CVE-2022-25883

This issue could allow that user to retain access to data if they were removed from a group that was granted access by a policy.

When executing the Immuta Data Security Framework, the status of the classification job for individual data sources can now be found in the data source health dropdown. The options include the following:

• Classification complete: Classification has run on the data source and applied the appropriate classification tags.

• Classification pending: A framework has been created, activated, or updated and will run on the data source.

• Classification is not applicable: The data source is not affected by classification.

• If users registered tables from the same schema as Immuta data sources, users could break data sources they didn't own if they deleted or changed the schema project connection.

• The Databricks Unity Catalog integration configuration on the App Settings page asked for an "Instance Role ARN" instead of the "Instance Profile ARN."

• Users were unable to add data sources from the Hive Metastore in the Databricks Spark integration with Unity Catalog.

December 8, 2022

Features and changes

• Databricks Spark Integration with Unity Catalog Support: Enable Unity Catalog support on Immuta clusters to use the Metastore across your Databricks workspaces and enforce Immuta policies on your data. This integration provides a migration pathway for you to add your tables in Unity Catalog while using Immuta policies. Consequently, when additional Unity Catalog features are available, you will be ready to use them. Databricks SQL policies will continue to be enforced through a view-based method, and interactive cluster policies through the Immuta plugin method.

• Databricks Runtime 11.2 support.

• Write Fewer, Simpler ABAC Policies. Enhanced Subscription Policy Variables (Public Preview) empower users to write fewer, simpler ABAC (Users with Specific Groups/Attributes) policies. Previously, policy writers had to specify groups in separate policies to grant access. With Enhanced Subscription Policy Variables, Immuta's policy engine compares users' groups with data source or column tags in a single policy to determine if there is a match. Users who have a group that matches a tag on a data source or column will be subscribed to that data source.

• Immuta supports registering data sources that exceed 1600 columns. However, sensitive data discovery and health checks will not run on those data sources.

• The maximum length for the Snowflake role prefix when using is 50 characters.

• Users cannot enable or disable impersonation when editing a previously configured integration.

Bug fixes

• Alternative owners of data sources were not included in the subscription audit records if the data source was created using the Immuta V2 API.

• Snowflake Table Grants: If a user who was added to a Snowflake data source through a group Subscription Policy was removed from a data source, that user could see the columns (without any data) of the table when they queried that data in Snowflake.

• When users edited a Snowflake integration configuration and changed the authentication type to Snowflake External OAuth, the configuration was still saved as Username and Password for the authentication type.

• Vulnerability: CVE-2022-39299

Known bugs

• Editing a schema project to a database that already exists fails.

UI and workflow removals

The following UI elements and workflows have been removed. Reach out to your Immuta representative if you need one of these elements re-enabled.

• Data source Metrics tab.

• Data source Queries tab.

• Creating data sources with a SQL statement.

• Selecting specific columns to hide when creating a data source in the UI or V2 API.

November 2022

November 22, 2022

Enhancement

• Tag enhancements (public preview): The tag enhancements feature will improve user experience by updating various components of the UI.

Bug fixes

• Azure Synapse Analytics: If a user was granted access to about 1300 data sources, access to those tables was delayed.

• Deleting an integration on the App Settings page and saving the configuration caused the Immuta UI to crash.

Known bugs

• Editing a schema project to a database that already exists fails.

November 17, 2022

Enhancements

• Collibra integration performance improvements.

• Immuta's Collibra integration recognizes the implicit relationship between the Database View in Collibra and Immuta data source columns so that tags are properly applied to those columns in Immuta.

• The Immuta V1 API /dataSource endpoint returns the remote table name so that users can get the schema and table name of a data source in one API call.

Bug fixes

• The data source Relationships tab only displayed up to 10 associated projects.

• If creating the Immuta database failed in the Snowflake without Snowflake Governance Controls or Databricks SQL integration, the error returned was incorrect.

• Removed historical schema monitoring metrics that contained database connection strings.

• Subqueries that referenced a table that didn't exist never resolved.

• Policies:

  • Disabling a Global conditional masking policy on a data source could sometimes disable all policies or none of the policies on the data source.

  • If users submitted a Global Policy payload to the API that was missing the subscriptionType from the actions, the Global Policies page broke when trying to display Subscription Policies.
• Redshift:

  • Users were unable to query tables that had a policy with a Limit usage to purpose(s) <ANY PURPOSE> applied to them.

  • There were error-handling inconsistencies between the Immuta UI and the database logs.

• Vulnerabilities:

  • CVE-2022-3517

  • CVE-2022-3602

Known bugs

• Editing a schema project to a database that already exists fails.

October 2022

October 19, 2022

Bug fixes

• Deleting a tag hierarchy deleted any tags with a like name. For example, deleting the tag department would also delete the tag department_marketing.

• The Refresh External Tags button appeared on the Tag page even if no external catalogs were configured.

• Users couldn't change the schema detection owners for schema projects.

• Collibra: If multiple values were assigned to an attribute in Collibra, they were added as a single tag in Immuta. For example, if an attribute list called Color contained values Blue, Green, and Yellow, and Blue and Green were selected in Collibra, Immuta displayed the data tag as Color.Blue,Green. Instead, Immuta should have created two tags: Color.Blue and Color.Green.

• Webhooks that were listening to setUserAuthorizations were not triggered.

• Deleting a Data Policy did not enable the Save Policy button.

• With Approve to Promote enabled, adding a comment to a policy did not enable the Save Policy button.

Known bugs

• Editing a schema project to a database that already exists fails.

September 2022

September 27, 2022

Features and enhancements

• Use the latest Databricks Runtime with Immuta. Databricks Runtime 11.0 is now supported in Immuta.

• Connect Snowflake data to Immuta without providing your account credentials. Immuta supports Snowflake External OAuth as a non-password authentication mechanism when configuring the Snowflake integration or creating Snowflake data sources.

Public preview

• Let Immuta manage privileges on your Snowflake tables instead of manually granting table access to users. With Snowflake table grants enabled, Snowflake Administrators no longer have to manually grant table access to users; instead, Immuta manages privileges on Snowflake tables and views according to the subscription policies on the corresponding Immuta data sources.

• Ensure that policies are adequately reviewed and approved before they are eligible for production environments. Instead of creating policies directly in production, Approve to Promote allows policy authors to create, assess, and revise policies in a policy-authoring environment. Then, the policy must be approved by a configured number of users before it is promoted to the production environment and enforced on data sources.

Deprecations and breaking changes

• The undocumented deletedHandlerSubscribers attribute, which indicates a subscription policy changed, was removed from the data source notifications webhook payload. If you were depending on that attribute in your customized webhooks, that code won't work.

Bug fixes

• IAMs:

  • Microsoft Entra ID: When SCIM was enabled for Microsoft Entra ID, sometimes user attributes were removed from users in Immuta when they should not have been.

• Policies:

  • Global Subscription Policies that were applied “When selected by data owners” could not be deleted when using Approve to Promote.

  • If a Global Subscription Policy was disabled for a data source, staging that Global Policy on the policies page caused the Subscription policy to change on the data source.

  • Local Policies using @columnTagged() were not properly applied to data in Databricks when the column was tagged.

• Projects:

  • Project owners could not edit projects with approved purposes and data sources.

  • The baseline percent null values could not be adjusted for k-anonymized columns on the Expert Determination tab in projects.

• Snowflake:

  • Instances that used the Snowflake integration without Snowflake Governance features were sometimes automatically migrated to using Snowflake Governance features when Immuta upgraded.

• Vulnerability:

  • CVE-2022-25647

• Tags sometimes did not update on data sources if those tags were quickly added or removed, which could cause policies to not be updated.

• The data source page sometimes took several minutes to load if there were over 100,000 data sources registered in Immuta.

• If a user was a member of a large number of groups (about 2,000), the UI search was sometimes slow.

• When searching for data sources on an instance with over 30,000 data sources and tables with complex struct columns, the search could take several minutes to return or freeze the Immuta tenant.

