--- title: Regular channel changelog description: Advanced Identity Cloud regular channel changelog tracking established features, enhancements, and fixes for development, UAT, staging, and production environments component: pingoneaic page_id: pingoneaic:release-notes:regular-channel-changelog canonical_url: https://docs.pingidentity.com/pingoneaic/release-notes/regular-channel-changelog.html llms_txt: https://docs.pingidentity.com/pingoneaic/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md page_aliases: ["product-information:changelog.adoc"] section_ids: september_2026: September 2026 29_sep_2026: 29 Sep 2026 key_features: Key features enhancements: Enhancements fixes: Fixes 28_sep_2026: 28 Sep 2026 22_sep_2026: 22 Sep 2026 15_sep_2026: 15 Sep 2026 enhancements_2: Enhancements fixes_2: Fixes 11_sep_2026: 11 Sep 2026 enhancements_3: Enhancements fixes_3: Fixes 09_sep_2026: 09 Sep 2026 04_sep_2026: 04 Sep 2026 fixes_4: Fixes 01_sep_2026: 01 Sep 2026 related_releases: Related releases august_2026: August 2026 20_aug_2026: 20 Aug 2026 fixes_5: Fixes 19_aug_2026: 19 Aug 2026 13_aug_2026: 13 Aug 2026 enhancements_4: Enhancements fixes_6: Fixes 13_aug_2026_2: 13 Aug 2026 12_aug_2026: 12 Aug 2026 fixes_7: Fixes 07_aug_2026: 07 Aug 2026 key_features_2: Key features enhancements_5: Enhancements fixes_8: Fixes 07_aug_2026_2: 07 Aug 2026 fixes_9: Fixes july_2026: July 2026 31_jul_2026: 31 Jul 2026 key_features_3: Key features enhancements_6: Enhancements fixes_10: Fixes changed_functionality: Changed functionality 21_jul_2026: 21 Jul 2026 15_jul_2026: 15 Jul 2026 enhancements_7: Enhancements fixes_11: Fixes 14_jul_2026: 14 Jul 2026 10_jul_2026: 10 Jul 2026 fixes_12: Fixes 08_jul_2026: 08 Jul 2026 06_jul_2026: 06 Jul 2026 02_jul_2026: 02 Jul 2026 01_july_2026: 01 July 2026 key_features_4: Key features enhancements_8: Enhancements fixes_13: Fixes june_2026: June 2026 17_june_2026: 17 June 2026 4_june_2026: 4 June 2026 fixes_14: Fixes may_2026: May 2026 18_may_2026: 18 May 2026 enhancements_9: Enhancements fixes_15: Fixes multi_region_ha_15_may_2026: 15 May 2026 key_features_5: Key features 12_may_2026: 12 May 2026 changed_functionality_2: Changed functionality 08_may_2026: 08 May 2026 key_features_6: Key features enhancements_10: Enhancements fixes_16: Fixes april_2026: April 2026 28_apr_2026: 28 Apr 2026 enhancements_11: Enhancements 23_apr_2026: 23 Apr 2026 14_apr_2026: 14 Apr 2026 key_features_7: Key features enhancements_12: Enhancements fixes_17: Fixes 10_apr_2026: 10 Apr 2026 01_april_2026: 01 April 2026 key_features_8: Key features enhancements_13: Enhancements fixes_18: Fixes march_2026: March 2026 31_mar_2026: 31 Mar 2026 enhancements_14: Enhancements fixes_19: Fixes changed_functionality_3: Changed functionality rcs_1_5_20_34: 26 Mar 2026 related_product_changes: Related product changes deprecation-non-persisted-schedules-2026-03-17: 17 Mar 2026 deprecations: Deprecations rcs_1_5_20_33: 10 Mar 2026 related_product_changes_2: Related product changes february_2026: February 2026 26_feb_2026: 26 Feb 2026 changed_functionality_4: Changed functionality ws_trust_ms365_upn_23_feb_2026: 23 Feb 2026 key_features_9: Key features 17_feb_2026: 17 Feb 2026 key_features_10: Key features enhancements_15: Enhancements fixes_20: Fixes 11_feb_2026: 11 Feb 2026 fixes_21: Fixes 03_feb_2026: 03 Feb 2026 fixes_22: Fixes --- # Regular channel changelog Subscribe to get automatic updates. Learn more in [Track regular channel releases](release-process.html#track-regular-channel-releases). For release notes published before February 2026, refer to the [Regular channel changelog archive](regular-channel-changelog-archive.html). ## September 2026 ### 29 Sep 2026 **Version 23604.12** #### Key features * Support for OAuth 2.0 Client ID Metadata Documents (CIMD) (AME-33561) Advanced Identity Cloud now supports CIMD. This allows AI agents and other external clients to identify themselves through a hosted metadata document instead of requiring prior registration or dynamic client registration. #### Enhancements * OPENAM-23858: A new **Store Software Statement in OAuth2 Client** setting on the OAuth 2.0 provider stores the software statement provided during dynamic client registration (DCR) in the client configuration. When stored, the software statement is returned in DCR read responses. * OPENAM-27412: The v2.0 OATH Registration node adds the ability to use any profile attribute as the username in the authenticator app. Select `Custom` in the **Account Name** configuration option to display **Custom Account Name Attribute** where you enter the required profile attribute. * OPENAM-26474: Access tokens can now be issued with `authorization_details` through the authorization code and refresh token grants, if the details were granted during authorization. * OPENAM-27658: A new **Allow audience members to introspect tokens** setting on the OAuth 2.0 provider lets any client whose `client_id` appears in a token's `aud` claim introspect that token, not just the issuing client. This lets resource servers that receive tokens through token exchange validate them without a special scope. * OPENAM-27945: You can now customize the redirect URI returned by the backchannel transaction initialize endpoint using the `redirectUrlType` and `customRedirectUrl` parameters, aligning its behavior with the Backchannel Initialize node. * OPENAM-27947: Backchannel transactions now record the authenticated subject on completion, even when no session is created. A subject declared before authentication is preserved. * OPENAM-28147: New versions (v2.0) of the LDAP Decision node and the Identity Store Decision node are available. These versions improve `username` handling. * OPENAM-28247: The new **Authentication Request Storage** option on the hosted IdP lets you configure where to store SAML authentication requests so that concurrent SAML SSO attempts in multiple browser tabs or browsers can complete independently. * TNTP-278: The ThreatMetrix nodes have been renamed to LexisNexis Dynamic Decision Platform (DDP) nodes. The LexisNexis InstantID Question and Answer (IIDQA) nodes have been updated to store the decision API responses in shared state. #### Fixes * OPENAM-26135: EC key attestation is now supported for Android device binding, resolving key attestation failures with newer Google hardware attestation root certificates. * OPENAM-26285, OPENAM-28428: Fixed an issue where CIBA backchannel authentication requests were rejected for omitting the optional `acr_values` claim. Advanced Identity Cloud now falls back to the client's or provider's default ACR values, and then to the realm's default authentication journey. When a client has multiple default ACR values, Advanced Identity Cloud now uses them in preference order. * OPENAM-28099: v2.0 of the Configuration Provider node fixes an issue where the Retry Limit Decision node's retry count was not cleared from the user profile on successful journey completion. * OPENAM-28317: The reCAPTCHA Enterprise node now logs errors when its Google project, site key, or API key secret is misconfigured, making failures easier to diagnose. * OPENAM-28364: v1.0 of the Page node is now deprecated. Use the latest version instead. * OPENAM-28699: Fixed an issue where `systemEnv.getProperty()` returned `null` for ESVs in next-generation SAML 2.0 IdP attribute mapper scripts. ### 28 Sep 2026 **Version 23453.10** No customer-facing features, enhancements, or fixes released.\[[1](#_footnotedef_1 "View footnote.")] ### 22 Sep 2026 **Version 23453.6** No customer-facing features, enhancements, or fixes released.\[[1](#_footnotedef_1 "View footnote.")] ### 15 Sep 2026 **Version 23453.4** #### Enhancements * IAM-9603: The Combined MFA Registration, OATH Registration, and Push Registration nodes now include an option to render QR codes without using JavaScript. * IAM-10200: Improved accessibility across the admin console by ensuring that expandable and collapsible menu controls expose their state to screen readers and other assistive technologies. * IAM-10682: The admin console left menu has been reorganized into logical, collapsible groups, making features easier to find and aligning labels with current terminology. * IAM-11617: The v2.0 Choice Collector node now lets you make choice callbacks with dynamically generated options that render as radio-button groups instead of drop-down lists, while existing drop-down behavior remains unchanged. * IGA-4652\[[2](#_footnotedef_2 "View footnote.")]: IGA now enforces the required request justification setting consistently across lifecycle management, request extension, and entitlement-grant requests. * IGA-4688\[[2](#_footnotedef_2 "View footnote.")]: IGA now lets you delete certificate templates using the UI. * IGA-4702\[[2](#_footnotedef_2 "View footnote.")]: IGA now lets you change the campaign title and owner when a campaign is launched. * IGA-4716\[[2](#_footnotedef_2 "View footnote.")]: IGA role request forms now display current role membership as read-only, and each member addition or removal in the role lifecycle management screen is submitted as an individual grant or removal request. * IGA-4741\[[2](#_footnotedef_2 "View footnote.")]: IGA activity and notification monitoring is now generally available, with improved event type filtering and audit log presentation. * IGA-4446\[[2](#_footnotedef_2 "View footnote.")]: IGA correlation rules for unmanaged applications let administrators link aggregated accounts to identities during account aggregation. * IGA-4254\[[2](#_footnotedef_2 "View footnote.")]: IGA identity profile certification enables reviewers to certify identity records, including external users and AI agents, rather than access alone. * IGA-4255\[[2](#_footnotedef_2 "View footnote.")]: IGA role composition certification enables reviewers to certify role definitions, including attributes, glossary data, entitlements, applications, and membership rules. * IGA-4582\[[2](#_footnotedef_2 "View footnote.")]: IGA certification review views let reviewers examine identity-profile and role-composition items in dedicated task views and make decisions. * IGA-4794\[[2](#_footnotedef_2 "View footnote.")]: Approval tasks can now be created when expiration is configured with a workflow variable. * OPENAM-28098: The v2.0 CAPTCHA node adds support for Friendly Captcha, a privacy-focused CAPTCHA provider. * OPENIDM-21472: You can now update a managed user even when the change conflicts with generated attribute values. The update propagates to all associated workforce application accounts during queued synchronization. * OPENIDM-21711: The external REST service now has a default user agent of `PingIdentity` for outbound requests. This can be overridden by setting the [`userAgent` property](../external-services/external-rest.html#external-rest-properties-user-agent) for