An issue where the Add Microsoft 365 tenant wizard requested consent for the wrong Cayosoft multi-tenant application when adding a GCC High tenant, which could block tenant onboarding until the correct consent was granted.

Cayosoft Guardian now collects change audit events from Cayosoft Administrator and presents them in Change History with the actual initiator of each change, instead of the Administrator service account.

After you register a Cayosoft Administrator server in Cayosoft Guardian and enable Change audit event writing in Administrator, operations performed in Administrator appear as Change History records. Find related returns both the Administrator record and the corresponding managed-system record for the same object, so you can connect a request to the change it produced.

To learn more about the feature, see Configuration: Add a Cayosoft Administrator server.

Cayosoft Guardian now rolls back changes through saved rollback jobs. Select one or more Change History records and create a named job that you can review, configure, and run again. Each job contains its records, restore settings, and any temporary credentials for just-in-time elevation.

If Guardian connects to a Microsoft Entra tenant or Active Directory domain with read-only permissions, add temporary Global Administrator or domain admin credentials to the job. Guardian elevates access only while the job runs and removes it when the job completes, fails, or is canceled.

Jobs also support adding a comment at creation, so you can link the rollback to a ticket.

To learn more about the feature, see Rolling back changes in Cayosoft Guardian.

Cayosoft Guardian now supports adding a backup location in read-only mode, so that backups written by one Cayosoft Guardian installation can be used for recovery by another, fully isolated installation.

When a backup location is read-only, Cayosoft Guardian does not apply retention rules and does not modify or delete its contents. This supports air-gapped recovery, where backups are produced in the production environment and restored by a separate recovery instance that cannot alter them.

Cayosoft Guardian now offers AI-enabled search for saved queries in Change History. As you type in the Quick search box, Cayosoft Guardian interprets your request and suggests the saved queries that match it under Relevant queries for you, with the filters it inferred shown alongside each suggestion. Double-click a suggestion to run the saved query.

To learn more about the feature, see Change History: AI-enabled search.

Cayosoft Guardian now supports adding a managed domain for Forest Recovery only, using a least-privileged account instead of a Domain Admin account. On the Select capabilities step of Configuration > Managed Domains > Add domains and partitions, clear Change monitoring and threat detection and keep Forest recovery.

This lets managed service providers and organizations with strict credential policies protect a domain without holding administrative credentials in it: the customer creates and owns the service account, and Forest Recovery runs through the in-domain agent.

Cayosoft Guardian now supports Microsoft 365 Government Community Cloud (GCC) and GCC High tenants. Administrators select the cloud instance in the Microsoft cloud environment settings, and Cayosoft Guardian authenticates and calls Microsoft Entra ID, Exchange Online, and audit log endpoints inside that sovereign boundary instead of the commercial cloud.

GCC High installations use a dedicated Cayosoft multi-tenant application registered in a Cayosoft-owned GCC High tenant, so you can sign in to the Cayosoft Guardian console with a GCC High account and collect changes from a GCC High tenant without depending on a commercial identity.

Cayosoft Guardian now provides an improved quick filter experience in Change History and preserves the grid layout with saved queries.

Quick filters can be combined across What, Where, Action, and When without clearing previously selected values, and each picker supports selecting multiple values. Columns, sorting, and grouping are stored with a saved query, so you no longer need to reapply them each time the query is opened.

Built-in and downloadable saved queries now include extended metadata, including a short description, a full description, and tags.

This makes it easier to find the right query for a use case and to understand what a query returns before running it.

The initial configuration wizard now includes an optional Configure notifications step. Administrators can configure Exchange Online and Microsoft Teams communication channels after activating the product, with admin consent granted once for both channels.

To learn more about the feature, see Configuring notifications in the initial configuration wizard.

Cayosoft Guardian now reports a clear error when you attempt to roll back a nested, or transitive, group membership Change History record.

Nested membership records are generated for reporting and cannot be rolled back; the rollback job now completes with an explanatory message instead of failing without explanation.

To learn more, see How Cayosoft Guardian collects changes .

Cayosoft Guardian now supports transferring backup data to Azure Storage over Azure Private Endpoint and Private Link instead of public Azure Storage endpoints.

This allows organizations whose security policy blocks traffic to public Azure Storage FQDNs — including those transferring backups from an on-premises SMB appliance — to use Instant Forest Recovery while keeping backup traffic inside their private network.

To learn more about the feature, see Manage cloud recovery sites.

Cayosoft Guardian now allows Forest Recovery backup plans to include domains that are managed through an Active Directory connector.

Because the Active Directory connector supports group managed service accounts (gMSA) in untrusted forests, this enables Forest Recovery for domains that can only be reached that way.

