We are pleased to announce the upcoming updates to Netwrix Identity Manager (NIM). This release expands certification workflows with multi-certifier support and role filtering, and introduces navigation and usability improvements.
Want the full details? Click the link below!
New Features and Enhancements
Certification delegation
Access Certification campaigns now support delegation, allowing certifiers to assign individual items to other users for review recommendations while retaining final decision authority. For more info, see here.
Campaign configuration
Campaign creators can enable delegation when creating a single-reviewer campaign. A new Delegate checkbox is available under the Allowed Actions section during campaign creation. Once a campaign is created, this setting cannot be modified. Delegation is not available for multi-reviewer campaigns.
Certifier experience
When delegation is enabled, certifiers gain access to three tabs:
- My Items — the standard certification tab
- Delegated to Me — items delegated to the logged-in user by another certifier
- Delegated to Others — items the logged-in user has delegated to someone else
A Delegate action is available on any undelegated item in the My Items tab. Items with an existing active delegation or a recorded decision do not show the Delegate action. Clicking Delegate opens a side panel where the certifier selects a recipient and adds an optional comment. After delegation, the item moves to the Delegated to Others tab.
To revoke a delegation, use the Revoke Delegation button on any item in the Delegated to Others tab. The item returns to the certifier’s My Items tab and is removed from the delegate’s view. The delegate’s comment and decision are cleared.
Delegate experience
When an item is delegated, the delegate receives an immediate email notification with the campaign name and description. The item appears in their Delegated to Me tab. Delegates can record:
- Approve or Refuse — records a recommendation visible to the certifier in their Delegated to Others tab
- Not For Me — returns the item to the certifier’s My Items tab with an Activity indicator; the delegate’s comment is preserved in the audit trail
Delegates cannot delegate or transfer items further.
Confirming decisions
When a certifier clicks Confirm Decisions and delegated items have recorded recommendations, a confirmation popup appears. The certifier can choose Confirm All Decisions to proceed or Cancel to review the Delegated to Others tab first. If the certifier has overridden a delegate’s recommendation, the certifier’s decision is used. Delegated items with no recorded recommendation are treated as undecided.
Audit trail
The Certification Report includes two new columns for delegated items:
- Delegated To — the display name of the delegate
- Delegate’s Decision — the delegate’s recorded decision (Approve, Refuse, Not For Me, or blank if none recorded)
If a certifier overrides a delegate’s recommendation, both decisions are captured. If a delegation is revoked, both columns are cleared.
The existing Forward History popup has been renamed Activity History. It now includes an Action column distinguishing between Transferred and Delegated events, with both types of history visible in the same panel.
SCIM 2.0 Connector (Preview — NIM 7.1)
Preview: Do not use in production without explicit Netwrix approval.
Netwrix Identity Manager 7.1 introduces a new SCIM 2.0 connector for bidirectional identity synchronization with any RFC 7643/7644-compliant endpoint.
Key capabilities:
- Export— reads users and groups from a SCIM endpoint into NIM for synchronization, with support for incremental (delta) exports.
- Provisioning— creates, updates, and deletes accounts and group memberships. Supports a “deactivate instead of delete” mode to preserve accounts for reactivation.
- Password reset— updates passwords directly on the managed system via SCIM.
- Flexible authentication— OAuth2 client credentials, static bearer token, or HTTP Basic.
- Schema auto-discovery— automatically detects the target system’s attribute schema at connection setup.
For complete documentation on this new connector go here.
New left navigation menu
A persistent left-hand navigation menu is now visible on all pages. The menu is collapsible, allowing users to expand it for full labels or collapse it to a compact, icon-only view.
Breaking change: New left navigation & icon set (UI rebranding project)
Part of our ongoing UI rebranding initiative, this release updates the left navigation menu and replaces the icon library used across the product.
What’s changing:
- Persistent left navigation — The left navigation menu is now visible on all pages. It can be collapsed to an icon-only view to save screen space.
- Icon library migration — Menu and entity type icons now use Font Awesome instead of Fluent UI. This is a visual change only; it does not affect functionality.
