New features summary

This section provides summaries of new features and enhancements that are available in this release. References to documentation describing these features and enhancements are also provided, when available.

General features and enhancements

Android features

iOS, macOS, watchOS, visionOS, and tvOS features

Windows features

General features and enhancements

  • Improved XML payload security: Ivanti Neurons for MDM now enforces centralized XML security controls that block XXE attacks and apply configurable limits on XML payloads. Default protections include limits on payload size, nesting depth, element name length, and entity expansions, helping meet STIG requirements while allowing component-specific adjustments without a service restart. For more information, see Custom Configuration.

  • Protect devices from bulk wipe and retire actions: Administrators can now configure threshold-based protection for device wipe and retire actions to help prevent accidental (user actions or configuration and policy changes) or malicious bulk operations. When the configured device threshold is exceeded within a specified time window, additional actions require approval from an authorized administrator. Administrators can define separate protection settings, choose whether to block further actions or resume them after the time window, and view or filter devices by their action approval status. Protection is disabled by default. For more information, see Wipe and Retire Protection.

  • Space-specific reporting and access control: Ivanti Neurons for MDM now scopes reporting activities and report access according to an administrator’s assigned spaces. Administrators can create, view, run, and download space-scoped reports only for spaces to which they have access, and cannot access reports created for other spaces. For the preconfigured reports that support space selection, the limits for scheduled reports and manually generated reports are now applied separately to each space instead of across the tenant. For more information, see Using Custom Reports.

  • Display latest available app version in Device Installed Apps view: The Device Installed Apps view now includes a Latest Version Available column that displays the latest available version for each installed app. In some cases, device inventory may omit the minor version even when the latest version is installed; however, the major version remains the same. For more information, see App Inventory.

  • Introduction of custom role for Play Lost Mode Sound: Delegated administrators can now play a lost mode sound on managed devices. A new space-specific role, Device Play Lost Mode Sound, is available for assignment after device enrollment. Assign this role to delegated administrators who need permission to play a sound on devices in Lost Mode. Administrators without this role cannot access the Play Lost Mode Sound action. For more information, see Roles Management.

  • SAML SSO support from an IdP client application: Ivanti Neurons for MDM now supports SAML-based single sign-on (SSO), enabling users to sign in from their IdP client application.

  • Enhanced reporting fields for improved data consistency: Reports now include additional device details to improve data consistency and provide more comprehensive reporting:

    • Device ID and UUID are now included in the All Applications, Most Used Apps, and Unmanaged Apps reports.

    • Device Group and Security Patch are now included in the Devices and Blocked Devices reports.

      For more information, see Using Custom Reports.

  • LDAP Sync Discard Notification Improvements: When an LDAP sync is discarded, the notification and email now list the groups that exceeded the change threshold. The audit trail entry for the event also includes a new discardedGroups section with the affected groups. This helps administrators identify the cause of a sync discard. For more information, see Enabling LDAP Sync Discard Notification.

  • LDAP sync failure notifications for every occurrence: Administrators can now choose to receive a notification each time an LDAP sync failure or discard occurs, including repeated occurrences of the same type. By default, a notification is sent only for the first occurrence of each type. For more information, see Configuring LDAP sync failure notifications.

Android features

  • Remove Unassigned Android Apps from Devices: Administrators can now choose to remove manually installed public Android apps when the apps are no longer assigned to a device. Enable Remove app from device when no longer assigned in the app installation configuration to remove the app when it is undistributed, deleted, or excluded. For more information, see App Configuration.

  • Import Google Play Apps into Spaces: Space administrators with app management permissions can now search for and import Google Play apps directly into their assigned spaces.

  • Lock Device When Disconnected from Wi‑Fi: Administrators can configure Android devices to automatically lock when they disconnect from a designated Wi‑Fi network. A configurable delay helps protect devices and data when they leave approved network environments while allowing brief connectivity interruptions. For more information, see Wi-Fi Configuration.

  • Added New Battery Information field: Battery serial numbers are now available for supported Unitech devices. Administrators can view this information in device details and use it in advanced searches, device groups, and custom policies. For more information, see Getting Started with Devices and Custom Policy

  • Schedule Downloads for Android In-House Apps: Administrators can now set separate download and installation windows for silently installed Android in-house apps. Apps can be downloaded to devices in advance and installed during a later window, helping reduce bandwidth-related disruptions during deployment. For more information, see App Configuration.

  • Show password option on the Kiosk login page: The Kiosk login page now includes a Show password icon next to the password field, enabling users who sign in with a password to view their entry and identify typing errors. For more information, see Setting up Android shared device kiosk

iOS, macOS, watchOS, visionOS, and tvOS features

  • Awaiting User Configuration for Shared iPad: Shared iPad now supports the Awaiting User Configuration option, which prevents new users from seeing apps from previous users. For more information, see Device Enrollment.

  • App Control support for macOS 27.0 and later: Use App Control rules to categorize applications as Allowed Binaries or Denied Binaries for specific devices or users. For more information, see App Control Configuration: Control Which Apps Are Installed Per Device.

  • Synchronize macOS and watchOS App Updates: You can now use Sync New Version to synchronize macOS and watchOS app updates from the App Store. For more information, see Viewing App Details.

  • Support for watchOS and visionOS in-house apps: Administrators can now upload and distribute multiplatform in-house apps that support watchOS and visionOS through MDM, including apps that share a bundle ID across supported Apple platforms. For more information, see Upgrading In-House Apps.

  • Addition of Skip Key for iOS18+ devices: You can now use the Skip Camera Button on devices running iOS 18 or later. For more information, see Device Enrollment.

Windows features

Mobile Threat Defense features

Mobile Threat Defense (MTD) protects managed devices from mobile threats and vulnerabilities affecting device, network, and applications. For information on MTD-related features, as applicable for the current release, see the Mobile Threat Defense Solution Guide for your platform, available under the MOBILE THREAT DEFENSE section on the Ivanti Product Documentation page.

Each version of the MTD guide contains all Mobile Threat Defense features that are currently fully tested and available for use on both server and client environments. Because of the gap between server and client releases, new versions of the MTD guide are made available with the final release in the series when the features are fully functional.