# AI features and data handling Canonical URL: https://docs.axiad.io/docs/overview/ai-features-data-handling Axiad Mesh includes AI-powered features that help you investigate your data and set up your tenant. This page describes where AI appears in the product, what data those features can access, how sensitive values are protected, how AI activity is audited, and which questions to raise in your organization's privacy review. ## Where AI appears in Mesh ### Mesh AI assistant The Mesh AI assistant is available from anywhere in the dashboard through the floating action button. You can ask free-form questions about your assets, identities, and risks in plain language, or start from guided prompts such as "Show me expiring certificates." Answers are grounded in your own data — the assistant works from the same data you see in the dashboard. ### Conversational tenant onboarding When an administrator signs in to a tenant that hasn't completed setup, Mesh opens a full-page, guided onboarding experience instead of the dashboard. The onboarding assistant walks you through capturing your organization profile, setting up your identity provider, choosing recommended connectors, and validating each configured integration. How the flow behaves: - Progress is saved at the tenant level and shared across all administrators, so any administrator can resume exactly where the flow left off. - You can skip onboarding. If you do, you return to the flow on your next sign-in. - Users without administrator access go straight to the dashboard. ### Guided Universal REST connector setup The Universal REST API connector uses a guided, conversational setup. It walks you through the application name, the base URL, the OpenAPI or Swagger specification, and the authentication scheme, then validates the specification and helps you select which data to collect. ### Agent-to-agent (A2A) integrations Mesh supports the open [A2A (Agent2Agent) protocol](https://a2a-protocol.org) in both directions, so the Mesh AI assistant can participate in your broader agent ecosystem: - **Outbound — Mesh calls your agents.** Administrators can register external A2A agents with Mesh. Once registered, the Mesh AI assistant can discover and invoke them during an investigation — for example, asking a remediation agent in another system to act on a finding. Each registered agent uses the authentication your administrator configures (API key, bearer token, or OAuth 2.0), and credentials are stored encrypted. - **Inbound — your agents call Mesh.** Your organization's own AI agents can connect to the Mesh agent over A2A and ask it questions or delegate Mesh-related tasks, with the same authentication and tenant isolation as any other access to your data. Mesh publishes a standard A2A **agent card** describing its skills and how to authenticate — see [Connect your agent to Mesh](./connect-your-agent-to-mesh.md) for the full integration guide. Nothing is connected by default: both directions require explicit administrator configuration. ## Data access and isolation The assistant only sees data your signed-in account is permitted to see, and your organization's data stays fully isolated. Answers reflect your own permissions in Mesh — the assistant doesn't grant access to anything you couldn't already view in the dashboard. ## Sensitive-data protection Every AI request passes through Mesh's PII protection gateway before it reaches any external large language model. The gateway works in both directions: - **On the way out**, personal data in your request and in the tenant data the assistant consults — values such as names, email addresses, and account identifiers — is replaced with opaque tokens. The tokens carry no meaning outside your conversation, so personal data is not sent to the model provider. - **On the way back**, the gateway restores the original values in the model's response before you see it — you read real names and addresses; the model only ever saw tokens. Token mappings are scoped to a single conversation, held only for the life of that conversation, and expire automatically. The categories of data that are tokenized are centrally defined and maintained by Axiad. ## Auditability and feedback - AI interactions are recorded in the [audit log](../admin-guide/audit-logging.md), so you can review how the assistant has been used in your tenant. - You can rate each assistant response with thumbs up or thumbs down. ## Current limitations The following capabilities aren't included today: - **No direct changes in Mesh** — the assistant can't modify data inside Mesh on your behalf, for example renewing a certificate. Actions in external systems are possible only through the A2A agent integrations your administrators explicitly configure. - **No outbound-data review** — there is no review or approval step for outbound data before it is sent. - **No multi-region or data-residency controls.