Skip to content

Configuring Privacy Controls

Admins can set when the browser extension monitors and logs browser activity through privacy controls.

Sending Password Hashes to the Cloud

The Send Hashed Passwords to the Cloud toggle allows the Application Visibility browser extension to transmit a cryptographically hashed version of the user’s username and password to the Application Visibility cloud. This transmission supports security checks, including:

  • Breached/Compromised Credentials - Determines whether the account appears in known breach or dark-web datasets.
  • Password Reuse Detection - Detects whether the same password is used across multiple applications.

Important

  • Enabling Send Password Hashes to the Cloud only submits the hash for external verification. The hashed username and password is not stored. This is sufficient for the detection of compromised credentials.
  • To support password reuse detection, Send Password Hashes to the Cloud and Store Hashed Passwords must be enabled.

To send password hashes to the cloud:

  1. Go to General settings > General tab.

  2. Within the Privacy section, select the toggle next to Send password hashes to the cloud.

Storing Hashed Passwords

The Store Hashed Passwords toggle allows the Application Visibility browser extension to store a cryptographically hashed version of the user’s password on their endpoint to support detection of reused passwords.

To store hashed passwords:

  1. Go to General settings > General tab.

  2. Within the Privacy section, select the toggle next to Store hashed passwords so Savvy can detect reused passwords.

Important

To fully support password reuse detection, Send Password Hashes to the Cloud and Store Hashed Passwords must be enabled.

Logging Personal Profile User Activity

The Activate when using personal profile toggle controls if Application Visibility monitors and logs user activity when a non-corporate browser profile is used.

To activate browser extension when using a non-corporate browser profile:

  1. Go to General settings > General tab.

  2. Within the Privacy section, select the toggle next to Activate when using personal profile.

Note

This setting only applies if your organization requires the use of separate browser profiles for corporate and personal web browsing.

Logging Personal Accounts

The Log all accounts toggle controls if Application Visibility logs activity and discovered accounts for personal accounts.

When disabled, you can configure whether discovered apps for ambiguous usernames, such as usernames without a domain suffix, are logged even when they cannot be identified as a corporate account.

Activity of unresolved identities is always logged. If during the session the identity is resolved and it shouldn't be logged, logging is stopped for the remainder of the session.

To log sign-in activity and accounts for personal accounts:

  1. Go to General settings > General tab.

  2. Within the Privacy section, select the toggle next to Log all accounts.

To log ambiguous usernames:

  1. Go to General settings > General tab.

  2. Within the Privacy section, disable the toggle next to Log all accounts.

  3. Enable the toggle next to Log ambiguous usernames.

Tip

Admins can configure the include-in-corporate-hostnames and include-in-corporate-apps lists to define which apps should always be considered as corporate.

When Log all accounts is disabled, activity for hostnames or apps that match will be logged.

Managing Global Allowlist

The Global Allow List is a policy-level feature that allows admins to explicitly exclude specific websites or applications from being monitored. When a website or application is included in the global allow list, the browser extension does not trigger for that destination resulting no activity being collected or logged.

To add an application to the allowlist:

  1. Go to General settings > Global allowlist tab.

  2. Select Add items.

  3. Select Applications.

  4. Select Next.

  5. On the allow items window, select the Value field and complete the following:

    • Select Lists to choose lists of applications.
    • Select Applications to choose individual applications.

  6. Select Add.

Application Visibility will not monitor activity for sessions involving matching websites or applications.

To add a domain to the allowlist:

  1. Go to General settings > Global allowlist tab.

  2. Select Add items.

  3. Select Domains.

  4. Select Next.

  5. On the allow items window, select the Value field.

  6. Select the desired list of domains.

  7. Select Add.

Application Visibility will not monitor activity for sessions involving matching domains.

To add an IP address to the allowlist:

  1. Go to General settings > Global allowlist tab.

  2. Select Add items.

  3. Select Domains.

  4. Select Next.

  5. On the allow items window, select the Value field.

  6. Select the desired list of IP addresses.

  7. Select Add.

Application Visibility will not monitor activity for sessions involving matching IP addresses.

Pausing the Browser Extension

Admins can configure whether all users or only specific users can pause the browser extension on their endpoint.

To configure who can pause the browser extension:

  1. Go to Extensions > Settings tab.

  2. In the Set who can pause the extension section, complete the following:

    • All users – Select to allow all users to pause the browser extension.
    • Only the following users – Select to choose specific users or groups that can pause the browser extension.

  3. Select Save.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.