October 2026 – SCIM connection, centrally managed tests and stronger passwords release notes

An overview of the main changes delivered in October 2026.

New

Keep users up to date automatically with a SCIM connection. An organisation can now send new employees, changes and leavers from Microsoft Entra, Okta or Google to 2LRN4 itself, without giving us access to its own environment. The role and the department are passed on as well. Anyone who leaves is set to inactive; progress and certificates are kept. The organisation's administrator switches the connection on under Integrations and then SCIM connection, collects the key there and sets up the role rules, the department and the welcome e-mail. If you use the app roles 2LRN4.Admin, 2LRN4.Manager, 2LRN4.Communication, 2LRN4.Helpdesk or 2LRN4.User in Entra, the user gets that role without any further setup. The connection is free of charge. The SCIM guide explains how to set it up.
Delete inactive accounts automatically. For each organisation you set under Access and security after how long inactive accounts are deleted: immediately, after 30, 90, 180 or 365 days, or never. The default is 365 days, counted from 15 October 2026. The user list shows in advance when an account will be deleted, and the contact person receives a monthly overview with the training history of the deleted accounts, as evidence for an audit.
Tests maintained centrally by 2LRN4, with room for your own changes. The 2LRN4 tests are now managed centrally, so new and improved questions reach every organisation automatically. Under Questions from 2LRN4 an administrator can switch off a central question, or make their own copy of it and edit it freely. Your own copy can always be reset to the central question. Anyone who has already taken a test keeps exactly the same result, even if the questions change later.
Five difficulty levels per test question. Each test question can have a level, from 1 (very easy) to 5 (very hard), and a sub-objective. You see them in the question editor, and when you import or export a test they are in the columns level and learning_objective. This is the basis for adaptive learning, in which participants will soon get questions that match their level.
Help choosing a strong password. When you choose or change a password, a bar now runs from very weak (red) to very strong (green). Strength depends mainly on length: green is only possible from 12 characters. Below it are the requirements of your organisation's password policy, with a tick as soon as you meet them, and a hint on how many more characters you need.
Earlier learning years in one go for new employees. The history policy of drip enrolment has a new setting: Enrol all at once as mandatory. A new employee then receives the training from earlier learning years in one go, with one bundled e-mail instead of an e-mail per course. The current learning year simply continues at the chosen pace.
Learning programme and security as separate permissions. The roles page has two new permissions. Manage learning programme covers the curriculum, recertification, the level margin, enrolling learners and drip enrolment, and belongs to partners by default. Manage security covers two-factor authentication and the period for inactive accounts, and also belongs to customer administrators. For each organisation, 2LRN4 can give the customer administrators the learning programme; drip enrolment then stays with the partner. The authorizations guide shows who can do what.
E-learning on or off per organisation, and phishing on the dashboard. Besides phishing, e-learning can now also be switched on or off per organisation; with a phishing-only licence this happens automatically. Without e-learning, the menu and the learner page only show what belongs to phishing. The organisation dashboard has a new Phishing simulations block showing, per simulation, the recipients, how many opened, clicked and submitted data, with clicks by mail scanners shown separately.

Improved

Passwords from a password manager are accepted. With the Mandatory special character policy, any special character now counts, including ^, _ or -. A generated password is therefore no longer rejected. Organisations that have not set their own minimum length now require at least 8 characters instead of 6, and 8 is also the shortest length you can choose in the policy. Existing passwords remain valid.
The start date of drip enrolment explains itself. The field now says that the first course is released on the start date and that the pace follows after that. Below the field and after saving you see the next three release dates. If the start date does not fall on the pace, the form warns that the second course will follow shortly after and suggests a start date that does.
The tiles on the learner dashboard no longer contradict each other. All tiles now count the same courses as the study progress: the completed courses and the courses available right now. The total number of enrolments is shown in small print below.
Cancelling a licence shows exactly what will happen. The Cancel question states until when the customer keeps access and when the users and the organisation will be deleted. Cancelling switches off automatic renewal, so a cancelled licence is not renewed after all.
A clearer e-mail overview for partners. The e-mail types overview of a partner now explains that e-mails are switched on or off per organisation, with a list of the organisations, the number of e-mails switched off and a button to their own e-mail settings.
All connections under one menu item. SAML2, user synchronisation, synchronisation schedules and SCIM are now grouped in the menu under Integrations.
Stronger security for accounts and sign-in. What an account may see and manage now depends everywhere on its role and organisation. An account outside an organisation no longer gets access to the data of an entire partner environment, and only accounts with the Partner role manage the partner environment. A sign-in through an organisation's SAML or LTI connection only admits accounts of that organisation; signing in with Microsoft works as before. Settings that only 2LRN4 may change, such as the licence, the number of seats and modules, are now also checked when saving. In addition, the portal no longer sends internal source files to the browser.
Prompt PHP security update. On 21 October two serious vulnerabilities were disclosed in PHP, the programming language the portal runs on. That afternoon we took the portal offline as a precaution until the update was available, and installed it straight away. The check afterwards found no signs of misuse.

Fixed

Scheduled reports are sent again. Since the end of August, automatic reports stopped arriving for a number of organisations, because an error in one report also held back the reports scheduled after it. The error has been fixed and one failing report no longer holds back the others. The administrator dashboard has a new tile for stalled reports.
Error when opening the portal after signing in with Microsoft or Google. On 2 October, users who sign in with Microsoft or Google and had previously ticked Remember me saw an error message instead of the dashboard between 06:48 and 18:02. No data was lost and the security of accounts was not at risk.
Readable error messages in forms. Some error messages were unreadable. They have been fixed and now name the field, for example "Password must be at least 8 characters.".
Notifications and e-mails show the right names and numbers again. In a number of languages, notifications and e-mails contained parts that were not filled in, such as a notification without a course name. In the e-mail about new courses in the library, the list of courses is now on a line of its own.
Changing your password shows whether it worked. The screen now shows a message when the password has been changed, when the old password is wrong or when the new password does not meet the policy.
A calmer organisation form. The extra frame around the first sections is gone, and customer administrators no longer see an empty Modules card.