** - **No usage-analytics view** for the assistant. - **No advanced feedback workflows**, such as flagging or escalating a response. ## Questions for your privacy review Some details that your privacy or security team may ask about aren't covered in this documentation, including: - Which large language model provider processes requests. - How long prompts and responses are retained. - Whether your data is used to train models. - Whether the assistant can be turned off for your tenant. For your organization's data-processing and subprocessor terms, contact your Axiad representative. --- # Connect your agent to Mesh Canonical URL: https://docs.axiad.io/docs/overview/connect-your-agent-to-mesh Axiad Mesh exposes its AI agent over the open [A2A (Agent2Agent) protocol](https://a2a-protocol.org), so your own AI agents and orchestration platforms can talk to Mesh the same way they talk to any other A2A-compatible agent. Your agent asks Mesh a question in natural language — "what are the top risky identities?", "show me expiring certificates" — and Mesh answers from your tenant's data, under your permissions. This page covers the **inbound** direction: an external agent connecting *to* Mesh. For the other direction — the Mesh AI assistant calling *your* registered agents during an investigation — see [Agent-to-agent integrations](./ai-features-data-handling.md#agent-to-agent-a2a-integrations). ## Discover the agent card Every A2A agent publishes an **agent card**: a JSON document that describes who the agent is, what it can do, and how to authenticate. Mesh serves its card at the standard well-known path, and no authentication is required to read it: ``` GET https:///.well-known/agent-card.json ``` The card advertises the agent's identity (name, description, provider, and version), its transport endpoints, its capabilities, its skills, and its supported authentication schemes. An A2A client library discovers all of this automatically from the card, so your agent doesn't hard-code any of it. ## What Mesh can do (skills) The card declares the **skills** the Mesh agent offers. Each skill has a name, a description, tags, and example prompts your agent can use to decide when to call Mesh: | Skill | What you can ask | | --- | --- | | **Identity Search** | Find and discover identities across your systems by name, email, or other attributes. | | **Risk Assessment** | Analyze identity and user risk scores, breakdowns, and the factors driving them. | | **Asset Analysis** | List and analyze software, certificate, and machine assets — for example, expiring certificates. | | **Correlation Management** | Review the identity correlations Mesh has drawn, and confirm or reject them. | | **FAIR Risk Analysis** | Run quantitative [FAIR](../concepts/risk-scoring.md#from-scores-to-loss-estimates) analysis, filtered by provider, risk profile, or risk source. | These map to the same capabilities the Mesh AI assistant uses inside the dashboard, so an external agent reaches the same answers a person would — bounded by the same permissions and tenant isolation. ## Capabilities The card also declares how the agent communicates: - **Streaming** — Mesh streams its response back as it is produced, so your agent can show progress rather than waiting for the full answer. - **Push notifications** — for longer-running work, Mesh can call a webhook you register when a task changes state, so your agent doesn't have to poll. Push payloads carry only task status, never message content. ## Authenticate Reading the card is open; **sending a message requires authentication**. Mesh supports two inbound schemes, both declared in the card: - **API key** — send your key in the `X-API-Key` request header. - **Bearer token** — send a signed JWT in the `Authorization: Bearer ` header; Mesh verifies it against your identity provider's signing keys. Either way, the credential carries the **tenant** the call belongs to, so every message your agent sends is scoped to your organization's data and isolated from every other tenant — exactly like any other access to Mesh. Credentials are issued by your administrator; nothing is connected by default. ## Send a message Mesh exposes the standard A2A interfaces, so any A2A client library works out of the box: - **JSON-RPC 2.0** at `POST /a2a/rpc` — the `message/send` and streaming `message/stream` methods. - **REST** under `/a2a/v1/` for clients that prefer plain HTTP. A typical exchange: 1. Your agent reads the agent card and picks a skill. 2. It sends a message — natural-language text, optionally with structured data — authenticated with your API key or bearer token. 