• An Adobe Font requirement caused timeout issues in the Immuta UI.

Known bugs

• Editing a schema project to a database that already exists fails.

August 2022

August 17, 2022

Enhancements

• Application Admins can enable policy adjustments separately from HIPAA Expert Determination on the App Settings page.

Bug fixes

• Snowflake Integration:

  • Schema detection caused non-date columns to be incorrectly tagged "New" for data sources that were added in bulk.

  • Migrating from a Snowflake Using Snowflake Governance Controls integration to a Snowflake Without Using Snowflake Governance Controls integration failed.

  • Enabling a Snowflake Using Snowflake Governance Controls integration using the automatic setup method failed.

• Sensitive Data Discovery did not automatically run when users bulk created data sources.

• If Immuta was unable to communicate with an external IAM provider because of a connection failure, groups were removed from Immuta, even if the IAM was still active.

• When creating 100,000 tables, the data source creation job sometimes expired.

• User Admins could not delete attributes assigned to an Immuta Accounts user.

• After configuring SAML and OpenID IAMs, users could not initially log in.

• In Databricks runtime 10.4, ShowPartitions commands on Delta tables failed.

• Users were unable to edit Global policies that were not on the first page of results.

• Automatic Subscription policies could cause out of memory issues if they added about 300 users to a data source.

Known bugs

• Editing a schema project to a database that already exists fails.

• Project owners are unable to edit projects with approved purposes and data sources.

August 4, 2022

Breaking change

• IAM Signing Certificate Required for SAML. You are required to upload your IAM signing certificate to Immuta to add or edit SAML-based IAMs. If you are already using Immuta's SAML integration, provide a signing certificate to existing configured IAMs for them to continue working.

Bug fixes

• In the Snowflake Governance features integration, unmasked data was sometimes visible for a fraction of a second while data policies were being applied.

• Databricks user impersonation did not work if backticks enclosed the username.

• Clicking the Sync User Metadata button in the Immuta UI could queue an infinite number of profile refresh background jobs.

• The enriched audit logs created an error if data policies did not exist on a data source.

• The attributes type for users was inconsistent with policy attributes type in the audit logs.

• Advanced Subscription Policies: If an advanced Subscription policy that did not contain special variables was created, customers with over 100,000 users could experience OOM issues.

• Okta/SCIM: When adding users to Okta to sync with Immuta, TypeError: attributeValues is not iterable appeared in the logs.

• LDAP users with parentheses in their common name caused authentication to fail when group sync was enabled.

Known bugs

• Editing a schema project to a database that already exists fails.

• Project owners are unable to edit projects with approved purposes and data sources.

• Databricks Runtime 10.4: Show partitions on delta table fails.

July 2022

July 7, 2022

New features

• Access background jobs with enhanced visibility. This feature allows you to access information to debug issues and identify the cause.

• Use the latest Databricks Runtime with Immuta. Databricks Runtime 10.4 LTS is now supported in Immuta.

• Prove compliance with Databricks audit trails that include denial events. When Immuta users query Databricks tables that have been registered in Immuta, the query audit logs will include denial events and the policies associated with the decision. Such audit trails are required by some information security teams to prove compliance with secure data access.

Private preview

• Snowflake:

  • Share policy-protected data in Snowflake with other Snowflake accounts using Snowflake Data Sharing. This integration allows you to author policies in Immuta and protect data shared with other Snowflake accounts in real time. For example, if a pharmaceutical company needed to share trial results outside their Snowflake account and needed to protect PHI, they could share that data outside their account and still have Immuta policies enforced.

Removed features

Removed features are no longer available in the product.

Bug fixes

• Creating a policy using the Advanced DSL Data policy builder in the view-based Snowflake integration sometimes caused errors.

• When a user's entitlements changed, Immuta did not properly send notification to the integration to GRANT or REVOKE access to tables in the remote system.

• Entering a single quotation mark in the search bar sometimes caused an error.

• After an Alation or Collibra catalog was configured, new data sources were not linked to the catalogs automatically.

• Logging in to Immuta after being logged out due to inactivity sometimes displayed a blank page.

• Local policies sometimes appeared on the Global policies page.

• Activity panel covered the policy builder when long SQL statements were entered for conditional policies.

• Clicking the Policies icon in the left sidebar while editing a Subscription policy displayed an empty Data Policy Builder instead of the Policies page.

• When configuring an External REST Catalog, users could not click the Test Connection button if the No Authentication option was selected.

• The Immuta login page did not display for some older browser versions of Edge.

Known bugs

• LDAP users with parentheses in CN cause authentication to fail if group sync is enabled.

• Databricks Runtime 10.4: Show partitions on delta table fails.

June 2022

June 9, 2022

Enhancements

• The visual styles in the application have been updated.

• Users can add multiple alternative owners to data sources at once.

• Users can now specify column tags instead of just data source tags with the @hasTagAsAttribute Enhanced Subscription Policy variable.

Feature removal

• Policy import/export

Bug fixes

• When attributes were added to groups that affected an Automatic Subscription policy, users were added or removed from the data source(s) appropriately, but these changes were not audited.

• Deleting the last values or all values from user or group attributes caused errors when processing Automatic Subscription policies.

• Local policies that were created or updated sometimes displayed on the Global Policy page.

• Writing a Global ABAC Subscription policy using @username in the Advanced DSL builder did not subscribe the user to the data source.

• Changing a Global Allow Individually Selected Users Subscription policy back to a Global ABAC policy that used special functions caused an error: Error: "actions[0].exceptions.conditions[0]" does not match any of allowed types.

• If a policy was added through the Immuta CLI, editing that policy in the Immuta UI sometimes caused an error.

• After being added to a data source through an Automatic Subscription policy, users sometimes encountered an error when making unmasking requests.

• Creating a Global conditional masking policy in the Advanced DSL builder that used @iam or @username caused an error when the policy was applied to a data source.

• Redshift:

  • Regex masking policies that used metacharacters with backslashes (\d, \s, etc.) did not mask columns.

  • Users' metadata was not updated in the integration if their usernames contained apostrophes.

May 2022

May 11, 2022

New features

• Enhanced Subscription Policy Variables (Public Preview): This feature empowers users to write fewer, simpler ABAC (Users with Specific Groups/Attributes) policies. Previously, policy writers had to specify user attribute keys in separate policies to grant access. With Enhanced Subscription Policy Variables, Immuta's policy engine compares user attributes with data source properties (database, host, schema, table, or tag) in a single policy to determine if there is a match. When attribute keys match the property specified, users will be able to subscribe to the data source(s).

• Snowflake Table Grants: With this feature enabled with the Snowflake with Governance Controls integration, Snowflake Administrators no longer have to manually grant table access to users; instead, Immuta manages privileges on Snowflake tables and views according to the subscription policies on the corresponding Immuta data sources.

Enhancement

• Improved performance of auto-subscription policies.

Bug fixes

• If an SSL CA cert was used when setting up an LDAP IAM, clicking the Test LDAP Sync button resulted in an error.

• Tags were removed from data sources if they were applied after data source creation and before the external catalog health check (which is triggered by navigating to the data source). However, tags applied to a data source during creation remained on the data source.

• Group permissions were not considered when users attempted to create data sources or Global Policies. For example, if a user was a member of a group that had the GOVERNANCE permission assigned to it, that user was not inheriting the GOVERNANCE permission. Consequently, when that user tried to apply a Global Policy to a data source, they received an error. However, if a user had the GOVERNANCE permissions applied to their account directly, they were able to create a Global Policy. This same behavior occurred with the CREATE_DATA_SOURCE permission.

• Creating an Immuta data source from a Databricks view that contained an implicit column alias failed.

Known bugs

• Editing a schema project to a database that already exists fails.

• The App Settings page freezes when a user selects Migrate Users from BIM when configuring an external IAM.

• An auto-subscription policy that adds more than 64,000 users to a data source can cause errors in the logs and impact subscription reports.

