EPM Connector: TBA Role Lockdown, New SFTP Auth Methods, and Config Export/Import

This page consolidates release notes for the NetSuite EPM Connector SuiteApp from version 25.1 through 26.1.1. Below is a technically-focused summary of every change that matters to admins and developers maintaining EPM integrations.

Breaking Change: TBA Role Restriction (25.1)

The NSEPM Implementer role can no longer be used to configure token-based authentication (TBA) for the EPM-to-NetSuite connection. You must now use the dedicated integration role that ships with each EPM sync SuiteApp:

• NSPB Integration — Planning and Budgeting Sync
• NSAR Integration — Account Reconciliation Sync
• FCCS Integration — Close Management and Consolidation Sync

Any existing TBA tokens created under the NSEPM Implementer role should be re-provisioned under the correct integration role. Verify this in Setup > Users/Roles > Access Tokens.

New SFTP Authentication Methods (25.1.1)

External SFTP connections now support two additional authentication methods beyond basic password auth:

• SSH Private Key + Password
• SSH Private Key + API Secret

Configure these under the External Connections settings in the EPM Connector. This is relevant if your EPM workflows use the Fetch File via SFTP job — a bug in that job was also fixed in 25.1.2.

SuiteQL Allowlist: custsql_ Prefix (25.1.1)

You can now add SuiteQL queries with the custsql_ prefix to the Planning and Budgeting data-source allowlist. Previously only saved searches and datasets could be allowlisted for P&B data extraction. This opens a path for custom SuiteQL-based data sources in planning integrations.

Configuration Export/Import (26.1)

The EPM Connector now supports exporting its full configuration to a single file. Use cases include:

• Backing up connector configuration before SuiteApp upgrades
• Migrating configuration between accounts (e.g., sandbox to production)

See the Import/Export Configuration documentation in the EPM Connector help for file format details.

Close Management and Consolidation Sync Support (25.1+)

Starting in 25.1, the EPM Connector supports installation of the Close Management and Consolidation Sync SuiteApp, with a dedicated FCCS Integration role for TBA. The Financial Consolidation and Close environment is accessible from the NetSuite EPM Access portlet.

Bug Fixes

• 26.1.1 — Manual search requests via the Download button on the Manage Saved Searches or Manage Datasets pages could fail when inbound connection URL verification was enabled.
• 25.1.4 — Connectivity error when only the EPM Connector was installed (without any sync SuiteApp).
• 25.1.3 — Connection failure between Data Exchange and accounts with a large number of saved searches.
• 25.1.2 — Fetch File via SFTP job was broken.

What to Do

1. Audit TBA tokens immediately. If any EPM integration tokens were created under the NSEPM Implementer role, regenerate them under the appropriate integration role (NSPB Integration, NSAR Integration, or FCCS Integration). Failure to do so may result in authentication failures.
2. Update the EPM Connector SuiteApp to 26.1.1 to pick up all bug fixes, especially the saved-search download fix when URL verification is active.
3. Update dependent sync SuiteApps — Close Management and Consolidation Sync, Planning and Budgeting Sync, and Account Reconciliation Sync each require companion updates for 26.1 compatibility.
4. Review SFTP connections. If you use the Fetch File via SFTP job, confirm it works after updating (25.1.2 fix) and consider migrating to SSH key-based auth for stronger security.
5. Test custsql_ queries. If you have custom SuiteQL queries for Planning and Budgeting data extraction, you can now add them to the allowlist with the custsql_ prefix instead of wrapping them in saved searches.
6. Export your configuration as a backup before and after upgrades using the new export feature in 26.1.