What's new?

Policy-Based Access Control (PBAC)

This is the big one. Role permissions are now expressed as Cedar policies. Instead of toggling a fixed list of Django permissions on each role, you write policies that describe who can perform which action on which resource, and Zentral evaluates them with a proper policy engine. You can browse the available actions and entity types directly in the new PBAC schema browser, and policies are validated as you write them.

We also took the opportunity to lock down privilege escalation: granting superuser status and managing PBAC policies now require a superuser logged in with a local session, and non-superusers can only grant a role they already hold themselves.

⚠️ This is a breaking change. Permissions can no longer be managed on roles, neither in the UI nor via the API — use PBAC policies instead. The migration converts your existing role permissions into policies, but make a backup and review the result carefully before relying on it. See the PBAC documentation for the full model.

MDM Package artifact

A new Package artifact lets you distribute installer packages directly from Zentral — no need to host them elsewhere. Zentral serves the package and its manifest itself, wires it into the DDM declarations, and the whole thing is manageable via the REST API. Package manifests now carry chunked SHA-256 hashes alongside the legacy MD5 chunks, and download tokens are rejected for blocked or checked-out devices.

Python 3.14

Zentral now runs on Python 3.14. Expect some performance improvements along the way.

Other notable changes

The machine list gained facet search for tags: you can add multiple tag filters and they now compose with AND. Each machine row also shows its full tag set, not just the tags that matched the filter.

Queued MDM device commands can now be deleted, via the API and in the UI, before they are sent to the device.

The DEP virtual server detail page now has a beta enrollment tokens section that fetches your organization's AppleSeed for IT tokens directly from Apple.

The MDM schema was updated to the 2026 Seed 1 Apple device management release.

Bug fixes, upgrade

Before you upgrade, read the CHANGELOG and review the backward incompatibilities carefully:

• 🧨 Legacy role permissions replaced by PBAC policies — see above.
• 🧨 Privilege escalation hardening — granting superuser status and managing PBAC policies now require a superuser on a local session.
• 🧨 Business unit tags removed — tags can no longer be applied to all machines in a business unit.
• 🧨 Monolith catalogs API endpoint pagination — the catalog list endpoint is paginated now; update your Terraform provider.
• 🧨 Inventory export tags column — the "Tags" column now matches the UI badges via str(tag), so taxonomy tags appear as taxonomy: name (e.g. env: prod) instead of the plain name the previous export emitted.

If you run into any problem during the upgrade, contact us by email or in the #zentral macadmins Slack channel.