• Integration jobs can end up in an expired state, even if they successfully are processed, under certain load conditions.

March 2022

March 31, 2022

• Edit configuration for integrations: Users can edit the configuration for Azure Synapse, Databricks SQL, Redshift, and Snowflake without disabling the integration.

• Manual approvals in ABAC global subscription policies: Governors can now add an approval workflow as an alternative method of access to data sources if a user does not meet the conditions of the Users with Specific Groups/Attributes (ABAC) Global Subscription Policy.

  • Before this release, if someone was manually added by an owner or Governor and didn’t meet the ABAC policy requirements, they could query the table, but no rows would come back because they didn’t have the groups or attributes specified in the policy. Now, manually adding users overrides the ABAC policy. Therefore, any users who had been manually subscribed to a data source but could not see any data will see data after this upgrade. You can prevent this behavior by either switching the Subscription policy to auto-subscribe (which removes users who don't meet the Subscription policy) or adding a Data Policy that redacts rows for users who do not have the groups or attributes specified in the Subscription policy.

  • If users have existing Global Subscription policies that were combined, those will not change on the data source after the upgrade. However, the Require Manual Subscription option will automatically be enabled on those existing policies, so users who meet the conditions of the policy will not be automatically subscribed.

• Sensitive data discovery global template and default sample size UI (public preview): Users can adjust these configurations on the App Settings page. If users already had a Global Template or default sample size configured in the Advanced Configuration section, these configurations will migrate to the new Sensitive Data Discovery section on the App Settings page when they upgrade their Immuta tenant.

• : Through this integration, Immuta applies policies directly in Starburst so that users can keep their existing tools and workflows (querying, reporting, etc.) and have per-user policies dynamically applied at query time.

• Support for PrivateLink with Snowflake on AWS: Contact Immuta to enable this feature.

Bug fixes

• "Active" tags on merged Share Responsibility Global policies did not show the active number of data sources they were enforced on.

• The configuration section for project workspaces could break if a handler was not enabled.

• Databricks:

  • If a table in Databricks had been created from an AVRO schema file, queries against the table on Immuta-enabled clusters only returned results for partition columns. Additionally, trying to create tables from an AVRO schema file on Immuta-enabled clusters returned an error: "Unable to infer the schema."

  • Fixed Databricks init script error handling when artifacts weren't downloading correctly.

  • Errors occurred when using mlflow.spark.log_model on non-Machine Learning clusters.

• Because Immuta's built-in identity manager (BIM) is not enabled in SaaS, the App Settings page froze when a user selected Migrate Users when configuring an external IAM.

• Redshift integration performance issues related to Python UDF concurrency capabilities.

• Snowflake:

  • When enabling a Snowflake integration with an external catalog, if the host had multiple periods in the account the Snowflake plugin was invalid.

  • When users tried to edit the Excepted Roles/Users List for the integration, the configuration saved correctly. However, when the App Settings page refreshed, the Excepted Roles/Users List was empty and the allow list in Snowflake was not updated.

Known bugs

• Editing a schema project to a database that already exists fails.

• Project owners are unable to edit projects with approved purposes and data sources.

March 14, 2022

• Disable query engine: Application Admins can disable the Query Engine on the App Settings page.

• New Immuta UI: Although the most significant change is the adjustment to the visual styles in the application, other UI changes include an expandable left navigation and dark mode support.

• Support for AWS-Sydney.

Databricks Spark integration note

• Databricks init script: To use the updated Immuta init script and cluster policies, existing SaaS users must update their Databricks cluster configuration following this Manually Update Your Databricks Cluster guide.

Bug fixes

• Databricks:

  • Views: Although users could create views in Databricks from Immuta data sources they were subscribed to, when users tried to select from those views, they received an error saying that the Immuta data source the view was created against did not exist or that they did not have access to it.

  • External Delta Tables: Querying an external Delta table that had been added as an Immuta data source as a non-admin resulted in a NoSuchDataSourceException error if the table path had a space in it.

  • Sensitive Data Discovery failed for Databricks data sources when initiated in the UI if the cluster was configured to use ephemeral overrides.

  • The integration did not work with the Databricks Runtime 9.1 maintenance update.

• Ephemeral Overrides:

  • The UI was not displaying the checkbox to apply the ephemeral override to multiple data sources.

  • Ephemeral overrides were not being used when calculating column detection.

• Out of memory errors occurred when several actions or jobs ran simultaneously, such as

  • Bulk disabling data sources

  • Bulk creating data sources

• Sensitive Data Discovery: Users could not configure sampleSize to override the default number of records sampled from a data source.

• Snowflake Governance Features Integration: When a data source existed in Immuta but not in Snowflake and a user tried to refresh the policies, Immuta continuously retried to update the policies and then failed with the following error: Execution error in store procedure UPSERT_POLICIES: SQL compilation error: Table does not exist or not authorized.

• Vulnerabilities

  • CVE-2022-0355: Information Exposure in simple-get

  • CVE-2022-0235: Information Exposure in node-fetch

Known bugs

• Databricks: Errors occur when using mlflow.spark.log_model on non-Machine Learning clusters.

• Editing a schema project to a database that already exists fails.

• Because Immuta's built-in identity manager (BIM) is not enabled in SaaS, the App Settings page freezes when a user selects Migrate Users when configuring an external IAM.

This feature was also announced in the Immuta Changelog.

December 16

Deprecation announcement for IP filtering for SaaS tenants: Support for the IP filtering feature for SaaS tenants has been deprecated and will reach end of life on March 31, 2026. This feature is being replaced by the Immuta SaaS private networking offering, which addresses the same security concern by allowing you to control who has access to your tenant's UI and APIs.

For assistance with setting up Immuta SaaS private networking, please contact your Immuta representative.

This deprecation was also announced in the Immuta Changelog.

December 8

Immuta integration with MySQL: Immuta now directly integrates with MySQL hosted on Amazon Relational Database Service (RDS) or Amazon Aurora. This enhancement means you can now

• Create Marketplace data products with data sources residing in your RDS or Aurora MySQL environments for unified access and discovery.

• Allow data consumers to easily request access to these securables directly through the Immuta Marketplace app.

• Enable approvers to efficiently manage access requests and provision access to your MySQL data safely and effectively, which simplifies management and auditing.

This integration extends Immuta’s industry-leading data governance capabilities to your key MySQL deployments in the AWS cloud.

See a demo of this new feature in the Immuta Changelog.

December 3

Behavior change release enabled for all accounts: Support for Databricks Delta Sharing

Immuta’s support for subscription policies on shares from Databricks Delta Sharing is now enabled for all accounts. This allows you to manage granting and revoking access to these securables safely and efficiently.

The release of this feature followed Immuta’s behavior change release process.

• Opt-in period: 10/3 - 11/2

• On by default: 11/3 - 12/2

• Enabled for all accounts: 12/3

This feature was also announced in the Immuta changelog.

December 2

OAuth support for Azure Synapse Analytics integration: Immuta now supports OAuth as an additional authentication method in the Azure Synapse Analytics integration. Users can configure an Azure Synapse Analytics integration in Immuta using OAuth with a client secret.

This feature was also announced in the Immuta changelog.

December 1

Behavior change release enabled for all accounts: Improved query audit for Databricks Unity Catalog

Immuta’s Unity Catalog improved query audit is now enabled for all accounts. The Databricks Unity Catalog audit ingestion query now uses the system.query.history table from Databricks. This foundational change significantly improves the match rate between Unity Catalog query audit records and Immuta-managed data sources, delivering more accurate and valuable insights.

What's new

• There's now a better linkage between queries run in Unity Catalog and their associated data sources in the Immuta audit dashboards and reports, providing a clearer, more reliable picture of data access usage within Unity Catalog.

• In addition to better linkage, the rowsProduced parameter is now also getting populated for Unity Catalog query audits.

• The following parameters are no longer populated, as they are not available in the system.query.history table: userAgent, requestId, clientIp.

The release of this feature followed Immuta’s behavior change release process.