external REST service requests. * OPENIDM-22745: All connectors included with Advanced Identity Cloud were upgraded to version 1.5.20.36. Learn more in [1.5.20.36 Connector changes](https://docs.pingidentity.com/openicf/connector-release-notes/connectors.html#_1_5_20_36_connectors). * OPENIDM-22871: The IDM native admin console is now deprecated, and displays a deprecation warning banner. #### Fixes * FRAAS-34254: Fixed an issue where large configuration files were truncated during promotion, corrupting configuration in both environments. * IAM-6646: Fixed an issue that prevented navigating back in the journey import modal. * IAM-9753: Restored the missing Jobs option in the platform UI for tenants without workforce enablement, and the Schedule Jobs option in the IDM admin UI. * IAM-10010: Fixed an issue that prevented hosted pages theme colors from applying to alert pop-ups. * IAM-10781: Fixed an issue where the Use Secret Store for secrets checkbox did not persist for legacy applications. * IAM-10974: Fixed an issue where the rollback button was missing from the promotion history page. * IAM-11118: Fixed an issue where the number of OAuth 2.0 clients displayed incorrectly in the **OAuth2 Clients** modal. * IAM-11201\[[2](#_footnotedef_2 "View footnote.")]: Fixed an issue with icon size and appearance in dark mode in the IGA **New Event** dialog. * IAM-11679: Fixed an issue where the **Debug** menu item in the journey editor was not dimmed when disabled. * IAM-11803: Fixed an issue with inconsistent padding and height in select and multiselect fields. * IAM-11835: Fixed an issue with unexpected behavior in the multiselect box when inviting tenant administrators. * IGA-4700\[[2](#_footnotedef_2 "View footnote.")]: IGA role entitlement selection now omits disconnected entitlements from unmanaged applications, so administrators see only available entitlements. * IGA-4745\[[2](#_footnotedef_2 "View footnote.")]: Fixed an issue that prevented saving changes to the details of an unmanaged application. * IGA-4764\[[2](#_footnotedef_2 "View footnote.")]: Fixed an issue that prevented saving glossary data for disconnected applications. * IGA-4772\[[2](#_footnotedef_2 "View footnote.")]: Fixed an issue where the revoke-from-role modal operated on the wrong table when multiple IGA resource tables were on the same page. * OPENIDM-20345: Advanced Identity Cloud now rejects relationship creation requests that use a property that does not accept the referenced object type, instead of silently creating the relationship through a different valid property. * OPENIDM-21675: Fixed an issue that caused an error when configuring an empty server list for remote connector client groups. * OPENIDM-21724: Fixed an issue that could cause an exception when restarting identity management services under specific conditions. * OPENIDM-22101: Advanced Identity Cloud now applies the configured WebSocket idle timeout correctly for ICF servlet connections, with a default timeout of 5 minutes. * OPENIDM-22102: Fixed an issue where an RCS connection didn't recover after a network interruption and required an RCS restart. * OPENIDM-22157: Fixed an issue that caused reconciliation to fail when correlation queries used numeric values. * OPENIDM-22399: Fixed an issue where system configuration overwrote existing authentication configuration after an upgrade. * OPENIDM-22562: Fixed an issue that caused excessive memory use and potential heap exhaustion under high load. ### 11 Sep 2026 **Version 23251.9** #### Enhancements * IAM-2357: After creating an identity, you can now create another without closing the modal. * IAM-4881: You can now see errors in the script editor when scripts use environment ESVs incorrectly. * IAM-5284: You can now use an ESV for the connector server name in the **New Connector Server** modal. * IAM-10131, IAM-10137, IAM-10147, IAM-10149, IAM-10161, IAM-10164, IAM-10172, IAM-10187, IAM-10202: Improved keyboard navigation and accessibility information for interactive controls. * IAM-10303: Forms now clearly identify fields that contain errors after you submit information. * IAM-10589: You can now edit a job scheduled to start in the future so that it starts sooner. * IAM-11004: You can now close modals with the Escape key. * IGA-4445\[[2](#_footnotedef_2 "View footnote.")]\[[3](#_footnotedef_3 "View footnote.")]: Identity Governance administrators can now download an object type schema as a double-quoted, comma-separated CSV file, making it easier to create CSV files for import. * IGA-4447\[[2](#_footnotedef_2 "View footnote.")]\[[3](#_footnotedef_3 "View footnote.")]: Identity Governance administrators can now download import failures as a CSV file, making it easier to correct the data and upload it again. * IGA-4632\[[2](#_footnotedef_2 "View footnote.")]\[[3](#_footnotedef_3 "View footnote.")]: Added a **System Messages** tab to campaign details, allowing you to view timestamped informational and error events, with sorting, pagination, and an empty state. * IGA-4635\[[2](#_footnotedef_2 "View footnote.")]\[[3](#_footnotedef_3 "View footnote.")]: Added timing options for expiration notifications in certification templates, allowing notifications to be sent when a campaign expires or a specified number of days before. * OPENAM-28351: The admin console navigation has been reorganized to improve customer experience. The **Identity Verification** page is now under **Integrations**. **Android Key Attestation** is under **Authentication Methods**, and **Security Questions** is under **Authentication**. #### Fixes * IAM-7238: Fixed an issue that prevented connector configurations from being cloned when they used boolean ESVs. * IAM-8672: Fixed an issue where saving changes to a provisioner reset the provisioner operation timeout to its default value if the field was set with an ESV. * IAM-9371: Fixed an issue that sent duplicate requests when you activated or deactivated an ESV version. * IAM-11053: Fixed an issue that added an unwanted space before the registered trademark symbol in the email editor. * IAM-11075: Fixed the styling of disabled toggles in the **Edit Glossary Item** modal. * IAM-11122: Fixed an issue that displayed an unwanted white rectangle in the tag list when you used the dark theme. * IAM-11123: Fixed the background color picker for journey sticky notes. * IAM-11637: Fixed an issue that caused duplicate requests and an incorrect loading animation after you created your first managed object. * IAM-11680: Fixed an issue that caused custom CSS in hosted pages themes to be overridden after a platform upgrade. * IAM-11764\[[3](#_footnotedef_3 "View footnote.")]: Fixed an issue that prevented custom CSS from overriding link colors on hosted pages. * IAM-11778: Fixed an issue where saving a password policy in the admin console reset the realm's default password storage scheme to `PBKDF2-HMAC-SHA256`. * IAM-11781: Fixed an issue in the hosted account pages that prevented delegated administrators from adding or removing MFA devices from a team member profile. * IGA-4653\[[2](#_footnotedef_2 "View footnote.")]\[[3](#_footnotedef_3 "View footnote.")]: Fixed an issue where publishing workflows automatically enabled expiration when expiration hadn't previously been configured. * IGA-4661\[[2](#_footnotedef_2 "View footnote.")]\[[3](#_footnotedef_3 "View footnote.")]: Fixed an issue that caused the **Notification** tab **Actions** menu to not open when notification records lacked decision data. * IGA-4728\[[2](#_footnotedef_2 "View footnote.")]\[[3](#_footnotedef_3 "View footnote.")]: Fixed an issue where the **Accounts** tab appeared for all managed identity types instead of only managed users. ### 09 Sep 2026 **Version 23057.21** No customer-facing features, enhancements, or fixes released.\[[1](#_footnotedef_1 "View footnote.")] ### 04 Sep 2026 **Version 23057.18** #### Fixes * IAM-11847: Fixed an issue with journeys where Page nodes displayed a blank error message on session timeout. * OPENAM-29211: ESV secrets are now stored in Google Secret Manager (GSM) using a unique, name-and-version identifier as the default JWK `kid`, preventing collisions when multiple secrets share the same GSM version. You can retain the legacy behavior, which uses just a version identifier, by setting the `esv.am.secrets.gsm.stableid.version.only` environment variable to `true`. ### 01 Sep 2026 **Version 23057.14** No customer-facing features, enhancements, or fixes released.\[[1](#_footnotedef_1 "View footnote.")] #### Related releases | | | | - | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | This section contains information about releases of other Ping Identity products that are often deployed as part of an Advanced Identity Cloud implementation. | * RCS 1.5.20.36 is now available to [download](https://backstage.pingidentity.com/downloads/browse/identity-cloud/all/productId:idm-connector-servers/minorVersion:1.5/version:1.5.20.36/language:java). Learn more in [ICF release notes](https://docs.pingidentity.com/openicf/connector-release-notes/preface.html). To take advantage of this update, you must manually upgrade your RCS implementation. ## August 2026 ### 20 Aug 2026 **Version 23057.10** #### Fixes * IAM-8581\[[4](#_footnotedef_4 "View footnote.")]: Fixed an issue with provisional promotion reports causing slow responses in the Advanced Identity Cloud admin console when large numbers of configuration changes are pending. ### 19 Aug 2026 **Version 22883.12** No customer-facing features, enhancements, or fixes released.\[[1](#_footnotedef_1 "View footnote.")] ### 13 Aug 2026 **Version 22555.19** #### Enhancements * OPENAM-27493\[[3](#_footnotedef_3 "View footnote.")]: You can now configure OAuth2 Provider settings, including scripted JWT issuers, in the Advanced Identity Cloud admin console under **Authorization > OAuth2 Provider**. #### Fixes * OPENAM-26180: Fixed an issue where ETag assertion was causing noisy CTS session assertion failures. ### 13 Aug 2026 **Version 22883.11** No customer-facing features, enhancements, or fixes released.