What's New in MOVEit Transfer 2024.1

With the current release, MOVEit Transfer adds the following features and improvements.

Windows Server 2016 no longer a supported OS

Starting in 2024.1 (this release), to ensure customers have the best experience, MOVEit Transfer 2024.1 and newer versions will not support operation on Windows Server 2016. Microsoft ended mainstream support for Windows Server 2016. Also, note that there is a known incompatibility if you run MOVEit Transfer 2024.1 or newer on Windows Server 2016. An incompatibility between Windows Server 2016 and the current MOVEit Transfer SFTP library can prevent users from creating SSH keys. For details, see Known Issues.

Future SFTP library update (retiring support for Legacy SSH Service)

In the 2025.0 release of MOVEit Transfer, we will be retiring the Legacy SSH Service. Users will no longer be able to use the “Revert to Legacy SSH Service” button in the MOVEit Transfer Config utility to change from the default SSH service to the legacy service. Additionally, upon upgrade systems that are currently set to use the legacy SSH service will be reverting back to using the default service.

Force Single Sign-on (SSO) with SAML

You can choose this new mode (SAML Mode = Required) from the SETTINGS - Security Policies - Single Sign-On [ Edit SAML Authentication Mode ] section. This setting permits only SAML authenticated users for the current org to access MOVEit Transfer.

Updates for IP Lockout Policy

A new control enables SysAdmin users to allow OrgAdmin users to unlock IP addresses that were locked based on the current IP lockout policy.

SysAdmin can use this control (SETTINGS - System - Remote Access [ IP Lockout Policy ]) to permit OrgAdmin users to unlock all IP addresses.

If enabled by SysAdmin, OrgAdmin users can access this control from SETTINGS - Security Policies - Remote Access - IP Lockouts [ Locked Out IP Address ].

Increased encryption key length

Fresh or new installations of MOVEit Transfer benefit from larger Org encryption keys by default. If you are upgrading MOVEit Transfer, after the upgrade, you can also benefit from this improvement the next time you perform an Org and System key rotation (ORGS tab <org-or-system> - Security Information - Encryption Keys).

HTTP endpoint whitelist

This feature provides an additional layer of protection to the MOVEit Transfer WebUI. To reduce attack surface area, by default, Microsoft IIS restricts operations through the MOVEit Transfer WebUI to a set of whitelisted HTTP endpoints.

AS2 Default Remote Access Controls (2024.1.7 Hotfix)

As of the 2024.1.7, MOVEit Transfer will Deny remote connections through the AS2 user interface. This is a change from previous behavior. For details, see the section titled Security Policies - Remote Access - Default Rules.