3. Mesh opens a **task**, streams status updates as it works, and returns the answer as the task's result. ### Task lifecycle A message creates a task that moves through the standard A2A states — **submitted → working → completed** (or **failed**, or **canceled** if you cancel it). Your agent can send a message and stream the result in one call, or send a message and fetch or list tasks later. Results come back as A2A artifacts, so any compliant client renders them the same way. ## Data handling An inbound A2A call is subject to the same protections as every other use of the Mesh AI assistant: it only reaches data your credential is permitted to see, personal data is tokenized before any AI request leaves the platform, and the interaction is recorded in the audit trail. See [AI features and data handling](./ai-features-data-handling.md) for the full picture. ## Related - [AI features and data handling](./ai-features-data-handling.md) — where AI appears in Mesh and how data is protected. - [Risk scoring](../concepts/risk-scoring.md) — the scores and FAIR analysis the agent returns. - [A2A protocol](https://a2a-protocol.org) — the open standard Mesh implements. --- # Overview Canonical URL: https://docs.axiad.io/docs/overview/ Axiad Mesh is an Enterprise Identity Risk Management platform that correlates identities across your systems, assesses risk, and tracks cryptographic assets. It works with your existing security infrastructure to provide a high-level, tailored visualization of your expansive organization. ![An Executive View workspace in Axiad Mesh Generative UI, showing the organization risk score, annual loss exposure, tracked programs, risk trend, and morning briefing widgets](/img/generative-ui/executive-view.png) Mesh has two dashboard modes: **[Generative UI](../user-guide/generative-ui.md)** — agent-composed workspaces, shown above, where you describe the view you want and Mesh assembles it from live widgets — and the **classic dashboards** below. ![Axiad Mesh classic dashboard showing the organization's overall risk score, its highest risks, and a bubble chart of entities colored by risk level](/img/imported/axiad-mesh/risk-overview-dashboard.png) ### Generative UI availability The Generative UI dashboard mode (the **Classic | Agentic** toggle and the Workspaces experience) is enabled per tenant and is off by default while it rolls out: - When it's off, users don't see the mode toggle, and opening Workspaces directly shows a "generative dashboard not enabled" message rather than an error. - Enabling it is a tenant-level change — contact your Axiad representative to turn it on for your organization. - Turning it on adds a mode; it changes nothing about your classic dashboards, data, or permissions. Tracking all users across multiple platforms — and understanding the impact if any one of them is hacked or impersonated — is becoming more and more impossible. Axiad Mesh isn't another security solution; instead, it empowers you to see what's happening within **all** of your security solutions. ## What does Axiad Mesh do? Your visibility tools already surface hundreds of identity risks. The hard part isn't finding them — it's knowing which ones actually matter, who owns them, and what to fix first. When everything is flagged as urgent, nothing gets fixed. Axiad Mesh sits above your visibility layer and turns that pile of findings into a ranked set of decisions. It pulls data from your connected systems and assesses risk across your entire identity landscape — not just human users, but the machine identities (service accounts, API keys, certificates, secrets) and AI agents that now vastly outnumber them and often run on credentials no one has audited. What makes Mesh different is how it looks at risk. It doesn't score a single user on a single application in isolation. It looks at one identity across many applications — and many identities across many applications, with different credential types — to see how a compromise in any one place could cascade. If a user is protected by a FIDO2 authenticator in one system but signs in to another with only a password, how secure is the first system once an attacker has that password? Mesh surfaces exactly these relationships — including the identity sprawl you didn't know you had — by correlating accounts, credentials, and access levels back to a single identity. Then Mesh ranks what it finds by impact: the financial cost of a compromised human, machine, or agent identity. That way you can see where your posture is weakest and act on the handful of risks that matter most, instead of triaging a flat list. Because information is only useful if it leads to action, Mesh doesn't stop at telling you what's wrong. It routes remediation back into the tools your team already uses and tracks your progress — so you can show movement against your security and compliance programs, not just a longer list of findings. ![A Security Operations workspace in Axiad Mesh Generative UI, ranking the identities and findings that matter most, with the top attack path and non-human identity inventory](/img/generative-ui/operator-workspace.png) ## How does Axiad Mesh work? Mesh admins connect data sources through connectors — identity providers, cloud platforms, PAM, IGA, and more. The more Mesh can see, the more correlations and risk assessments it can make. Mesh evaluates each data point and