\[[1](#_footnotedef_1 "View footnote.")] ### 12 Aug 2026 **Version 22883.10** #### Fixes * OPENAM-27975: Fixed redirect failures caused by long OAuth 2.0 authorization request URLs. Same-server redirect URLs now support up to 8192 characters. Cross-origin redirect URLs remain limited to 2000 characters. * OPENAM-28931: Fixed an issue where OAuth 2.0 authorization requests using Pushed Authorization Requests (PAR) could fail with an HTTP 400 error after a user successfully authenticated. ### 07 Aug 2026 **Version 22883.8** #### Key features * Send email from next-generation scripts (OPENAM-25617) Advanced Identity Cloud now provides a next-generation script binding, `emailService`, that lets you send email directly from a script. #### Enhancements * AME-33978: The **Enable Connection via Credential** toggle for the PingOne Worker service now automatically enables or disables the relevant connection fields based on your selection. * AME-35088: You can now use a new `validate` action on the `secrets` endpoint to validate whether a secret mapping resolves to a valid secret in the configured secret store. * FRAAS-33591: The promotions API now returns report metadata ordered by creation date, with the most recent first. * IAM-3954, IAM-10782: Improved accessibility of numeric input fields and list fields throughout the admin console. * IAM-10610: You can now mark parameters in custom reports as optional, giving you more flexibility when running reports. * IAM-10764: Journey annotation notes now display multi-line formatting in view mode, matching how they appear when editing. * IAM-10917: The deferred release environment message displayed in a modal during promotions now uses clearer language and explains that updating your production release version during promotion is standard practice. * IGA-4435\[[2](#_footnotedef_2 "View footnote.")]\[[3](#_footnotedef_3 "View footnote.")]: Added an **Object Types** tab to the unmanaged application edit view, enabling administrators to define, manage, and reorder object type properties and import schemas. * IGA-4453\[[2](#_footnotedef_2 "View footnote.")]\[[3](#_footnotedef_3 "View footnote.")]: Added an **Activity** tab to the account detail view, giving administrators visibility into activity history for individual accounts. * IGA-4461\[[2](#_footnotedef_2 "View footnote.")]\[[3](#_footnotedef_3 "View footnote.")]: Improved the **My Requests** list view to display approval status, fulfillment status, and errors for each request. * IGA-4510\[[2](#_footnotedef_2 "View footnote.")]\[[3](#_footnotedef_3 "View footnote.")]: Improved the approval task view to display the name of the approver when the task was assigned to a role and has been completed. * OPENAM-26326, OPENAM-26452\[[5](#_footnotedef_5 "View footnote.")]: A new realm-level OAuth2 Provider setting, **Enable Rich Authorization Requests with RCS**, lets Advanced Identity Cloud process `authorization_details` requests when an RCS is configured. This setting also controls whether `authorization_details_types_supported` is advertised on Advanced Identity Cloud's well-known endpoint. * OPENAM-26458\[[5](#_footnotedef_5 "View footnote.")]: You can now configure **Authorization Detail Type(s)** on individual OAuth 2.0 clients to control which authorization detail types, as defined in RFC 9396 Rich Authorization Requests, each client can request. * OPENAM-26470\[[5](#_footnotedef_5 "View footnote.")]: Dynamic client registration requests can now include `authorization_details_types` to register the authorization detail types an OAuth 2.0 client supports. * OPENAM-26721: You can now skip signature verification when importing SAML metadata. * OPENAM-26073: Advanced Identity Cloud now includes v2.0 of the Patch Object node. This new version removes the **Patch as Object** configuration option and always updates the managed identity object as Advanced Identity Cloud. The v1.0 node is deprecated but continues to work in existing journeys. * OPENAM-27493\[[3](#_footnotedef_3 "View footnote.")]: You can now configure OAuth2 Provider settings, including scripted JWT issuers, in the Advanced Identity Cloud admin console under **Authorization > OAuth2 Provider**. * OPENAM-27494\[[3](#_footnotedef_3 "View footnote.")]: You can now configure Android Key Attestation, Jumio, and OneSpan identity verification settings in the Advanced Identity Cloud admin console. * OPENAM-27495\[[3](#_footnotedef_3 "View footnote.")]: You can now configure push authentication, push notification delivery, TOTP, WebAuthn, and device binding settings in the Advanced Identity Cloud admin console under **Authentication > Authentication Methods**. * OPENAM-27496\[[3](#_footnotedef_3 "View footnote.")]: You can now configure the Remote Consent Service in the Advanced Identity Cloud admin console under **Authorization > Remote Consent Service**. #### Fixes * AME-34781: Fixed an issue where the **Add AI Agent** button in the AM native admin console caused an error for Advanced Identity Cloud tenants. This button is now hidden but you can still add agents through the Advanced Identity Cloud admin console. * AME-34898: Fixed an issue where SAML SSO flows could use a circle of trust set to **Inactive**. * ANALYTICS-1557\[[4](#_footnotedef_4 "View footnote.")]: Optimised analytics query execution to resolve a processing issue affecting dashboards and internal metrics. * FRAAS-32040: Fixed a deadlock where the `/environment/startup` endpoint became unresponsive when Advanced Identity Cloud services failed to start because of bad configuration. * IAM-6882: Fixed an issue where the admin console displayed the incorrect product name. * IAM-7788: Fixed an issue where the Next Generation scripts editor displayed unpublished environment secrets and variables. * IAM-8343: Fixed an issue where the delete button for ESVs was not disabled for tenant auditors. * IGA-3972\[[2](#_footnotedef_2 "View footnote.")]\[[3](#_footnotedef_3 "View footnote.")]: Fixed an issue where the selected filter value in the requests view reset to the default when navigating to a record or switching tabs. * IGA-4363\[[2](#_footnotedef_2 "View footnote.")]\[[3](#_footnotedef_3 "View footnote.")]: Fixed an issue where applying a date or text multivalued glossary field filter in the hosted account pages returned an error instead of filtered results. * IGA-4393\[[2](#_footnotedef_2 "View footnote.")]\[[3](#_footnotedef_3 "View footnote.")]: Fixed an issue where a boolean glossary attribute set to `false` was omitted from the entitlement API response instead of returning the correct value. * IGA-4598\[[2](#_footnotedef_2 "View footnote.")]\[[3](#_footnotedef_3 "View footnote.")]: Fixed an error in the **Approval Task** workflow node that caused the task to fail when an expiration notification was configured. * IGA-4651\[[2](#_footnotedef_2 "View footnote.")]\[[3](#_footnotedef_3 "View footnote.")]: Fixed an issue where account create, update, and delete events from connected applications were missing from IGA audit data. * IGA-4654\[[2](#_footnotedef_2 "View footnote.")]\[[3](#_footnotedef_3 "View footnote.")]: Fixed a form validation error in the new certification template wizard that prevented users from navigating past the first section. * IGA-4662\[[2](#_footnotedef_2 "View footnote.")]: Fixed an issue where entitlement mappings used application display names instead of stable connector IDs, which could cause incorrect behavior if application names changed or contained special characters. * IAM-10686: Fixed an issue where navigation labels in the hosted pages editor wrapped inconsistently compared to the hosted account pages. * IAM-10728: Fixed a pagination issue where organization administrators with a limited user scope saw a `no users found` error after navigating past the last page of the user list. * IAM-10780: Fixed an issue where exporting a journey containing a Device Profile node with a custom matching script did not include the script, causing import failures. * IAM-10812: Fixed an issue where the edit icon in the Inner Tree Node and Scripted Decision Node opened an intermediate list instead of navigating directly to the linked resource. * OPENAM-23079\[[3](#_footnotedef_3 "View footnote.")]: Fixed an issue where the Apple social provider failed on Android devices. During native authentication flows, Advanced Identity Cloud was not including the `code_verifier` in requests to Apple's token endpoint, which caused an `invalid_grant` error. * OPENAM-25429: The default **Minimum Secret Key Length** on the OATH Registration and Combined MFA Registration nodes has increased from 32 to 40 characters, for compatibility with Google Authenticator. * OPENAM-25556\[[3](#_footnotedef_3 "View footnote.")]: Advanced Identity Cloud now honors the `pubKeyCredParams` sequence in WebAuthn credential creation requests. * OPENAM-25801: Fixed an issue where the SAML SP adapter returned the wrong failure code when it couldn't map an assertion to a user profile. * OPENAM-26086: Advanced Identity Cloud no longer relies on an oversized browser cookie to carry the full OAuth 2.0 `/authorize` request through the login flow. Instead, it stores that request state securely in CTS (Core Token Service) and restores it after authentication. This prevents large requests, such as ones with a big `id_token_hint`, from failing with missing `client_id` after the user successfully sign on. * OPENAM-26106: Resolved an issue where the IdP account mapper could return the `NameID` value from the wrong SAML entity when a remote SP was used in multiple circles of trust with different `NameID` value mappings. * OPENAM-26180: Fixed an issue where ETag assertion was causing noisy CTS session assertion failures. * OPENAM-26834\[[3](#_footnotedef_3 "View footnote.")]: Hardened realm path handling for API requests to prevent potential security bypass. * OPENAM-28330\[[3](#_footnotedef_3 "View footnote.")]: Fixed an issue where CDNs cached transient 404 errors for static assets during rolling deployments for up to 30 days, instead of treating them as non-cacheable. * OPENDJ-12269\[[3](#_footnotedef_3 "View footnote.")]: Fixed an issue where the password substring check rejected passwords containing attribute values shorter than the minimum substring length, such as a two-character surname. Attribute values shorter than the minimum substring length are no longer checked for substrings by default. ### 07 Aug 2026 **Version 22555.18** #### Fixes * ANALYTICS-1557\[[4](#_footnotedef_4 "View footnote.")]: Optimised analytics query execution to resolve a processing issue affecting dashboards and internal metrics. ## July 2026 ### 31 Jul 2026 **Version 22555.17** #### Key features * Identity for AI (IAM-9357) You can now use *AI agent identities* to secure your organization's AI-driven solutions. AI agent identities are specialized OAuth 2.0 clients that are onboarded with their own identities. They can securely perform tasks on behalf of end users through a delegated token exchange process, ensuring distinct accountability and granular access control. You can use AI agent identities to securely build digital assistants that operate on behalf of end users, such as a chatbot on a retail website helping a user navigate products, or an internal workforce assistant acting on behalf of an employee to access enterprise tools like Salesforce. Find more information in [Secure your AI-driven solutions using AI agent identities](../identity-for-ai/ai-agent-identities.html). * Proxy