What has changed in the shared platform every service runs on, newest first.
Changes to administration, roles and Teams, identity and provisioning. Bug fixes and routine maintenance are not listed here, and the platform release notes cover every service in one feed.
New
Under Self-Service Portal, Teams an organization keeps teams of email addresses, added by hand or provisioned over SCIM. A team is bound to a Sign In access policy, to an EasyPSK, EntryPoint or Endpoint Manager group with the roles its members get, to an EasyPSK onboarding rule or to a Site manager role. A binding can send a welcome mail to people who join later.
New
Deleting a team, removing a member or unbinding a team opens one dialog that counts the people who lose access and what happens per service: Sign In sessions end and pending guest requests are declined, personal PEAP accounts are deleted, and personal EasyPSK groups are deleted. The removal takes effect within a minute and cannot be undone.
New
Self-Service Portal, Provisioning adds a SCIM registration for self-service users, with its own bearer token and activity log. Provisioned groups become Self-Service Teams marked SCIM, and a changed user name moves everything to the new address. A person the identity provider blocks or removes from a group loses access at once, and their PEAP accounts and EasyPSK groups are kept blocked for 30 days in case they return.
Changed
When the identity provider sets an administrator inactive, the administrator is now blocked instead of removed. Roles and teams are kept, and setting the person active again within 30 days restores them. After 30 days the administrator is removed. A delete still removes at once. The Administrators list hides blocked administrators unless Show blocked is on.
New
A new Self-Service Portal runs beside the classic one. The organization chooses the Default portal, Classic unless changed, and each user can switch. An EasyPSK group opens on a home page with the network, the password, the QR code, the devices with online state, the device cap and Register a device for Wi-Fi or cable. Sign In, EntryPoint, EasyPSK and Endpoint Manager groups all have pages there.
New
The organization menu has a Self-Service Portal section with Settings, Authentication, Teams and Provisioning. Settings holds the default portal, the appearance of the new portal (dark, light or match the device), the languages with a fallback, a light and a dark mode logo, and the portal address with Copy link. The logos are used on the new portal’s sign-in page and in Wi-Fi Key Card designs.
Improved
The audit log of the organization and of each Sign In, EntryPoint, EasyPSK and Endpoint Manager service is a timeline with search, a period, chips per kind of change with counts, and a panel showing each change before and after. Export CSV downloads the newest 5,000 entries.
Changed
The organization menu has an Administration section with Settings, Authentication, Administrators, Teams, Provisioning and Applications. Settings holds the organization’s name and website, its slugs and the network access list for the Administration Portal. Email MFA sits under Authentication, which also shows the Administration Portal address with Copy link. The identity pages open with a short introduction film and links to the documentation.
Improved
The Administration Portal, the MSP Portal and the Self-Service Portal ask Do you want to stay signed in? two minutes before an idle session ends, with a countdown, Sign out and Stay signed in. After a new version is deployed they show Portal updated, and the next page opens the new version.
New
Under Selfservice Access Control, Authentication, Email Magic Link can be disabled once SAML 2.0 for the Self-Service Portal is enabled and configured. The portal’s sign-in page then shows only the SAML button, sign-in links already sent by email stop working, and emails that link to the portal lead to its login page. SAML 2.0 cannot be disabled while it is the only sign-in method. The setting covers the whole organization.
New
The menu of the MSP Portal, and of the Admin Console for the partner’s organizations, shows the partner’s logo at the top in place of the platform logo. Netgraph sets the logo for the partner: PNG, WebP or SVG, made for a dark background and with a transparent background. Without a partner logo the menu keeps the platform logo.
New
An Applications entry under Admin Access Control, in the Admin Console and in the MSP Portal, holds API keys for scripts and integrations. A key gets the APIs it may call at Read or Write level, the Sign In contexts it covers (all, including new ones, or a selection), a token expiry from 30 days to none, and an IP access list. The token is shown once; a key can be disabled and rotated with an overlap of up to seven days.
The Alerts page warns 30 days before a key’s last token expires and when it has expired, with a link to the key.
New
The Applications page shows the API base URL and every endpoint path with the organization, context and partner IDs filled in. With the Platform API an organization key reads the organization and its contexts and manages Sign In access policies, their email patterns and whitelistings, with batch create and revoke. With the MSP API a partner key reads the status of every tenant’s Sign In contexts: each Service Gateway router’s reachability and SXP connection, and the default gateways of the DHCP scopes, filterable on state.
Lists are paged with a cursor, errors carry one code per cause, and an OpenAPI description is served at /openapi.json under the base URL.
New
A SAML registration shows the signing certificate it uses and the published replacement, each with fingerprint, validity period and its own download. The registration can be switched to the replacement early and back while the previous certificate is valid; the console asks for confirmation since the identity provider must hold the new certificate first.
