The Trials API is now available, with endpoints for accounts and resellers to list active and expired product trials. This allows API users to view trial statuses and choose which product trials to start when creating accounts through the API.

See the Trials API documentation for details.

Admins can now view the latest delivery status for account and organization invitations on the Pending Users page: Sending, Delivered, Bounced, or Blocked. Hover over a status to see what it means and the recommended next step.

If an invitation is marked Bounced, admins can resend it from the portal after confirming the recipient’s mailbox is ready. Invitations sent before this update will have a blank status.

You can now choose which Huntress notifications are sent to ServiceNow, giving you more control over what enters your workflows.

Choose the notification types you want to send:

Resellers can now configure SAML single sign-on (SSO) at the reseller level. Previously, SSO was available only at the account level.

To get started, go to Settings > Access Management. After a successful login verifies the configuration, you can enforce SSO.

See the SAML SSO for the Huntress Platform support article for setup details.

Adversary Infrastructure is now generally available for every Managed ITDR partner and customer protecting Microsoft 365.

Here’s how it works. When the Huntress SOC confirms the hosting, relay, or proxy infrastructure behind an identity attack in one tenant, our detection engineers validate it against legitimate traffic across the entire fleet. Then we deploy a blocking Conditional Access policy to every eligible, opted-in tenant, the same day. The next attack from that infrastructure fails at sign-in. One partner’s incident becomes every partner’s protection.

The new Adversary Infrastructure dashboard can be found under ITDR in the left nav, at both the account and organization level. It shows:

Blocking policies deploy to Microsoft 365 tenants that meet all four:

Tenants that can’t run Conditional Access still get the same detections and incident reports from the same campaigns, just after the sign-in instead of before. For more info on Conditional Access and Managed ITDR, see How Entra Conditional Access Policies and Huntress Managed ITDR Work Together.

Go to ITDR settings and turn on the Adversary Infrastructure toggle. Set the default at the account level, override it per organization, or enable and disable in bulk.

Existing ITDR partners: opted out by default. Opt in to start receiving policies. Partners onboarded from 11/5/26 forward: opted in by default. Opt out anytime.

Huntress creates one named location and one blocking policy per campaign. We never edit your policies, named locations, or exclusions. Please don’t hand-edit ours; the daily check reverts changes. Opting out turns our policies off without deleting them, so opting back in takes effect right away.

Adversary Infrastructure is included with Managed ITDR at no extra cost.

Read our new Adversary Infrastructure blog and join us November 19 for Herd Immunity for Microsoft 365: How We Stop Attacks at Sign-In. Register for the livestream.

You can now list misconfigured SIEM log sources through the API, with the same data shown on the Misconfigured Sources tab in the portal. Each record includes the agent ID, hostname, organization, status (unresolved or resolving), and the full required audit policy (category, name, success/failure), so you can see exactly what needs to change. Results are paginated and can be filtered by organization_id.

PSA integration Configure pages now have a Troubleshooting tab, so account admins can check their own setup without opening a support ticket. It gives you a self-service way to track down the most common configuration and setup issues.

How secure is your Microsoft 365 environment - and what should you fix first? Our new Identity Posture Assessment gives you a clear picture of where you stand and a prioritized path to stronger defenses.

This on-demand report evaluates your tenant against the Huntress Identity Security Framework, highlighting security gaps, misconfigurations, and opportunities to improve. It only scores controls you’re licensed for, so you’re never penalized for features you don’t own.

What’s inside:

Available on demand in the Huntress portal and via API. From the ISPM dashboard, select an organization in the Quick Assessment card and click Generate to download your PDF. You can also retrieve the report through the Huntress API to incorporate assessments into your existing workflows.

Whether you’re helping clients harden their tenants or securing your own organization, start with a clear baseline and generate fresh assessments to show your progress.

Learn more about the Posture Assessment in our new blog.

Your Microsoft 365 tenant has a history.

Now generally available, Lookback automatically runs Huntress Unwanted Access detections across up to 180 days of available Microsoft 365 login history when an eligible tenant onboards to Managed ITDR. It helps you uncover earlier compromises, understand what you’ve inherited, and address active threats without waiting for an attacker’s next move.

What this means for you:

There’s nothing extra to configure. Lookback is not available for GCC, GCC High, or CPV tenants.

Whether you’re onboarding a new client or bringing your own organization onto Managed ITDR, Lookback gives you historical context and SOC-backed action from day one.

Read more in our new blog and check out our KB article.

Partners can now list their SIEM log sources through the API, using the same data shown on the Source Management page: name, type, organization, agent, status, last activity, and 30-day data volume. This makes it easy to check coverage and catch a source that's gone silent, right from your own tools, without needing to open the portal. See the API docs to learn more.