Connect UI (AM-9628) You can now configure and manage Proxy Connect network security settings directly in the Advanced Identity Cloud admin console. Tenant administrators can manage HTTP header rulesets, IP address filtering (CIDR ranges), and toggle environment filtering statuses. Pending changes are staged and validated automatically before being applied to the load balancer. Find more information in [Manage Proxy Connect using the admin console](../tenants/proxy-connect-ui.html). #### Enhancements * AME-34566: The **Evaluator Version** selector is now available in the Advanced Identity Cloud admin console for all remaining next-generation script types, including OIDC node, Social Provider Handler node, OAuth2 scripts, and Policy Condition scripts. * FRAAS-33086: You can now migrate user accounts from the deprecated PKCS5S2 password hashing scheme to a more secure algorithm. * IAM-2333: The **Identities** page now includes an **Account Status** column that shows whether each user account is **Active** or **Inactive**. This column is display-only and is not intended for search or sort operations. * IAM-3671, IAM-9388, IAM-10148, IAM-10174, IAM-10548: Improved accessibility across hosted journey pages, including context-sensitive page titles, form field labels, and `aria-describedby` attributes for the Attribute Collector node. * IAM-8200: You can now use an environment secret or variable (ESV) to configure the `from` address for email providers. * IAM-9953: The Advanced Identity Cloud admin console now supports light and dark display themes. You can switch between themes to match your preference or your system's display settings. * IAM-10069: Hosted journey pages now display hCaptcha text and challenges in the end user's configured locale. * IAM-10536, IAM-10553, IAM-10558, IAM-10559: Improved color contrast for active UI components across multiple areas of the hosted journey pages to meet accessibility standards. * IAM-10595: Updated the column picker component for consistent behavior across data tables in the admin console and hosted account pages. * IAM-10596, IAM-10597, IAM-10598: Column visibility preferences for data tables in the admin console and hosted account pages are now customizable and saved between sessions. * IAM-10796: Super administrators can now configure the **redirect URI** field to use a custom domain when setting up federated administrator access. * IAM-10952: The **Identities** page now displays a loading spinner while identity data is being fetched. * IGA-3141\[[2](#_footnotedef_2 "View footnote.")]: Added a configurable option to control which user attributes are displayed in the user information panel, with all attributes shown by default when none are configured. * IGA-3267, IGA-4140\[[2](#_footnotedef_2 "View footnote.")]: Improved certification management with configurable expiration and escalation settings that enable automatic reassignment, and a new access filter in the certification items table to help reviewers narrow results more efficiently. * IGA-4215\[[2](#_footnotedef_2 "View footnote.")]: Improved the manual fulfillment task view to display user, account, and entitlement details and added the ability to mark a fulfillment task as complete. * IGA-4224\[[2](#_footnotedef_2 "View footnote.")]: Added the ability to design custom lifecycle management forms for entitlements, enabling administrators to configure fields from glossary and schema attributes for create and modify operations. * IGA-4293\[[2](#_footnotedef_2 "View footnote.")]: Added support for granting and revoking roles, entitlements, and app access to AI agents from the agent console and custodian view. * IGA-4295\[[2](#_footnotedef_2 "View footnote.")]: Added the ability to update an AI agent's custodians, including adding or removing custodians as needed. * IGA-4299\[[2](#_footnotedef_2 "View footnote.")]: Added an **Activity** tab for AI agents. * IGA-4333\[[2](#_footnotedef_2 "View footnote.")]: Added a sidebar filter to requests to make it easier to find and work with specific requests. * IGA-4381\[[2](#_footnotedef_2 "View footnote.")]:Improved the request type filter to dynamically retrieve available request types, so new and custom request types appear as filter options. * IGA-4382\[[2](#_footnotedef_2 "View footnote.")]: Improved the display of account and entitlement properties to use friendly labels from the object type schema instead of raw property keys. * IGA-4417, IGA-4418\[[2](#_footnotedef_2 "View footnote.")]: Added column customization to LCM table views. The entitlement LCM view now supports glossary attributes as selectable column options, and the user LCM table includes a column selector based on available schema fields and user permissions. * IGA-4433, IGA-4434\[[2](#_footnotedef_2 "View footnote.")]: Added support for unmanaged applications, including an **Unmanaged Applications** tab on the **Applications** page, create and edit flows, glossary management, and CSV import with upload history. * IGA-4438\[[2](#_footnotedef_2 "View footnote.")]: Improved access catalog role search so users can find roles by more than just role name, including role descriptions and related application or entitlement details. * OPENAM-27489: You can now create and edit social identity providers in the Advanced Identity Cloud admin console. * OPENAM-27492: You can now configure self-service journey mappings directly in the Advanced Identity Cloud admin console. #### Fixes * FRAAS-31319: Fixed an issue where the log-streaming service relied on the `source` field for the original log source, which can conflict with Splunk's reserved `source` field. Splunk log streaming now includes `stream_source` to preserve the original Advanced Identity Cloud log source. No additional Advanced Identity Cloud or Splunk configuration is required. If the log streaming-service is already configured, the `stream_source` field is included automatically. * IAM-4875: Fixed an issue where ESV values couldn't be entered as the well-known endpoint URL when setting up Microsoft Entra ID as a federation IdP. * IAM-5457: Fixed an issue where using an ESV in the **Password Policy** page caused the page to freeze. * IAM-6374: Fixed an issue where journeys could be imported even when their referenced ESVs were not published. * IAM-8313: Fixed an issue where setting a managed object property to nullable caused it to disappear from the **Password Policy** attribute validation list. * IAM-10593: Fixed a layout issue on the **Journeys** page where journey counts for category tags were obscured for locales with longer words. * IAM-10776: Fixed an issue where the stored username was overwritten with an OTP value when **Remember Me** was enabled during MFA sign-on. * IAM-10833: Fixed an issue where the admin console incorrectly displayed "Rollback in progress" during a standard environment promotion. * IAM-10836: Fixed a regression where `TextOutputCallback` messages containing custom HTML were rendered with unexpected line breaks. * IGA-4304\[[2](#_footnotedef_2 "View footnote.")]: Fixed several disconnected application UI issues, including improvements to entitlement visibility, request handling, and error behavior in related views. * IGA-4388\[[2](#_footnotedef_2 "View footnote.")]: Fixed an error in the default LCM modify user form that prevented changes from being saved when a custom integer field contained a value of zero. * IGA-4426\[[2](#_footnotedef_2 "View footnote.")]: Fixed an issue where the **Direct Reports** and **Delegates** tables displayed an inflated record count and showed empty pages at the end of the list. * IGA-4441\[[2](#_footnotedef_2 "View footnote.")]: Fixed an issue where the **Add** button from the certification filters sidebar incorrectly appeared in other views that use the dynamic filter. * IGA-4452\[[2](#_footnotedef_2 "View footnote.")]: Fixed an issue where the export items action did not work for certification access reviews. * IGA-4516\[[2](#_footnotedef_2 "View footnote.")]: Fixed an issue where a glossary attribute update applied to an entitlement was not propagated to all accounts that held the entitlement. #### Changed functionality * OPENIDM-22404\[[3](#_footnotedef_3 "View footnote.")]: Fixed a user enumeration vulnerability in the managed object `?_action=patch` endpoint that didn't enforce authorization before evaluating query filters. Query authorization on the target resource collection is now required and is granted through access rules or delegated admin rules. This change can affect custom integrations (like password plugins) that patch resource collections by query. * PF-39499\[[6](#_footnotedef_6 "View footnote.")]: Microsoft 365 SSO applications now use the selected **UPN Attribute Name** setting for WS-Trust username authentication. Existing applications must be resaved for this change to take effect. Find more information in [Configure WS-Trust](../app-management/register-a-custom-application.html#ws-trust-config). ### 21 Jul 2026 **Version 22293.20** No customer-facing features, enhancements, or fixes released.\[[1](#_footnotedef_1 "View footnote.")] ### 15 Jul 2026 **Version 22293.18** #### Enhancements * OPENIDM-22274: All connectors included with Advanced Identity Cloud were upgraded to version 1.5.20.35. Learn more in [1.5.20.35 Connector changes](https://docs.pingidentity.com/openicf/connector-release-notes/connectors.html#_1_5_20_35_connectors). #### Fixes * OPENAM-28291: Fixed an issue where Page nodes using both a CAPTCHA node and live password validation could fail because the CAPTCHA token was reused on repeated validation requests. The fix is now available [Page node v3](https://docs.pingidentity.com/auth-node-ref/latest/page.html#changelog), which ensures that nodes with validation enabled generate a new CAPTCHA token for each validation request. ### 14 Jul 2026 **Version 22293.15** No customer-facing features, enhancements, or fixes released.\[[1](#_footnotedef_1 "View footnote.")] ### 10 Jul 2026 **Version 22170.22** #### Fixes * OPENAM-28030\[[4](#_footnotedef_4 "View footnote.")]: Journey name validation rules in the access management backend are now consistent with those in the access management native console and the Advanced Identity Cloud admin console. ### 08 Jul 2026 **Version 22170.18** No customer-facing features, enhancements, or fixes released.\[[1](#_footnotedef_1 "View footnote.")] ### 06 Jul 2026 **Version 22170.17** No customer-facing features, enhancements, or fixes released.\[[1](#_footnotedef_1 "View footnote.")] ### 02 Jul 2026 **Version 22170.16** No customer-facing features, enhancements, or fixes released.