Questions about the 2026.4 Upgrade

SPAS 2026.4 primarily includes functional improvements, user-interface updates, additional functionality, and bug fixes. Please refer to the public release-notes article for the complete list of changes.

Downtime and Service Impact

We expect authentication downtime to be limited to a few minutes. No server reboot is required. Existing authenticated sessions will remain active because integrations such as WLM, PAM, and ADFS contact SPAS briefly to process 2FA and do not require an ongoing connection to maintain the session. New authentication requests will not be processed while the update is in progress. We recommend scheduling a 15–20-minute maintenance window outside business hours.

Prerequisites and Compatibility

Full Release Notes and Download Links

The updated SPAS and SPINSTMGR require the .NET 10 Hosting Bundle and Desktop Runtime on the SPAS server only. Other SPAS-related applications do not require .NET 10 because they use C++ or .NET Framework. The .NET 8 and .NET 10 Hosting Bundles can coexist; there is no need to remove .NET 8. There are no known issues with installing the .NET 10 Hosting Bundle or Desktop Runtime. The Hosting Bundle installation is typically quick and usually does not require a reboot. The SPAS installation guide requires IIS with ASPX support.

SPAS 2026.4 is supported on Windows Server 2019 and later.

SQL Server 2019 or later is supported, including SQL Server 2025. SQL Server 2016 has worked with adjustments to some SQL queries; 2019 or later is the recommended baseline.

There are no known compatibility issues with existing ADFS, SAML, or OTP integrations.

Upgrade and Database Changes

SPINSTMGR performs the database schema update and creates a database backup. The user logged into Windows and running SPINSTMGR must have SQL Server sysadmin rights to update the database. The schema update typically takes about a minute. Restarting IIS after the upgrade is recommended.

The upgrade updates or adds the standard SPAS components: API, MFA, IDP, SAML, and OIDC. Enabling OIDC or Entra EAM is optional. Existing users, authentication policies, enrollments, tokens, certificates, and API keys are preserved. Existing configuration, passwords, and keys do not need to be changed. No changes are required to other components outside the SPAS server. SPINSTMGR can also rotate system keys if desired; this does not require changes to components outside the SPAS server.

For small implementations, in-place is recommend and should be performed on a weekend.

Backup and Rollback

SPINSTMGR creates a complete backup of the SPAS installation parent folder and its subfolders, as well as a SQL database backup. Before starting, we also recommend taking a VM snapshot if the server is virtualized and confirming a full system backup. If the upgrade is unsuccessful, automatic rollback restores the SPAS folders and files from the backup. The database schema is not reverted because the schema updates are backward-compatible.

Manual Rollback

No database restore or schema changes are needed.

1. Stop IIS and back up the current SPAS installation folder, for example, C:\Program Files (x86)\SurePassID Corp\SurePassID Authentication Server 24.3.
2. Replace its contents with the pre-upgrade SPAS files from the SPINSTMGR backup, for example, C:\Program Files (x86)\SurePassID Corp\SurePassID_System_backup_20261019_125006.zip\SurePassID Authentication Server 24.3 (backup).
3. Start IIS, then test SPAS and the relevant integrations.

See the Manual Rollback KB for these instructions.

Scheduling and Post-Upgrade Validation

SPINSTMGR performs an in-place upgrade. Afterward, log in to SPAS and confirm it is operating, then validate the relevant integrations, such as WLM, PAM, RADIUS, ADFS, and the SharePoint Employee Portal. We recommend scheduling the upgrade during off-hours and reserving a two-hour maintenance window. The required time may depend on whether full-system and/or SQL backups are performed within that window. We can arrange to be available or online with you during the maintenance.