July 2026 Firezone Updates and Releases | Firezone Devlog

July made Firezone's logs easier to use outside the portal, introduced the foundations of certificate-backed device trust, improved connection recovery across roaming and suspend, and more than doubled Windows download throughput in testing.

Stream Logs to Your SIEM

Audit data now lives under one Logs section in the admin portal, with tabs for change, session, flow, and API request logs.1 More importantly, those streams can now be delivered directly to external systems.

July added log sinks for Splunk, Datadog, New Relic, Elastic, Microsoft Sentinel, Amazon S3, IBM QRadar, and generic HTTP endpoints.2 Delivery is cursor-based and at-least-once, with backfill for historical events, size-aware batching, retries for transient errors, and notifications when a sink has to be disabled.

Certificate-Backed Device Trust

The new Client protocol can challenge a connecting device to prove possession of an MDM-provisioned certificate.3 The portal verifies the nonce signature, certificate validity, client-auth usage, and chain back to an account trust anchor before extracting normalized device identifiers.4

Attestation does not block an initial rollout: a missing or invalid proof leaves the current session unverified instead of preventing the connection. Verified identifiers also let a reinstalled client resolve back to its existing device row rather than silently creating a duplicate.

Connections Recover After Roaming and Suspend

ICE candidates are exchanged through the portal, so a candidate change emitted during a portal outage used to disappear permanently. Connlib now queues additions and invalidations while the portal is disconnected and flushes them after reconnect, allowing peers to discover a client's new address after roaming.5

A separate suspend-aware clock fixes another recovery edge case.6 It makes elapsed time consistent across platforms so a resumed client does not try to re-key a WireGuard session that the remote peer has already expired.

Faster Windows Downloads

Windows download throughput was constrained by the cost of handing each TCP packet to WinTUN individually. Firezone can now coalesce adjacent TCP packets into segments as large as 65,535 bytes before writing them to the driver, amortizing per-packet work in the Windows networking stack.7 Local benchmarking showed more than a 2× throughput improvement with the feature enabled.

The WinTUN ring buffers also grew from 1 MiB to 16 MiB—enough to absorb a normal scheduling delay at the 10 Gbit/s rate used to size the rest of the data path.8

Entra Authentication Without Shared Secrets

Entra directory sync and OIDC sign-in can now authenticate through Azure workload identity federation instead of long-lived client secrets.9 The portal exchanges its managed identity for a customer-tenant assertion, reducing the blast radius and rotation burden of shared credentials without changing the app identity or permissions customers already consented to.

Other Notable Changes

Footnotes

  1. feat(portal): unify audit logs behind a single Logs section ↩

  2. feat(portal): add Splunk log sinks ↩

  3. feat(portal): add device-trust challenge ↩

  4. feat(portal): add device-trust challenge verification ↩

  5. feat(connlib): hold back ICE candidates while portal is down ↩

  6. fix(connlib): introduce suspend-aware clock ↩

  7. feat(windows): coalesce TCP packets before writing to WinTUN ↩

  8. perf(connlib): size the WinTUN ring buffer for 10 Gbit/s ↩

  9. feat(portal): Entra sync via workload identity federation ↩

  10. feat(portal): allow flow logs for Internet Resource ↩

  11. perf(connlib): drive WireGuard timers on demand ↩

  12. feat(portal): optionally sync all Google Workspace domains ↩