\[[1](#_footnotedef_1 "View footnote.")] ### 01 July 2026 **Version 22170.14** #### Key features * Identity Governance role LCM (IGA-4265)\[[2](#_footnotedef_2 "View footnote.")] The new role lifecycle management (LCM) feature lets designated end users create, update, and delete roles on behalf of others without full administrative access. All changes are submitted as workflow-driven requests, maintaining governance and security while delegating role management to business owners. * Identity Governance for AI agents (IGA-4223)\[[2](#_footnotedef_2 "View footnote.")] Agent Governance lets you detect, onboard, and govern AI agents the same way you govern human identities, accounts, and roles. This brings them under the governance umbrella alongside human identities. Agent Governance provides application templates to discover AI agents in the following agentic platforms: * AWS Bedrock * AWS Bedrock AgentCore * Azure AI Foundry * Microsoft Copilot Studio * Google Vertex AI Find more information in [Agent Governance](../identity-governance/administration/iga-agent-governance.html) and [Agent Governance: custodian and reviewer tasks](../identity-governance/end-user/iga-agent-governance-enduser.html). #### Enhancements * AME-28187: You can now set a **Metadata URL** in your remote consent agent. Advanced Identity Cloud retrieves the remote consent server's (RCS) metadata from this URL. When configured, the OIDC `.well-known` endpoint includes the `authorization_details_types_supported` field, populated from the authorization detail types advertised by the RCS. * AME-33781: Advanced Identity Cloud now supports the [WebAuthn conditional UI](../am-authentication/authn-mfa-webauthn.html#webauthn-conditional-ui), also known as passkey autofill. This lets your end users sign in with a passkey if they've previously saved one in their browser. * AME-34458: Enhanced the output when you test the connection in the PingOne Worker service to display the values used in the connection test to make them easier to verify. These details are extracted from the credential JWT or derived from the worker service configuration. * AME-34513: Added support for the `_queryFilter` parameter on the `realm-config/services/pingOneWorkerService/workers` endpoint. Use this to query the configured worker services. For example, you can filter by credential type or by a property value such as the API URL. * IAM-1478: Autofill is now disabled for fields on pages where you add identities. * IAM-4646: Tenant administrators registered through federation no longer have the option to update their username and password on the sign-on screen. * IAM-8699: Advanced Identity Cloud now supports [node versioning](../journeys/node-versions.html). When we make changes to a node in the future, we'll create a new version of the node. This release introduces new node versions for the following nodes: | Node | Description of change | | --------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | | [Page node](https://docs.pingidentity.com/auth-node-ref/latest/page.html) | Adds support for standalone nodes within a Page node. Standalone nodes are self-contained and can be included after the final multiple outcome node. | | [Platform Username node](https://docs.pingidentity.com/auth-node-ref/latest/platform-username.html) | Adds an option to prepopulate the username if it's available in the shared state. | | [WebAuthn Authentication node](https://docs.pingidentity.com/auth-node-ref/latest/webauthn-authentication.html) | Adds support for the WebAuthn conditional UI, also known as passkey autofill, and removes the ability to return the challenge as JavaScript. | | [WebAuthn Registration node](https://docs.pingidentity.com/auth-node-ref/latest/webauthn-registration.html) | Removes the ability to return the challenge as JavaScript. | Other node versioning changes include: * Resource version `3.0` for `authenticationtrees` REST endpoint We've added a version-aware `3.0` resource to the `realm-config/authentication/authenticationtrees` endpoint. When sending a request to this endpoint, set the `Accept-API-Version` header to `protocol=2.1,resource=3.0`. Resource versions 1.0 and 2.0 are deprecated. * Versioned node endpoints The `realm-config/authentication/authenticationtrees/nodes` endpoint is now versioned. Specify the version of the node in the request URL, for example: `https:///am/json/realms/root/realms/alpha/realm-config/authentication/authenticationtrees/nodes/UsernameCollectorNode/2.0`. Versionless node endpoints are deprecated. * Audit logging The node version is logged in the [am-authentication](../tenants/audit-debug-log-sources.html#am-sources) source under the `AM-NODE-LOGIN-COMPLETED` event for node versions greater than `1.0`. * IAM-9002: The **Journeys** page now has an **Add journey** button that opens a modal for creating or importing a journey. This makes the available journey options easier to find. * IAM-9608: You can now assign an authorization policy to a SAML or OIDC application. This lets you restrict who can access an application to a subset of end users who have authenticated through a specific journey. Find more information in [Configure an application authorization policy](../app-management/configure-app-authorization-policy.html). * IAM-9937: The [SaaS REST](../app-management/applications/saas-rest.html) and [SaaS REST (connector server)](../app-management/applications/saas-rest-rcs.html) applications now let you add filter policies to object types when you configure provisioning. Adding filters at the API level reduces network overhead, boosts synchronization performance, and prevents unwanted data from entering your identity pipeline. * IAM-10132: You can now use the Tab and Enter keys to focus and select interactive table rows on the **My Requests** page in the hosted account pages. * IAM-10625: The Custom WS-Fed application now includes logout mode, always authenticate user, and multi-valued claim support for SSO. Find more information in [Configure the custom WS-Fed application](../app-management/register-an-sso-application.html#sso-config-custom-wsfed-app). * IAM-10626: The Microsoft 365 application now includes logout mode and always authenticate user settings for WS-Trust SSO. Find more information in [Microsoft 365 Sign On settings](../app-management/register-an-sso-application.html#sso-microsoft-365-settings). * IAM-10810: The PingOne worker service now lets you configure the connection to PingOne using a credential JWT. * OPENAM-25759: The `jwtValidator` script binding now supports configurable clock skew for `expirationTime` and `issuedAt` claim validation. * OPENAM-25910: The OAuth 2.0 introspection endpoint now supports an RFC 9701-compliant JWT response format. When enabled, token introspection claims are nested under a top-level `token_introspection` claim, which separates the `aud` claim of the introspection response from the `aud` claim of the token itself. The token's `aud` claim is also now correctly included for all token types, including stateless tokens. * OPENAM-25936: Next-generation scripts now support the `utils.crypto.checkBcrypt(bcryptHash, password)` method for bcrypt hash verification. * OPENAM-25957: All next-generation OAuth 2.0 scripts now have access to the `identity`, `session`, `clientProperties`, and `requestProperties` bindings. * OPENAM-27540: You can now configure a trusted CA certificate for each OAuth 2.0 client using the `tls_client_auth` authentication method, instead of relying only on realm-wide CAs. #### Fixes * AME-34254: Added support for next-generation SAML SP account mapper scripts to the Advanced Identity Cloud admin console. * FRAAS-29198: Fixed an issue where promotions that failed due to the encrypted secrets verification check were not listing the configuration paths that needed updating. * IAM-5003: Fixed an issue where changing the locale on the terms and conditions creation page didn't change the text in the editor. * IAM-9751: Fixed an accessibility issue where the VoiceOver screen reader was not vocalizing UI text correctly. * IAM-10040: Fixed an issue where the browser was incorrectly using autofill if a KBA Definition Node was within a Page node. The issue prevented use of tab and arrow functionality for that node. * IAM-10087: Fixed an issue where the password policy on a hosted pages sign-on screen disappeared on a window refresh when the **Access Management** > **Authentication** > **Settings** > **Trees** > **Enable Allowlisting** setting was enabled. * IGA-4139\[[2](#_footnotedef_2 "View footnote.")]: Updated the access filter component in the IGA access graph to accept dynamic filter options. This lets you use different UI components to customize the available filter options, based on context. * IGA-4275\[[2](#_footnotedef_2 "View footnote.")]: Fixed a pagination issue in the Direct Reports view by removing sortable columns and default sort from the Direct Reports and Delegates pages. * OPENAM-25543: Allowing a SAML authentication flow to continue when a circle of trust (CoT) is inactive is now deprecated. Review your SAML configurations and ensure that any CoTs used for authentication are active before Advanced Identity Cloud begins enforcing CoT status after the end-of-life date. * OPENAM-26359: Added a new configuration option, Enable Rich Authorization Requests with RCS, to the `OAuth2 Provider` service. This resolves an issue with remote consent where authorize requests with `authorization_details` would fail with an `invalid_request` error if an RCS was not configured. ## June 2026 ### 17 June 2026 **Version 21659.11** No customer-facing features, enhancements, or fixes released.\[[1](#_footnotedef_1 "View footnote.")] ### 4 June 2026 **Version 21659.8** #### Fixes * FRAAS-32554: Addressed a security issue. ## May 2026 ### 18 May 2026 **Version 21659.7** #### Enhancements * OPENAM-26335\[[4](#_footnotedef_4 "View footnote.")]: The [PingOne Verify Evaluation node](https://docs.pingidentity.com/auth-node-ref/latest/pingone/pingone-verify-evaluation.html) now lets you suppress the display of the verification code in the PingOne Verify web UI. #### Fixes * OPENAM-26326\[[4](#_footnotedef_4 "View footnote.")]: Added a new configuration option, Enable Rich Authorization Requests with RCS, to the `OAuth2 Provider` service. This resolves an issue with remote consent where authorize requests with `authorization_details` would fail with an `invalid_request` error if an RCS was not configured. ### 15 May 2026 **Version N/A** #### Key features * Multi-region high availability (FRAAS-17848) Advanced Identity Cloud now offers a multi-region high availability deployment option as an [add-on capability](../product-information/add-on-capabilities.html). This deployment option hosts identity-related services across both a primary and a secondary region, with data replicated in near real-time. It allows for rapid failover to the secondary region in the event of a failure in the primary region, with a significantly better recovery time objective (RTO) and recovery point objective (RPO) compared to the default single-region deployment option. Learn more in [Architecture, availability, and disaster recovery](../tenants/environments-architecture-availability-disaster-recovery.html). ### 12 May 2026 **Version 21659.5** #### Changed functionality * Graceful shutdown of identity management services (OPENIDM-19536) **What changed?