This release tackles two blind spots that have been quietly growing in hybrid environments — AI agent identities and cloud file activity — giving your security team a clearer, more complete view of what’s happening across your environment.
Want the full details? Click the link below!
What’s Changed in Netwrix Threat Manager 3.3
Visibility into AI Agent Identities in Microsoft Entra
AI agents are emerging as a new, privileged identity type, with their own lifecycle, roles, and authentication behavior that existing identity monitoring wasn’t built to see. Netwrix Threat Manager 3.3 gives teams the visibility they need to understand where AI agents exist and how they’re being used.
Investigate Azure Files Activity in Threat Manager
Threat Manager 3.3 brings Azure Files activity directly into your investigation workflow. See exactly what’s happening with your cloud file operations, right where you already work.
Requires Netwrix Activity Monitor v10.1+.
Enhancements
- Organizations can now define the organizational unit (OU) or naming convention (e.g., SVC_*) for their service accounts, enabling automatic population of the Service Accounts dashboard without manual tagging.
- Reduce alert noise by excluding known-safe locations (e.g., VPN exit points, trusted offices) from Impossible Travel detection logic.
Bug Fixes and Miscellaneous Updates
Investigations
- Fixed incorrect perpetrator attribution in Application Permission Change alerts caused by malformed Azure audit log data.
- Fixed a server error when expanding Azure authentication event details during investigations.
- Fixed Azure Sign-Ins displaying a null GUID for the target.
- Fixed the Abnormal Time job crashing under certain conditions.
- Fixed a server error when filtering NTP-based investigations by time of day.
- Fixed the perpetrator filter not applying correctly to applications in investigations.
- Fixed the time filter not returning correct results in some investigation scenarios.
- Fixed the Object Move operation incorrectly displaying as “Renamed” in NTP investigation descriptions.
- Fixed a missing error message when filter values are left empty on the Events Over Time and Top Resources tabs.
Identity & Directory Sync
- Fixed legacy (2.7 and earlier) Disable Active Directory Account actions failing on execution.
- Fixed re-created objects incorrectly retaining links to deleted object details.
- Fixed global roles not being created per tenant during Entra ID sync, which caused cross-tenant role linking.
- Fixed intermittent inability to connect to Entra.
- Fixed computer objects displaying as user objects after deletion.
- Fixed a missing retention policy for Azure sync history.
- Fixed cancellation requests for Azure and AD history sync failing to send when navigating between pages.
Service Accounts & Tags
- Fixed the Tags page returning duplicate entries.
- Fixed the ‘Sensitive’ tag assignment from NAA not applying correctly.
- Fixed search cleanup not triggering after clicking “View Critical Accounts” on the Service Accounts page.
- Fixed the Investigate button not navigating to the investigation page from Service Accounts.
- Fixed long service principal name (SPN) values being truncated on the service account detail form.
- Fixed audit log entries not being created when tags were added or deleted.
Authentication & Access
- Fixed the MFA authentication provider not being set correctly when adding the first password for an admin post-install.
- Fixed the login error message failing to display when external authentication configuration is missing.
- Fixed a server error at login for new users added via SAML group membership.
- Fixed a misleading error message on the login page when a password change is required.
- Fixed username not displaying on the credential profile.
Threat Response & Playbooks
- Fixed the PowerShell action step body overlapping other controls in Threat Response.
- Fixed the ability to create playbook entries with duplicate names.
Platform & Administration
- Fixed incorrect date formatting in threat notifications. *(Escalation 00484117)*
- Fixed a server error when exporting logs with PostgreSQL hosted on a separate server. *(Escalation 00483739)*
- Fixed the “GET Favorites” request returning an empty array.
- Prevented creation of duplicate-named entries on the Integrations page.
- Fixed missing CSS styles for radio buttons in email integration settings.
- Fixed broken styling on the recipients field of the export-via-email form.
- Fixed the Move Database feature referencing a previous product name.
- Fixed installer warning message colors to match the current theme.
- Improved PostgreSQL reconnection logic.
Plan your upgrade
Netwrix Threat Manager 3.1 will reach its end of support life on February 18, 2027. For more info, visit the Supported Versions page.
Need help with this update?
There are many different ways to get help with our products!
| Situation | Action |
|---|---|
| If you feel the product is broken and not working as intended… | Contact Support |
| If you have a question you’d like to ask other experts… | Create a discussion in the community: Threat Manager > Discussions & Questions |
| If you have a feature request… | Let our product team know directly: Threat Manager > Ideas |
| If you have something cool to show… | Show everyone what you built: Threat Manager > Show & Tell |
What are your thoughts?
We are always happy to hear from our users on what you like, and what you hope to see in the future. Please, share your thoughts below!