1. Opt-in period: 10/1 - 10/31

2. Opt-out period: 11/1 - 11/30

3. Enabled for all accounts: 12/1

Note: If you were using Immuta's Databricks UC audit feature without the required privileges for this change, Immuta disabled the audit ingest feature.

This feature was also announced in the Immuta changelog.

November 2025

November 26

Subscription policy support on Amazon Redshift tables: Immuta now supports subscription policies on Amazon Redshift tables through an enhanced Amazon Redshift integration.

With this release, users can provision data to their consumers by using Immuta subscription policies or the Immuta Marketplace. Users’ access will be automatically updated and enforced in Amazon Redshift based on what is dictated in Immuta.

To begin using this integration, contact your Immuta representative.

See a demo of this new feature in the Immuta changelog.

November 25

• Marketplace notifications inbox: You can now view all your notifications directly within the Marketplace app by navigating to your notifications tab. This page displays the same email and Slack notifications you receive from directly in the app, providing a single, convenient view of your entire notification history. This feature was also announced in the Immuta changelog.

• Databricks Unity Catalog integration validation improvements: Immuta has made backend improvements to the validations run that verify the health of Databricks Unity Catalog integrations. These improvements were released to all customers on November 25 and can result in significant cost savings. Your specific cost savings depends on how you've configured your Immuta and Databricks environments, such as your Databricks warehouse size and Immuta audit ingest interval. This change was also announced in the Immuta changelog.

November 21

Behavior change release enabled for all accounts: Fine-grained access controls for Databricks Unity Catalog materialized views and streaming tables

Immuta’s support for fine grained access controls on Unity Catalog materialized views and streaming tables is now enabled for all accounts. This feature allows you to apply row filtering and column masking policies on Unity Catalog materialized views and streaming tables.

Since these securables now support Immuta subscription and data policies, you gain enhanced security and flexibility with consistent policy enforcement across your Unity Catalog ecosystem.

The release of this feature followed Immuta’s behavior change release process.

1. Opt-in period: 9/18 - 10/20

2. On by default period: 10/21 - 11/20

3. Enabled for all accounts: 11/21

This feature was also announced in the Immuta changelog.

November 18

Slack notifications default setting: Admins can now control default Slack notification preferences for all Immuta Marketplace users. Application admins can choose whether Slack notifications are on or off by default across a workspace for each Slack integration.

If enabled, all users are automatically opted in to receive real-time Marketplace notifications in Slack, without any individual user action.

This feature was also announced in the Immuta changelog.

November 12

Support for PostgreSQL materialized views: Immuta now supports provisioning access to PostgreSQL materialized views with subscription policies. This enhances the existing subscription policy support for PostgreSQL standard tables and views, streamlining access provisioning and governance with Immuta.

This feature was also announced in the Immuta changelog.

November 7

Viewless integration with Amazon Redshift: Immuta has begun releasing an enhanced version of the Amazon Redshift integration. Instead of creating Immuta-managed views, Immuta will now be able to manage base tables directly.

With this viewless integration, you can create Marketplace data products with Amazon Redshift tables, which allows consumers to request access to these securables and enables approvers to efficiently manage access requests and provision access to data safely.

To begin using this integration, contact your Immuta representative.

See a demo of this new feature in the Immuta changelog.

November 6

Slack notifications for Immuta Marketplace: Marketplace now supports Slack notifications, bringing real-time alerts directly to where your teams collaborate. This new capability extends our existing email notification system, allowing users to receive the same event-driven updates, such as approvals, data access changes, and requests, via direct messages in Slack.

Slack notifications for Marketplace requests can enable your teams and speed up process in multiple ways.

• Faster collaboration: Receive data access and governance updates instantly within Slack, without switching between tools.

• Higher engagement: Direct notifications encourage faster responses from data stewards and data consumers, improving workflow velocity.

See a demo of this new feature in the Immuta changelog.

November 3

• Immuta integration with Teradata: You can now use Immuta to manage access to Teradata views. Access controls defined in Immuta through subscription policies are automatically enforced in Teradata.

  • This integration enables users to provision and manage access to Teradata data dynamically and at scale, reducing manual overhead for administrative teams and ensuring consistent access control across Teradata and other platforms that Immuta supports.

  • To begin using this integration, please contact your Immuta representative.

• Behavior change release on by default period: Support for Databricks Delta Sharing

  • What's changing: Immuta now supports enforcing subscription policies on shares from Databricks Delta Sharing, allowing you to manage granting and revoking access to these securables safely and efficiently.

  • On Monday, November 3, this feature will be enabled by default for all customers except those who have opted out.

• Behavior change release on by default period: Improved query audit for Databricks Unity Catalog

  • What's changing: Immuta’s Unity Catalog audit ingestion query now uses the table from Databricks. This foundational change significantly improves the match rate between Unity Catalog query audit records and Immuta-managed data sources, delivering more accurate and valuable insights.

    • There's now a better linkage between queries run in Unity Catalog and their associated data sources in the Immuta audit dashboards and reports, providing a clearer, more reliable picture of data access usage within Unity Catalog.

October 2025

October 30

MariaDB integration: Immuta now directly integrates with MariaDB hosted on Amazon Relational Database Service (RDS).

You can create Marketplace data products with MariaDB data sources, which allows your consumers to request access to these securables and enables approvers to efficiently manage access requests and provision access to data safely.

To begin using this connection, contact your Immuta representative.

October 24

Bug fix

Improved logic for data source health status: Data source health status reporting has been improved for clarity and accuracy.

• Previously, an Unhealthy data source could briefly appear as Healthy while a failed job was actively resyncing.

• Now, data sources will remain Unhealthy until all resync jobs are complete. The data source health status is updated only after the resync finishes, which prevents false positive health statuses from being displayed during failed policy resyncs and eliminates confusion for users.

October 22

Webhook history for Marketplace: You are now able to view the status of historical webhook events for your configured webhook endpoints. This new history view makes it easier to diagnose webhook errors and verify successful event delivery.

October 21

Behavior change release on by default period: Fine-grained access controls for Databricks Unity Catalog materialized views and streaming tables

Immuta supports row filtering and column masking on Unity Catalog materialized views and streaming tables. Since these securables now support Immuta subscription and data policies, you gain enhanced security and flexibility with consistent policy enforcement across your Unity Catalog ecosystem.

This feature is now enabled by default on all Immuta tenants that have not opted out of it. See the behavior change release features page for details.

October 15

Performance improvement for Trino integration: Immuta has optimized policy calculations for our Trino integration. This is a back-end update that is released to all customers.

These optimizations have led to performance improvements for Trino users who are not using Immuta projects. After releasing this enhancement, query times improved an average of 70% for users without an Immuta project set.

October 8

Python UDFs no longer created for Amazon Redshift integration: Immuta no longer creates Python UDFs in Amazon Redshift when an integration is created.

• AWS is ending support for Python UDFs in Amazon Redshift and will prevent the creation of new Python UDFs on November 1, 2025.

• Two policy types relied on Python UDFs when applied to Redshift data sources: reversible masking policies and non-global regex masking policies. Consequently, support for these policy types on Redshift data sources has been deprecated.

• On July 1, 2026, existing Python UDFs will no longer be functional, and Immuta will no longer support non-global regex masking or reversible masking policies for the Amazon Redshift integration. These policy types must not be used after this date.

October 3

Masking exception requests: Immuta Marketplace now supports masking exception requests, enabling organizations to safely grant granular access to sensitive data. Data consumers can request access to specific masked columns within a data product, and, if approved, see the unmasked values while masking continues to apply for all other users.

• Requests can be made for one or more columns within a data product.

• Approvals, denials, and revocations follow the same workflow and auditing as existing Marketplace access requests.

• Provisioning is handled automatically through Immuta policies, column tags, and user attributes.

Masking exception requests make column-level access manageable and auditable. Consumers only request what they need, while stewards review the request with context like classification tags. The result is simplified, repeatable workflows.

Contact your Immuta customer success representative for access to this feature.