generates a risk score for individual entities — human users, machine identities, AI agents, connectors, locations, and groups — which roll up into overall scores that highlight the most and least secure parts of your environment. A score reflects more than the entity itself: it factors in the entity's level of access, the blast radius of the applications and identities it touches, the strength of the authentication in use, and more. Beyond the raw score, Mesh ranks risks by real-world impact — dollar cost for humans, machines, and agents — and rescores dynamically as your environment changes, so the priority list stays current instead of going stale the moment it's generated. From there, you can view the big picture or drill into any risk to see where it originates, then route remediation into the systems your team already works in and track progress against your programs. ![A post-quantum readiness workspace in Axiad Mesh Generative UI, composed by the agent from live data, with a readiness gauge, discovery coverage, quantum-vulnerable asset breakdown, and migration priorities](/img/generative-ui/pqc-readiness-workspace.png) ### Axiad delegation We don't want you to have to figure everything out on your own. As an industry leader, Axiad provides insight into the risk that we see and also helps you to resolve it to decrease the risk score. ![Delegate the investigation dialog for assigning an identity risk investigation to a teammate, with an editable notification message](/img/imported/axiad-mesh/delegate-investigation.png) ## Does Axiad Mesh require Axiad Conductor? Though you can use both Axiad products to enhance your security posture, they are independent products and aren't reliant on each other to work. Axiad Mesh prerequisites do include: - An identity provider (IdP) for secure sign-in to the web application - At least one connector to provide data to Axiad Mesh ![Identity details view correlating one person's accounts across an HR system, a development data source, and an identity provider](/img/imported/axiad-mesh/identity-details.png) > **tip** Check out the [Admin Guide](../admin-guide/index.md) and the [User Guide](../user-guide/index.md) to understand more about how this product works. ## How this documentation is organized - **Getting Started** — the fast path from zero to your first risk investigation. - **Admin Guide** — configuration, tenants, connectors, and operations. - **User Guide** — day-to-day usage of the Mesh dashboard. - **Connectors & Integrations** — per-source setup and reference. - **API Reference** — REST/GraphQL API details. - **Release Notes** — what changed, chronologically. Use search (top right) at any time to jump straight to a topic. --- # Security and compliance Canonical URL: https://docs.axiad.io/docs/overview/security-and-compliance Axiad's security and compliance information — for Axiad Mesh and all other Axiad products — is published in the **[Axiad Trust Center](https://trustcenter.axiad.com/)**. The Trust Center is the authoritative, always-current source for: - **Certifications and attestations** that Axiad holds, with reports available on request. - **Security policies and controls** — how Axiad protects the confidentiality, integrity, and availability of customer data. - **Compliance documentation** and answers to common security questions. For the Customer Data terms that apply to your organization — including data extraction during the term of your agreement, retrieval after termination, and retention commitments — refer to your agreement with Axiad or contact your Axiad representative. ## How Mesh handles data in the product For product-level detail on how Axiad Mesh handles your data, see: - [AI features and data handling](./ai-features-data-handling.md) — what data AI features use, and how personal data is tokenized before any AI request leaves the platform. - [Audit logging](../admin-guide/audit-logging.md) — what Mesh records and how to export it. - [Credential management](../admin-guide/credential-management.md) — how connector secrets are stored and protected. --- # Use these docs with your AI agent Canonical URL: https://docs.axiad.io/docs/overview/use-with-ai You do not have to read this documentation yourself. Install the **Axiad Mesh docs skill** and your AI agent answers Mesh questions from these pages — grounded, current, and with links back to the source. The skill uses the open [Agent Skills](https://agentskills.io) format (a folder with a `SKILL.md` file), supported by Claude, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, and a growing list of agent tools. **[Download the skill](pathname:///ai/axiad-mesh-docs-skill.zip)** · [inspect the raw SKILL.md](pathname:///ai/axiad-mesh-docs/SKILL.md) ## Install in Claude 1. Open the Claude desktop or web app and go to **Settings → Capabilities → Skills** (a paid plan with code execution enabled is required). 2. Select **Upload skill** and choose the downloaded `axiad-mesh-docs-skill.zip`. 