** When an identity management service instance shuts down, it now drains in-flight HTTP traffic before exiting. In-flight responses include a `Connection: close` header that signals clients to close persistent (keep-alive) connections. **Why it matters?** Previously, integrations that held long-lived connections through a connection pool sent a request over a connection to an instance that had already shut down, which resulted in transient `404` responses or connection errors. With this change, compliant HTTP clients close affected connections and reconnect on the next request, which eliminates those transient failures during routine restarts and upgrades. **What you need to do?** Nothing, in most cases. Standard HTTP client libraries and connection pools honor the `Connection: close` header, by default. If you maintain a custom HTTP client or have explicitly disabled connection-close handling, verify that your client respects `HTTP/1.1` connection-close semantics. ### 08 May 2026 **Version 21478.4** #### Key features * Snowflake connector (OPENIDM-21957) The [Snowflake connector](https://docs.pingidentity.com/openicf/connector-reference/snowflake.html) is now bundled with Advanced Identity Cloud. This new connector allows you to manage users, grant and revoke roles and database roles, and synchronize data between Advanced Identity Cloud and Snowflake. Learn more about the [1.5.20.33 Connector changes](https://docs.pingidentity.com/openicf/connector-release-notes/connectors.html#1_5_20_33_connectors). * Identity Governance Access Modeling\[[2](#_footnotedef_2 "View footnote.")] (IGA-3696) Advanced Identity Cloud Identity Governance introduces a new feature called Access Modeling (role mining) that analyzes existing user-to-entitlement assignments to discover potential access roles that reflect how people use access in your environment. Using advanced machine learning, it examines current roles and entitlements across your access landscape to propose new role candidates and suggest changes to existing ones. Access Modeling is an Advanced Identity Cloud add-on capability that integrates with the Identity Governance add-on capability. #### Enhancements * IAM-1715: Improve messaging on back button for 404 pages in the Advanced Identity Cloud admin console. * IAM-3829: You can now perform dry-run promotions in the Advanced Identity Cloud admin console. * IAM-3834: Distinguish between dry-run and actual promotions in the promotion report in the Advanced Identity Cloud admin console. * IAM-8149, IAM-8275, IAM-8988: Added the following configuration options to the Advanced Identity Cloud admin console when you create or edit a journey: * `Override authenticated session timeout`, `Maximum Session Time`, and `Maximum Idle Time` * `Transactional Only` * `No Session` Previously, these settings could only be configured over REST. * IAM-8972: You can now configure managed objects and relationships in the Advanced Identity Cloud admin console. * IAM-9819\[[7](#_footnotedef_7 "View footnote.")]: Added the ability to export custom reports. * IAM-9822: You can now perform promotion rollbacks in the Advanced Identity Cloud admin console. * IAM-9903\[[7](#_footnotedef_7 "View footnote.")]: Added the ability to import custom reports. * IAM-9960: Added a wider scope to the monitoring search feature by being able to search on `/payload/message` and just `/payload` in cases where the monitoring record's payload is a string. * OPENIDM-22009: All connectors included with Advanced Identity Cloud were upgraded. Learn more in [1.5.20.34 Connector changes](https://docs.pingidentity.com/openicf/connector-release-notes/connectors.html#1_5_20_34_connectors). * IGA-4036: Added the ability to add and remove members of an entitlement directly from the entitlement LCM users tab. #### Fixes * FRAAS-31613: Fixed an issue where password policy updates weren't properly replicating to the datastore in mutable environments. * IAM-1907: Fixed an issue where custom endpoint search showed an incorrect message. * IAM-2537: Fixed an issue where non-dashboard URLs didn't show a 404 page. * IAM-2615: Fixed an issue where border radius settings affected the hosted pages editor preview. * IAM-3453: Fixed styling issues with the back button. * IAM-5439: Fixed an issue where an ESV couldn't be updated after its last value was deleted. * IAM-7502: Fixed an issue where the color in the `Card Input Border Focus Color` hosted pages setting wasn't applied to the search field in the **My Applications** hosted account page. * IAM-9475: Fixed an issue in the hosted journey pages where a journey was allowed to continue in the event of a password mismatch when a message node was on the same page. * IAM-9752: Fixed an issue where VoiceOver gestures didn't work on drop-down lists. * IAM-9842: Fixed an issue where VoiceOver didn't announce text for some page elements. * IAM-9936: Fixed an issue with the query operation in the SaaS REST application where setting the type select field prevented the method select field from being cleared, and the other way around. * IAM-9952: Fixed an issue where the table header for the action column was empty on several pages in the hosted account pages. * IAM-9958: Fixed an issue where the table header for the action column was empty on several pages in the Advanced Identity Cloud admin console. * IAM-10056: Fixed an issue on the **Auth Scripts** page where the modal body failed to load after clicking **[icon: add, set=material, size=inline] New Script**. ## April 2026 ### 28 Apr 2026 **Version 21182.12** #### Enhancements * New binding for next-generation SP adapter scripts (OPENAM-26050) A new `authnRequestHelper` binding has been added for next-generation SP adapter scripts. This binding lets you retrieve and modify the destination property of the `AuthnRequest`. Find more information in [SP adapter scripting API](../am-scripting/saml2-sp-adapter-api.html). ### 23 Apr 2026 **Version 21182.10** No customer-facing features, enhancements, or fixes released.\[[1](#_footnotedef_1 "View footnote.")] ### 14 Apr 2026 **Version 21182.9** #### Key features * Partial support for Rich Authorization Requests (RAR) (AME-28325) The `/authorize` and `/par` endpoints now optionally accept the `authorization_details` parameter from the RAR (Rich Authorization Requests) specification RFC 9396, allowing clients to specify fine-grained authorization requirements. * App Policy Decision node (AME-30063) A new [App Policy Decision node](https://docs.pingidentity.com/auth-node-ref/latest/app-policy-decision.html) is a specialized policy node that lets you enforce OIDC and SAML application access policies in journeys. You can use the node to filter access by group, organization, and more. * Support for audience parameter in token exchange (AME-33970) A client can now specify audience parameters in OAuth 2.0 Token Exchange requests. These parameters can be allowlisted and, if valid, are included in the audience claim of the resulting token. * Next-generation scripted JWT operations (OPENAM-25836) The `jwtValidator` and `jwtAssertion` bindings are now available in all next-generation scripts. #### Enhancements * AME-33573: Next-generation scripts now include `utils.base64url.encode()` and `utils.base64url.decodeToBytes()` for Base64URL encoding and decoding. * AME-33971: Added a new Save and Test Connection button to the PingOne worker configuration screen allowing you to validate the connection. * AME-33973: You can now configure the PingOne Worker Service connection using a credential JWT. * AME-34248: You can now use next-generation scripts in the Social Provider Handler node to transform normalized profile data into identities or managed users. * AME-34249: You can now use next-generation scripts in the OIDC ID Token Validator node. The `jwtClaims` binding now behaves as a native JavaScript object. * AME-34540: You can now specify autocomplete attributes for username nodes. * OPENAM-21474: A new `Minimum max_age for Authorize Requests` property is now available in the advanced OIDC settings of the OAuth 2.0 provider service. * OPENAM-24523: You can now dynamically modify the scopes of a refresh token during the refresh flow with the new next-generation scope validation script binding, `scopeValidatorHelper`, and its method, `inheritAccessTokenScopesOnRefresh()`. This is useful when scope validation scripts alter access token scopes and you need the refresh token to inherit those changes. * OPENAM-25901: Next-generation OAuth 2.0 scope validation scripts now have access to the `availableScopes` binding, which lists all scopes configured for the client. A new `throwInvalidScope()` method is also available to simplify error handling. #### Fixes * AME-34216, AME-34398: When using an SSO token as the subject for a policy with an `IDM user` environment condition, it now correctly resolves to the IDM `_id` instead of the user's AM universal ID. You can temporarily revert this behavior by setting the ESV `esv.am.policy.condition.idm.universalId` to `true` to let you update policies to use another property. * AME-34329: By default, parallel updates can no longer be made for CTS sessions. You can revert this behavior by setting the ESV `esv.cts.use.etag.assertion.on.updates` to `false`. * FRAAS-31318: Fixed an issue where setting certain special characters in an ESV prevented the ESV from being interpreted correctly. ### 10 Apr 2026 **Version 21027.5** No customer-facing features, enhancements, or fixes released.