We are pleased to announce the upcoming updates to Netwrix Identity Manager (NIM). This release expands certification workflows with multi-certifier support and role filtering, and introduces navigation and usability improvements.
Want the full details? Click the link below!
Important Dates
- The update is scheduled to be released to the preproduction environment on 2026-07-09T14:00:00Z→2026-07-09T16:00:00Z
- The update is scheduled to be released to the production environment on 2026-07-27T15:00:00Z→2026-07-27T17:00:00Z
New Features and Enhancements
Certification delegation
Access Certification campaigns now support delegation, allowing certifiers to assign individual items to other users for review recommendations while retaining final decision authority.
Campaign configuration
Campaign creators can enable delegation when creating a single-reviewer campaign. A new Delegate checkbox is available under the Allowed Actions section during campaign creation. Once a campaign is created, this setting cannot be modified. Delegation is not available for multi-reviewer campaigns.
Certifier experience
When delegation is enabled, certifiers gain access to three tabs:
- My Items — the standard certification tab
- Delegated to Me — items delegated to the logged-in user by another certifier
- Delegated to Others — items the logged-in user has delegated to someone else
A Delegate action is available on any undelegated item in the My Items tab. Items with an existing active delegation or a recorded decision do not show the Delegate action. Clicking Delegate opens a side panel where the certifier selects a recipient and adds an optional comment. After delegation, the item moves to the Delegated to Others tab.
To revoke a delegation, use the Revoke Delegation button on any item in the Delegated to Others tab. The item returns to the certifier’s My Items tab and is removed from the delegate’s view. The delegate’s comment and decision are cleared.
Delegate experience
When an item is delegated, the delegate receives an immediate email notification with the campaign name and description. The item appears in their Delegated to Me tab. Delegates can record:
- Approve or Refuse — records a recommendation visible to the certifier in their Delegated to Others tab
- Not For Me — returns the item to the certifier’s My Items tab with an Activity indicator; the delegate’s comment is preserved in the audit trail
Delegates cannot delegate or transfer items further.
Confirming decisions
When a certifier clicks Confirm Decisions and delegated items have recorded recommendations, a confirmation popup appears. The certifier can choose Confirm All Decisions to proceed or Cancel to review the Delegated to Others tab first. If the certifier has overridden a delegate’s recommendation, the certifier’s decision is used. Delegated items with no recorded recommendation are treated as undecided.
Audit trail
The Certification Report includes two new columns for delegated items:
- Delegated To — the display name of the delegate
- Delegate’s Decision — the delegate’s recorded decision (Approve, Refuse, Not For Me, or blank if none recorded)
If a certifier overrides a delegate’s recommendation, both decisions are captured. If a delegation is revoked, both columns are cleared.
The existing Forward History popup has been renamed Activity History. It now includes an Action column distinguishing between Transferred and Delegated events, with both types of history visible in the same panel.
SCIM 2.0 Connector (Preview — NIM 7.1)
Preview: Do not use in production without explicit Netwrix approval.
Netwrix Identity Manager 7.1 introduces a new SCIM 2.0 connector for bidirectional identity synchronization with any RFC 7643/7644-compliant endpoint.
Key capabilities:
- Export— reads users and groups from a SCIM endpoint into NIM for synchronization, with support for incremental (delta) exports.
- Provisioning— creates, updates, and deletes accounts and group memberships. Supports a “deactivate instead of delete” mode to preserve accounts for reactivation.
- Password reset— updates passwords directly on the managed system via SCIM.
- Flexible authentication— OAuth2 client credentials, static bearer token, or HTTP Basic.
- Schema auto-discovery— automatically detects the target system’s attribute schema at connection setup.
New left navigation menu
A persistent left-hand navigation menu is now visible on all pages. The menu is collapsible, allowing users to expand it for full labels or collapse it to a compact, icon-only view.
Campaign description field
Campaign creators can now add a description to a certification campaign. The description is visible to certifiers in email notifications, providing context before they begin reviewing.
Permission-based filtering in campaigns
Certifiers can now filter campaign items by permission. This makes it easier to isolate specific roles within a campaign, speeding up review and reducing the risk of overlooking or misjudging access during decision-making.