3. Claude shows the skill name and description. Enable it, then ask anything — for example "How do I delegate remediation for a risky identity in Mesh?" ## Install in Claude Code ```bash unzip axiad-mesh-docs-skill.zip -d ~/.claude/skills/ ``` Restart Claude Code and run `/skills` to confirm `axiad-mesh-docs` is loaded. ## Install in other agents Any tool that supports the Agent Skills format reads the same folder — for example Codex, Copilot, Cursor, and Gemini CLI each document a skills directory in their settings. Unzip the download into that directory and the agent picks it up. If your tool does not support skills yet, you can still point it at the machine-readable documentation directly: - [`/llms.txt`](pathname:///llms.txt) — an index of every page with a one-line summary and a direct raw-markdown URL. - [`/llms-full.txt`](pathname:///llms-full.txt) — the entire documentation set in a single markdown file. - Every page on this site also serves a raw-markdown twin at its URL plus `.md` — use the **View as Markdown** button on any page. ## What the skill does The skill teaches your agent to look answers up rather than guess: it fetches the page index, reads the specific pages that match your question, answers in the product's own vocabulary, and cites the pages it used. When the documentation does not cover a question, the agent says so instead of inventing an answer. ## A note on freshness The skill contains no documentation content itself — only instructions for finding it — so your agent always reads the live site, including release notes published after you installed the skill. Reinstalling is only needed if the skill file itself changes. --- # Axiad Mesh admin onboarding Canonical URL: https://docs.axiad.io/docs/getting-started/admin-onboarding Welcome to Axiad Mesh! This guide walks you through what to expect as a first-time admin user: activating your account, connecting your primary identity provider (IdP), nominating admin groups, and signing in for the first time. > **note** This is the onboarding experience for an **Admin** Mesh user. For a standard user (no administrative privileges in Axiad Mesh), see the [User Guide](../user-guide/index.md). If you purchased Axiad Mesh from the Azure Marketplace, your account setup runs through the Marketplace wizard instead — see [Complete your Marketplace onboarding](../getting-started/complete-onboarding.md). You can sign in to the tool alongside the Axiad video walkthrough, follow the step-by-step guide below, or both. ## Video walkthrough If the embedded player doesn't load, watch the [Axiad Mesh onboarding playlist on YouTube](https://www.youtube.com/playlist?list=PLJxpG6oVAP4JICVz-SzgFWjbajbfcsfX-). ## Initial configuration To set up secure access for you and your users, you'll receive two emails at your admin address: - **Welcome to Axiad Mesh** — your one-time setup link. - **Your Axiad Mesh security code** — a 6-character code. Both arrive in the same inbox, and you need both. Because the link and the code are delivered separately, intercepting one alone isn't enough to reach setup. ![The "Welcome to Axiad Mesh" email containing the one-time setup link](/img/getting-started/admin-onboarding/01_welcome_email.png) ![The "Your Axiad Mesh security code" email containing the 6-character code](/img/getting-started/admin-onboarding/02_security_code_email.png) 1. In the **Welcome to Axiad Mesh** email, select the secure setup link to open the web application. Keep this email until setup is complete — you'll use the link to return if you step away. 2. When prompted, enter the 6-character code from the **Your Axiad Mesh security code** email. - The code is paired with your link and stays valid as long as the link does, so enter it each time you open the link. - It isn't a one-time passcode: there's no separate expiry and no limit on attempts. - Axiad will never ask you to share this code by phone, chat, or any other channel. ![The security-code entry screen](/img/getting-started/admin-onboarding/03_code_entry.png) 3. Once verified, you enter the Axiad Mesh setup assistant — an AI-guided chat that walks you through the rest of onboarding. ![The setup assistant welcome screen](/img/getting-started/admin-onboarding/04_assistant_welcome.png) - **Connect your identity provider (IdP).** Choose the directory that manages your users' access to Axiad Mesh — for example, Microsoft Entra ID or Okta — so Mesh can read your users and groups. ![Choosing an identity provider in the setup assistant](/img/getting-started/admin-onboarding/05_idp_selection.png) When prompted, provide the IdP credentials, such as a client secret. These go directly to the configuration service and are never shared with the AI. ![Entering identity provider credentials](/img/getting-started/admin-onboarding/06_idp_credentials.png) - **Nominate admin groups (required).