--- title: PingAccess Agent for IIS release notes description: These release notes summarize the changes in current and previous PingAccess agent for Internet Information Services (IIS) updates. component: pingaccess version: 9.0 page_id: pingaccess:agents_and_integrations:pa_iis_rn canonical_url: https://docs.pingidentity.com/pingaccess/9.0/agents_and_integrations/pa_iis_rn.html revdate: August 19, 2025 section_ids: pingaccess-agent-for-iis-3-0-july-2025: PingAccess agent for IIS 3.0 (July 2025) agent-sdk-for-c-compatibility: Agent SDK for C compatibility key-pairs-incompatible-with-windows-2016: Key pairs incompatible with Windows 2016 authenticate-the-pingaccess-agent-for-iis-with-a-bearer-token: Authenticate the PingAccess agent for IIS with a bearer token pingaccess-agent-for-iis-1-5-july-2024: PingAccess Agent for IIS 1.5 (July 2024) agent-sdk-for-c-compatibility-2: Agent SDK for C compatibility cache-multiple-token-types-for-web-api-applications: Cache multiple token-types for Web + API applications block-bad-characters-in-iis-agent-deployments: Block bad characters in IIS agent deployments configure-the-iis-agent-to-ignore-crl-checking-if-revocation-server-is-unresponsive: Configure the IIS agent to ignore CRL checking if revocation server is unresponsive pingaccess-agent-for-iis-1-4-4-july-2021: PingAccess Agent for IIS 1.4.4 (July 2021) agent-sdk-for-c-compatibility-3: Agent SDK for C compatibility added-agent-inventory-response: Added agent inventory response pingaccess-agent-for-iis-1-4-3-december-2020: PingAccess Agent for IIS 1.4.3 (December 2020) agent-sdk-for-c-compatibility-4: Agent SDK for C compatibility disable-iis-caching-only-when-modifying-response: Disable IIS caching only when modifying response pingaccess-agent-for-iis-1-4-2-july-2020: PingAccess Agent for IIS 1.4.2 (July 2020) agent-sdk-for-c-compatibility-5: Agent SDK for C compatibility fixed-application-pool-crashing: Fixed application pool crashing pingaccess-agent-for-iis-1-4-1-february-2020: PingAccess Agent for IIS 1.4.1 (February 2020) agent-sdk-for-c-compatibility-6: Agent SDK for C compatibility fixed-a-potential-security-issue: Fixed a potential security issue pingaccess-agent-for-iis-1-4-june-2019: PingAccess Agent for IIS 1.4 (June 2019) agent-sdk-for-c-compatibility-7: Agent SDK for C compatibility set-the-policy-caching-mechanism-in-agent-properties: Set the policy caching mechanism in agent.properties manage-agent-processing-for-a-request-based-on-the-note-field: Manage agent processing for a request based on the note field fixed-a-potential-security-issue-2: Fixed a potential security issue pingaccess-agent-for-iis-1-3-2-november-2018: PingAccess Agent for IIS 1.3.2 (November 2018) fixed-a-potential-security-issue-3: Fixed a potential security issue pingaccess-agent-for-iis-1-3-january-2017: PingAccess Agent for IIS 1.3 (January 2017) agent-for-sdk-compatibility: Agent for SDK compatibility use-iis-10-on-windows-server-2016: Use IIS 10 on Windows Server 2016 fixed-iis-preload-enabled-setting: Fixed IIS Preload Enabled setting pingaccess-agent-for-iis-1-2-1-november-2016: PingAccess Agent for IIS 1.2.1 (November 2016) configure-the-preload-enabled-setting-in-iis: Configure the Preload Enabled setting in IIS security-enhancements: Security enhancements pingaccess-agent-for-iis-1-2-august-2016: PingAccess Agent for IIS 1.2 (August 2016) agent-sdk-for-c-compatibility-8: Agent SDK for C compatibility pingaccess-agent-for-iis-1-1-2-february-2016: PingAccess Agent for IIS 1.1.2 (February 2016) fixed-an-issue-preventing-custom-request-headers-from-setting: Fixed an issue preventing custom request headers from setting pingaccess-agent-for-iis-1-1-1-september-2015: PingAccess Agent for IIS 1.1.1 (September 2015) use-the-iis-websphere-plugin: Use the IIS WebSphere plugin pingaccess-agent-for-iis-1-1-december-2014: PingAccess Agent for IIS 1.1 (December 2014) compatibility-with-iis-7-0-running-on-windows-server-2008: Compatibility with IIS 7.0 running on Windows Server 2008 compatibility-with-iis-7-5-running-on-windows-server-2008-r2: Compatibility with IIS 7.5 