Release date: 1 Augus 2026| Previous version: v26.4.0 (15 May 2026)
Scope: Aggregated changes across patches v26.4.1 through v26.4.24 and the upcoming v26.5.0 minor cut.
Features
DLP enforcement module (new service)
New standalone DLP service with a dedicated DLP page in the client (Settings, Transport Rules and Audit tabs)
Exchange transport-rule enforcement managed from a central DLP configuration, with one-click automatic enabling of transport rules (MS OAuth handler plus client button)
Per-algorithm-category transport-rule switches (new dlp_transport_rule flag on algorithms and algorithm_category); incompatible algorithms are blacklisted automatically
Document classes can now trigger DLP actions via new dlp_notify and dlp_block flags
Teams notifications: dedicated Teams bot with automatic installation, notifications for all sources, and a direct link to the Teams chat message in each notification
Enforcement flow: grace periods before enforcement, admin enforcement and cancellation, revert-block action with grace-period options, and an exclusions table with removal support
Graph integration: OCR is invoked for DLP processing; files not shared externally or last modified by an application are skipped; SharePoint "all" scope excludes OneDrives; quarantine email returns the moved message id
Full audit trail in the new dlp_audit index, including sender name and email; redesigned DLP audit tab with chart, summary cards and polished log table
New "Manage DLP" IAM permission; all DLP routes are permission-protected
LLM document classification
LLM classifier integration in document-class tagging (new llm-management service integration)
LLM classification controls in the Document Class Builder, including a new output_class_only document class type
All marking and refresh tasks respect the llm_class flag; classification calls authenticate via IAM_SECRET
AI dashboard charts and MCP server
Built-in per-tenant MCP server for AI-created dashboard charts
MCP key management in the client with a new "Manage MCP Keys" IAM permission
AI charts render on the dashboard (new ai_chart_ids field on dashboard configs); new analytics routes serve AI chart data
Mailstore (IMAP) source type
New mailstore source type backed by the IMAP service: creation form, settings page and account management
Accounts are set active on registration; account list with metadata-only enforcement indicator
Mailstore enforcement routing through the IMAP service
Data-subject tagging (Known Persons)
Tag data subjects directly: new tags on the known-persons index with status per tag
Quick-create a tag from a data subject, with custom tag naming
Tagging engine: label-value matching
New Label Value matching in tags, including multiple label values per tag and "label value near label value" queries
Near-text tag queries now support multiple words
Runtime-mapping efficiency improvements for NearLabel and LabelValueNear
New tagger handler for the label_value type in the profiler
Token and drive fishing (Graph pre-filtering)
New FISHING ingestion mode for token-based pre-filtering of Graph sources, with KQL query batching and time bounding
Drive fishing ingestion service with diff-based new/delete detection and false-positive token exclusions
Enabled per source definition; fishing queries are loaded from a storage file
MIP label hierarchy
Parent information is stored for MIP labels; the client shows the full label hierarchy
Parent labels are hidden in policy enforcement selection
Both the new and the old MIP label format are written when tagging
MIP tagging is disabled automatically when enforcement is disabled on the source
Google Drive and Gmail in Data Owners
Google Drive and Gmail sources now appear in Data Owners
Owners and custom owners on Drive sources (new owners field on google_drives); owners shown instead of creator id
Custodian spreadsheet download and upload for Google Drive sources
OCR pipeline
Combined worker for signature, YuNet and ID-or-not processing
New tesseract-only extraction route with a dedicated express queue
Direct ingestion respected end-to-end; PDF images with annotations over them are skipped; unreadable PDF images no longer crash processing
Client platform overhaul
New DropdownPanel component adopted across the entire app: teleported panels, smart positioning, unified styling
Bootstrap fully removed from the client (drained into scoped SCSS partials, modern CSS reset, stylelint added)
Logs moved to a separate sidebar page
TinyMCE editor removed; new HTML/Markdown conversion utilities
Changes
Credentials and app registrations
Daily reminder emails to sendout managers for 14 days before an Azure app-registration secret expires