** Select the directory groups whose members get admin access in Axiad Mesh, and include at least one group you belong to. This step is mandatory: admin access is what lets you manage your identity provider and connectors after onboarding — without it, no one will be able to edit or manage your IdP or connectors later. - **Add connectors.** Select the apps and systems whose user and access data Mesh ingests for identity correlation and risk scoring. ![Selecting connectors in the setup assistant](/img/getting-started/admin-onboarding/07_connector_selection.png) The assistant configures and validates each piece as you go, then shows a summary of everything it has set up. ![The setup assistant's validation summary](/img/getting-started/admin-onboarding/08_validation_summary.png) 4. When your profile, IdP, and connectors are in place, the assistant finalizes your tenant. Your organization is now live on Axiad Mesh, and your first data sync begins. ![The setup-complete confirmation screen](/img/getting-started/admin-onboarding/09_setup_complete.png) ## First-time sign-in With the initial configuration complete, you and other nominated users (admin users from the selected user groups) can sign in to the tool through the connected IdP. 1. From the new Axiad email, select the sign-in link, which opens a web browser. 2. On the sign-in page, enter your username and select **Next**. ![Axiad Mesh sign-in page asking for a username](/img/imported/admin-onboarding/signin-username.png) 3. After you authenticate through your IdP, you land on the homepage of your new Axiad Mesh environment. ![Homepage of a new Axiad Mesh environment after the first sign-in](/img/imported/admin-onboarding/new-environment-homepage.png) > **note** Once you add connectors, the homepage displays your identity ecosystem visualization so you can instantly see the overview of your environment. 4. Once you've successfully signed in to Axiad Mesh through your IdP, your onboarding process is complete. 5. To sign out of Axiad Mesh, select your name in the top-right corner and select **Sign out**. - You can also access the Axiad Knowledge Center anytime from this same menu. ![Account menu open in the top-right corner showing the Sign out option](/img/imported/admin-onboarding/sign-out-menu.png) ## Good to know - **Link expiry:** the setup link expires 14 days after it's issued (the exact date and time are in the welcome email). If it lapses before you finish, contact Axiad support to reissue it. - **Resume anytime:** reopen the setup link before it expires to pick up where you left off — you'll re-enter your security code each time. - Don't delete the welcome email until setup is complete. - **Two channels by design:** the link and code are sent separately so access requires both. ## Next steps - Read how to set up [connectors](../connectors/index.md) to create your personalized visualization of your company's identity ecosystem. - To learn how to use the visualization tool, check out the [User Guide](../user-guide/index.md). --- # Complete your Marketplace onboarding Canonical URL: https://docs.axiad.io/docs/getting-started/complete-onboarding Welcome to Axiad Mesh! After you purchase Axiad Mesh from the Azure Marketplace, a short wizard helps you finish setting up your account. This guide walks you through every screen, in order, exactly as you'll see it. It takes about **10 minutes**. ## Before you begin - You've purchased Axiad Mesh on the Azure Marketplace and can open your subscription setup page from **Configure account now**. - You'll need three values from your organization's **Microsoft Entra ID**: a **Tenant ID**, an **Application (client) ID**, and a **Client Secret Value**. Links to Microsoft's official guides are included at each field. - You know the name of the group that should have **administrator** access in Mesh. > **note** If you don't have your Microsoft Entra ID details, ask your Microsoft Entra administrator before you start. You can gather them and return to onboarding. ## Step 1 — Start onboarding After you select **Configure account now** on the Azure Marketplace, your Axiad Mesh subscription setup page opens. Review your subscription details, then select **Start Onboarding**. ![Axiad Mesh subscription setup page with the Start Onboarding button](/img/getting-started/onboarding-wizard/01-marketplace-landing-page.png) The onboarding wizard opens on a welcome screen. At the bottom of the screen, select **Manual Wizard** to set up your account step by step. ![Onboarding welcome screen](/img/getting-started/onboarding-wizard/02-onboarding-selection.png) ## Step 2 — Tell us about your organization On the **Profile** step, enter your **Company name**, then choose your **Company size** and **Industry**. ![Profile step with empty fields](/img/getting-started/onboarding-wizard/03-organization-profile-empty.png) Once your details are filled in, select **Continue**. ![Profile step with the details completed](/img/getting-started/onboarding-wizard/04-organization-profile-filled.png) ## Step 3 — Set up your identity provider On the **Set up primary