Breaking change details
This release changes the underlying icon library. Here’s what that means for your environment:
Icon type What happens
Standard/system icons Migrated automatically during the database upgrade. No action needed.
Custom icons The migration script will run to update most icons automatically. Be aware that the next configuration deployment will overwrite this migration — you’ll need to update the icons in your configuration and redeploy to make the fix permanent.
What you need to do (custom icons)
You can run the migration script to update most custom icons automatically. Be aware that the next configuration deployment will overwrite this migration. To fix this permanently, you’ll need to update the icons in your configuration and redeploy.
- Run the migration script: The script can be found inside runtime here:
/Runtime/MigrationScripts/20260427.sqlThis updates most icons, including custom icons, as part of the database upgrade. - Update icons in configuration: Go through your custom icon configuration and update the icon references to valid Font Awesome icons. This is the permanent fix — it’s what prevents your next configuration deployment from overwriting the migrated icons.
- Redeploy the configuration: Once icons are updated, redeploy your configuration so the corrected references take effect going forward.
Note: Running the migration script is a quick fix to get icons displaying correctly right away, but updating the configuration and redeploying is the permanent solution. If you don’t update your icons in configuration before your next deployment, you’ll see a warning message indicating that the imported icon codes do not correspond to Font Awesome. The invalid icon codes will be displayed as dashes.
Why this matters
This is the first visible step in our broader UI rebranding effort. Standardizing on Font Awesome gives us a more consistent, extensible icon set going forward, and the always-visible collapsible navigation makes it easier to move around the product without losing context.
For more info see: How to Prepare for NIM 7.1: Icon Upgrade - Identity Manager / Show & Tell - Netwrix Community
Campaign description field
Campaign creators can now add a description to a certification campaign. The description is visible to certifiers in email notifications, providing context before they begin reviewing.
Permission-based filtering in campaigns (Preview)
Certifiers can now filter campaign items by permission. This makes it easier to isolate specific roles within a campaign, speeding up review and reducing the risk of overlooking or misjudging access during decision-making.
Permission based filtering in campaigns is in preview mode: Preview Features | Netwrix Product Documentation
Multi-reviewer mode now generally available
Multi-reviewer mode for certification campaigns has graduated from Preview and is now generally available. The preview flag has been removed, and per-campaign reviewer mode selection is available directly in the campaign settings UI.
Bug Fixes and Miscellaneous Updates
New
| Component | Description |
|---|---|
| Certifications and Risks | Certification campaign items can now be filtered by permission (role) in addition to user. Certifiers can filter by role category (including all child categories) or select specific roles, making it faster to review who holds a given permission across large campaigns. |
| Certifications and Risks | The new feature, multi-certifiers for certification reviews, is no longer in preview and has been released for general availability. This option can be activated when creating campaigns. See the documentation for more information. |
| Connectors and Integrations | The Salesforce SCIM connector now supports the OAuth2 client credentials flow. Set ApplicationId and ApplicationKey to the Connected App’s Consumer Key and Secret respectively and leave Login and Password empty. Salesforce is deprecating the resource owner password credentials flow on September 1, 2026 — migration to client credentials is required before that date. |
| UI / UX | Role and category filtering now accepts “>” as a separator, matching the visual breadcrumb displayed in the UI (e.g., Human Resources > Payroll > Sedna > Reader). Surrounding spaces around “>” are also handled. This applies across all screens that filter on roles: Access Roles, Role Review, Role Reconciliation, Permission Basket, Role Selection, Workflow Overview, and Access Certification Campaigns. |
| UI / UX | The Assigned Roles page now includes a “Denied” option in the workflow state filter, allowing denied assignments to be viewed and filtered. |
| UI / UX | The left navigation menu is now visible on all pages and can be collapsed to icon-only view. Breaking change: menu and entity type icons now use Font Awesome instead of Fluent UI. Most icons are migrated automatically during the database upgrade; connector icons can be updated via the UI and others via the configuration. |
