Issue No. 18 | March 2026 

This edition of the Platform Newsletter highlights the final migration phase from Data Ocean to Trimble File Service, set for completion by the end of 2026, alongside the official launch of Trimble Connect Workflows and new offline licensing capabilities. Security is a major focus this month, with upcoming mandates for mandatory OTP verification for non-MFA users on March 31, updates to email verification logic in Trimble Identity, and the removal of weak TLS ciphers in API Cloud environments. Additionally, the newsletter shares key findings from the January API Platform Survey and announces the deprecation of the API Management menu in the Cloud Console, redirecting those functions to more streamlined locations.

The Future of File Management - File Service

As part of our commitment to a unified file management solution, we are migrating all remaining Data Ocean users to Trimble File Service by the end of 2026, ahead of Data Ocean's retirement in early 2027. Launched in 2024, Trimble File Service builds on the foundations of Data Ocean and Trimble Connect to offer a more robust, platform-centric experience. Check out the migration guide.

Read about data ocean migration:

Unlocking Connectivity: Highlights from the Trimble Workflows Town Hall

Following our recent Town Hall, we are excited to officially introduce Trimble Connect Workflows to the community. We invite you to dive into the documentation today to start building engines, operations, and integrations that will power our connected ecosystem.

Watch the recording and more on Charlie:

Offline Licensing is here!

Trimble has officially launched new offline licensing capabilities through EMS and the Admin Console, allowing users to manage and use licenses without an active internet connection. Product teams are encouraged to adopt this high-demand feature to enable seamless field access for customers across Construction and AECO.

Read the announcement and watch the videos:

Key Findings from our API Platform Survey

Following our January poll evaluating Trimble's API landscape, we have begun analyzing feedback regarding deployment, availability, and the adoption of the Trimble API Standard. This ongoing review aggregates key insights and addresses specific provider concerns to help shape the future of our platform.

Read the detailed findings on Charlie:

🎗️ REMINDERS

Trimble Identity: Security Update to Email Verification Claims

This is a reminder to enhance security and address vulnerabilities related to identity spoofing, Trimble Identity (TID) is updating its email verification logic. Previously, TID defaulted the email_verified claim to true for all social federation (Microsoft Azure, Google, Apple) logins, based on implicit trust in the provider's email claim. With this update, Trimble Identity will implement a more robust mechanism to accurately determine the email_verified claim's value.

Production - March 13, at 5:30 AM UTC

Processing Framework - Maintenance Window Release

On Mar 14, 2026, a Maintenance Window will be scheduled in order to perform upgrades to the Trimble Platform Processing Framework service infrastructure. The outage period should be minimal, at less than 5 minutes. Clients may experience degraded performance for up to 30 minutes, with slower response times.

Production - March 14, 4:00 PM to 4:30 PM UTC

📅 UPCOMING EVENTS

Trimble ID:  Mandatory OTP Verification for Non-MFA Users

Trimble ID (TID) will enable two-step verification (2SV) for all unfederated users, in response to Cyber’s 2025 Security mandate. TID will enable one-time passcode (OTP) sign-in  verification for all integrated applications in Production on March 31, 2026. This security enhancement will apply to all unfederated Trimble Identity users that sign in with email and have not yet enabled an MFA method as previously announced here:.

Production - March 31, 5:30 AM UTC

Trimble Identity: Security Update: Enforcement of Consistent Client Authentication

To align with OAuth 2.0 security best practices, we have implemented a measure to prevent "Mix and Match" in client authentication methods. This update ensures that a client cannot switch its authentication method during a session. For example, if a client initially authenticates using the code exchange (authorization_code grant) by using its client_id and client_secret (Http Basic authentication), and then attempts to use a Refresh Token (RT) grant using either PKCE or MTLS, TID will respond with “Could not authenticate client”.

Staging - March 12, 5:30 AM UTC

Production - April 7, 5:30 AM UTC

Trimble Identity: Upcoming Security Update: Enhancing Our Encryption Standards

As part of TID's commitment to the highest security standards, TID is upgrading its secure connection protocols.

