v2026.10

MSIGN-3400

v2026.10

Improvement

Typing in the Title field of a new profile property is no longer slow. An empty dropdown no longer opens when you click the field.

MSIGN-3451

v2026.10

Improvement

Running a user source sync no longer makes every server reload its source settings. This lowers server load during syncs, especially on multi-server installations.

MSIGN-3459

v2026.10

Improvement

New environment variable {{MONOSIGN_LOG_FORMAT}} selects the console log format of every Monosign component (account, api, management, seed, service, RADIUS, LDAP gateway, access gateway): {{text}} (default, unchanged) or {{json}}, where every stdout line is one JSON object, including start-up prints and exceptions with their stack trace in {{@x}}. An unknown value keeps text and prints one warning; no migration, permission or seed change. Config: deploy the v2026.10 images (core 6.10.9), set {{MONOSIGN_LOG_FORMAT=json}} on each component whose stdout feeds a JSON-lines pipeline (e.g. Logstash) and restart it; remove any {{Serilog__WriteTo__<n>__*}} Console workaround variables, they are ignored in json mode with a warning. Rollback: unset the variable and restart.

MSIGN-3469

v2026.10

Improvement

Security Score and Identity Visibility now show the same numbers everywhere and open instantly on large tenants.

MSIGN-3473

v2026.10

Improvement

Administrators get live operational insight and control: per-node service status, fleet-wide service switches without a restart, run histories with retention limits, and a status page that shows real outages.

MSIGN-3474

v2026.10

Improvement

Application and API key screens are easier to use, and devices can be removed in bulk with advanced filters.

Key

Version

Type Name

Release Notes

MSIGN-3447

v2026.10

Bug

The Account application now checks the API's certificate before it connects to receive cache updates. It no longer connects to a server with an untrusted certificate. If the check fails, Account logs an error, and sign-in keeps working.

MSIGN-3448

v2026.10

Bug

Fixed a security issue on multi-tenant installations. Saving a profile property or property group now affects only the administrator's own tenant.

MSIGN-3455

v2026.10

Bug

Built-in applications, such as Management, Account and API, can no longer be deleted. Their keys can no longer be deleted either. This prevents an administrator from breaking MonoSign by mistake. You can still disable a key or set it to expire.

MSIGN-3464

v2026.10

Bug

Automations now take back the access they assigned when a user is removed, give it back when the user matches again, and the rule settings have clearer names.

MSIGN-3465

v2026.10

Bug

Access granted through AD groups is now accurate: deleted groups disappear with their memberships, group members no longer flap after a service restart, and time-bound memberships apply only between their dates.

MSIGN-3466

v2026.10

Bug

Large certification campaigns are created reliably, can be cancelled while being built, keep their final status, and end users only see the campaigns that concern them.

MSIGN-3467

v2026.10

Bug

Removing a user from an access package now really takes the package's access away, and time-limited package requests end on their end date.

MSIGN-3468

v2026.10

Bug

Account lock information is consistent across Management, the dashboard and login, locked sign-in attempts are now visible in the audit log, and password reminders work in every tenant.

MSIGN-3470

v2026.10

Bug

Several API authorization gaps are closed. Note: a scheduled Deny access restriction now blocks only during its scheduled hours (UTC) instead of all day.

MSIGN-3471

v2026.10

Bug

Shared-account approvals, bulk uploads and e-mail updates through the API no longer fail with server errors, and renaming a tenant host keeps its links working.

MSIGN-3472

v2026.10

Bug

The MFA code page no longer shows a misleading "code still valid" warning on the first attempt or sends a second code when the provider is slow. Failed external authenticator calls are now visible in the audit log.

MSIGN-3475

v2026.10

Bug

Workflow Code steps that convert text (for example to UTF-8) no longer fail. When a Code or Branch step fails, the error now says why and on which line. Request codes are now always unique, even when many requests start at the same moment. Large installations no longer see deadlock errors from background workflow processing.