October 2

• Support for Databricks Delta Sharing: Immuta now supports enforcing subscription policies on shares from Databricks Delta Sharing, allowing you to manage granting and revoking access to these securables safely and efficiently. The release of this feature will follow Immuta’s behavior change release process. The specific dates for each phase in that process are outlined below. For details about each phase, see the Behavior change release process page.

  • Opt-in period: 10/3 - 11/2

  • On by default period: 11/3 - 12/2

  • Enabled for all accounts: 12/3

• Ending Python UDFs support for Amazon Redshift integration: Support for non-global regex masking and reversible masking policies on Amazon Redshift data sources has been deprecated. AWS is ending support for Python UDFs in Amazon Redshift and will prevent the creation of new Python UDFs on November 1, 2025. To align with this, as of October 8 Immuta will no longer create Python UDFs in Amazon Redshift when an integration is created in Immuta. Two policy types relied on Python UDFs when applied to Redshift data sources: reversible masking policies and non-global regex masking policies. Consequently, support for these policy types on Redshift data sources has been deprecated. On July 1, 2026, existing Python UDFs will no longer be functional, and Immuta will no longer support non-global regex masking or reversible masking policies for the Amazon Redshift integration. These policy types must not be used after this date.

October 1

Improved query audit for Databricks Unity Catalog: Immuta’s Unity Catalog audit ingestion query now uses the system.query.history table from Databricks. This foundational change significantly improves the match rate between Unity Catalog query audit records and Immuta-managed data sources, delivering more accurate and valuable insights.

There's now a better linkage between queries run in Unity Catalog and their associated data sources in the Immuta audit dashboards and reports, providing a clearer, more reliable picture of data access usage within Unity Catalog.

• The following parameter is now populated: rowsProduced.

• These parameters are no longer populated, as they are not available in the system.query.history table: userAgent, requestId, clientIp.

The release of this feature will follow Immuta’s behavior change release process. The specific dates for each phase in that process are outlined below. For details about each phase, see the Behavior change release process page.

1. Opt-in period: 10/1 - 10/31

2. On by default period: 11/1 - 11/30

3. Enabled for all accounts: 12/1

If you are currently using Immuta's Databricks Unity Catalog audit feature without the required privileges for this change, you will see an in-app banner, requiring you to take action. If action is not taken by October 31, Immuta will disable the audit ingest feature on that date (query audit will be toggled to off in the integration settings).

September 2025

September 17

Fine-grained access controls for Databricks Unity Catalog materialized views and streaming tables: Immuta supports row filtering and column masking on Unity Catalog materialized views and streaming tables.

Since these securables now support Immuta subscription and data policies, you gain enhanced security and flexibility with consistent policy enforcement across your Unity Catalog ecosystem.

The release of this feature will follow Immuta’s behavior change release process. The specific dates for each phase in that process are outlined below.

1. Opt-in period: 9/18 - 10/20

2. On by default period: 10/21 - 11/20

3. Enabled for all accounts: 11/21

September 16

Bug fix

Eliminating possibility of wrong Collibra assets being autolinked to Immuta data sources: Previously, if a data source was created in Immuta before it was present as an asset in Collibra, a fallback method could link the wrong Collibra asset to the data source in Immuta. This only happened in the rare case where Collibra assets with the same schema and table name already existed in Collibra at the time of the auto-linking attempt, but the correct target asset wasn’t present yet.

Now, the Immuta catalog auto-linking method for Collibra will only attempt to auto-link Collibra assets using the fully qualified asset name following the Edge naming convention - eliminating the need for any fallback linking method. This guarantees an accurate match rate every time.

September 15

Databricks Runtime 14.3 support: Immuta's Databricks Spark integration now supports Databricks Runtime 14.3. With this update, you can upgrade your Databricks environment while preserving Immuta’s core data governance capabilities.

This update is only relevant to Databricks Spark customers, not customers using Unity Catalog.

September 12

Microsoft SQL Server integration: Immuta now directly integrates with Microsoft SQL Server. This integration supports several different deployment methods, including SQL Server hosted on Amazon Relational Database Service (RDS), Azure SQL Server, and self-hosted.

• You can now create Marketplace data products with SQL Server data sources.

• Data consumers can request access to these securables.

• Approvers can efficiently manage access requests and provision access to data safely.

To begin using this integration, please reach out to your Immuta representative.

September 11

Google BigQuery integration: The Google BigQuery integration is now enabled for all accounts, so you can explore the integration without having to request to have it enabled.

Once Google BigQuery has been configured, BigQuery administrators can author Immuta policies to enforce access controls, and users can then query policy-protected data directly in BigQuery.

September 10

Guardrail subscription policies: Guardrail subscription policies prevent users from gaining access to data unless they meet certain conditions. Unlike grant policies, guardrail policies do not subscribe users; they act as the minimum requirements that must be met before a user is even eligible to subscribe to data in the first place.

If the conditions of a guardrail subscription policy are not met, users will not be subscribed to the data source even if they meet conditions of a grant policy on the data source.

If you are using the Immuta API to generate subscription policy logic, ALL subscription policies with subscriptionType: policy will now always be set to shareResponsibility: true. Any different payload parameters for the shared responsibility setting will be ignored.

This feature will be introduced in a phased rollout. Immuta tenants where the feature has been activated will receive a notification popup on the policies page upon login. The Immuta team will contact customers who have not yet received the feature (as they may require a migration of existing policies) to coordinate the rollout, which must be performed by October 10.

September 8

Multiple approvers for data access requests: When configuring a request form with the list of data stewards that can respond to an access request, you can now select that all data steward groups, attributes, or permissions in the list approve. This option is now available in addition to the current behavior of any data steward from the list being able to approve.

This feature benefits organizations that require more than one level of approvals.

For example, you may require that the domain steward and someone from the governance team both approve every request for data access.

September 5

The cleanup script for deleting a Snowflake integration or connection now removes Immuta policies and Immuta-managed roles from your Snowflake environment. This enhancement provides the following benefits:

• Deletion of Immuta roles and policies happens in one place, which simplifies the cleanup process.

• You have full control over cleanup actions when running the script.

• You can better identify points of failure if any issues occur.

• You can easily re-run the script as needed.

This change applies to any Immuta Snowflake user running this script, regardless of whether or not you have migrated to using connections to register data or you still use the legacy integration method.

For guidance on how to delete a Snowflake integration or connection, see the Edit or remove your Snowflake integration or Deregister a connection guide. Before running the script, ensure you are using the latest version downloaded from Immuta and not a legacy version you may have saved previously.

September 4

Configuring the permissions that Immuta revokes for Databricks Unity Catalog users: You can now configure whether or not Immuta revokes Immuta users’ USE_CATALOG and USE_SCHEMA permissions when users do not have access to any of the securables within that catalog or schema.

Previously, Immuta revoked USE_CATALOG and USE_SCHEMA from users that did not have access to any securable within a particular catalog or schema. Now, you can disable this default behavior.

When this setting is disabled, Immuta users who do not have access to any securables within a catalog or schema will keep their existing USE_CATALOG and USE_SCHEMA permissions. Updating this setting will not retroactively update existing user permissions; this change will be applied on a go-forward basis only.

See the App settings guide for instructions on configuring this setting.

September 3

API response change

A portion of the response for the GET /policy/global/{policyId} endpoint (which retrieves all global policies) has been changed. The syncStatuses field used to be a rollup of all relevant job statuses and their counts; now the field is a boolean:

• Before

• After

August 2025

August 15

Custom WHERE clause policies behavior change: Data policies that use custom WHERE functions that include a column name argument must now use @columnReference('Column_Name') to specify the data source column to use in the policy. The following data policy types are affected by this change:

• Masking using a custom function (Mask columns tagged Discovered.PII using the custom function <custom where clause function>)

• Masking policy conditions that use a custom function (Mask using hashing columns tagged Discovered.PII where <custom WHERE clause function>)

• Row-level policies that use a custom function (Only show rows where <custom WHERE clause function>)

This change makes it easier to author custom WHERE clause policies and ensures greater accuracy and reliability in policy application.

Existing custom WHERE clause policies that reference column names and are applied to Snowflake and Databricks data sources have been automatically migrated to use the new @columnReference() format:

• Before migration: Only show rows where 'Location'='US'

• After migration: Only show rows where @columnReference('Location')='US'

August 13

Oracle integration: Immuta supports registering a connection for Oracle hosted on Amazon Relational Database Service (RDS). You can now create Marketplace data products with Oracle data sources, allowing your consumers to request access to these securables and enabling approvers to efficiently manage access requests and provision access to data safely.

August 11

Delegating steward review flow to the data product: When creating request forms, it is now possible to delegate the review flow configuration to each data product where the request form is used rather than it being set in the request form. Delegating the configuration of the review flow to the data products allows you to reuse request form questions yet still have unique stewards set per data product.

August 7

Compatibility with Collibra’s data classification module: Immuta’s integration with Collibra enterprise data catalog now also supports ingestion of Collibra data classifications as column tags into Immuta.

This allows customers that use the Collibra data classification module to leverage the resulting classifications for subscription or data policy authoring in Immuta. For example, you could use an Immuta masking policy to mask all columns by default if they were classified as sensitive by the Collibra data classification module.

August 5

Private networking support for Marketplace: Both the Immuta SaaS Marketplace and Governance applications now support private connectivity from organizations' networks. This allows organizations to meet security and compliance controls by ensuring that all traffic to the SaaS tenant applications only traverse private networks and no users can access it outside of their internal networks.

July 2025

July 31

Deprecations

Deprecated features remain in the product with minimal support until their end of life date.

In October, Immuta will require Snowflake integrations to enable table grants and low-row access policy mode. Additionally, Snowflake project workspaces (which require table grants to be disabled) will be unavailable.

Before October, Snowflake customers not using these features must complete the following tasks:

1. Ensure the user who has set up the Snowflake integration or Snowflake connection has all permissions listed on the Register a Snowflake connection guide. There are two permissions that may need to be granted to that user that were not previously required:

   1. CREATE ROLE ON ACCOUNT WITH GRANT OPTION

   2. MANAGE GRANTS ON ACCOUNT WITH GRANT OPTION

2. Navigate to App Settings > Global Integration Settings in Immuta, check the Enable Snowflake table grants box, and save the changes.

Once these steps are complete, you can use Immuta to manage Snowflake table grants without needing to grant access manually in Snowflake.

July 23

• Marketplace webhooks: Marketplace actions now fire webhooks that users can set up with their own systems to subscribe and react to. Actions like creating a data product, requesting access to a data product, or approving an access request that require additional follow-up actions outside of Immuta send out webhooks. You can then listen for those events and trigger your downstream actions based on your configuration.

• Manually link external catalogs on Amazon S3 data sources: Users can now manually link Amazon S3 data sources to an asset in an external catalog. Using this link, Immuta polls the external catalog to ingest and apply tags to each Amazon S3 data source. Immuta checks every 24 hours for any relevant metadata changes in the connected external catalog.

  The linked external catalog can be seen on the data source's detail page. The external catalog tags can be seen on the data source dictionary page. These tags can then be used to drive policies or classification frameworks.

July 17

Multi-tag dynamic domain assignment: You can now use multiple table tags to assign data sources to domains dynamically. Before, you could only pick one tag and every data source with that tag was assigned to a certain domain. This enhancement removes that limitation for table tags and connection tags.

• Table tags example: If you have a data source tagged Finance and another data source tagged HR but you want both to belong to the Operations domain, you can configure the Operations domain with dynamic tag assignment and select both the Finance and the HR tags.

• Connection tags example: If you have a catalog in Databricks and a database in Snowflake that both belong to the Customer 360 domain, you can leverage connection tags and select both the Databricks and Snowflake connection tags to assign data sources to the same domain.

You can combine up to 100 tags through this mechanism.

July 10

PostgreSQL integration in public preview: This includes Immuta’s enhanced connections onboarding and support for table grants. Immuta currently offers support for the following deployment methods:

1. Self-managed PostgreSQL

2. Amazon Aurora

3. Amazon RDS

4. Neon

5. Crunchy Data

July 1

Email notifications for Marketplace: The following Marketplace events will trigger email notifications to the appropriate users, accelerating time to data, if user emails are mapped from your identity manager to Immuta:

• Data product request

• Determination made on request

• Access revoked

• Canceled request

• Pending request(s) reminder

• Expiration reminder (temporary approvals)

• Data product deletion which impacts a request

June 2025

June 13

Updates to governance reports for subscription status: Improved performance by 10x for rendering the following governance reports:

• What data sources are users subscribed to

• What users and groups are subscribed to a data source

Additionally, these reports include a new “Access Grant” column that denotes if a user has READ or WRITE access to a data source.

June 12

Marketplace is public preview: Marketplace is available to all customers to help manage their request and approve provisioning needs.

June 11

Identification for Redshift in general availability: Identification support for Redshift is generally available.

Redshift identification supports multiple criteria to identify and tag your data:

• Column name matching with a regex

• Column contents matching where a sample of the actual data is matched with a regex

• Dictionary matching where a sample of the actual data is matched with a dictionary

To perform the matching, Immuta analyzes the sample directly inside Redshift so that no data ever leaves your data lake. Immuta provides 50+ out-of-the-box identifiers to find common PII, like credit cards or social security numbers.

June 10

Review assist for access requests

Review assist monitors access request determinations made by your data stewards and finds trends across two factors that determine access approvals, temporary approvals, or denials. Those factors are:

• The data in the data product itself, meaning the trends are associated with the specific requested data.

• Metadata about the requestors, such as the groups and attributes they possess.

Once review assist has identified trends, it begins to form a recommendation about whether the data steward should approve, temporarily approve, or deny the request that it presents in future access requests.

An AI-generated justification for the decision will accompany that recommendation, which is pre-populated to submit along with the access determination. This AI-generated justification is based on the trends across the factors above, as well as prior human-entered justifications. For temporary approvals, review assist also considers past temporary approvals to determine the recommended duration.

June 3

Customizing stewards in Marketplace: Users can now customize the stewards who manage access requests at the request-form level. This enhancement provides the following benefits:

• Granular steward assignment: Steward assignment can be as granular as needed. You can assign stewards by specifying usernames, groups, attributes, or permissions.

• Separation of duties: Stewards can be assigned separately from the data product owners (those with the Manage Data Products permission in the domain).

June 2

Support for Redshift datashares: Immuta can now govern Redshift datashares. Users can onboard and apply Immuta controls to Redshift datashares with the same workflows they are using for standard Redshift data sources today.

May 2025

May 30

Integration with Atlan for seamless tag ingestion: Immuta now offers a new, out-of-the-box standard connector designed to seamlessly integrate Immuta with the Atlan enterprise data catalog. This connector enables automated tag enrichment within Immuta, leveraging the rich metadata and tagging information managed within Atlan. By establishing a direct link between these two platforms, organizations can significantly streamline the process of applying consistent and comprehensive tags to their data assets within Immuta.

May 29

Marketplace temporary approvals: Stewards are now able to temporarily approve access to data products by either accepting the requestor’s proposed duration of access, or entering their own. Temporary approvals allow the steward to:

• Hedge riskier approvals

• Reduce recertification / entitlement review load: Access is lost and if the user still needs it, they can ask again rather than steward’s reviewing and confirming access through periodic campaigns

Immuta will automatically deprovision access directly in the data platform as soon as the duration period ends.

May 28

Identification for Starburst (Trino) in general availability: Identification support for both Trino open source and Starburst Enterprise is generally available.

Starburst (Trino) identification supports multiple criteria to identify and tag your data:

• Column name matching with a regex

• Column contents matching where a sample of the actual data is matched with a regex

• Dictionary matching where a sample of the actual data is matched with a dictionary

To perform the matching, Immuta analyzes the sample directly inside Starburst (Trino) so that no data ever leaves your data lake. Immuta provides 50+ out-of-the-box identifiers to find common PII, like credit cards or social security numbers.