Fixes
| Component | Description |
|---|---|
| Access Control and Workflows | Configuration-Import failed with a NotSupportedException when deploying Razor templates containing an @functions block. These templates now compile correctly. |
| Access Control and Workflows | Clearing an Int32 or Int64 property value in a workflow form and submitting failed with an “Invalid int” error (HTTP 500). The value is now cleared successfully. |
| Access Control and Workflows | The workflow summary step failed with an error when the summary includes a collection of navigation properties containing more than 5 items. The summary step now loads and displays the collection correctly regardless of item count. |
| Access Control and Workflows | Action buttons on the Policy Simulation Roles and Rules pivots were visible to users holding a permission whose name shared a prefix with the required permission. Permissions are now matched exactly. |
| Access Control and Workflows | A bulk workflow using a picker control on a multi-valued property crashed when the picker submitted a null value. The null value is now handled correctly and the workflow completes successfully. |
| Connectors and Integrations | The agent could time out during long-running export or provisioning operations, causing the operation to fail even if the server was still processing. The agent now checks the server’s last progress and retries or logs a clear error and stops if the server appears stalled. |
| Connectors and Integrations | The SAP S/4HANA connector is now compatible with .NET 10, requiring an updated HANA client driver available from NuGet or the SAP tools website (see documentation for guidance) SAP ERP 6.0 and SAP S4/HANA | Netwrix Product Documentation) Copy Sap.Data.Hana.Net.v10.0.dll and rename it as Sap.Data.Hana.Net.dll |
| Jobs and Policy | When keeping a non-conforming role via Role Reconciliation, the assignment’s context-bound end date behavior was not applied correctly. The kept assignment now respects the configured end date locking mode. |
| Jobs and Policy | Updating a scalar or binary resource assignment via the API with only the changed fields returned an error. Partial updates now succeed as expected. |
| Jobs and Policy | The Send-Notifications task failed with an unhandled error and sent no notifications when a role policy notification had more than one reviewer identified by a profile email (e.g. a shared mailbox). The task now completes successfully. |
| Jobs and Policy | Profile assignments were not calculated when a ProfileRule used a SubExpression and its parent ProfileRuleContext specified an EntityType. Profile assignments are now calculated correctly in this configuration. |
| Logs / Performance / Security | Workflow overview and consultation queries could run slowly on large resource sets. New type-filtered reverse-join indexes on UR_Resources are now generated automatically during the ManageIndexes job to improve query performance. On Premises deployments should plan for additional index storage (\~0.1 MB per 1,000 rows in UR_Resources) on the first ManageIndexes run after upgrade. |
| UI / UX | ViewHistory returned no data when comparing a record-targeted resource type, or when an assigned resource type was created after the resource itself. History now loads correctly in both cases. |
| UI / UX | Resource type counters (ResourceCount, AssignmentCount, OrphanCount) were computed only incrementally and could drift permanently from actual values. These counts are now recalculated during complete synchronization and non-dirty classification runs, ensuring accurate counter resets. |
| UI / UX | Opening the scalar rule creation modal a second time after creating a rule left some fields hidden. All fields are now displayed correctly on every open. |
| UI / UX | The role assignment approval history showed only the last approver for roles with a multi-step manual approval workflow, omitting earlier reviewers. All reviewers are now displayed. |
| UI / UX | On the Roles selection pages, when a role or resource type shared its exact name with its parent category, narrowing the label column corrupted the breadcrumb display, repeating the name multiple times. The breadcrumb now renders correctly at any column width. |
Need help with this update?
There are many different ways to get help with our products!
| Situation | Action |
|---|---|
| If you feel the product is broken and not working as intended… | Contact Support |
| If you have a question you’d like to ask other experts… | Create a discussion in the community: Identity Manager > Discussions & Questions |
| If you have a feature request… | Let our product team know directly: Identity Manager > Ideas |
| If you have something cool to show… | Show everyone what you built: Identity Manager > Show & Tell |
What are your thoughts?
We are always happy to hear from our users on what you like, and what you hope to see in the future. Please, share your thoughts below!