Release v0.69.0
Jun 02, 2026
A broad security and tenant-isolation hardening pass, site-scoped technician access, a new Microsoft 365 help desk agent, a completed device filter bar with per-user columns, and Linux ARM64 agent support.
Security & Compliance
- Site-scoped technician access. Technicians limited to specific sites can no longer read or act on devices, browser policies, or AI-agent tools outside their assigned sites. A broad review closed a series of cross-site and cross-organization access gaps.
- Tighter AI-agent and automation isolation. Tool execution is now bound to the correct tenant, so an AI tool can never be steered to dispatch commands or collect data on another customer's devices.
- SOC 2 hardening. Expanded audit coverage and step-up multi-factor authentication for sensitive actions such as administrator changes and email-address updates.
- Hardened agent credentials and enrollment. Agent access is now tied to tenant status (suspended or deleted tenants lose access immediately), quarantined devices cannot re-enroll, and macOS agent updates are verified against a signed release manifest.
- Outbound-request protections. Third-party integrations — Huntress, Microsoft 365, SentinelOne, and DNS lookups — are hardened against server-side request forgery, and the agent update channel now refuses unsigned downgrades.
- Closed transient windows where agent configuration secrets could briefly appear in plaintext on disk.
Identity & Integrations
- Microsoft 365 help desk agent. A new AI agent can perform Microsoft 365 help desk tasks with role-based access controls, approval workflows, and full audit logging.
Devices & Interface
- Completed device filter bar. The chip-based filter engine is now feature-complete, with hardened search input so wildcard characters in a search no longer behave unexpectedly.
- Per-user column visibility and reordering on the Devices list. Choose which columns you see and drag them into the order you want; your layout is remembered per user.
Remote Management & Agent Reliability
- Fixed fleet-wide black screen on Windows remote desktop. The agent now self-heals a missing helper component that could leave remote sessions showing a black screen.
- More reliable remote sessions. Improved idle detection, reconnection, and session teardown, plus enforcement of mid-session access revocation and clipboard controls.
- Correct characters in terminals and process output. Terminal and process output now stay on UTF-8 boundaries, fixing garbled characters that could appear across data chunks.
- More resilient enrollment and restarts. The agent presents its existing token on a forced re-enrollment and records its live process ID early in startup, avoiding stale-state issues.
Platform & Infrastructure
- Linux ARM64 agent. Breeze now builds and serves agent binaries for ARM64 Linux devices such as Raspberry Pi and ARM-based servers.
- Encrypted off-region backups. Database backups are GPG-encrypted and copied to a separate region for disaster recovery.
- Graceful API shutdown. The API now drains in-flight requests before tearing down workers and database connections during a deploy, reducing dropped requests.
- More accurate patch counts. Uninstalled patches are no longer counted as outstanding, and software version pinning is correctly rejected on non-Windows devices.
Version 0.69.0 is a security-first release. The bulk of the work is a wide hardening pass across multi-tenant isolation: technicians scoped to specific sites are now consistently prevented from reading or acting on devices, browser policies, and AI-agent tools outside those sites, and a series of cross-site and cross-organization gaps were closed across the device, automation, and AI layers.
On top of that, this release adds SOC 2 hardening — broader audit coverage and step-up multi-factor authentication for sensitive actions — and tightens agent security end to end: access is tied to tenant status, quarantined devices can’t re-enroll, macOS updates are signature-verified, and third-party integrations are hardened against server-side request forgery.
Beyond security, 0.69.0 introduces a Microsoft 365 help desk agent with role-based controls and approvals, completes the new device filter bar with per-user column visibility and reordering, adds a Linux ARM64 agent, and fixes a fleet-wide black-screen issue on Windows remote desktop.