Removed features

Databricks Runtime 9.1 and 10.4: Support for these Databricks Runtime versions has been removed from the product.

May 22

Connections for Snowflake and Databricks Unity Catalog in general availability: Connections are Immuta’s improved way of efficient data object management.

As part of our commitment to delivering the best possible onboarding experience, by September 2025, Immuta will no longer support onboarding Snowflake and Databricks Unity Catalog data sources using the legacy method.

Over the coming weeks, a banner will be displayed to Immuta administrators for tenants that have not been upgraded yet. This will redirect them to the Upgrade Manager where they can initiate the process to upgrade any remaining integrations using the legacy onboarding pattern.

For any questions or concerns, please reach out to your Immuta support professional.

May 21

Identifiers in domains in general availability: Identifiers in domains is now generally available and will be enabled for all SaaS tenants. This functionality replaces identification frameworks, which are now deprecated and removed from the product.

New functionality and advantages of identifiers in domains allows you to do the following:

• Leverage your existing domains to segregate identifiers by domain

• Delegate ownership of identifiers to specific individuals by granting the Manage Identifiers permission on a domain level

• Control whether or not identification should run on new data sources and columns automatically for each domain

• Place tags outside of the Discovered . * hierarchy

• Understand via the tag side sheet which identifier placed each tag and what the specific hit rate was (only available for tags placed with the new feature enabled)

Immuta is automatically migrating all tenants to identifiers in domains. You will see the following changes in your tenant:

• Identification frameworks will disappear and become unavailable.

• The SDD application setting will disappear and become unavailable. SDD is now always enabled, but will only run on data sources in domains with identifiers.

• There is a new Identifier tab and a new setting for auto-scanning in each domain.

• The API is changing.

• A new domain has been generated for each deprecated identification framework. It will be named as the name of the identification framework plus (Immuta generated). These domains hold the same data sources and identifiers the identification framework held before.

• If you set a global framework in the application settings previously, the respective domain will be set to auto-scanning and get data sources assigned to dynamically. It will now run on all data sources, regardless of if they are in another domain.

• The built-in identifiers Immuta provides have been improved and are more accurate. This won’t impact any existing identifiers that are already part of a domain (or were part of an identification framework). You will only get the latest version of a reference identifier when you copy it into a domain.

If you are currently actively using identification / SDD, your tenants have been excluded from this rollout. An Immuta customer success representative will reach out to coordinate the rollout with you for your specific SaaS tenants

May 16

Customized request forms for Marketplace: This feature allows you to customize questions you ask requestors and more easily manage data use agreements. Furthermore, they provide more valuable information to the data steward making access determinations by ensuring all relevant information is answered by the requestor.

May 15

Enhancement

Collibra integration now supports the OAuth 2.0 authentication method: In a continuous effort of adapting industry best practices for authentication between applications, Immuta’s Collibra integration has added support for the OAuth 2.0 authentication method in addition to the supported username/password authentication method.

Removed feature

Removed ability to change the default subscription policy setting: The ability to configure the behavior of the default subscription policy on newly registered data sources has reached its end of life (EOL) date and has been removed from the product. As a result, by default Immuta will never apply a subscription policy to newly registered data sources unless an existing global policy applies to them. To set an "Allow individually selected users" subscription policy on all data sources, create a global subscription policy with that condition that applies to all data sources.

May 9

Automatic SSO login for Marketplace: Once you configure a single identity manager (IAM) with Immuta that supports SAML or OIDC SSO, users that are signed in to the SSO will be automatically logged into Marketplace. If they use a link within an external catalog, they will be automatically redirected to the request access screen in Marketplace without seeing the sign in screen.

With an SSO configured, users will not be able to login to Marketplace with internal Immuta accounts.

April 2025

April 29

Identifiers in domains: Identifiers in domains is available in public preview and enabled by default on all new SaaS tenants. This functionality replaces identification frameworks and allows you to

• Leverage your existing domains to segregate identifiers by domain

• Delegate ownership of identifiers to specific individuals by granting the Manage Identifiers permission on a domain level

• Place tags outside of the Discovered . * hierarchy

Behavior change

Disabled data source behavior for Azure Synapse Analytics, Databricks Unity Catalog, Google BigQuery, Redshift, and Snowflake integrations: Immuta will remove all policies on disabled data sources for these integrations.

• Previous behavior: Disabling a data source triggered a lockdown policy, which revoked all users’ access until the data source was either deleted from Immuta or re-enabled.

• New behavior: Disabling a data source will remove existing Immuta subscription and data policies and prevent Immuta from adding new policies until the data source is re-enabled. Immuta policies will be removed from currently disabled data sources. For view-based integrations (Azure Synapse Analytics, Google BigQuery, and Redshift), if a user disables an object in Immuta, the Immuta-created view will be deleted.

April 24

Data source changes in the Governance app are reflected in the Marketplace app: If a data source is deleted or removed from a domain in the Governance app, it will now be removed from any corresponding data products that contain that data source in the Marketplace app.

April 22

Immuta SaaS private networking over AWS PrivateLink in public preview: The Immuta SaaS Governance application supports private connectivity from organizations' networks. This allows organizations to meet security and compliance controls by ensuring that all traffic to the SaaS tenant Governance application only traverses private networks and no users can access it outside of their internal networks.

April 21

Automated connection tags: All data sources that are registered from connections will now have an automated tag applied that represents the connection. These tags can be used like any other tags in Immuta to build policies, add data sources to domains or generate reports. Immuta fully manages those tags, and they can’t be deleted or edited.

The tag will be formatted as follows: Immuta Connections . The Technology . Your Connection

April 15

AWS Lake Formation integration: This integration allows administrators to use Immuta to orchestrate Lake Formation access controls so they can better centralize and scale governance in AWS. Immuta can enforce subscription policies (grants and revokes at the table level) across three AWS services: Amazon Athena, Amazon EMR Spark, and Amazon Redshift Spectrum.

April 14

Behavior change

Identification and sensitive data discovery will replace orphaned legacy tags: Starting on April 22, 2025, Immuta will remove orphaned tags placed by the legacy sensitive data discovery mechanism.

• Previously: The legacy sensitive data discovery mechanism was deprecated in September 2023. Tags placed by the legacy SDD mechanism are still visible on columns and can’t be removed - only disabled.

• New behavior: If you run identification on a data source, unless identification places the same tag, the tag will get removed.

April 8

Support for Databricks Unity Catalog models and functions in public preview: Immuta has expanded its governance capabilities by introducing subscription policy support for Databricks Unity Catalog models & functions. In addition to existing support for tables, views, and volumes, Immuta now supports governing which users can execute models & functions. This feature is currently available in public preview for customers using Immuta connections and will be included in the connections upgrade.

April 3

Data source to domain assignment is now generally available: Assigning data sources to domains dynamically is now generally available and enabled by default. When you create a new domain or edit an existing domain, you can choose to either assign data sources manually or dynamically based on a table tag. All existing domains are set to manual assignment.

April 1

User interface changes

• Updated color scheme: The updated color scheme improves accessibility and contrast throughout the application. This change will also provide a more consistent experience alongside the new Marketplace offering.

• Improved navigation menu: The reorganized navigation menu makes the application more intuitive and user-friendly. The menu now includes a Metadata section for managing tags; an Identities section for managing users, groups, and attributes; and an Insights section for managing reports, audit, and notifications.

• Detect, Discover, and Governance sections have been removed from the navigation menu. These functionalities are now integrated throughout the application.

Feature removal

K-anonymization policies have reached end of life and will be removed from the product.

March 2025

March 27

Removed infrastructure admin permission for connections: The infrastructure admin permission has been removed, as it was a duplication of the data owner permission functionality. Any users that previously had the infrastructure admin permission on any connection, database, schema, or data object have been granted the data owner permission at the relevant hierarchy levels instead.

