If you upgraded to PingFederate 10.1 from a previous version, the use of expressions is still enabled or disabled based on the configuration in the earlier version. Also, when upgrading PingFederate to 10.1 or later, administrative users who were granted the Admin role in the earlier installation are granted the Expression Admin role automatically.