Version 2026.3.0 (September 15, 2026)

Version 2026.3.0 (September 15, 2026)

avatar
Maxime Bernier

Breaking Changes

  • Get-DSPamFolder is deprecated and no longer available for Devolutions Server workspaces past version 2026.3.0; users should instead use Get-DSFolder or Get-DSFolders
  • Legacy Website entries can no longer be edited before being converted to modern Website entries
  • Removed deprecated parameters ResetPasswordOnCheckIn, UnmanagedAction, and Unmanaged in Import-DSPamScanResult


New Features

  • Added Add-RDMForbiddenPasswordList to add a forbidden password list
  • Added ConvertTo-RDMEntryXml to serialize a live entry (from Get-RDMEntry) or a historical version (from Get-RDMEntryHistory) to XML
  • Added Enable-DSPamProviderSelfRotation to convert a PAM provider's own username/password into a server-managed, self-rotating PAM account
  • Added Get-DSAdministrativeRole, Add-DSRoleAssignment, Get-DSRoleAssignment, Remove-DSRoleAssignment, and Get-DSPrincipalRoleAssignment to look up, grant, and revoke Devolutions Server administrative role assignments at vault, gateway, PAM provider, organizational unit, or global scope (requires a workspace running 2026.3.0 or later)
  • Added Get-RDMAdministrativeRole, Add-RDMRoleAssignment, Get-RDMRoleAssignment, Remove-RDMRoleAssignment, and Get-RDMPrincipalRoleAssignment for managing role assignments through an active RDM/RDMS data source connection
  • Added Get-RDMEntryCheckOut to fetch an entry's current check-outs
  • Added Get-RDMEntryHistory to list an entry's version history, newest first; accepts a PSConnection via pipeline or -InputObject, and requires a workspace that supports version history
  • Added Get-RDMForbiddenPasswordList to fetch forbidden password lists
  • Added Get-RDMImportableDomain to discover the domains an identity provider makes available for import
  • Added Get-RDMImportableUser to discover the users an identity provider makes available for import
  • Added Get-RDMTicket to retrieve tickets from a ticketing service selected via -ServiceName or -ServiceId (defaulting to the highest-priority one), emitting each ticket's Code, Summary, Priority, Status, Description, Assignee, and Url
  • Added Get-RDMTicketingService to list the log-enabled ticketing services configured on the current data source (Name, Id, ServiceType, Priority), never returning stored credentials
  • Added Get-RDMUserTags to allow fetching user tags
  • Added Get-RDMUserTemplate to retrieve the user template (default settings for new users) from a workspace's system settings
  • Added Get-RDMVaultTemplate, New-RDMVaultTemplate, Set-RDMVaultTemplate, and Remove-RDMVaultTemplate to manage vault templates on Devolutions Server and Devolutions Hub
  • Added Import-RDMUser to import users discovered from an identity provider
  • Added Invoke-RDMUserCleanup to clean up users that no longer match their identity provider
  • Added Remove-RDMEntryHistory to delete specific version(s) of an entry's history, or all versions of one or more entries; requires administrator or vault-owner rights and a workspace that supports deleting version history (Hub Business is not supported)
  • Added Remove-RDMForbiddenPasswordList to remove a forbidden password list
  • Added Restore-RDMEntryHistory to revert a live entry to a version obtained from Get-RDMEntryHistory, preserving the entry's password history and restoring any embedded document from that version; supports -PassThru to return the reverted entry
  • Added Set-RDMForbiddenPasswordList to modify a forbidden password list
  • Added Set-RDMUserTags to allow updating user tags
  • Added Sync-RDMUser to synchronize users from providers
  • Added Sync-RDMUserGroup to synchronize user groups from providers