IdP** step, connect **Microsoft Entra ID** so your team can sign in with the work accounts they already use. You'll see this form: ![Identity provider form, top section](/img/getting-started/onboarding-wizard/05-configure-idp-part-1.png) ![Identity provider form, lower section](/img/getting-started/onboarding-wizard/06-configure-idp-part-2.png) Fill in the fields: - **Domain** — your organization's email domain (for example, `contoso.com`). - **Provider** — leave this set to **Microsoft Entra ID**. - **Instance Type** — choose **Commercial** unless your organization uses Azure Government, in which case choose **US Gov**. If you're not sure, choose **Commercial**. - **Microsoft Entra tenant ID** — to find this value, see Microsoft's guide, [Find your Microsoft Entra tenant ID](https://learn.microsoft.com/en-us/entra/fundamentals/how-to-find-tenant), then paste it here. - **Application (client) ID** — to get this value, follow Microsoft's guide, [Register an application in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app), then paste it here. - **Client secret value** — to create one, follow Microsoft's guide, [Add a client secret](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app#add-a-client-secret), then paste the value here. Once your details are entered, the form looks like this: ![Identity provider form completed, top section](/img/getting-started/onboarding-wizard/07-configure-idp-filled-part-1.png) ![Identity provider form completed, with Test Connection](/img/getting-started/onboarding-wizard/08-configure-idp-filled-part-2.png) > **warning** Microsoft shows the client secret **Value** only once, right after you create it. Copy it into Mesh before you leave Microsoft — otherwise you'll need to create a new one. Select **Test Connection**. When you see **Connection successful**, select **Continue**. ![Test Connection showing a successful result](/img/getting-started/onboarding-wizard/09-test-connection-success.png) ## Step 4 — Assign admin groups On the **Assign admins** step, decide which groups have **administrator** access in Mesh. In the **Admin groups** field, type each group's display name exactly as it appears in your directory, pressing **Enter** (or using commas) to add each one. ![Assign admins step before adding a group](/img/getting-started/onboarding-wizard/10-admin-groups-empty.png) Each group you add appears as a tag. ![Assign admins step with a group added](/img/getting-started/onboarding-wizard/11-admin-groups-filled.png) > **tip** Add a group that you belong to, so you'll keep administrator access once onboarding is complete. Only members of the groups you add will have admin access. When you're ready, select **Nominate groups & finish**. ## Step 5 — Finish and sign in A confirmation appears. Select **Finish initial configurations**. Mesh completes the onboarding process and redirects you to the sign-in page. ![Confirmation before finishing onboarding](/img/getting-started/onboarding-wizard/12-finish-onboarding.png) You're taken to the sign-in page. Enter your work email and select **Sign In** — continue signing in with your work account. ![Axiad Mesh sign-in page](/img/getting-started/onboarding-wizard/13-sign-in-page.png) ## Verify - The **Test Connection** check showed **Connection successful**. - You can sign in with your work email. - Members of the groups you added have administrator access in Mesh. ## Next step Once you've signed in, continue with the end-user onboarding guide to get started in the product. ➡️ [End-user onboarding](../user-guide/end-user-onboarding.md) --- # Set up your first connector Canonical URL: https://docs.axiad.io/docs/getting-started/first-connector Connectors bring account, entitlement, and activity data from your source systems into Mesh, where it is correlated against the identities from your IdP. Start with one high-value system — an HR system, a cloud directory, or an ITSM tool works well. ## Choose a connector Connectors are organized by source-system category: - **Identity providers** (already connected in step 1) - **HR systems** — authoritative worker data - **ITSM** — ticketing and access requests - **Cloud & directory** — cloud IAM and directory services - **Endpoint** — device and endpoint posture Browse the [Connectors & Integrations](../connectors/index.md) section to see what each connector collects and its prerequisites. ## Steps 1. In **Admin → Connectors**, choose **Add connector** and pick your source system. 2. Provide the authentication the connector requires (API token, OAuth app, or service account). Follow the per-connector **Authentication** and **Setup** sections. 3. Configure the collection scope and schedule. 