As of PingFederate 10.1, the use of expressions is enabled by default. Additionally, a new administrative role, Expression Admin, has been added.
When upgrading to PingFederate 10.1 from a previous version, administrative users who were granted the Admin role in the earlier installation are granted the Expression Admin role automatically. You can achieve the same result by using the /bulk/import administrative API endpoint to bulk-import a configuration that was bulk-exported from PingFederate 10.0.
If preferred, administrators can disable the use of expressions by setting
evaluateExpressions to false as described in Enabling and disabling expressions. Also, go to the window and remove the Expression Admin role from all Admin users. Doing
this will prevent Admin users from entering expressions into PingFederate if the
evaluateExpressions element is set to true at a later time. For
more information, see Administrative accounts.