The MSP Portal shows the same block on its registration view.
New
A new Alerts entry under Services in the left menu, with a count badge coloured by the most serious item. The page lists the certificate warnings from the RADIUS services and from single sign-on, filtered to what the administrator has rights to see, and each alert links to the page where it is resolved.
New
A Team is a named group of administrators that holds roles. Instead of assigning roles to each person, you grant them to a Team and manage who belongs to it. Every member inherits what the Team holds.
A Team can hold different roles in different service contexts, so one team can administer a context while holding read only access to another. Access to a further context can be added from the Team itself.
An administrator's detail page lists the Teams they belong to and what each one grants, so it is possible to see where a person's access actually comes from.
Available at organization level and, for partners, in the MSP Portal.
New
Administrator accounts and groups can be provisioned automatically from an identity provider over SCIM 2.0. When someone joins the relevant group in your directory they become an administrator here, and when they are removed or deactivated their access is withdrawn.
A provisioned group becomes a Team, so the roles granted to that Team apply to whoever your directory places in it.
A provisioning activity log records what the identity provider sent and what came of it, searchable and paged.
New
An organization, and a partner in the MSP Portal, can federate administrator sign-in with its own identity provider. The sign-in page offers the identity providers configured for the scope being signed in to.
A federation carries a default role, so someone who arrives without a role claim still lands with defined access, and roles can be mapped from the claim your identity provider sends.
Administrators who arrive this way appear in the list without having been invited, with the source of the account shown alongside the date they joined.
New
The portal is available in every language an organization can be set to. A language picker is offered, and the organization's own default takes precedence over a secondary browser language rather than losing to it.
The page also reports its active language to the browser, so screen readers pronounce it correctly.
New
An organization can reach the platform over a private IPSec tunnel instead of the public internet. A firewall, or any device on your side that supports IPSec, establishes a single tunnel to a dedicated endpoint on the platform, and the services you bind to it carry their traffic through it.
EntryPoint's RADIUS path, EasyPSK via RADIUS, the platform's access to an on-premises Cisco ISE, and webhook deliveries can each be bound to the same tunnel. Sign In is not carried this way: it uses the Service Gateway.
A connector's page shows the settings to apply on your own device, including a worked Cisco IOS-XE example, the routes the connector publishes, and which services and ports are using it. Tunnel status is shown per connector, and the destination of a bound service can be changed without unbinding it first.
Available to organization administrators and, for partners, in the MSP Portal.
Improved
The basic settings show the source host name that webhook deliveries come from, so it can be allowed through a firewall without guessing.
Improved
When a session expires the page you were on is remembered, and you are returned to it after signing in instead of to the dashboard.
New
An administrator is given roles at the level the access belongs to: on the organization, or on a single service context inside it. The same person can therefore administer one service while only reading another.
The partner side works the same way in the MSP Portal, with its own set of partner roles.
New
A customer is an organization, and each service it runs is a service context inside that organization. Sign In, EntryPoint, EasyPSK and Endpoint Manager are all created and administered the same way, under the same organization, instead of each living in its own structure.
One identity can hold roles in more than one organization and move between them without signing out, which is what lets a consultant or a partner employee work across several customers.
New
An organization can federate sign-in against its own identity provider on all three surfaces: the administration portal, the Self-Service portal, and the captive portal where a guest or employee signs in to the network.
Each surface is configured separately, so an organization can federate its administrators without federating its guests, or the other way around.
New
An organization can list the IP ranges its administrators sign in from, so the administration portal answers only from the networks you name.
Changed
Administrative changes are recorded the same way whichever service they concern, and read from one place, instead of each service keeping its own record in its own shape.
Webhooks follow the same model, so the events an integration subscribes to look alike across services.
New
Partners have their own portal, separate from the Administration and Self-Service portals that customers use. It is where a partner provisions and manages the organizations it serves, and follows their usage and support.
New
Webhooks are no longer tied to one service. Every service can publish its events, and which webhooks an administrator may see and change follows their roles.
A delivery is inspectable: the console shows which endpoint was called, which event types the delivery carried, and whether it succeeded. Events raised while a webhook is switched off are held rather than lost, and the console says plainly that the webhook is disabled.
Sign In session events are covered in full, and events can be delivered in batches instead of one request per event.
New
Each service carries its own set of administrator roles, so access can be granted for one service without granting it for the others an organization happens to run.
New
How long login records, session history and device data are kept is set per service context, under Administration and Compliance. The shortest period that can be configured is one day.
Terms and privacy policy are handled separately from each other at the same time, so one can be changed without touching the other.
No entries for that service yet.