\[[1](#_footnotedef_1 "View footnote.")] ### 01 April 2026 **Version 21027.2** #### Key features * Policy Decision node (AME-28779) A new [Policy Decision node](https://docs.pingidentity.com/auth-node-ref/latest/policy-decision.html) lets you evaluate an authorization policy against resources within an authentication journey. * Backchannel Notification node (AME-32579) Introduced a new [Backchannel Notification node](https://docs.pingidentity.com/auth-node-ref/latest/backchannel-notification.html) that allows a backchannel journey to send real-time status updates to the main authentication journey. #### Enhancements * FRAAS-28387: Invites for Advanced Identity Cloud tenant registration now use a one-time passcode (OTP) instead of a magic link. This change prevents email scanners from accidentally invalidating single-use links. * AME-29745: Improved the certificate validation process in the Certificate Collector and Certificate Validation nodes. By default, Advanced Identity Cloud collects the *first* certificate in a certificate chain (the user certificate). You can now create an ESV named `esv-am-nodes-certificatechain-validation-enforced` and set its value to `true` to collect the chain of certificates. * AME-33851: You can now use next-generation scripts for social identity provider transformation scripts. * OPENAM-23610: The default value for the Return challenge as JavaScript (Legacy) property on the WebAuthn Authentication and WebAuthn Registration nodes is now not enabled. Ping Identity recommends that you keep this setting. * OPENAM-25329: The PingOne Protect Initialize node now includes an `Additional Signals SDK Initialization Options` attribute. This allows you to configure options that aren't already defined in the node. The `PingOneProtectInitializeCallback` has been updated with new fields to support this. * OPENAM-25677: The `PingOneProtectInitializeCallback` now includes a `universalDeviceIdentification` field, which replaces the deprecated `enableTrust` field. The `enableTrust` field is still returned for backward compatibility. #### Fixes * IGA-4186\[[2](#_footnotedef_2 "View footnote.")]: Fixed an issue for user LCM in the hosted account pages where large user populations weren't correctly sorted and paginated. * OPENAM-22698: Fixed a bug that caused duplicate URIs in WS-Federation responses. ## March 2026 ### 31 Mar 2026 **Version 20814.9** #### Enhancements * The following OAuth 2.0 scripts can now use the next-generation scripting engine, which gives them access to common bindings such as `utils` and `openidm`: * AME-33228: OIDC claims * AME-33846: Scripted JWT validator * AME-33847: Scope validation * AME-33848: Authorize endpoint data provider * AME-33849: Scope evaluation * AME-33850: May act * The following SAML 2.0 scripts can now use the next-generation scripting engine, which gives them access to common bindings such as `utils` and `openidm`: * AME-32919: SP adapter * AME-32920: IDP adapter * AME-32921: IDP attribute mapper * AME-32969: You can now make sure the `samlApplication` binding is available for all SAML flows by enabling the application context in the hosted IdP or remote SP entity configuration. Previously this was only added in certain situations such as when using an application journey or IdP-initiated integrated mode. * AME-32997: Added an `Allow Retry` option to the Backchannel Initialize node that lets end users retry a failed backchannel authentication journey. * AME-33430: You can now include remote consent agent credentials in a `Basic Authentication` header for pushed consent requests. * AME-33930: A new `testConnection` action on the `realm-config/services/pingOneWorkerService/workers/pingone-worker-service-name` endpoint lets you test the connection from Advanced Identity Cloud to PingOne. * AME-33939: A new `listLatestNodeDefinitions` action on the `realm-config/authentication/authenticationtrees/nodes` endpoint provides a list of node definitions for the *latest* version of each node. This action combines the responses from the following separate actions into a single response: * `getAllTypes` action on the `realm-config/authentication/authenticationtrees/nodes` endpoint * `schema`, `template` and `listOutcomes` actions on the `realm-config/authentication/authenticationtrees/nodes/node-name` endpoint * ANALYTICS-1383\[[7](#_footnotedef_7 "View footnote.")]: The new historical change report feature provides a complete audit trail of changes to your managed identities. It tracks all modifications to user profiles, roles, accounts, and applications. You can easily generate reports to see what changed, who made the change, and when it happened, which gives you clear insights for compliance and security monitoring. * FRAAS-29084: Custom domains are now restricted to a maximum of 63 characters in the Advanced Identity Cloud admin console. This restriction has always existed on the system backend. * OPENAM-22125: A new Proxy Configuration tab in the Http Client Service configuration lets you use separate proxy configurations per HTTP Client instance. * OPENAM-24476: Added `java.util.zip` classes to the allowlist for the Scripted Decision node scripting context. * The following enhancements have been made to the nodes provided with Advanced Identity Cloud: * AME-33009: Enhanced the RADIUS Decision node to capture Vendor-Specific Attributes (VSA) returned by the RADIUS server during authentication. * Enhancements to the PingOne Protect Evaluation node: * AME-33807: Fixed an issue where a default value was sent for the flow subtype. Previously, the node would fall back to using the value configured in Authentication Flow Subtype or Authorization Flow Subtype. Now, if nothing is found in the node state, the node doesn't send a value to PingOne Protect. * OPENAM-24557: Added a configuration property that lets you specify a custom session ID in the node state. * OPENAM-24562: Added two configuration properties that let you include a custom browser cookie and any externally maintained `deviceId` in the request sent to PingOne. * OPENAM-25553: Added a configuration property that lets you include user group information as part of a risk evaluation. * The following nodes now let you set custom headers on journey success, failure, and error: * AME-33813: Set Success Details node * AME-33874: Set Failure Details node * AME-33873: Set Error Details node * OPENAM-24401: The CAPTCHA node now prevents submission after expiry. * OPENAM-24419: Added a new [RSA SecurID](https://docs.pingidentity.com/auth-node-ref/latest/rsa-securid.html) node. This node replaces the Marketplace RSA SecurID node, which is now deprecated. * OPENAM-24489: The Device Binding and Device Signing Verifier nodes now let you specify a clock skew between the client device and AIC. This helps prevent binding failures caused by clocks being out of sync. * OPENAM-24546: Removed certain unused and unsupported configuration properties from the PingOne Protect Initialize node and its associated callback (`PingOneProtectInitializeCallback`). * OPENAM-25372: Added a [JWT Password Replay](https://docs.pingidentity.com/auth-node-ref/latest/jwt-password-replay.html) node to secure the user's password within an encrypted JSON Web Token (JWT). This node is used by PingGateway and replaces the old Password Replay scripting functionality. * OPENAM-25371: Added a configuration property to the PingOne Verify Evaluation node to enable automatic redirection to the journey after an end user completes verification (when using the `Redirect` delivery mode). * OPENAM-25618: The new `locales` binding lets you return the localized version of a string from a translation map. It is available to next-generation Configuration Provider node, Journey Decision node, and Device Match node scripts. * OPENIDM-21493: You can now cancel a clustered reconciliation even when a route associated with the source or target system is unavailable. * AME-34191: You can now override the HTTP binding used to redirect users to the SAML error page. To do this, configure an [ESV variable](../tenants/esvs.html#variables) named `esv-global-saml-error-page-http-binding` and set its value to `HTTP-POST` or `HTTP-Redirect`. If you don't set this variable, Advanced Identity Cloud uses the default value of `HTTP-POST`. * IAM-6546: End users now have more options to manage their devices in the hosted account pages. For each device, they can view when it was last used for sign on, view when it was added, edit its name, and delete it. * IAM-9672: In the advanced sync **Mapping** tab, if no properties have been mapped, it now shows a more accurate description of the target and source identity objects whose properties can be mapped. #### Fixes * AME-33653: Custom nodes now work with the Configuration Provider node. * AME-33808: If Node State Attribute For User ID is provided in the PingOne Protect Evaluation node, but the corresponding attribute is missing from the node state, the node triggers the failure outcome rather than using the user ID associated with the AM identity. * AME-34217: Added a version setting to the Configuration Provider node. This update provides the underlying infrastructure for a node versioning feature in an upcoming release. * AME-34034: Fixed an issue where omitting a shared secret label in the RADIUS Decision node caused Prometheus metrics to become unavailable. * ANALYTICS-1326\[[7](#_footnotedef_7 "View footnote.")]: Fixed an issue in custom reports caused by relationships between custom identities that contain multiple underscores. * ANALYTICS-1367\[[7](#_footnotedef_7 "View footnote.")]: Fixed an issue in custom reports caused by IP addresses in journey events. * OPENAM-23918: Resolved a race condition in the OATH Registration node and OATH Device Storage node where recovery codes could potentially be lost. * OPENAM-24065: Improved consistency for error responses across realms when processing illegal arguments. The `/authenticate` call now correctly returns a 400 (Bad Request) instead of a 500 (Internal Server Error) for invalid arguments. * OPENAM-25406: Added an `identity.exists()` method to next-generation objects returned by `idRepository.getIdentity()`. This lets scripts verify an identity's existence in the identity store before further processing. * OPENAM-25646: For backward compatibility, we've restored the following deprecated fields sent to PingOne Protect by the PingOne Protect Initialize node (in the `PingOneProtectInitializeCallback`): * `consoleLogEnabled` * `deviceAttributesIgnored` * `customHost` * `lazyMetadata` * `deviceKeyRsyncIntervals` * `disableHub` | | | | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | These fields are deprecated and no longer supported in PingOne. This fix restores the fields but you should update your clients and scripts to remove the unsupported fields as soon as possible. | * OPENAM-25779: Deletion of the `samlApplication` object is now deferred for unsuccessful authentication journeys so that the object is still available for subsequent sign-on attempts in the same session. * IAM-6640: Fixed an issue in the hosted pages theme preview where clicking **Edit Personal Info** opened two instances of the modal. * IAM-8221: Fixed an issue in the terms & conditions live preview where interactive elements weren't disabled. * IAM-9620\[[2](#_footnotedef_2 "View footnote.")]: Fixed an Identity Governance issue where clicking **Save** in the certification template creation wizard didn't disable the button after submission, which could result in the creation of unintended duplicate templates. * IAM-9786: Fixed an issue where ESV placeholders manually entered into a field were always treated