  • Drawer to explore user attributes from an integration
Changed
  • Integration display name hidden when only there is only one integration of the same type
  • Renamed 'System Bootstrap Service Account' to 'Init Service Account'
Fixed
  • Display of secondary email
  • Search in resource picker

Requests automatically select a reviewer for a request. In order of preference, this is the requestor (if they can self-approve), an object owner, or an Oblique Admin. The requestor can still select a different reviewer from the list of possible reviewers if desired.

Changed
  • Reviewer automatically selected for requests

Okta app detail pages include how a user has access to a resource, i.e. with an individual or group Okta app assignment.

New
  • Okta apps show Okta group assignments
  • User profiles include secondary emails
Fixed
  • Groups list page search query persists reloading

When multiple integrations provide the same user information, like title or manager, canonical attributes determine which source Oblique displays in user profiles.

Attributes from integrations are namespaced and all attributes remain available for attribute-based groups.

New
  • Canonical attributes
Changed
  • Redesign of integrations list page
  • Improved keyboard navigation in integrations list page
Fixed
  • Extended Latin accents now render correctly
  • Removed links to Okta and audit logs for non Admins
New
  • Filter resources by type (Okta group, Okta app, Google group)
  • Integration detail page shows number of attributes being synced

The Oblique Slack app lets Oblique notify users about pending requests directly in Slack.

The Slack app sends notifications for all requests made in Oblique to a public channel. Requestors and reviewers are automatically tagged, with updates threaded and status changes reflected in real-time.

New
  • Notifications for requests
  • Slack app
New
  • Go to profile option in command palette
Fixed
  • Faster navigation in reporting hierarchy
Deprecated
  • Administrative information removed from resource detail sidebar

Request access for current user by default

Section titled “Request access for current user by default”
New
  • App icons for Okta apps
Changed
  • Resource detail page shows whether current user has access
  • When making an access request, use current user as default subject

App assignments for Okta groups are shown on both the Okta app and the Okta group. View which Okta apps an Okta group is assigned on the Okta group’s resource detail page, and which Okta groups are assigned an Okta app on the Okta app’s resource detail page.

New
  • Group assignments for Okta apps shown on Okta app detail page
  • Okta apps assigned to group shown on Okta group detail page
Fixed
  • Requests cannot have duplicate changes
  • Deleted teams' members cannot be changed

Request change and access change summary card

Section titled “Request change and access change summary card”
New
  • Summary of changes and access changes in request page activity section
  • Count of apps being synced from an integration included in integration detail page
  • List of resources being synced from an integration on integration detail page
  • Attribute-based group and team group members lists show when users were added in overflow menu
Changed
  • Integration sync logs show relative time
  • Okta app assignments sync every 5 minutes

Okta apps and Okta app assignments sync as resources and entitlements for those resources. Put Okta apps into push mode to make Oblique the source of truth for app assignments.

New
  • Okta apps sync as resources
  • Team creation requests link to the created teams once the request is applied
Changed
  • More compact access previews in entitlement requests
  • Tweaking of Google OAuth2 prompts for faster logins
  • Add members button changed to Edit members on team detail page
  • Sync time under 1 minute shows 'just now'
Fixed
  • Entitlement expiration countdown shows n days, not n-1 days
  • Grant access button removed from push resources
New
  • Summary of access changes for users and resources in a request
Fixed
  • Request reviewers and Oblique Admins can enable or disable auto-apply for a request
Changed
  • Request timeline events for the same action are grouped
Fixed
  • Bug with expiring some entitlements

Request entitlement extension and revocation

Section titled “Request entitlement extension and revocation”

All entitlement changes use the request workflow.

New
  • Request to edit entitlements, to change expiration
  • Request to revoke entitlements

Creating an entitlement now uses the request workflow. Users can request access for themselves, another user, or an attribute-based group or team to any resource. The request can be approved by the resource owner or an Oblique Admin.

New
  • Request to create entitlements
  • Oblique automatically closes requests that are obsolete
Changed
  • Creating an entitlement is now a request
  • When an integration is removed, its resources are soft deleted
Deprecated
  • Obsolete requests are now 'Closed' with a comment instead of 'Obsoleted'
Fixed
  • Bug with removing users from groups
Fixed
  • Requests list page showed timestamps twice
  • Requests links opened in new tabs

Remove an integration to immediately stop syncing it. All resources from the integrations will be removed from Oblique.

New
  • Remove integration

Instead of auto-applying a change request, you can manually apply it after approval. This option can be changed until the request is approved. Once a request is approved, it can be applied by either the requestor, an owner, or an Oblique Admin.

New
  • Manually apply requests
Changed
  • Request title for single user changes include user's name
Fixed
  • Author badge also shown in owner section of team requests
  • Request subtitle shows closed time for closed requests
Changed
  • Requests are now 'Applied' instead of 'Merged'

The history of a request is now shown at the top of the request, with information on changes and access changes shown in separate tabs.

The request also shows if it set to auto-merge. This can be disabled by the requestor.

New
  • Disable auto-merge for request
  • User, team and group profiles display what other objects they are an owner of
Changed
  • Request page layout

Instead of using parent teams to allow for more complex management of a team, set another team group or attribute-based group as a team’s owner.

Deprecated
  • Parent teams
  • Team hierarchy section
Changed
  • Any user, not just a team owner, can request removing a member from a team
  • Redesigned team hierarchy component
Changed
  • User attributes section only visible to yourself and to Oblique Admins
  • Group and team hovercards include membership information, e.g., Member
  • URL for team detail page is now /teams/* instead of /team/*
Fixed
  • Request comments appear in the audit log for request events

Several improvements to the requests user experience, to make these easier to understand, faster, and more streamlined.