running on Windows Server 2008 R2 compatibility-with-iis-8-0-running-on-windows-server-2012-datacenter-edition: Compatibility with IIS 8.0 running on Windows Server 2012 Datacenter Edition fixed-a-potential-security-issue-4: Fixed a potential security issue pingaccess-agent-for-iis-1-0-july-2014: PingAccess Agent for IIS 1.0 (July 2014) initial-release: Initial release --- # PingAccess Agent for IIS release notes These release notes summarize the changes in current and previous PingAccess agent for Internet Information Services (IIS) updates. ## PingAccess agent for IIS 3.0 (July 2025) ### Agent SDK for C compatibility Info Compatible with the Agent SDK for C version 3.0. ### Key pairs incompatible with Windows 2016 Issue When importing key pairs exported from PingAccess 8.3 or later into IIS on Windows Server 2016, IIS returns a `Password is not correct` message, regardless of whether the password is correct. This issue happens because Windows 2016 doesn't support the algorithm that PingAccess 8.3 and later use to encrypt private keys for PFX certificates. ### Authenticate the PingAccess agent for IIS with a bearer token New PASDKC-200 Authenticate PingAccess agents to the engine nodes with a stronger authentication method. | | | | - | --------------------------------------------------------------------------------------------------------------- | | | To use this feature, you must upgrade to PingAccess 8.2 or later and the PingAccess agent for IIS 3.0 or later. | Learn more in the [PingAccess 8.2 release notes](https://docs.pingidentity.com/pingaccess/8.3/release_notes/pa_release_notes.html#configure-pingaccess-to-allow-agents-to-authenticate-with-a-bearer-token). You can find setup instructions in [Configuring PingAccess agents to use bearer token authentication](../pingaccess_user_interface_reference_guide/pa_configuring_pa_agents_to_use_bearer_token_authn.html) and [Agent SDK for C 3.0 (April 2025)](pa_sdk_for_c_rn.html#sdk-for-c-30). ## PingAccess Agent for IIS 1.5 (July 2024) ### Agent SDK for C compatibility Info Compatible with the Agent SDK for C version 1.4. ### Cache multiple token-types for **Web + API** applications New PA-15516 If you use a **Web + API** application, the `vnd-pi-resource-cache` PingAccess agent protocol (PAAP) header now contains an additional path so **Web + API** applications can cache both cookie and authorization header token-types. For more information, see the **Cache multiple token-types for Web + API applications** entry in the PingAccess 8.1 release notes, and the `agent.cache.defaultTokenType` property on the IIS agent configuration page. | | | | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | | Existing agent environments ignore the new `vnd-pi-token-cache-oauth-ttl` header and additional paths in the `vnd-pi-resource-cache` header.To see the performance boost, upgrade to PingAccess 8.1 and upgrade to the latest version of the IIS agent. Otherwise, continue to use an earlier agent version. | ### Block bad characters in IIS agent deployments New PAA-251 Configure the PingAccess agent for IIS to block requests that contain bad characters in the URI, query parameters, form parameters, or request body without having to reach out to PingAccess for a decision. Added eight new properties to the agent: 1. `agent.request.block.xss.characters` 2. `agent.request.block.uri.characters` 3. `agent.request.block.query.characters` 4. `agent.request.block.form.characters` 5. `agent.request.block.xss.http.status` 6. `agent.request.block.uri.http.status` 7. `agent.request.block.query.http.status` 8. `agent.request.block.form.http.status` Learn more in the [IIS agent configuration](pa_iis_configuration.html) configuration page. | | | | - | ------------------------------------------------------------------------------------------------------------------------------- | | | For large scale or more complex blocking decisions, it's best practice for the agent to reach out to PingAccess for a decision. | ### Configure the IIS agent to ignore CRL checking if revocation server is unresponsive Improved PAA-265 Added a new configuration