Improvements

  • Added a -VaultTemplate parameter to New-RDMVault to create a new vault pre-populated from an existing vault template on Devolutions Server and Devolutions Hub
  • Added -AllowCheckoutExtensions parameter to New-DSPamCheckoutPolicy and Update-DSPamCheckoutPolicy to enable allowing or disabling checkout extensions on a policy
  • Added -CheckOut parameter to Invoke-RDMEntryCheckIn to force the check-in of specific user check-outs
  • Added -JitAccountMode parameter to New-DSPamAccount and Update-DSPamAccount, adding a new EnableDisable JIT mode that references an existing DomainUser or AzureADUser account instead of creating one, enabling it and adding it to configured groups on checkout, and disabling it and removing it on check-in
  • Added -MaxCheckoutTime parameter to New-DSPamCheckoutPolicy and Update-DSPamCheckoutPolicy to enable setting a policy's maximum checkout time
  • Added -MaxExtensionTime parameter to New-DSPamCheckoutPolicy and Update-DSPamCheckoutPolicy to enable setting a policy's maximum extension time
  • Added -RequireApprovalForExtensions parameter to New-DSPamCheckoutPolicy and Update-DSPamCheckoutPolicy to enable setting a policy's extension approval behavior
  • Added -Resolved parameter to Get-DSPamCheckoutPolicy to return the effective global-default value for any policy setting left at its default
  • Added -Tag parameter to Get-RDMUser to allow filtering returned users by their tags
  • Added -UserType, -HasUserVaultAccess, -Language, -OfflineMode, -AllowDragAndDrop, -PasswordManagerOfflineMode, -AllowApiKey, -DefaultVault, and -PassThru parameters to Edit-RDMUserTemplate, alongside the existing -AddVault/-RemoveVault
  • Blocked deletion of the currently-selected vault by Remove-RDMVault, which now raises an error
  • Changed Edit-RDMUserTemplate to raise a catchable error on workspaces that don't support user templates (e.g., Hub, local), instead of silently warning and doing nothing
  • Deprecated the -Workspace parameter on Edit-RDMUserTemplate; the cmdlet now operates on the current workspace by default, and using -Workspace emits a warning
  • Emits a warning and returns $null from Get-RDMCommand -Tool SSH instead of a file path, since SSH is no longer bundled
  • Invoke-RDMEntryCheckOut and Invoke-RDMEntryCheckIn now issue a single batched request for all entries piped through in one call instead of one request per entry on Devolutions Server workspace
  • IsJitAccount on New-DSPamAccount is deprecated in favor of -JitAccountMode CreateDelete; it still works, but now emits a deprecation warning
  • Marked Get-RDMForbiddenPassword and Set-RDMForbiddenPassword as deprecated
  • New-DSPamProvider and Update-DSPamProvider now accept a -LinkedCredential parameter to link an existing PAM account (from Get-DSPamAccount) as the provider's credential instead of a Username/Password pair; the cmdlet raises a catchable error if the supplied object is not a PAM account
  • New-DSPamProvider now returns the created PamProvider object instead of returning nothing
  • New-DSVault, Update-DSVault, and New-DSPamVault now emit a warning instead of failing when their -User, -UserGroup, or -Application parameters can't be applied because the workspace uses the role-assignment model; the vault operation itself still succeeds
  • On Devolutions Server workspaces running 2026.3.0 or later, Add-/Remove-RDMUserVaultAccess and Add-/Remove-RDMUserGroupVaultAccess simply assign or unassign the Vault User role on that vault instead of writing to the legacy per-vault list, and warn, naming the role, if the target still has access through another role assignment after a revoke
  • PSConnectionHistory now includes a HistoryTypeDescription property showing what kind of change it was (Update, Insert, Delete, Restore, or Move)
  • RDM license cmdlets now work on Hub data sources
  • RDM user cmdlets now work on Hub data sources
  • RDM user group cmdlets now work on Hub data sources
  • Remove-RDMDeletedEntry now raises a targeted error when a piped-in history record is not a deleted-entry record (i.e., not obtained from Get-RDMDeletedEntry), instead of processing it silently
  • Set-DSVaultUser, Set-DSVaultUserGroup, Set-DSVaultApplication, and Get-DSVaultPermission now raise a clear error directing callers to the new role-assignment cmdlets when run against a workspace that has switched to the role-assignment model, instead of appearing to succeed while doing nothing
  • Set-RDMEntry and Set-RDMEntryPassword now validate forbidden passwords
  • Update-DSPamAccount can now switch an existing account's JIT mode between None and EnableDisable, which it previously couldn't change at all after creation. CreateDelete remains settable only at creation (New-DSPamAccount) and can't be changed once set
  • Update-DSPamProvider now emits a warning when a -LinkedCredential switch will delete the provider's current self-rotation-managed account


Fixes

  • Fixed a TypeLoadException when authenticating to Microsoft Graph (Connect-MgGraph) after importing Devolutions.PowerShell, caused by a conflict between bundled Azure/Graph/Identity assemblies
  • Fixed Bitwarden synchronizers warning with "The Bitwarden synchronizer is not supported." on Open-RDMSyncEntry
  • Fixed bug in Invoke-RDMEntryCheckOut where folders couldn't be checked out if one of their children was checked out
  • Fixed New-DCEntry not persisting document attachment metadata when using -DocumentPath parameter
  • Fixed Rename-RDMGroup allowing a folder to be renamed to a name that collides with an existing sibling or descendant group
  • Fixed Set-RDMEntry and New-RDMFavoriteFolder's duplicate-folder-name check missing collisions with folders hidden from the user by permissions
  • Fixed Set-RDMEntryCredentials reporting a user vault entry's previous credential mode instead of the mode just set (e.g. Inherited) when the entry was queried again in the same PowerShell session


All Comments (0)