The Oblique app now live updates, so that when one user makes a change, for example approving a request, it immediately updates for other users, without needing to refresh the page.

When requests are approved, they are automatically merged.

When a user creates a request for a new team, they are automatically added as a team owner and team member as part of the request. If this is not what is desired, they can remove themselves prior to submitting the request.

Users list view has been deprecated. If you need to find a specific user, use the search bar and command palette.

New
  • Changes live update
  • Groups list view shows whether a user is part of a group
  • Users can leave a group they are a member of
  • Requests appear in audit logs
Changed
  • Approved requests auto-merge
  • Requestors for team creation are automatically listed as team owners and team members
  • User hovercards and detail pages include relationship information, e.g., Manager or Peer
  • User hovercards include email copy button
Deprecated
  • Users list view
Fixed
  • Incorrect keys for Windows keyboard shortcut
  • Bug where direct team owners were unable to approve team changes
New
  • Navigate to requests from the command palette
Changed
  • Users, teams and groups no longer have a 'Management' sidebar
  • Non-Admin users can no longer see configuration information for Integrations
New
  • Filter requests by state
  • Change user to add as part of a request to join a team

Each request includes a history of the request, including when it was created, any reviews requested, when it was approved, and when it was merged. This history also includes any comments made.

New
  • See request history

Requirements for a request to be approved are listed in the Review section, for example, changing team membership requires the approval of a team owner. Where a specific reviewer is required, you can choose Add reviewer to add a reviewer meeting those requirements, rather than manually selecting reviewers.

New
  • Requirements listed for approving a request
  • Option to add a suggested reviewer to meet a requirement

If set at the integration level, the creation of a new team in Oblique creates a corresponding Google group for the team.

New
  • Create Google groups for new teams
Changed
  • Redesign of team create request
New
  • Add comment when approving a request
Changed
  • Separate Approve and Merge buttons

Once a request is approved, it can be merged by either the requestor, an owner, or an Oblique Admin. Requests are not automatically merged.

New
  • Merge requests after approval
  • Timeline of requests on team detail page
Changed
  • Approved requests are not immediately merged

Owners of teams in Oblique can request to edit a team’s members, which needs the approval of the team owner, the parent team’s owner, or an Oblique Admin. A user can request to add or remove themselves or other members from the team. When an Admin reviews the request, they see how the request author is related to the team.

New
  • Edit team members request
  • Badge for author of edit team members request
  • Reviewers list includes an explanation for why they can be a reviewer
Changed
  • Editing a team's members requires a request
  • Reviewers can be edited after a request is created

When creating a request, a team can select specific reviewers to review the request. For joining a team, team owners are listed. For all requests, Oblique Admins are listed.

If the user making a request has sufficient permissions to approve it, e.g., if they are an Admin creating a team, the request is auto-approved.

New
  • Select reviewers for a team create request
  • Select reviewers for a team join request
Changed
  • Auto-approve requests
  • Improved picker for parent team in team create request

Users of Oblique can request to join a team, which needs the approval of an Oblique Admin. The user can also optionally include a justification as part of the request. When an Admin reviews the request, they can also preview how the user’s access will change when they are added to the team.

Creating a team always requires a request, including when an Admin requests to create a team.

New
  • Join team request
Changed
  • Creating a team always requires a request
New
  • Requests tab shows count of open requests
Changed
  • Requests awaiting approval are now called 'Open' instead of 'Active'

Users of Oblique can request the creation of a new team, which needs the approval of an Oblique Admin. The request includes the team name, description, members, owners, and parent team. The user can also optionally include a justification as part of the request. Admins can see requests in the new requests page, accessed from the Requests tab.

New
  • Team create request
  • Requests page
Changed
  • Vertical redesign of group creation page
  • Vertical redesign for team creation page
  • Vertical redesign for add entitlement page
  • Vertical redesign for add integration page
New
  • Rich hovercard with detailed group information
  • Rich hovercard with detailed team information
  • Rich hovercard with detailed resource information

Connect Oblique with Google Workspace to pull users from Google and manage Google Groups. Pull and push membership of Google groups from within Oblique.

New
  • Sync users from Google Workspace
  • Sync Google groups resources
  • Manage Google groups resources
New
  • Rich hovercard with detailed user information
  • Search for users by email
Changed
  • Improved view of reporting chain and reports
New
  • Add and remove team members as part of a single change

Preview the impact of an access change as part of adding entitlements or changing team membership:

  • Which users and resources are affected, and which users remain unaffected
  • Which users gain or lose access per resource
New
  • Preview the impact of access changes on users and resources

Quick search for users, team and attribute-based groups, resources, and integrations by typing their name in directly.

You can also use keyboard shortcuts for search. Use Command + K Control + K to open search.

New
  • Search for integrations
New
  • Integration sync logs

Attributes display a richer set of information, including what integration they are from, total number of values, and sample values.

New
  • Rich attributes on the user profile, group detail, and integration detail pages
  • Download a csv of attributes from the integration detail page

Oblique is available in Light, Dark, and System modes. By default, Oblique respects System settings.

New
  • Dark mode
Changed
  • By default, Oblique's appearance is set to System

See users with indirect access to a resource

Section titled “See users with indirect access to a resource”

From the resource detail page, you can:

  • See a list of every user who has access to the resource
  • Identify whether each user has direct access, indirect access (through group membership), or both
New
  • See list of users with indirect access to the resource from the resource detail page
  • See how a user has access (direct, indirect, or both) and via which groups or teams from the resource detail page
  • Delete direct user entitlements from the resource detail page
  • Filter resource list by the number of users with access to the resource
  • Integration detail page shows recent syncs
Changed
  • By default, the resource list is filtered by the number of users with access to the resource