Issue No. 15 | December 2025 

The Agentic AI team is announcing important updates, including information on an exciting n8n v2 update. The Trimble Identity team continues to deploy essential improvements to the system. Finally, we close off 2025 with a survey for you to provide feedback on this newsletter. 

👉 Please take a few minutes to fill out our annual survey. It's basically the same as last year, very short and anonymous. We really value your feedback so take a couple minutes and let us know what we can do better and what you like. 

🚀 N8N Platform update

The Agentic AI team is planning an upgrade to n8n v2.0 in Q1. This is a breaking change. The team will follow up with a specific list of affected workflows to ensure you have time to update them before the upgrade.

See the announcement for more details:

🫱🏼‍🫲🏽 Connect Workflows extension 

The Connect Workflows extension is now available for select projects within the Connect CDE staging environment. Workflows allow users to create custom data transformations or use curated ones from the library. 

For more information, please refer to the Charlie post:

🛡️ Security Upgrade for Trimble Identity (MFA)

As part of Trimble Identity's ongoing Multi-Factor Authentication (MFA) enhancement and our commitment to customer security, we are excited to announce a mandatory update introducing Recovery Codes.

These single-use codes provide a secure backup mechanism, ensuring customers using MFA never get locked out of their accounts. Designed for self-service recovery, Recovery Codes allow customers to regain access if they lose their primary MFA device, reducing reliance on direct Support assistance.

See the announcement on Charlie for more details:

🛡️ One Time Password (OTP) Mandate for MFA

Trimble ID is enforcing an OTP mandate for logins to MXP hosted websites (trimble.com, sketchup.trimble.com), Commerce, Admin Console, My Products, Account Management Portal (AMP), and SketchUp products. A One-Time Passcode will be sent to the primary Trimble ID email for verification upon each login within these applications for users who do not already have MFA enabled with a passkey, authenticator app, or secondary email OTP.

See the announcement on Charlie for more details:

📅 UPCOMING EVENTS

Trimble Identity : HTTP Strict Transport Security (HSTS)

Trimble Identity (TID) is enhancing security by implementing HTTP Strict Transport Security (HSTS) headers for all HTTPS responses. This implementation mandates that user browsers communicate with TID exclusively over secure connections, significantly mitigating the risks associated with insecure protocols.

Staging - January 22, 2026

Trimble Identity : Standardizing Support Contact

To enhance the Trimble Identity (TID) support workflow, the direct email address (support@trimble.com) will be replaced with a dedicated link to the structured Trimble Support contact form: https://www.trimble.com/en/contact-support/sign-in-product-access. This change is a strategic move to standardize support data collection and move away from inconsistent, free-form email communication.

Staging - December 4, 5:30 AM UTC

Production - December 9, 5:30 AM UTC

Trimble Identity: Mandatory OTP Verification for Non-MFA Users

Trimble Identity (TID) will enable one-time passcode (OTP) login verification for all integrated applications in Staging on January 19, 2026.

REQUIRED ACTION: If your applications have automation or test workflows that involve user authentication, please prepare to accommodate the new flow. If needed, request an exemption for any domains that aren’t already exempted using the following form.

Staging - January 19, 5:30 AM UTC

Trimble Identity : User Account ID in SAML Assertions

TID is enhancing its SAML support by introducing the user's account_id as a standard attribute within all SAML assertions. This enhancement allows downstream systems to uniquely and correctly identify a user's associated account, which will streamline the authentication and enhance overall system security. This feature will be enabled for all applications by default.

Staging - January 8, 5:30 AM UTC

Production - January 13, 5:30 AM UTC

API Cloud: mTLS certificate expiration 

API providers using mTLS must update their trust stores with the new certificate chain before January 6th, 2026, or their API proxies in Dev, QA, and Stage will fail to authenticate.

REQUIRED ACTION: If you are an API provider using mTLS to authenticate connections to your API proxies, you will need to add the new certificate chain to your trust stores before API Cloud updates their Client Authentication certificate.

You will be able to download the latest certificate from our documentation site after December 6th, 2025.

Staging - January 6, 2026

🚀 RELEASE NOTES

Trimble Identity

• Enhanced Security for Field-to-Cloud (F2C) Token Exchange.
• Introduced this new grant type, enabling self-hosted and host environment applications to retrieve on-behalf-of tokens even when the primary identity is absent.
• Device ID in Field-to-Cloud (F2C) token exchanges.
• Improved User Synchronization.
• Recovery Codes for MFA Users Now Active!
• Mutual TLS (mTLS) for Field-to-Cloud Token Exchange.
• Implemented new role-based checks to ensure application accounts only perform actions they are specifically authorized for.
• DPoP Support for Subject Delegation.
• Web Application Firewall (WAF) Rate Limit counting.
• One-Time Password (OTP) banner is now standardized.
• The recovery code workflow and supporting changes have been implemented.
• Deployed a Mutual TLS (mTLS) token endpoint for application identities, critically enabling the "F2C" (Field to Cloud) use case.
• Application specific banner content for Notifying users about default OTP feature for Users logging in using password and without MFA.
• Rotated the SAML Signing Certificate

API Cloud & Cloud Console

• Consumption logs from Staging environments must be directed to the pre-production EDW dataset, while Production consumption logs are pushed to the production EDW dataset.
• Remove the backward compatibility of APICloud v1 urls.
• APIX Migration.

File Service

• Optimized Complete multipart, Get upload, and Create batch folder endpoints under Space membership to reduce latency and improve throughput.
  

Identity and Access Management (IAM)

• IAM Events Now Distinguish Invitation Expiry
• User Creation Permission Refactoring
• Internal PATCH API for Bootstrap Migration.
• Enhanced Account API for Application Role Assignment.
• Error Codes Added to Documentation.

IoT

• Enhancement of License Notifications Processing with Dead Letter Queue.
• Real-Time Notification for IoT Device License Assignment.
• Security Enhancements in Events Listener, Rollback Handler, and Bootstrap service.

Processing Framework

• Users can now configure optional Deployment timeout settings.
• Users can create Engines without consuming events.
• Memory allocation for the Metrics Ingestion Lambda has been increased to enhance performance.
• Implemented modifications to the Azure function for NIST compliance.
• Deprecate the Windows Server 2019 m5.2xlarge Cluster.
• The trimble-to-bimxml Engine has been retired.
• Production Operation & Procedure Event Metrics have been successfully pushed to the File Service location for EDW Data.

Trimble Access Management (TAM)

• Fixed an issue related to image tag immutability, ensuring tags on images in TAM ECR private repositories are properly secured. Enhanced data protection by adding specific configurations to the WAF web ACLs.
• WAF logs have been enabled for both the ELB WAF Web ACL and the CloudFront WAF Web ACL.

Need to join the mailing list for this newsletter or know someone who does? Let us know by filling out this very short form: