Saved views, custom columns and better filters

You can now shape a table once and come back to it, on Applications, Accounts and Licenses, Identities and Users, Tickets, and Contracts.

• Save a view: name a set of filters and columns, then pick it again from the views dropdown whenever you need it.

• A rebuilt filter bar with new operators: build conditions field by field, with operators that suit the field, including "is not" to exclude rather than only include.

• Share views to your workspace or keep them to yourself : saves views either as workspace view so any other admin can see it, or save it as a personal view for yourself only.

• Define a default view: set on each page a view as a default view and come back to it every time you loads Corma.

• Choose your columns: show the fields you care about, hide the rest, and keep that choice per view.

• Table or board: switch view mode, and send a link that opens the table exactly as you left it.

This means the filtering you rebuild every morning becomes something you set up once.

Capacities are now reads and writes, with history logs

What a connector does is no longer described as capacities. Each connector now tells you plainly what it reads from an app and what it writes back, and lets you control each one.

• Reads and writes replace capacities: the same underlying operations, named for what they actually do. Reads are the data Corma pulls in, writes are the changes Corma can make.

• Counts on every connector: see how many operations a connector reads and how many it writes before you connect it, not after.

• Turn any single operation on or off: open Manage on a connected connector and switch an individual read or write without disconnecting the whole integration.

• See what ran and when: each operation shows the outcome of its last run beside it, so a failing sync is visible next to the operation itself instead of buried in a log.

• Writes say when they fire: provisioning and deprovisioning actions are tagged as onboarding or offboarding actions, with a line explaining what triggers each one.

This means you can tell exactly what Corma does with an app, in the words you would use yourself, and change it one operation at a time.

Contracts and invoices are now in the public API

You can now manage contracts, invoices and tickets programmatically, alongside the users, licenses and groups already available.

• Contracts and invoices: list, create, update and delete both. Contract responses include seat items with their cost and billing period, plus fixed items and subscription details.

• Tickets replace tasks and access requests: the API now matches the product, where those two became tickets. A new Create action endpoint takes over from the legacy Tasks endpoint.

• Documented in the API reference: every new endpoint, its parameters and its error cases, in the Dev center.

This means your contract and ticket data can flow into your own finance and ITSM tooling without an export step.

Improvements

• Corma now collects more of your Google SSO and SAML applications, including their last activity dates, so more of your stack shows up without extra setup.

• Row actions have moved out of the three dots menu at the right of tables and into the selection bar, with 17 new bulk actions across 8 more entities so nothing is lost.

• Password reset and creation steps for Google Workspace, Microsoft and AWS now share one recipients picker, with optional subject and message fields, so you can send your own wording along with the temporary password.

• Application page cards now cover every status, including restricted, to review and decommissioned, instead of grouping everything into Official and Shadow IT.

• The Authentification checkboxes on applications are now labels, so authentication methods work like every other label and can be filtered the same way.

• You can now see and edit an employee's personal email from the HR Properties panel on their page.

• The main search modal now shows its keyboard shortcuts in a footer.

• Public and Internal labels now always appear after your own labels, so yours are the ones shown first in tables.

• HubSpot seats are now the source of truth for license types on that integration, so removing a seat in HubSpot updates Corma.

• Updating a single license is faster.

Fixes

• Google SAML applications not appearing in your SSO applications, and so not being matchable, has been fixed.

• A nightly job marking non-Microsoft SSO applications as deleted has been fixed, and the affected records have been repaired.

• "Sync members" on a Google or Microsoft identity provider group reporting success while doing nothing has been fixed.

• Date-reached workflow triggers never firing when the date landed on the day itself has been fixed.

• CSV import failing on users who already exist, instead of updating them, has been fixed.

• Nightly Kelio user syncs timing out on large tenants has been fixed.

• A declined sync pass showing as a completed run has been fixed, and sources are now ordered by freshness everywhere.

• A contract renewal date sent as empty being stored as 1970, and producing renewal reminders dated in the past, has been fixed.

• Assigning a country code through the public API when no other user in the workspace had that country has been fixed.

Sign in to Corma with SAML SSO

Corma now supports SAML 2.0 single sign-on, so your team logs in with your own identity provider alongside the existing Google and Microsoft sign-in methods.

• One connection per workspace: a workspace admin connects your provider once from Settings > Security > SAML, using the provider's metadata URL or XML file.

• Presets for the providers you already use: pick Okta, Google Workspace, Microsoft Entra ID, Keycloak or OneLogin from the provider dropdown, or connect any other SAML 2.0 provider through the "Other" option.

• Automatic provisioning on first sign-in: anyone your identity provider authenticates joins your workspace automatically as an employee, with no invitation and no seat to prepare in advance.

• Optional enforcement: once your connection is verified, "Enforce SAML for all members" blocks password, Google and Microsoft sign-in and sends everyone through your identity provider instead.

This means access to Corma itself can follow the same identity rules as the rest of your stack.

Enforcement requires an active SAML connection, and deleting the connection resets it, so a workspace can never lock itself out.

Start here: SAML SSO and How to set up SAML SSO, or go straight to your provider: Okta, Google Workspace, Microsoft Entra ID.

A more complete picture from Okta

Corma's Okta sync now keeps every field Okta returns, instead of discarding some of them along the way.

• Apps land in the right category: apps that were previously miscategorized, or that failed to match against Corma's catalog, now come through correctly.

• User groups come across too: with the new scopes in place, Corma can collect your Okta user groups.

• User Roles are now synced

• Corma can now provision and deprovision Okta users

This means what you see under Connectors > Okta now lines up with what you see in Okta.

Improvements

• Workflows and Audit logs are out of beta, and Workflows now sits in a new "Power up" section in the sidebar.

• Workflows have a new action: add a user to a bundle.

• Updating a license status is faster.

• Contract line items load faster and are more reliable.

Fixes

• Activating a workflow sending it back to draft has been fixed.

• Duplicating a workflow losing its branches and its trigger has been fixed, and a duplicated workflow now starts as a draft.

• CSV exports timing out on large files has been fixed.

• Several Cormie reliability issues, including actions failing to run, have been fixed.

Introducing Labels

You can now create your own custom labels for Apps, Users, and Licenses — a flexible way to organize your workspace beyond Corma's built-in fields.

• Create labels your way: name a label, pick a color from 10 presets (or enter a custom hex), and choose whether it applies to Apps, Users, or Licenses.

• Apply them anywhere: add labels directly from an app or user's page, or right from the Applications, Users, and Licenses tables.

• See them at a glance: labels show up as colored pills in your tables, with a hover card listing everything if more than one is applied.

• Filter by label: find everything tagged with a specific label across your tables.

• Manage them centrally: a new Labels page in Settings lists every label, how many items it's applied to, and when it was last used.

  This gives you a flexible way to organize and find what matters to your company, on top of everything Corma already tracks.

  

  ---

  Improvements

  • Public API keys can now be created as read-only, in addition to full-access.

  • Custom agents can now ask for login credentials mid-chat, instead of requiring them all upfront.

  • The Bitwarden integration now works with self-hosted Bitwarden workspaces, not just Bitwarden Cloud.

  • Provisioning now has a "No action" option, matching the existing deprovisioning behavior.

  • CSV imports for users and licenses no longer time out on large files.

  • The Security page's "Restricted apps in use" card is back, with apps sorted by last activity.

  Fixes

  • Extension activity data no longer updating has been fixed.

  • Some Modjo license syncs failing has been fixed.

  • Licenses missing account ID after custom agent provisioning has been fixed.

  • Workflow runs getting stuck "in progress" has been fixed.

  • Dropdowns inside modals being cut off has been fixed.

  • Session cookies growing too large and causing login errors has been fixed.

  • Okta sometimes misclassifying catalog apps as custom apps has been fixed.

Temporary access requests

Employees can now request access for a limited time instead of indefinitely, and Corma revokes it automatically once that time is up.

• Add access lengths per app: in an app's Requests settings, turn on Temporary access and add the durations employees can choose from — hours, days, weeks, or months.

• Choose from Employee App Store or Slack: employees pick their access length from the same dropdown, whether they request through the App Store or Slack.

• Decide if indefinite access stays allowed: turn off indefinite requests entirely if every request for an app should be time-bound.

• Automatic revocation: once the duration passes, access is revoked automatically and the employee is notified — if they still need it, they submit a new request.

This means access can be granted for exactly as long as it's needed, without anyone having to remember to clean it up afterward.

Shadow IT policies

Your Security page has a new look, and you can now define your own policies for how employees are stopped from using unauthorized apps:

• Warning or Blocked: choose whether employees see a dismissible warning or a full-page block when they open an app covered by a policy.

• Applies to a list of apps: one policy can cover several apps at once, and each app can belong to only one policy.

• Exclude specific teams: leave out any user groups who should be allowed to use the app.

• Write your own message and call to action: customize what employees see, with optional buttons pointing them to an approved alternative.

• Enforced through the browser extension: policies apply the moment an employee opens the app in their browser.

This gives admins real, granular control over Shadow IT, instead of relying on an app's status alone.

Improvements

• Okta integration can now sync HR data (department, job title, country, and more), not just identity.

• Sorting added for the Extension and Desktop agent columns on the Users table.

• Password requirements (length, character rules) for the Reset Password action are now configurable in Settings.

• App details, previously hidden behind clicking an app's logo, now live in their own dedicated Settings tab.

• Custom agent connections now show their creation and connection date, current credential method, and can be renamed — disconnecting and reconnecting no longer wipes your existing configuration.

• Integration connections can now be disconnected directly from their card, without losing existing automations.

Fixes

• Slack ticket messages losing their action buttons and outcome has been fixed.

• Non-admin users seeing settings controls they shouldn't has been fixed.

• Kelio syncs timing out and failing to import data has been fixed.

• A Shadow IT policy edge case with certain domains has been fixed.

• Offboarding suggestions missing for distant termination dates has been fixed.

• The "Re-assign license" button not opening its modal has been fixed.

• The Google "transfer email" workflow action failing has been fixed.

Bring custom agents to your internal apps

You can now build a custom agent for your own internal applications, not just apps in Corma's public catalog.

• Full coverage, even for homemade tools: if your company built or uses a tool that isn't in Corma's 50,000+ apps catalog, you can now train a custom agent for it the same way you would for any other app.

• Same provisioning and deprovisioning automation: internal apps get the exact same custom agent capabilities as public ones, no more manual exceptions for the tools built in-house.

This means you can reach closer to full automation across your entire stack, including the tools that are unique to your company.

Microsoft Teams notifications

Corma can now send workflow and access management notifications directly to Microsoft Teams, alongside existing Slack support.

• Stay informed in Teams: get notified about workflow runs and access events without needing to check Corma or Slack.

This means teams that use Microsoft Teams instead of Slack no longer have to miss out on real-time notifications.

See how to conifgure it here: Enable Microsoft Teams notifications on Corma 

Yooz Integration

Corma now integrates with Yooz!

Yooz is an AP automation and invoice-processing platform that helps finance teams digitize and streamline their accounts payable workflows.

You can now:

• Collect licenses: centralize Yooz users and licenses in Corma

• Provisioning & deprovisioning: automatically assign and revoke Yooz access directly from Corma to effortlessly manage your licenses use

Improvements

• Custom agent setup no longer disconnects when switching tabs, and you can now see a log of custom agent runs and their status.

• Apps that already have a custom agent connected are now shown as disabled with an explanatory tooltip, instead of disappearing from the creation modal.

• Start and termination dates can now be cleared once set, with an improved date picker.

• Offboarding no longer creates noisy duplicate manual tasks for child products under aggregated vendors like Microsoft, Atlassian, and Google.

• User CSV import now supports a personal email column, alongside the professional one.

• New filters on the Applications page: filter by User Group or by Country.

• The App filter on license tables now supports an "is not" operator, letting you exclude specific apps instead of only including them.

• Activity extraction added for Cursor & Claude

Fixes

• Onboardings sometimes getting stuck in "Ongoing" status has been fixed.

• Admin invitations by email sometimes failing has been fixed.

• CSV export emails being wrongly suppressed when email notifications were disabled has been fixed.

• Search sometimes treating similarly-named tickets or users as identical results has been fixed.

• Termination dates set more than 30 days in advance are no longer hidden and can be nulled

• Access owners losing the ability to manage their apps from the employee portal has been fixed.

Big announcement today: Tasks and Requests that used to be separate concepts have now been merged as one single concept called “Tickets”!

This is a major shift in the product logic, which aims to greatly simplify how IT teams view and handle every task that requires manual input and is triggered by Corma’s access management solution.

How it was before:

Previously Tasks were all the actions that had to be performed manually and that Corma could not automate via API or Agent. While Requests were all access requests submitted by employees or their managers to gain access to a tool they need to do their job.

Both lived separately; only tasks could generate Jira or Siit tickets, and our users were confused since ultimately both result in the same thing: an IT team member needs to perform a manual action and validate it in Corma so we could update the record of truth of your access and licenses.

Well no more!

How it is now:

As of today, both Tasks and Requests are now living under the same page and concept called Tickets.

This means no more back and forth between what you need to do in Tasks and what you need to do in Requests. Everything is centralized in Tickets, clearly and automatically titled, auto-assigned to the relevant person, and labelled with the full context of this ticket.
An access removal is linked to an access review that was recently completed? You will see it clearly in the ticket and can directly go to the relevant access review to see who made the decision.

This also means that now every ticket, no matter the type of ticket, that lives in Corma can generate a ticket in your main ticketing system. Our goal is to take this further very soon by giving you:

• More flexibility to create custom ticket types in Corma (e.g. New app request, Need a password reset, etc…)

• A full 2-way synch between Corma tickets and tickets in your ITSM, starting with Jira and Siit.

That’s not all: New Triggers, Actions and APIs

We’re all releasing some new Triggers, Actions and APIs today to go along this massive change in our product:

New trigger: Ticket created

You can now trigger workflows whenever a ticket is created in Corma. This allows you to build workflows like the simple one below to create tickets in your main ticketing system every time one is created in Corma so no data silo is created between your tools.

You can go further with our branching system to build much more complex workflows, for instance to put tickets in different Jira projects and with different task types depending on the app being targeted by the workflow!

New workflow action: Ask approval

A brand new action to ask approval of anyone before proceeding with the rest of your workflow.

Here is an example below of a workflow where, when a user has their termination date today, it asks the manager for confirmation before deprovisioning all their accounts automatically.

New workflow action: Add user to group

Add user to Corma user groups directly from the workflow as a new automated action

New public APIs: Manage User Groups

Brand new endpoints to manage Corma user groups programmatically outside of Corma.

Perform GET, POST, DELETE and PATCH operations on any group except IdP groups that cannot be modified, as the source of truth lives in the IdP.

And much more of course:

• New User Group rule based on user type

• Salesforce connector fixes

• Activity extractor for ChatGPT agent

• Microsoft token skip fix for large paginated responses

Add branching logic to your workflows

Your workflows can now split into different paths depending on conditions you set. For example, sending internal employees down one path and external contractors down another.

• Branching steps: add if/switch conditions to any workflow, with scoped variables and validation.

• Live run graph: see exactly which path a workflow run took, with the ability to retry or skip individual steps.

This makes it possible to handle more complex, real-world processes without needing multiple separate workflows.

(Note: the "ask for approval" branching action is coming soon.)

Learn more about how to set up conditional workflows here

Improvements

• The chat panel during custom agent setup can now be extended.

• Clicking an invoice now opens a redesigned modal.

Fixes

• Custom agent not being available for apps that already have an API connector (e.g. Amplitude, Yousign) has been fixed.

Dark Mode, for your eyes only

You can now switch Corma's appearance to a dark theme from your profile settings.

• Appearance setting: choose your preferred theme from the profile dropdown.

• Applies across the app: dark mode carries through every page.

This gives you a more comfortable viewing experience, especially in low-light environments.

A smarter search bar

Corma's search now looks across more than just apps. You can find users, workflows, user groups, bundles, and access reviews directly from the search bar.

• Search across more than apps: find users, applications, bundles, access reviews, workflows, and user groups all from one search bar.

• Faster navigation: jump straight to the page or item you're looking for without digging through menus.

This makes it quicker to find exactly what you're looking for, wherever it lives in Corma.

Settings page got a revamp and Team is now Department

You can now navigate a redesigned, cleaner Settings section, and what was called "Team" is now "Department," with a new view for managing HR properties and where each one comes from.

• Cleaner admin panel: a redesigned, less cluttered Settings layout.

• Department renaming: "Team" is now "Department" throughout the app.

• HR properties view: see and manage your Departments and Job Titles synced from 80+ HR tools, each showing its source and how many users are tied to it.

This gives admins a clearer way to manage company settings and understand where HR data comes from.

Kelio Integration

Corma now integrates with Kelio! Kelio is a French HR and time-management platform used to manage employee records, absences, and time tracking.

You can now:

• Get HR data: sync manager, department, job title, country, start date, and termination date directly from Kelio.

  

Improvements

• New "Offboard user" button added directly to the Provisioning > Offboarding page.

• License revoke actions show what the underlying deprovisioning action will do (e.g. account deletion) before you confirm.

• Audit log entries more clearly distinguish suspended users from revoked access, and no longer show a confusing "Ongoing" state.

• App descriptions are shown on the employee app store.

• New employees not yet assigned to a team no longer see a confusing blank onboarding page.

Fixes

• Jira tickets not being created for manual tasks has been fixed.

• Copy/paste for email and password in the agent's embedded browser during connector login has been fixed.

• Monday.com connector OAuth connection failures have been fixed.

• Unauthorized apps not appearing correctly in the employee portal's app list has been fixed.

• The employee portal search shortcut has been fixed and now uses Cmd+K, matching the admin portal.

• The "request new app" action in the employee portal not submitting has been fixed.

• Employees being able to request apps they already have access to has been fixed.

• The "no decision" filter on employee-mode access reviews not being uncheckable has been fixed.

• Deleting a user sometimes returning an error has been fixed.

• Updating an app's owner sometimes failing with no clear error has been fixed.

• Usernames created through Corma (e.g. via Google, Slack, or Atlassian) sometimes showing in the wrong format has been fixed.

• Redirection links of onboarding has been fixed.

• A visual glitch has been fixed.

• License and access status occasionally showing stale or taking a long time to update after syncing has been fixed.