The CloudFront security policy is being updated from TLSv1.2_2019 to TLSv1.2_2025. This enhancement ensures that all connections to services utilize the most modern and robust encryption ciphers available, protecting your data against evolving cyber threats.

Staging - March 12, 5:30 AM UTC

Production - April 7, 5:30 AM UTC

API Cloud: Weak ciphers removal

To rapidly enhance the security of our systems, the API Cloud team is planning to remove support for the following weak ciphers TLS version across EU1 environments.

• TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
• TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384

The upgrade will be rolled out as per the following schedule:

Staging (March 12th, 2026)

• eu1.dev.api.trimblecloud.com
• eu1.stage.api.trimblecloud.com

Production (March 18th, 2026)

• eu1.api.trimble.com

APICloud v2: Deprecation of API Management menu in Console

The API Management & Approvals menu is being removed from the Cloud Console's left navigation pane. Previously, API Providers used this menu to manage their API Proxies, API Products & manage Subscription requests.

This functionality is being relocated:

• API Proxy configuration will now be handled via Apis.
• New API Products will be managed through the existing Products menu.

Subscription Approvals will be managed via Notifications menu

Staging - March 23, 2026

Production - March 30, 2026

IAM: Geoisolation URL availability

Keeping your information safe is our top priority. That’s why we’re excited to announce that geoisolation is coming to our IAM suite next quarter. This new feature helps us ensure your data stays exactly where it’s supposed to be, boosting both security and compliance. We’ll be sharing everything you need to know over the coming weeks to make the transition a breeze.

Go Live - April 1, 2026

IAM Provenance Data Update - CDH Identifier as Source System

IAM is implementing  a  foundational change to how it manages account provenance data. IAM will refer to the CDH original system reference as the Source System, updating the provenance data based on the source of truth claimed by Digital Transformation (DX). There is no planned change to how data is discovered via API at this time, this update is a change in how we will internally identify the source system.

Production - Marck

🚀 RELEASE NOTES

Trimble Identity

🚀 Product & UI Enhancements

• MyProfile Redesign Prep: Expanded the User endpoint with new profile attributes and introduced a redesigned TOTP management section (currently behind a feature flag).
• Seamless MFA Enrollment: Enabled Progressive MFA, allowing users to enroll more naturally. This includes a new option to custom-name Authenticator Apps during setup.
• Email Verification: Activated a mandatory verification flow for users created before 2026 to ensure account security and data integrity.
• Localization: Added full translation support for all primary email-related templates.

🛡️ Security & Authentication

• Advanced Grant Flows: Added support for Actor Tokens in "on-behalf-of" authentication and introduced PKCE support for Third-Party Token Stores.
• Hardened Rate Limiting: Upgraded SAML Request limiting from simple monitoring to an active Block-and-Alert enforcement rule.
• Token Security: Refined DPoP (Proof-of-Possession) implementation to focus specifically on Refresh Tokens (RT).
• Social Federation Update: Adjusted Azure Social Federation logic to default the email_verified attribute to false for manual validation.

⚙️ Infrastructure & Performance

• Regional Syncing: Optimized TID-IAM synchronization by switching to regional endpoints, improving data residency compliance and sync speeds.
• Codebase Cleanup: Improved system maintainability by removing deprecated WSO2-related components and legacy code.

IoT

🏗️ Infrastructure & Performance

• Enhanced Code Reliability: Significantly increased unit test coverage for core AWS Lambda (Certificate & Disaster Management) and Azure Function Apps (Event Processing & Feedback), ensuring more stable deployments.
• Legacy Cleanup: Successfully refactored the codebase to remove deprecated WSO2-related components.

🛡️ Resilience & Reliability

• Azure Device Fallback: Implemented a new fallback mechanism for device and certificate lookups. If an IAM lookup fails due to synchronization delays, the system now automatically falls back to Profiles, preventing authentication failures during live-sync gaps.

Need to join the mailing list for this newsletter or know someone who does? Let us know by filling out this very short form: