Managing approval processes can often be cumbersome and inefficient, especially when multiple approvers are involved. Therefore it would be nice to have a possibility to have multi-level approval workflows which can be configured as needed.

Multi-level approval workflows

As administrator currently it is quite laborious to mange profiles as every profile has to be considered separately:

In order to start or adapt profile management quickly we are considering to provide import and export functionality. But how would a import/export file would be most helpful for you? We would love to hear your feedback.

Import and Export of Profiles and Profile Permissions

Currently, scripts stored in the Access Manager cannot be executed directly via an external interface. As a result, their usage is limited to predefined internal flows, which restricts broader automation and integration scenarios.

Enabling the execution of specific Access Manager scripts via a REST API would significantly expand automation capabilities. It would allow external systems and workflows to trigger existing logic on demand, support cross-system orchestration, and increase reuse of established scripts without duplicating functionality. This enhancement would further strengthen the platform’s role as an integration-ready automation hub.

Trigger stored scripts via REST API

Currently, self-service workflows end after a request is approved or rejected, without any automated way to trigger customer-specific follow-up actions. As a result, customers are limited in how they can process request data, decisions, and related business logic in a consistent and automated manner, often relying on manual steps or custom workarounds.

Introducing a standardized mechanism to trigger customer-specific scripts at the end of each self-service request would significantly increase the flexibility. It would enable deeper automation, seamless integration with external systems, and support a wide range of customer use cases. 

Allow to execute scripts at the end of each workflow

When (rights) folders need to be moved within a share, the current process is complex and manual. The current approach looks like this: 

This process is time-consuming and prone to errors. It would be great to have this workflow automated.

Similarly, when a folder collection needs to be moved to a different resource group, this is currently not possible. Such a reassignment might be required, for example, when restructuring the environment or introducing DFS, where folder collections should be grouped under a new resource group for consistency. 

The Access Manager should support both the movement of rights folders within a share and the reassignment of folder collections to a new resource group.

Move (rights) folders and folder collections

When employees join a new department, their access permissions are assigned via Access Manager. This includes all file server and SharePoint permissions, as well as memberships in AD groups, Teams, and distribution lists.

, access to these mailboxes is often overlooked during the initial rights assignment. This can lead to inconsistencies and hidden costs, as employees may not be able to work efficiently from the start. To avoid this, mailbox owners should be able to maintain and manage access permissions.

Management of Exchange Functional/Shared Mailboxes [Exchange Online]

When managing user access across multiple systems, comprehensive reporting capabilities are essential. The 

 module provides an overview of all identities and their associated user accounts. This allows administrators and managers to quickly review account status, permissions, and assignments, ensuring transparency and efficient access management. 

UAM: Reports - Overview of identities

If an employee’s personal information changes, for example relocating to a different city or changing their last name due to marriage, these changes can be recorded in the 

 . After approval, the updates are applied consistently across all relevant systems, ensuring that user accounts, permissions, and access rights remain accurate and up to date. 

UAM: Update employee information

End users often do not know which profiles are used for which purpose, for example because the names are unclear. The Access Manager now allows a description to be stored for each profile. This makes it easier for users to understand the purpose of a profile when requesting membership and ensures that profile assignments are consistent and transparent. 

Self Service: Description for profiles

Currently only data from AD users can be imported to by displayed as additional information Access Manager. When working with Entra users it would be great to import those data as well, e.g. for

import additional information for EntraID users

Development of an interface for User Account Management (UAM) that is seamlessly connected to HR systems. This extension of the REST APIs enables:

UAM: RestAPI Extension

Based on the organizational structure companies apply different meta data on accounts. To ensure correct application and due to this reduce errors in manual tasks it would be great to store those information in an organizational structure.

more flexible organisational structure

Within organizations there are different level of sensitive data where permissions require reapproval on a regular basis. As in highly sensitive data permissions need to be controlled more often than in less sensitive data it would be great to have different intervals for each security class.

Reapproval - Different time intervals for different sensitivity levels

In multi agent environments the update is quite laborious as every agent needs to be updated on its own. It would be great to provide an automated update.

Automated Agent Update

When an employee moves to a new site or department, the User Account Management (UAM) automatically updates their user account(s) with the necessary permissions and access rights for their new position. 

UAM: Mover process

The Access Manager is able to execute scripts in a job. Currently this is only possible to be executed once. Afterwards the system forgets the script. With script management it shall be possible to manage scripts centrally and within the Access Manager. This enables administrators to 

Centralized Script Management

Many customers already use a wide variety of storage solutions that support the SMB protocol. The goal is to expand the file server module so that all SMB-compatible platforms can be connected, including Azure Files, NetApp ONTAP, Amazon FSx, Dell PowerScale, and others.

Seamless integration of SMB-based storage solutions: Azure, NetApp, Amazon, Dell, and more

Currently, new AD accounts can only be created during the joiner process. If an additional account is needed later, it must be created separately and manually linked to the identity. Introducing a option to create additional AD accounts with defined account categories at any point in the identity lifecycle would improve flexibility, reduce administrative effort, and ensure consistent identity-account relationships. 