NOTE    For domains managed through an Active Directory connector, disaster recovery agent management is manual. You can install or upgrade agents on demand from the Cayosoft Guardian console using a Domain Admin account, or run the agent setup on each domain controller.

To learn more about the feature, see Forest Recovery: Create and run backup plans.

The relative time interval in the Change History When filter — Retrieve data in the last [N] [unit] — now supports Days in addition to Weeks and Months.

The Forest Recovery license tier now includes Cayosoft Guardian Protector functionality at no additional cost. Customers licensed for Forest Recovery only also get the change monitoring capabilities included in the Protector tier.

To learn more about the feature, see Planning and preparation: Product licensing.

The Cayosoft Guardian application registration now requests the SharePointTenantSettings.Read.All Microsoft Graph permission, which is required by a new threat signature.

NOTE    On upgrade, an administrator must grant consent for the new permission in the Microsoft Entra admin center before the related threat signature can evaluate.

An issue where rollback initiated from an object's Properties > Change History tab in Live View failed for both Active Directory and Microsoft Entra ID objects, returning the error: Resource 'versionHistory' does not exist or one of its queried reference-property objects are not present.

Related requests: 18118.

An issue where thread pool starvation could delay the start of Forest Recovery child jobs beyond the fixed 30-second timeout, causing recovery and backup plans to fail.

Related requests: 18220.

An issue where Change History records for Active Directory objects could be misattributed when several updates were made to the same object in quick succession: updates made by different administrators were collapsed into a single record, and the wrong account was reported in Who.

Related requests: 18294.

An issue where Who was not discovered for Microsoft Entra group membership updates when the change collection job ran for several minutes, even though the corresponding event was collected to the event log.

An issue where unexpected Change History records were reported for the Microsoft Entra Admin Consent Request Policy after the change collection job encountered throttling or other errors from Microsoft Graph.

An issue where the initiator was not discovered for Exchange Online mailbox customAttributeXX properties updated by directory synchronization. Who was reported for the corresponding Microsoft Entra user change but left empty for the mailbox change.

An issue where repeating Change History records were reported for Exchange Online mailbox timestamp properties such as litigationHoldDate and lastExchangeChangedTime when Exchange Online returned the same timestamp in different regional formats.

An issue where the Status field in the change alert details panel was disabled in Cayosoft Guardian Protector, so alerts could not be dismissed or resolved.

Cayosoft Guardian now supports Microsoft US government clouds. Administrators select the Microsoft cloud environment for the installation, and Cayosoft Guardian authenticates and calls Microsoft services in the selected cloud, GCC High or GCC, as well as the commercial cloud.

To learn more about the feature, see Configuration: Add a Tenant.

Cayosoft Guardian now supports forest recovery backup plans for Active Directory domains that are managed through an AD connector.

Because AD connectors support group managed service accounts (gMSA) in untrusted forests, this allows organizations to protect domains in untrusted forests with a gMSA account rather than a trusted-forest credential.

To learn more about the feature, see Forest Recovery: Create, configure, verify and run forest recovery plan.

Cayosoft Guardian now uses a configurable Job start timeout (seconds) value for forest recovery and backup plans.

The timeout is set in Job Manager settings, defaults to 180 seconds, and accepts values from 30 to 1200 seconds. Job worker settings are now shown in the web interface, together with new read-only properties that let administrators review the current Job Manager load.

To learn more about the feature, see Job Execution Settings.

Related requests: 18220.

An issue where Active Directory Change History records could be misattributed when several updates were made to the same object in quick succession. Changes made by different administrators could be collapsed into one record, so the Who value from one update was reported for attributes changed by another. This occurred both when only non-linked attributes were updated and when a linked attribute, such as manager, and non-linked attributes were written at the same time.

Related requests: 18294.

An issue where Cayosoft Guardian could report repeated, or flickering, Change History records for Exchange Online mailbox timestamp properties, including litigationHoldDate and lastExchangeChangedTime, when Exchange Online returned the same timestamp in different regional formats, such as en-US and en-GB.

Related requests: 18592.

An issue where the initiator was not discovered for Exchange Online mailbox customAttributeXX changes that originated from an on-premises Active Directory extensionAttributeXX update on a hybrid mailbox. The Who value was reported for the corresponding Microsoft Entra ID user change but left empty for the mailbox change.

Related requests: 18592.

An issue where Cayosoft Guardian could report unexpected Change History records for Microsoft Entra ID policies when Microsoft Graph returned an error for the policy request during change collection. Affected policies are Admin Consent Request Policy, Authentication Flows Policy, Device Registration Policy, Authorization Policy, and External Identities Policy.

Related requests: 18564.

