13 January 2026

Production release: 13 January 2026
Staging release: 08 January 2026

08 January 2026

• Enhanced SAML Support : The account_id is now available as a standard attribute in SAML assertions.
• On-Behalf-Of grant Refresh Token Revocation : Implemented the ability to revoke refresh tokens on behalf of users via mTLS.
• Token Exchange Restrictions : Added stricter validation for Token Exchange Grants when using delegated tokens to prevent unauthorized access.
• Presigned URL Optimization: For improved security, the Time-to-Live (TTL) for shortened presigned image URLs has been reduced from 72 hours to 1.5 hours.
• Account ID for Developer Console: Users (including federated users) without an existing account who log in via the Developer Console will now have an account ID automatically created with the required attributes in IAM
• TID Synchronization: Introduced a backend implementation to Sync data between TID and IAM. This feature is currently turned OFF and will be enabled in a future update.
• Validation Updates: Removed unnecessary account ID validation during the update of TTL for invited users
• Mobile Accessibility (WCAG): Optimized email and username input fields on mobile devices to improve usability and ensure compliance with accessibility standards.
• Enhanced Logging: Added issuer name logging for SAML requests that contain empty Assertion Consumer Service (ACS) URLs to assist in troubleshooting.
• UI Module Cleanup: Performed a unused code cleanup of the Sign-in logic to improve maintainability

Bug Fixes :

• Navigation Fix : Resolved a minor issue in the browser “Back” button during login workflow.
• Decryption Robustness : Added comprehensive error handling for decryption failures across several key modules, including SAML IdP responses, OAuth authorization, and regional handlers.
• Fixed a bug where flags for mfaSettings, lastLoginTimestamp, and dataRegion were not being correctly passed during profile synchronization.
• Fixed a Tuple index out of range error and NoneType issues within the UI backend and API authorizer.
• Resolved an unhandled error triggered when an authentication request was canceled while using ArcGIS and the Third Party Token Store.
• Resolved a UI backend error regarding “Invalid OAuth parameters.”
• Corrected a logic error regarding the reservation of UUID update calls for existing users.