Since both permissions offered the same functionality, this change does not impact users’ ability to perform actions in Immuta.

March 20

Behavior change

Identification and sensitive data discovery timeout: Starting on April 2, 2025, Immuta queries for identification and sensitive data discovery will have a timeout of 15 minutes. This timeout ensures that there are no long-running queries that block your compute resources and helps to reduce the cost of running identification.

The majority of identification runs complete within 15 minutes. If you expect identification to run longer than 15 minutes, reach out to your Immuta representative to configure a longer timeout window for your tenant.

Running identification on complex views with large amounts of data is more likely to result in timeouts. Immuta recommends running sensitive data discovery and identification on the underlying base tables.

Deprecation

Databricks Runtime 10.4: Support for this Databricks Runtime has been deprecated.

March 18

Data source to domains assignment: This new feature is the ability to choose how data sources are assigned to your domains. Either manually, as has always been possible, or dynamically, which will assign the data sources to a domain based on their table tags.

Before, a user with the GOVERNANCE permission had to manually assign every data source to a domain. However, with this new feature, the governance user can now decide on a tag, and every data source with that tag will be added to the domain. Dynamic assignment will continuously update the domain so that only and all data sources with the tag are in the domain.

March 14

Support multiple Redshift integrations with the same host on a single Immuta tenant: Immuta allows multiple Redshift integrations with the same host to exist on a single Immuta tenant. Users can create multiple Redshift integrations with the same host name, provided that each integration has a different port (which Immuta uses to differentiate each one). This support gives Redshift users the flexibility to use infrastructure setups with multiple Redshift clusters, instead of being limited to using a single cluster.

March 13

Support for Databricks Unity Catalog volumes in public preview: Immuta supports READ and WRITE access controls for volumes in Databricks Unity Catalog. This feature is currently available in public preview for customers using Immuta connections and will be included in the connections upgrade.

March 12

• SDD global settings update: The global sensitive data discovery (SDD) enablement setting has been removed from the app settings page and is available by default on all tenants. To run identification on your data sources, add them to an identification framework. If you want SDD to run automatically, add an identification framework to the Global SDD Template field on the app settings page.

• Marketplace now allows user-provided IDs when creating data products over the API: The create data products endpoint now accepts an optional user-provided ID for the data product. This allows users to share IDs across systems (such as between Collibra and Immuta)

  and and pushing approved changes to the Immuta API.

March 11

Databricks Runtime 14.3 support: Immuta's Databricks Spark integration now supports Databricks Runtime 14.3. This compatibility enables users to upgrade their Databricks environments while preserving Immuta’s core data governance capabilities.

March 7

• Display last 5 access determinations in Marketplace: When a data steward is making a determination on a request for access, Immuta shows the last 5 approvals and denials. This enhancement assists the data stewards in making an accurate decision, as they can see the prior decisions and the reasoning behind them.

• Include account ID in Marketplace URLs: You can append the account identifier to the end of the Marketplace URL. Adding the account identifier can simplify URL redirects to the Marketplace because the user no longer needs to know the account ID to login.

March 6

Bug fixes

• UI tab loading issues: The permissions tab was not loading properly when customers were using connections. This was caused by a custom JavaScript object type coming from a third-party library. UI code has been changed to no longer use this custom object type, which has resolved the issue.

• Snowflake object type mislabelling leading to policy lockdown: Some customers using connections for Snowflake were seeing Immuta processes sending wrong SQL statements when trying to apply data policies on their environment, such as ALTER TABLE on Snowflake objects of type VIEW.

  Since these SQL statements by definition will always fail to execute successfully, Immuta revoked all users' existing access on the affected objects because it could no longer guarantee successful application of masking and row-filter policies on those objects.

  The issue of mislabelling Snowflake table types was caused by an incorrect query in Immuta’s backend code, leading to erroneous overrides of Snowflake table types in the Immuta internal metadata storage. The query has since been fixed and all affected objects have been updated to contain the correct Snowflake table type.

February 2025

February 27

Data connections for Snowflake and Databricks Unity Catalog in public preview: Connections is Immuta’s enhanced way of efficient data object management that offers the following benefits:

• Reduced complexity by just having one connection in Immuta for both metadata onboarding (pull) and policy application (push) with your data platform

• Increased scalability by onboarding all your objects at once instead of repetitive patterns (such as schema by schema)

• Improved performance to manage and track metadata changes

• Fully automated metadata change detection

Connections is enabled by default on all new tenants created after February 26, 2025, and available upon request for tenants created prior. Reach out to your Immuta support professional to enable it on your tenant. Once enabled, a banner will direct you to the upgrade manager where you can initiate the process to upgrade any of your existing integrations.

February 25

Column name regex support for Google BigQuery: Sensitive data discovery now works to tag data source columns based on column name regexes for Google BigQuery data sources. Those tags can then be leveraged when building data or subscription policies to grant access to data sources and mask sensitive data. Classification is also supported to place sensitivity tags and classify data further.

February 20

Column name regex support for Azure Synapse Analytics: Sensitive data discovery now works to tag data source columns based on column name regexes for Azure Synapse Analytics data sources. Those tags can then be leveraged when building data or subscription policies to grant access to data sources and mask sensitive data. Classification is also supported to place sensitivity tags and classify data further.

February 18

• Marketplace API support: All Marketplace functionality is now available to customers through the Marketplace API.

• New built-in patterns: Two new built-in identifiers are available to all customers using sensitive data discovery:

  • SEC_STOCK_TICKER: This new pattern detects strings consistent with stock tickers recognized by the U.S. Securities and Exchange Commission (SEC).

  • FINANCIAL_INSTITUTIONS: This new pattern detects strings consistent with the official and alternate names of financial institutions from lists by the FDIC and OCC.

  Add these identifiers to your frameworks to start detecting and automatically tagging this data.

February 4

@hasTagAsAttribute() and @hasTagAsGroup() functions for subscription policies in general availability: These functions provide a way to dynamically grant and revoke access to users by doing an exact match comparison between their user information (attribute or group membership) and the tags applied on data sources or its columns.

Ultimately, these functions can combine the complexity of multiple roles or rules into a single policy that dynamically assigns access based on users’ attributes or group membership. This results in fewer policies to manage overall and a more streamlined approach to data access management, especially for the most complex use cases.

Deprecation

K-anonymization policies: Support for k-anonymization policies has been deprecated.

January 2025

January 30

Data policy support for foreign tables in Databricks Unity Catalog: Users can apply subscription and data policies to foreign tables in Databricks Unity Catalog.

January 28

Changing the default value for Default Subscription Merge Options (in app settings): Based on customer insights, Immuta has changed the default behavior of how multiple global subscription policies that apply to a single data source are merged.

Prior to this change, the global default had been that users must meet all the conditions outlined in each policy to get access. Now, the global default is that users must only meet the conditions of one policy to get access. This behavior can be configured on the app settings page.

January 23

Support for masking complex columns as NULL in Databricks Unity Catalog: Users can mask the entire column of STRUCT, MAP, and ARRAY column types in Databricks Unity Catalog as NULL.

January 16

• Streamlined Databricks user management with improved handling of external IDs: The default behavior going forward will be that users' external Databricks IDs will be updated to None if Immuta attempts to update these users' Databricks access and Databricks returns a response dictating the targeted principal(s) do not exist. This can be the case if a user is created in Immuta before that user is created in Databricks. Marking external Databricks IDs as NONE will enable Immuta to skip future attempts to update those users' access. This streamlines the tasks that Immuta must process and avoids superfluous errors.

  Databricks external IDs can be updated as needed manually, either through the user profile or by setting this property to <NO IDENTITY> in the external IAM configuration.

• : Identifiers can be segregated by domain now to manage which identifiers should run on which data sources. Additionally, you can delegate the management of identifiers to specific users by granting them the Manage Identifiers domain permission.

  Once generally available, this functionality will replace identification frameworks.

CVE-2022-37616