An issue where the initiator was not discovered for Microsoft Entra ID group membership updates when the Entra change collection job continued to run for several minutes after group changes were collected. The Who value was left empty even though the corresponding event was collected in the Event log.

Related requests: 18564.

Cayosoft Guardian now tracks nested, or transitive, group membership changes for Active Directory and Microsoft Entra ID groups. When a member is added to or removed from a group, Cayosoft Guardian generates Change History records for each parent group in the nesting chain.

To learn more, see How Cayosoft Guardian collects changes

Cayosoft Guardian now supports deploying a standby forest recovery site into customer-provided Azure networking resources, including a virtual network, subnet, and network security group, instead of provisioning its own resources.

This allows organizations with strict network governance, hub-and-spoke topologies, or pre-approved subnet allocations to use Guardian standby forest recovery while meeting internal networking standards.

To learn more about the feature, see Manage cloud recovery sitesand Forest Recovery: Create a cloud recovery site for Forest Recovery plan.

Cayosoft Guardian now supports registering an Azure subscription by using a customer-provided application account identified by Client ID and authenticated with a client secret or certificate.

The registration and downstream Forest Recovery, backup, and Cloud Service wizards complete end to end without requiring Global Administrator privileges in the customer's Microsoft Entra tenant.

To learn more about the feature, see Cloud Services.

Cayosoft Guardian now supports secure LDAP (LDAPS over port 636 and Global Catalog over SSL on port 3269) for Active Directory connections made by both the Cayosoft Guardian Service and the Forest Recovery agent.

This allows Cayosoft Guardian to operate in hardened environments that require TLS-encrypted LDAP traffic for security and compliance mandates such as HIPAA, NIST, and PCI-DSS.

To learn more about the feature, see Security guide.

The Forest Recovery agent now supports WinRM over HTTPS (port 5986) when connecting to Domain Controllers to collect Active Directory topology metadata during backup, in addition to the existing HTTP transport (port 5985).

This enables successful backups in hardened and mixed environments where some or all Domain Controllers allow only WinRM over SSL.

To learn about the feature, seeSecurity guide

Cayosoft Guardian now lets administrators restrict public network access to temporary recovery site storage accounts used during Azure standby forest recovery, reducing the attack surface during deployment.

New options under Service Settings > Forest Recovery settings allow administrators to scope public access to specific IP addresses or ranges and to allowed Azure virtual network subnets.

By default, public access is not restricted to preserve previous behavior.

To learn about the feature, see Forest Recovery Settings.

Cayosoft Guardian now optimizes DNS processing during Forest Recovery to reduce recovery time in environments with large DNS configurations.

New options allow administrators to skip reverse lookup zone cleanup, skip DNS SRV record cleanup, and perform AD-integrated zone and record removal directly through LDAP.

To learn more about the feature, see Forest Recovery settings.

Cayosoft Guardian now supports inclusion rules for AD Change Collection jobs, in addition to existing exclusion rules, allowing administrators to define a positive scope for monitored objects.

Inclusion and exclusion rules can be combined on the same job. The more specific, deeper rule takes precedence, and rules can apply to a single object or to an object and its children.

When no inclusion rules are configured, the job continues to monitor the full environment as before.

To learn more about the feature, see Define collection scope for an AD Change Collection job

Cayosoft Guardian now restores links to re-created Microsoft Entra users and groups when a hard-deleted object is recovered through Rollback.

After recovery, Cayosoft Guardian updates references to the object's new ID in Conditional Access Policies, including Named Locations, App Role Assignments, and PIM role assignments, so restored objects remain correctly linked.

To learn more about the feature, see Objects supported by Cayosoft Guardian.

Cayosoft Guardian now supports undelete through the Recycle Bin for Microsoft Entra security groups.

Deleted security groups appear in the Deleted Objects container and can be undeleted from there or from a Change History deletion record, restoring the group with its original object ID.

To learn more about the feature, see Objects supported by Cayosoft Guardian.

Cayosoft Guardian now provides a consistent experience between the Add Azure Subscription wizard in Cloud Services and the Add Microsoft 365 Tenant wizard.

The update aligns wizard steps, descriptions, sign-in behavior, and the name of the created Entra application.

To learn more about the feature, see Cloud Services.

An issue where Forest Recovery could not create resources in Azure when a custom Azure Policy that blocks subnets without an assigned network security group was enforced.

An issue where job settings for Configure Primary DNS Zones and Configure DNS Records recovery workflow steps displayed DNS optimization checkboxes that did not correctly represent the actual configuration.

An issue where the connection to the built-in LocalDB history database could time out during service startup without being retried, which could cause Cayosoft Guardian to create a new, empty history database.