Multi-reviewer mode now generally available
Multi-reviewer mode for certification campaigns has graduated from Preview and is now generally available. The preview flag has been removed, and per-campaign reviewer mode selection is available directly in the campaign settings UI.
Bug Fixes and Miscellaneous Updates
New
| Component | Description |
|---|---|
| Certifications and Risks | Certification campaign items can now be filtered by permission (role) in addition to user. Certifiers can filter by role category (including all child categories) or select specific roles, making it faster to review who holds a given permission across large campaigns. |
| Certifications and Risks | The new feature, multi-certifiers for certification reviews, is no longer in preview and has been released for general availability. This option can be activated when creating campaigns. See the documentation for more information. |
| Connectors and Integrations | The Salesforce SCIM connector now supports the OAuth2 client credentials flow. Set ApplicationId and ApplicationKey to the Connected App’s Consumer Key and Secret respectively and leave Login and Password empty. Salesforce is deprecating the resource owner password credentials flow on September 1, 2026 — migration to client credentials is required before that date. |
| UI / UX | Role and category filtering now accepts “>” as a separator, matching the visual breadcrumb displayed in the UI (e.g., Human Resources > Payroll > Sedna > Reader). Surrounding spaces around “>” are also handled. This applies across all screens that filter on roles: Access Roles, Role Review, Role Reconciliation, Permission Basket, Role Selection, Workflow Overview, and Access Certification Campaigns. |
| UI / UX | The Assigned Roles page now includes a “Denied” option in the workflow state filter, allowing denied assignments to be viewed and filtered. |
| UI / UX | The left navigation menu is now visible on all pages and can be collapsed to icon-only view. Breaking change: menu and entity type icons now use Font Awesome instead of Fluent UI. Most icons are migrated automatically during the database upgrade; connector icons can be updated via the UI and others via the configuration. |
Fixes
| Component | Description |
|---|---|
| Access Control and Workflows | A bulk workflow using a picker control on a multi-valued property crashed when the picker submitted a null value. The null value is now handled correctly and the workflow completes successfully. |
| Access Control and Workflows | The workflow summary step failed with an error when the summary includes a collection of navigation properties containing more than 5 items. The summary step now loads and displays the collection correctly regardless of item count. |
| Connectors and Integrations | The SAP S/4HANA connector is now compatible with .NET 10, requiring an updated HANA client driver available from NuGet or the SAP tools website. Copy Sap.Data.Hana.Net.v10.0.dll and rename it to Sap.Data.Hana.Net.dll. |
| Jobs and Policy | Profile assignments were not calculated when a ProfileRule used a SubExpression and its parent ProfileRuleContext specified an EntityType. Profile assignments are now calculated correctly in this configuration. |
| Jobs and Policy | The Send-Notifications task failed with an unhandled error and sent no notifications when a role policy notification had more than one reviewer identified by a profile email (e.g. a shared mailbox). The task now completes successfully. |
| Jobs and Policy | Updating a scalar or binary resource assignment via the API with only the changed fields returned an error. Partial updates now succeed as expected. |
| Jobs and Policy | When keeping a non-conforming role via Role Reconciliation, the assignment’s context-bound end date behavior was not applied correctly. The kept assignment now respects the configured end date locking mode. |
| UI / UX | Resource type counters (ResourceCount, AssignmentCount, OrphanCount) were computed only incrementally and could drift permanently from actual values. These counts are now recalculated during complete synchronization and non-dirty classification runs, ensuring accurate counter resets. |
Need help with this update?
There are many different ways to get help with our products!
| Situation | Action |
|---|---|
| If you feel the product is broken and not working as intended… | Contact Support |
| If you have a question you’d like to ask other experts… | Create a discussion in the community: Identity Manager > Discussions & Questions |
| If you have a feature request… | Let our product team know directly: Identity Manager > Ideas |
| If you have something cool to show… | Show everyone what you built: Identity Manager > Show & Tell |
What are your thoughts?
We are always happy to hear from our users on what you like, and what you hope to see in the future. Please, share your thoughts below!