Release v0.124.0
Oct 19, 2026
A fuller Trust Center with declared controls, documents on request, framework views and a signed attestation; connection health that tells you when an integration breaks; Huntress and SentinelOne deployed from a configuration policy; Windows System Restore checkpoints before patches, scripts and installs; an AI data and privacy policy; verified Microsoft 365 identity actions; and faster navigation between customers. Back up before upgrading: one migration is one-way.
Trust Center
- Declared controls: practices Breeze can't measure, such as security awareness training, an incident response plan or cyber insurance, can be declared by a named person on your team. Each declaration expires after a year, with a reminder a month before, so the page never quietly goes stale. An MFA-enforced control can be derived from the customer's Microsoft 365 Conditional Access policies.
- Documents on request: publish a policy or an audit report as gated. A visitor confirms their email, you approve the request, and they get a download link that lasts seven days. Optional NDA text can be required before download.
- Framework views with coverage summaries (NIST CSF 2.0 by default), a subprocessors list with suggestions from the tools Breeze already sees, an FAQ, and a 90-day history of controls met.
- A partner-wide template under Settings → Partner → Trust Center. Every organization's page inherits it, with Inherited badges and a reset on each field.
- A signed, machine-verifiable attestation of the page, an embed card for the customer's own website with an allowlist of origins, and CSV or JSON questionnaire export from the editor.
- Customers can edit their draft page from the portal when you turn that portal feature on. Publishing stays with you. The public page is translated into eight languages.
Connection Health
- A Connection Health panel on Integrations lists every broken integration with a link to the fix, and the recent recoveries. It covers Huntress, SentinelOne, Pax8, UniFi, backup providers, EDR consoles, accounting, DNS filtering, Microsoft 365 connections and sync, Google Workspace, and ticket mailboxes.
- Dead webhooks and stalled syncs are detected, not just failed sign-ins.
- Admins who can fix an incident get one daily digest email, sent during their morning, with a toggle under My Account and a one-click unsubscribe. Customer admins can be notified too; that is off by default.
Security Agents & Windows Safety Nets
- Huntress and SentinelOne deployed from a configuration policy, first usable release: turn a vendor on in the policy's Security Agents tab and every in-scope device whose organization is mapped in that vendor's integration gets the agent, with per-device coverage on the policy compliance view and alerts for gaps. Endpoints a SentinelOne console no longer returns are marked absent instead of reading as covered.
- Windows System Restore checkpoints, agent side: with this release's agent, Windows devices take one restore point before the first change a patch run, script or software install makes, and report the outcome back to patch history, script results and deployments. The policy shipped in v0.123.0; this is the release that makes it real.
- Linux maintenance-window reboots get the same prompt, deferral and deadline as Windows, with a broadcast to signed-in terminal users and a direct reboot when no one is signed in.
AI & Microsoft 365
- AI data and privacy policy: a partner default and an organization override (the organization can only tighten) for what the AI assistant may read from devices (Off, Excludes user profile folders, or Any path with approval) and how long tool output is kept (30 days by default). The policy is enforced for chat, agent runs, MCP, Breeze Assist and the script builder, and device file contents, command output and registry values now reach the model clearly marked as untrusted data.
- Verified Microsoft 365 identity actions: password resets and account disables are pinned to one Entra account and need a fresh caller verification (SMS or email link, callback attestation, or an administrative disable with MFA step-up) before they run.
- Eight more Microsoft 365 identity actions are available through the AI assistant with four-eyes approval, such as revoking sessions, resetting MFA and managing group membership. Tenants consented to the previous permission profile keep the actions they already cover; a new action asks for re-consent first.
- A partner can hold more than one Anthropic connection, for example a second key for another region. Only the first takes over the features that were on the platform key.
- API keys and OAuth grants can be limited to chosen MCP tool areas (Devices, Scripts & automation, Patching, Monitoring, Network, Security, Backup, Tickets), and an OpenAPI source kind lets you add your own REST tools to the catalog.
Navigation & Everyday Work
- The header organization switcher becomes Customer › Page, with live counts of devices online and offline, open tickets and critical alerts.
- Organization, site, device and ticket names link to their record everywhere they appear. A Recent list sits in the sidebar and on the dashboard.
- The devices list gains an Attention column (open alerts and tickets) and a column chooser. Organization records lead with fleet health, add billing address and site columns, and get a Devices tab with search and filters. Bulk reboot or lock asks for confirmation first.
- Tickets: save a ticket's checklist as a template, duplicate a template, see step progress in the queue, and link or change the device on an existing ticket.
- Record an agreement the client signed elsewhere (DocuSign, wet ink, email) with its evidence snapshot.
- Device Group filters gain does not equal and is not one of. Two new Windows library scripts remove printers by name or everything except a list, each with a dry run.
Agent & Remote Support
- Remote desktop over a relay no longer fails when the relay candidate arrives late. Needs this release's agent and viewer.
- Agents stay connected under load: the watchdog no longer restarts a healthy agent when the server answers busy, reconnects back off when the server asks, and Windows DHCP state is read without spawning a PowerShell process per heartbeat.
- Windows notifications are raised natively with no console flash, and fall back cleanly when notifications are disabled. Windows 10 1507 agents no longer crash-loop.
- Zscaler Client Connector, GlobalProtect, Cisco Secure Client, FortiClient and Netskope are recognized as VPN providers.
Security & Platform
- Security hardening across verification and invoice links, AI tool results, AI device file reads (fail closed when the owning partner cannot be established), MCP grant scoping, backup and EDR credential changes, caller-verification retries, policy caches after an organization move, rate limits, and a standard security.txt with an abuse contact. Self-hosters are encouraged to upgrade.
- Patch approval rules now live only on the Update Ring; the old policy-level auto-approve switch is gone from every surface.
- Privileged access: moving or merging a device's organization expires its live elevation requests with an audit entry.
- Field validation errors read as plain sentences, and API error messages are translated in six more languages.
The Trust Center you first saw in v0.123.0 is now a page you can hand to a prospect. Declare the controls Breeze can’t measure, publish a policy as a gated download, pick the framework the customer cares about, and give them a signed attestation and an embed for their own website. If they want to tweak their draft, they can do it from the portal while publishing stays with you.
Connection health closes the gap between “the integration was set up” and “the integration still works.” One panel lists every broken connection, dead webhook and stalled sync with the fix one click away, and the people who can fix it get a single morning digest instead of a stream of alerts. In the same spirit, Huntress and SentinelOne now deploy from a configuration policy with real coverage reporting, and Windows devices take a System Restore checkpoint before patches, scripts and installs, so the fast path back from a bad change is already there when you need it.
Before you upgrade, take a database backup. This release retires the old AI model configuration storage after archiving it, and that migration is one-way: rolling back to v0.123.0 means restoring the database. Password resets and account disables for Microsoft 365 now require caller verification by default; if your environment file still carries the old CALLER_VERIFICATION_ENABLED=false line, remove it, or those two actions will be refused. The GitHub release notes list every migration and setting.