Connection timeouts to LocalDB are now retried, consistent with external database handling.

Related requests: 17338.

Cayosoft Guardian is now enhanced with stronger in-transit security by ensuring encrypted WinRM transport and by applying LDAP sealing across previously uncovered communication paths between Cayosoft Guardian and domain controllers, eliminating identified cases of unencrypted traffic.

Cayosoft Guardian now supports updating existing Azure subscriptions from legacy user account credentials to Entra application account credentials. When an existing subscription is re-added, Cayosoft Guardian updates the subscription to use Entra application account authentication. Related backup locations, including temporary locations in recovery sites, are updated automatically.

To learn more about the feature, see How to switch Forest Recovery from a connection account to an Entra application account.

Cayosoft Guardian now supports using an Entra application account in the Add Cloud Service wizard when adding an Azure subscription for Forest Recovery. This allows administrators to create and manage Forest Recovery Azure resources under a dedicated Microsoft Entra application (instead of relying on a user account), with the required subscription permissions applied for resource deployment and ongoing credential management.

To learn more about the feature, see Cloud Services

Cayosoft Guardian now lets administrators automatically resolve remediated alerts for supported threat signatures from Threat Detection > Threat Alerts. When triggered, auto-resolve evaluates all eligible supported alerts and marks remediated ones as Auto-resolved, reducing manual alert cleanup.

For more information about changes, see Auto-resolve support for CTD-000001 and CTD-000033 threat signatures

Cayosoft Guardian now supports LocalDB 2025 (SQL Express) for the built-in database option. This increases the default maximum size of the built-in database to 50 GB, reducing database-size limitations for new installations and upgrades that previously used the 10 GB limit.

IMPORTANT    When using a local database, Cayosoft Guardian will upgrade the database to SQL Server Express 2025 during installation. Ensure the host runs Windows Server 2019 or later, as required by SQL Server Express 2025.

For the full list of system requirements, see Planning and preparation: Cayosoft Guardian system requirements

Cayosoft Guardian now monitors changes to Microsoft Entra Agent Identity entities, including Agent Identity Blueprints, Agent Identities, Agent Identity Blueprint Principals, and Agent Users. This expands Change Monitoring coverage for Microsoft Entra ID objects and helps administrators review Entra agent-related activity directly in Change History.

For the full list of objects supported by Cayosoft Guardian, see Objects supported by Cayosoft Guardian.

An issue where Cayosoft Guardian could generate a false Member Added alert when a time-bound Microsoft Entra PIM activation expired for a role assigned as Eligible via group.

Related requests: 17048

Cayosoft Guardian introduces fine-grained Role-Based Access Control (RBAC) with six predefined roles, enabling administrators to delegate precise permissions aligned with operational responsibilities. A user or group may be assigned one or more of the following roles:

• Global Administrator - Full access to all features and settings in Cayosoft Guardian.

• Global Reader - Read-only access to all areas in Cayosoft Guardian, including configuration and monitoring data.

• Threat Alerts Reader - Review all detected threats and alert details.

• Threat Detection Operator - Manage threat detection jobs, configure notifications, and mark threats as resolved.

• Change History Reader - Review the full history of configuration and object changes across connected systems.

• Change Monitoring Operator - Manage change monitoring, review changes, and manage alerts.

To learn more about the feature, see Role-based access control in Cayosoft Guardian.

Cayosoft Guardian introduces support for Write-Once-Read-Many (WORM) compliance mode for Azure and AWS S3 storages. Administrators can now enable Immutable and Retention Period options when adding Azure and AWS S3 storages. When configured, Cayosoft Guardian applies Time-Based Retention to the bucket and objects in Compliance mode, ensuring that stored backups cannot be modified or deleted during the retention period.

To learn more about the feature, see Forest Recovery: Add backup locations.

Cayosoft Guardian has added support for tracking QR code authentication method changes for Microsoft Entra ID users. Cayosoft Guardian now captures add, edit, and remove operations for the QR code (Preview) method, displaying correlated records in Change History and detailed property updates in the Event Log.

For the full list of objects supported by Cayosoft Guardian, see Objects supported by Cayosoft Guardian.

Cayosoft Guardian introduces a standardized ownership model across configuration and system objects bringing clarity, consistency, and control to how Cayosoft Guardian determines who can manage specific objects across the system.

Three new metadata properties are now available for applicable entity types:

• Created by – identifies the account that created the object

• Modified by – identifies the account that last modified the object (populated on update where feasible)

• Owners – a multi-valued property listing all authorized owners; by default, includes the creator
  

An issue where domain trust password reset operations skipped domains whose DNS names contained uppercase characters.

Related requests: 16347.