UAM: AD Account Creation in Edit Identity Workflow

When an employee leaves the company, there should be a process to deactivate the accounts/mailboxes/etc. of the identity, so there won't be any security concerns.

UAM: Leaver process (and temp absence)

Previously, a user with the "Assistance" role had to request permissions for several users individually. To simplify this process, this release allows authorizations to be requested for multiple users at the same time. All information such as expiration date, authorization, comment is entered once for all users and then automatically duplicated for the individual requests. A separate request is generated for each requested authorization, but the person responsible only receives one email with all requests.

Assistance: Request permissions for multiple users

Managing AD accounts can be a time-consuming and complex task, especially when dealing with multiple accounts for a single employee. Our new feature addresses these challenges by allowing you to:

UAM: Create Multiple AD Accounts with customizable Account categories and naming conventions

To support hybrid IT landscapes and modern identity requirements, the Access Manager should allow switching between two authentication methods via configuration:

This enhancement should enable organizations to align authentication with their infrastructure strategy, improve security, and offer a more flexible user experience. Only one method can be active at a time to ensure clear and secure login flows.

Login in Access Manager

Currently, both on-premises Active Directory  accounts and Entra ID accounts are used in parallel. When accessing profiles or resources (e.g., Teams, SharePoint sites, file shares), both identities must be manually added and managed. This makes access management error-prone, especially when resource permissions or group memberships are only granted to one of the accounts, and the other is forgotten.

Therefore it'd be great to introduce AM users who act as a mapping entity of all similar user accounts. This should automatically resolve and apply the correct linked account (AD or Entra ID) when calculating effective permissions, whether for user profiles or resource permissions.

Simplified Access and Profile Management with AM users

Previously, permissions could only be assigned to profiles directly by resource responsible or profile administrator. It has not been possible to request permissions for a profile via the self-service portal. In order to request permission on a specific resource for a profile the “request permission” dialogue has been enhanced for users with assistance role. 
Now, in addition to user permissions, you can also request permissions for one or multiple profiles, or exclusively for profiles. The information provided for permissions and comments applies to both profiles and users (if users have also requested permissions), expiration date applies to user permissions only. If multiple permission requests are submitted, the responsible person receives an email containing all the requests, but requests are approved individually. 

Assistance - Request rights for multiple profiles

Currently it is possible to assign AD OUs and profiles as a resource to the organigram in the UAM. It would be nice to be able to assign scripts as well.

UAM: Assign scripts to organigram units as a resource

Following the introduction of centralized logging with Grafana Loki in Access Manager version 2023.1, this release adds logging with Splunk for more flexibility.

Several new logging settings have been introduced as part of this. For example, the log level of the agent can be set to Warning with 

. Descriptions of the other new settings can be found in the user manual.

Logging with Splunk

The self-service portal enables end users to autonomously perform a variety of operational actions, such as requesting permissions or profilememberships, without having to contact the IT department or help desk, even without in-depth technical knowledge. In order to ensure a more intuitive and smooth user experience, some UI improvements could be beneficial. 


The following pages will be enhanced and improved:

Self Service: UI Improvements

When a new company joins the group, often users of this company receive a new account in the group domain, but do have the old account with existing permissions and roles in Access Manager. To remove old user accounts in a later state, those permissions and roles shall be transferred to the new account.

Support for User Permissions & Roles Migrations

User should have the possibility to request 3rd Party items in Self Service. Therefore naming conventions shall be configured and applied to new AD Groups.

Request new AD Groups with Naming Conventions

With this release 2023.1, centralized logging with Grafana Loki is offered. With this, administrators have an easier and faster way to view messages through extended search and filter options. If other systems are maintained that also support centralized logging, this can also be bundled in Grafana Loki.

Centralized Logging with Loki

REST API is available for BAYOOSOFT Access Manager. 

REST API

As an approver of requests I receive mails for pending requests. It would be appreciated to have a visual reminder of open requests at startup of the AM, so that every employee gets their permissions on time and I won't forget. 

For now it is sufficient to display the number for open requests also shown on the request management page for owners/responsibles. In future, this can be extended to admin requests and profile requests

Reminder of pending requests at Startup

Until now, AMPR could only be used via the web interface and thus access to a browser was necessary when forgetting one's own Windows password, which was very inconvenient. To increase user acceptance, this version now allows the user to reset the password directly on the login page using the credential provider if the logon password has been forgotten. After successful authentication, the user can assign a new password according to the password policies, the password is reset directly and one can log in immediately with the new password. The TAN procedure or the token procedure can be selected as authentication procedure.

Credential Provider for Password Reset

The popular authentication method based on the four-eyes principle has reached the limits of its applicability in times of mobile working. To be able to continue to obtain the support of colleagues in the event that a password reset is required, a new authentication method enables a four-eye principle by splitting the password, which does not require the physical presence of the colleagues:

For-eyes-principle for remote work

The new identity management module can be used to map so-called joiner, mover, leaver processes (life situations) within an organization. Identities are created, modified or deleted within the framework of standardized workflows.