option to give protected applications better reliability without giving up the ability to perform CRL checking when the server is available: the `agent.engine.configuration.checkCertRevocation.bestEffort` property. This change provides better alignment between PingAccess, PingFederate, and PingAccess policy server CRL checking. Learn more in [IIS agent configuration](pa_iis_configuration.html). ## PingAccess Agent for IIS 1.4.4 (July 2021) ### Agent SDK for C compatibility Info Compatible with the Agent SDK for C version 1.3. ### Added agent inventory response New PAA-224 Added agent inventory response. ## PingAccess Agent for IIS 1.4.3 (December 2020) ### Agent SDK for C compatibility Info Compatible with the Agent SDK for C version 1.3. ### Disable IIS caching only when modifying response Improved PAA-202 Updated the agent to only disable IIS caching when the agent modifies the response. This preserves performance while mitigating an IIS session swapping vulnerability. ## PingAccess Agent for IIS 1.4.2 (July 2020) ### Agent SDK for C compatibility Info Compatible with the Agent SDK for C version 1.3. ### Fixed application pool crashing Fixed PAA-194-15776 Fixed an issue that caused intermittent application pool crashes. ## PingAccess Agent for IIS 1.4.1 (February 2020) ### Agent SDK for C compatibility Info Compatible with the Agent SDK for C version 1.2.1. ### Fixed a potential security issue Security Fixed a potential security issue. ## PingAccess Agent for IIS 1.4 (June 2019) ### Agent SDK for C compatibility Info Compatible with the Agent SDK for C version 1.2.0. ### Set the policy caching mechanism in `agent.properties` New PAA-105 Added ability to set policy caching mechanism using a property in the `agent.properties` file. ### Manage agent processing for a request based on the note field New Added ability to enable or disable agent processing for a request based on a note field. ### Fixed a potential security issue Security Fixed a potential security issue. ## PingAccess Agent for IIS 1.3.2 (November 2018) ### Fixed a potential security issue Security Fixed a potential security issue. ## PingAccess Agent for IIS 1.3 (January 2017) ### Agent for SDK compatibility Improved Updated to version 1.1.1 of the PingAccess Agent SDK for C. ### Use IIS 10 on Windows Server 2016 New Added support for IIS 10 on Windows Server 2016. ### Fixed IIS `Preload Enabled` setting Fixed Resolved an issue with the IIS `Preload Enabled` setting. ## PingAccess Agent for IIS 1.2.1 (November 2016) ### Configure the `Preload Enabled` setting in IIS New Added support for the `Preload Enabled` setting in IIS. ### Security enhancements Security Made agent security enhancements. ## PingAccess Agent for IIS 1.2 (August 2016) ### Agent SDK for C compatibility Improved Updated to version 1.0.1 of the PingAccess Agent SDK for C. ## PingAccess Agent for IIS 1.1.2 (February 2016) ### Fixed an issue preventing custom request headers from setting Fixed Addressed issue with custom request headers not being set when URL contains query string parameters. ## PingAccess Agent for IIS 1.1.1 (September 2015) ### Use the IIS WebSphere plugin New Addressed compatibility with the IIS plugin for WebSphere. ## PingAccess Agent for IIS 1.1 (December 2014) ### Compatibility with IIS 7.0 running on Windows Server 2008 New Added Support for Microsoft Internet Information Services (IIS) 7.0 running on Windows Server 2008. ### Compatibility with IIS 7.5 running on Windows Server 2008 R2 New Added Support for Microsoft Internet Information Services (IIS) 7.5 running on Windows Server 2008 R2. ### Compatibility with IIS 8.0 running on Windows Server 2012 Datacenter Edition New Added Support for Microsoft Internet Information Services (IIS) 8.0 running on Windows Server 2012 Datacenter Edition. ### Fixed a potential security issue Security Fixed a potential security issue related to caching (SECBL007). This security bulletin is available in the Ping Identity Support Portal (). ## PingAccess Agent for IIS 1.0 (July 2014) ### Initial release Info Initial release of the PingAccess Agent for IIS.