Secret-expiration checkbox on the app registration form
Purge and reingestion
Purge-all support for Outlook and OneDrive graph_modern sources; purge status criterion with migration
Stale graph_modern SharePoint sites are tagged for purge; purge cleaning alert added
Case-insensitive site and drive matching in purge; obsolete reactive purge code removed
Source defaults
Graph sources: default deltas set to daily, default threads reduced from 8 to 2
Fileshare sources: default one thread per source
New sources get updated defaults for shared and personal mailbox ingestion
Data Owners
Multiple emails per path via semicolon-separated values in custom owners and Outlook mailbox uploads
Additional columns supported in custom-owners uploads; upload lines sorted before parsing
Custodian uploads standardised on spreadsheets (CSV upload disallowed in custodians)
"Show more" label reflects 10,000+ results
Exchange on-premise (EWS)
Delete-tagged enforcer with skip-orphan support
Business-hours throttling driven from the collector
Duplicate-account guard on account creation
Reporting and analytics
ITR variant of the PoC report, plus a classified-documents-per-language section
PoC and monthly report colours aligned with the dashboard; key figures hidden when SharePoint data is missing
Executive summary reworked; groundwork for AD-group scoped monthly reports
Usage stats switched to percentages; server-stats history kept for 14 days
Platform resilience
Elasticsearch bulk writes no longer trigger 429 storms
Graph 429/503 responses retried honouring Retry-After
ES health alerts tuned: red-only on single-node clusters, red-or-yellow on multi-node clusters
Tika streams auto-closed to prevent leaks (EWS, IMAP, Google, fileshare, Graph)
Integrations
Simplified DMCS to Redaction Tool integration (push model); Pixel Redaction button in the REDACTED tab
Deploy GitHub Action with Ansible playbook for orchestrated host upgrades; release action can be triggered by the management tool
Bugfixes
API
Fix race conditions when marking fileshare sources and in CSV creator/owner update tasks
Fix sort order when fetching Data Owners documents; fix sorting report documents by path
Fix user-policies aggregation and report-sendout blacklist edge cases
Fix Azure user search count mismatch; apply search query to groups field; group searches made case-insensitive
Fix ES version issue for counts with runtime mappings
Fix LLM classification scope and stale-detection in unmark tasks
Fix missing HubSpot id in caselog contacts; fix edit-exchange for demo accounts
Client
Post-migration dropdown fixes: overflow, stale search, double borders, hidden panels inside teleported containers
Fix empty groups table in user settings; fix login language switcher
Fix flicker in the notification report; fix multiselect input position
Fix report file download permissions; fix copying report document paths for Gmail sources
Fix app-registration error when no groups are selected
Fix orphans-only filter for nested folders in Data Owners
Graph services
Fix stale owners on SharePoint validate; prefer the SharePoint owners group for site owners; derive site owners from the full root-item ACL
Fix cross-tenant site deletion during full ingest
Fix drive-fishing filter dropping search results
Fix HTML-response crash in mailbox settings fetch; fix OkHttp connection leak in enforcer file download
Fix DISC to DISP typo in the move enforcer (EWS, IMAP and Graph)
Return 404 instead of an error when a user photo is missing
IMAP / Mailstore
Fix environment-variable loading for the Elastic config
Set in-ingestion status on new attachments; log authentication issues
Analytics
Fix division-by-zero and missing-data edge cases in monthly report generation
Fix external data queries and queries that did not specify an index
Security hardening
Rate limiting: NGINX rate limiting added on authentication routes across all stacks
Permission model: new "Manage DLP" and "Manage MCP Keys" IAM permissions; DLP routes permission-protected; logs permissions moved to a dedicated category; header links restricted by organization permission
Service-to-service auth: internal /classify calls authenticate with IAM_SECRET in the Authorization header
Audit trail: DLP audit logs record actor name and email; audit-log sender fields reworked
XSS surface reduction: TinyMCE editor removed from the client; HTML sanitisation consolidated
Tenant isolation: cross-tenant site deletion during full ingest fixed
Credential hygiene: proactive secret-expiration reminders for Azure app registrations; last-login schema strips invalid emails