The workflows are available to the new Access Manager role "Personnel Manager" as well as to the administration.

No-code Identity Management - Ask for a demo now

Digitizing identity workflows helps a lot to reduce efforts in IT department, but if there are dependencies between accounts of one or more target systems, it must be ensured that as-is state corresponds to the to-be state.

target/actual comparison for accounts

AMPR end users can now edit the attributes of their own AD accounts and the data in AMPR in the Self Service in the personal settings area. After selecting an AD user account assigned to the user, the stored AD data is displayed and can be changed. In the administration area, it is possible to define which AD attributes, such as name, job title, e-mail or similar, can be edited by the end user.

Active Directory in Self Service

With Password Reset in Self Service, employees can reset their forgotten passwords autonomously. Besides a high user acceptance, this allows to significantly reduce the service desk costs due to corresponding tickets. This is particularly successful when the organization's central applications are covered in the Self Service Password Reset.

In addition to common environments such as Active Directory, Azure AD, SAP, or individual databases, in the hospital environment this is primarily the respective hospital information system. Therefore, AMPR now offers the option to connect M-KIS - the hospital information system from Meyerhofer - as an additional target system.

For further information, please visit one of our open webinars or arrange your individual product presentation [

AMPR - New Target System: Meierhofer KIS

With 2023.1 you can manage MS Teams memberships together with other authorizations in BAYOOSOFT Access Manager for the first time. The new extension module uses the proven authorization management from the base module for the active administration of MS Teams authorizations. Thus, even more authorizations can be managed centrally in one place.

MS Teams Management - test it now

Until now, employees in other countries have only been able to use the Access Manager in German and English. From now on, other language packages can also be integrated on request. The system always remembers the last language set for the user interface for the employees and also sends the mails in this language.

Multi-Language-Supported User Interface

There is always the constellation that the assignment of authorizations is to be audited, but an explicit approval by a data controller is not mandatory. In this case, the authorization can be automatically assigned to the requesting person.

For this purpose, the BAYOOSOFT Access Manager now provides the option for IT administration as well as owners to make 3rd party elements publicly accessible. If permissions on this element are requested via the Self Service Portal, they are automatically accepted by the system and documented as usual.

Public Items: Automatically approve requests on 3rd Party Items

With Password Reset in Self Service, employees can reset forgotten passwords on their own. In addition to a high level of user acceptance, this makes it possible to significantly reduce costs at the service desk due to corresponding tickets. Nevertheless, many employees reach for the phone in this acute situation - either because the number of the service desk is known, or the appointed trusted persons are not available. To be able to continue to relieve the service desk by means of password resets in self-service, AMPR now offers the option of being able to run through routines for unlocking user IDs and resetting passwords by telephone.

In this way, you can check whether the call is for the designated function before putting the call through to a service desk employee. Callers are identified by specifying the user ID and checking the transmitted phone number and are then guided through the process with voice support. The following options are available for authentication:

Password Reset via Phone Call

The module Easy Desktop offers end users even more convenience in self-service: The Microsoft WindowsTM Explorer plug-in EASY DESKTOP enables the most important functions to be executed directly via the context menu of the respective directories. 

Directories managed by the Access Manager and visible in Self Service are marked by an orange symbol directly on the folder. Right-clicking on such an authorisation folder opens its context menu and the following functions are directly available:

Easy Desktop: Self Service in Windows Explorer - test it now

AD Group Management enables you to manage memberships in existing AD security groups, meaning the access management of the Fileserver Management basic module can also be applied to third-party services such as remote applications, print sharing or internet access.

Integrating third-party permissions with Access Manager provides you with comprehensive identity and access management – fully retraceable and auditable at all times.

AD Group Management - test it now

A new setting UserTaggingGroups enables you to tag user accounts in the system with icons. in the system. For this purpose, AD groups can be stored whose members are to be tagged.

User Tagging

For highly sensitive data, it may be advisable to carry out pre-authorization, e.g. in the form of anti-sabotage or confidentiality training, in addition to complying with the need-to-know principle. At the same time, it is important to ensure that only those employees who have completed this pre-authorization are granted access permissions.

In order to technically map such organizational protective measures, it is now possible to define AD groups for data protection classes that contain the pre-authorized employees.

If a resource is marked with this data protection group, the system guarantees that only those permissions are transferred to the target system that have been authorized by AD group membership. Unauthorized users are highlighted in the user interface. If they are later added to the group, the permission is transferred to the target system during the next job run.

Protect sensitive data with additional user pre-authorization

BAYOOSOFT's expertise in automation of access rights management began in 2008 and has continued to develop ever since.

Besides continuous feature development and improvement the following milestones could be achieved:

Previously in History

Please note: It's a roadmap, not a promise. Items might be subject to change without notice.