as strings, regardless of whether they were an array, list, or string. * IAM-9886: Fixed a display issue on the **Reports Run History** tab where the pop-up menu items weren't displayed correctly. * FRAAS-29855\[[3](#_footnotedef_3 "View footnote.")]: Fixed an issue where OTLP log streaming reported all Advanced Identity Cloud logs with `am-core` or `idm-core` as the source and omitted custom IDM event-hook logs. Logs streamed via OTLP now preserve their correct source (for example, `am-authentication`, `am-access`, `idm-access`) and include custom IDM event-hook messages. #### Changed functionality * OPENIDM-21718: The `maxQueueSize` for [queued synchronization](../idm-synchronization/chap-implicit-live-sync.html#queued-sync) now defaults to `1000` and can't be configured to a value higher than `1000` or lower than `100`. The previous default was `20000`. The `pageSize` still defaults to `100`, but now can't be configured to a value higher than `100` or lower than `10`. If the configured `pageSize` is greater than `maxQueueSize / 10`, Advanced Identity Cloud uses `maxQueueSize / 10` for the page size. If you have any configuration outside of these bounds, Advanced Identity Cloud automatically adjusts the values to the nearest bound. ### 26 Mar 2026 **Version N/A** #### Related product changes | | | | - | -------------------------------------------------------------------------------------------------------------------------------------------------- | | | This section contains information about other Ping Identity products that are often deployed as part of an Advanced Identity Cloud implementation. | * RCS 1.5.20.34 is now available to [download](https://backstage.pingidentity.com/downloads/browse/identity-cloud/all/productId:idm-connector-servers/minorVersion:1.5/version:1.5.20.34/language:java). To take advantage of these updates, you must manually upgrade your RCS implementation. Learn more in [ICF release notes](https://docs.pingidentity.com/openicf/connector-release-notes/preface.html). ### 17 Mar 2026 **Version N/A** #### Deprecations * Non-persisted schedules deprecated Non-persisted (in memory) schedules are now deprecated. Update your tenants to use [persisted schedules](../idm-schedules/persistent-schedules.html). You can continue to use non-persisted schedules in the short term, but they will be removed on the [end-of-life date](../product-information/deprecation-notices.html#deprecation-non-persisted-schedules). ### 10 Mar 2026 **Version N/A** #### Related product changes | | | | - | -------------------------------------------------------------------------------------------------------------------------------------------------- | | | This section contains information about other Ping Identity products that are often deployed as part of an Advanced Identity Cloud implementation. | * RCS 1.5.20.33 is now available to [download](https://backstage.pingidentity.com/downloads/browse/identity-cloud/all/productId:idm-connector-servers/minorVersion:1.5/version:1.5.20.33/language:java). To take advantage of these updates, you must manually upgrade your RCS implementation. Learn more in [ICF release notes](https://docs.pingidentity.com/openicf/connector-release-notes/preface.html). * Support for using older versions of the web agent with Advanced Identity Cloud is now deprecated. If you have web agents in your deployment, you should upgrade to 2024.11.2 or 2025.9 and later to ensure you remain compatible in the future. Learn more in [Incompatible changes](https://docs.pingidentity.com/web-agents/latest/release-notes/changes.html). ## February 2026 ### 26 Feb 2026 **Version 20512.6** #### Changed functionality * Connector server access configuration now added to all tenants (OPENIDM-21744) Ping Identity previously introduced access configuration that lets you lock down Advanced Identity Cloud connector servers so that each connector server can be accessed only by an RCS connector using that connector server's designated OAuth 2.0 client. This prevents an RCS connector associated with a particular connector server from gaining unauthorized access to the resources of other connector servers. When this access configuration was introduced, it was added to new tenants by default, but needed to be manually added to existing tenants. With this change, the access configuration has been added to all existing tenants too. The access configuration adds access rules for connector servers using the `RCSClient` OAuth 2.0 client. If you have connector servers that use a specific OAuth 2.0 client, and you haven't already added this access configuration to your tenant configuration, you need to check or modify the configuration as described in [Connector servers using specific OAuth 2.0 clients](../product-information/migration-dependent-features/rcs-configuration-migration-faq.html#connector-servers-using-specific-oauth2-clients). ### 23 Feb 2026 **Version N/A** #### Key features * User Principal Name (UPN) mapping available for Microsoft 365 WS-Trust SSO applications (IAM-9896\[[6](#_footnotedef_6 "View footnote.")]) Microsoft 365 SSO applications that use the WS-Trust protocol can now map an attribute to the UPN. Learn more in [Configure WS-Trust](../app-management/register-a-custom-application.html#ws-trust-config). | | | | - | ----------------------------------------------------------------------- | | | This feature requires Advanced Identity Cloud version 20512.5 or later. | ### 17 Feb 2026 **Version 20512.5** #### Key features * Identity Governance user-access graph (IGA-4051\[[3](#_footnotedef_3 "View footnote.")]\[[2](#_footnotedef_2 "View footnote.")]) The user-access graph provides a graphical view of an end user's access. It visualizes the links between an end user and their types of access, such as roles, applications, or entitlements. Identity Governance administrators can view graphs in the Advanced Identity Cloud admin console, and end users can view their own graph in the hosted account pages. Learn more in [Access graph](../identity-governance/administration/view-access-graph.html). * Two-factor authentication report \[[3](#_footnotedef_3 "View footnote.")]\[[7](#_footnotedef_7 "View footnote.")] Advanced Reporting now lets you include information in your reports about the two-factor authentication (2FA) configurations of your end users. This includes the specific authentication methods each end user has registered and when each method was last used. This provides administrators with greater insight into second-factor adoption and helps ensure compliance with security policies. Learn more in [Report for two-factor authentication](../reports/administration/reports-2FA-profile-attributes.html). #### Enhancements * FRAAS-23284: RCS connections to Advanced Identity Cloud now have a default timeout value of `10000` (10 seconds) for new tenants. Existing tenants retain the default timeout value of `-1` (no timeout). * FRAAS-29829: Removed a reference to "PingOne Advanced Identity Cloud" from the `404 Not Found` error page. * IAM-4464: Next-generation configuration provider scripts created through the journey editor now contain the default config for the selected node type. * IAM-9709: Updated the journey editor to make fewer network calls when saving a journey that contains page nodes. #### Fixes * IAM-4345: Fixed an issue where vertical tabs were missing a hover state. * IAM-8033: Journey name field did not have a length check in place. * IAM-8226: When importing a journey, if you skip the download backup option but then return to it using the **Previous** link, it now completes the backup before offering the download. * IAM-9590: The message shown in the hosted pages for an unauthorized access attempt is now correctly centered on a single page. * IAM-9687: When you enter a valid ESV placeholder in the URL field of a bookmark application, the field is now immediately disabled and shows a delete icon to remove the placeholder. * IGA-4085\[[2](#_footnotedef_2 "View footnote.")]\[[3](#_footnotedef_3 "View footnote.")]: Fixed an Identity Governance access request issue where glossary schema properties displayed an extra space for nonexistent icons. * IGA-3980\[[2](#_footnotedef_2 "View footnote.")]\[[3](#_footnotedef_3 "View footnote.")]: Fixed an Identity Governance certification issue where the certification count on the **Summary** page didn't include the `certificationType` query parameter. ### 11 Feb 2026 **Version 20340.8** #### Fixes * OPENAM-25702: The [PingOne Protect Evaluation node](https://docs.pingidentity.com/auth-node-ref/latest/pingone/pingone-protect-evaluation.html) again supports a Node State Attribute For Username setting. PingOne Protect risk evaluation calls can depend on the username. * OPENIDM-21776: The Advanced Identity Cloud identity management service now uses synchronous HTTP client requests to connect to external identity management, REST, and token introspection services. This change prevents connection closure exceptions from terminating reconciliation. ### 03 Feb 2026 **Version 20340.5** #### Fixes * FRAAS-13233: AM script validation now ignores ESV placeholders in commented-out code. * IAM-9803: The link to the access management native console from the Advanced Identity Cloud admin console now always correctly links to the Alpha or Bravo realm. * OPENAM-25707: Fixed [PingOneProtectInitializeCallback](../am-authentication/callbacks-interactive.html#PingOneProtectInitializeCallback) processing to prevent unwarranted HTTP 4xx and 5xx errors. *** [1](#_footnoteref_1). This release focuses on internal improvements and technical updates to enhance the overall stability, performance, and maintainability of the platform. While there are no direct customer-facing changes, these updates lay the groundwork for future feature releases and improvements.[2](#_footnoteref_2). This change applies to a feature only available in PingOne Identity Governance, which is an [add-on capability](../product-information/add-on-capabilities.html) and must be purchased separately.[3](#_footnoteref_3). This issue was inadvertently excluded from the rapid changelog.[4](#_footnoteref_4). This issue is a hotfix so has been expedited across both release channels, reaching the regular channel before, or at the same time as, the rapid channel.[5](#_footnoteref_5). These updates add foundational support for Rich Authorization Requests (RAR). Comprehensive RAR functionality will be available in a future release.[6](#_footnoteref_6). Requires WS-Federation/WS-Trust, which is an [add-on capability](../product-information/add-on-capabilities.html).[7](#_footnoteref_7). This change applies to a feature only available in Advanced Reporting, which is an [add-on capability](../product-information/add-on-capabilities.html) and must be purchased separately.