4. Save and run an initial collection. ## Verify - The connector reports **Connected** and completes its first collection. - Accounts from the source system are correlated to identities and visible in the dashboard. ## Next step Now orient yourself in the dashboard: ➡️ [Your first dashboard view](./first-dashboard-view.md) --- # Your first dashboard view Canonical URL: https://docs.axiad.io/docs/getting-started/first-dashboard-view Once your IdP and first connector are collecting, the Mesh dashboard becomes your window into correlated identities and their risk. ## Two ways to see your data Mesh has two dashboard modes, switched with the **Classic | Agentic** toggle in the app header: - **Classic** — the fixed dashboards this walkthrough uses. Start here: the views are predictable, and everything below applies. - **Agentic** — describe the view you want and the Mesh agent composes a workspace of live widgets for you. Availability is per tenant during rollout. When you're comfortable with the basics, see [Generative UI](../user-guide/generative-ui.md). ## What you're looking at - **Identities** — people and non-human identities correlated across your connected systems. Each identity aggregates the accounts and entitlements Mesh found for it. - **Risk signals** — Mesh's risk engines flag conditions such as excessive access, stale accounts, weak authentication, and known breach exposure. - **Severity** — signals are ranked (low, moderate, high, critical) so you can triage the most important items first. ## Orient yourself 1. Start on the overview to see the population of identities and the current risk distribution. 2. Filter by source system, department, or severity to narrow the view. 3. Open an identity to see its correlated accounts, entitlements, and the risk signals attached to it. ## Verify - You can see identities from your IdP and connector. - Risk signals are populated (this may take a collection cycle or two as engines run). ## Next step Put it together by investigating a risky identity end to end: ➡️ [Investigate a risky identity](./investigate-risky-identity.md) --- # Go-live checklist Canonical URL: https://docs.axiad.io/docs/getting-started/go-live-checklist You've completed initial setup and run your first investigation. Before you roll Mesh out to your whole organization, walk through this checklist to confirm the tenant is ready for everyday use. Every item links to the page that shows you how. ## Data foundations - [ ] **Your identity provider is connected and syncing.** The IdP connector shows **Connected**, collections complete without errors, and identities from your IdP appear in the dashboard. See [Connect your identity provider](./idp-setup.md). - [ ] **At least one source connector is healthy.** Beyond the IdP, at least one source system — an HR system, a cloud directory, or an ITSM tool — reports **Connected** and completes its collections, and its accounts are correlated to identities. See [Set up your first connector](./first-connector.md) and browse [Connectors & Integrations](../connectors/index.md) for what else to connect. ## Access and security - [ ] **Admin groups and roles are assigned.** The right IdP groups grant **Admin** access, standard users get the **User** role, and you belong to an admin group yourself. See [Signing in, roles, and access](../admin-guide/roles-and-access.md). - [ ] **The sign-in identity provider is configured.** Users sign in to Mesh through your organization's IdP with single sign-on — this is separate from the IdP data connector. See [Identity providers (sign-in)](../admin-guide/identity-providers/index.md). - [ ] **Audit logging is reviewed.** You know where the audit log lives, what Mesh records, and how to export it for compliance reporting. See [Audit logging](../admin-guide/audit-logging.md). - [ ] **You have a connector credential rotation plan.** Each connector credential's expiry date is in your rotation calendar, and you know how to replace a secret before it lapses. See [Manage connector credentials](../admin-guide/credential-management.md). ## People readiness - [ ] **You've completed the dashboard walkthrough.** You can read the overall risk score, the bubble chart, and an identity's risk signals, and you can show others how. See [Your first dashboard view](./first-dashboard-view.md). - [ ] **Support paths are known.** Your team knows how to diagnose common sign-in, connector, and export issues, how to check service status, and what to include when contacting Axiad. See [Troubleshooting and getting help](../admin-guide/troubleshooting-and-support.md). ## After go-live Keep the momentum going: - Add more connectors as you expand coverage — the correlation gets better with every source. See [Connectors & Integrations](../connectors/index.md). - Resolve profiling gaps as they appear to keep your risk score accurate. See [Identities](../concepts/identities.md#profiling-gaps). - Watch the [release notes](/release-notes) for new connectors and features. --- # Connect your identity provider Canonical URL: https://docs.axiad.io/docs/getting-started/idp-setup Your identity provider (IdP) is the anchor for identity correlation in Axiad Mesh. Connecting it first lets Mesh resolve who your people are before you layer on data from other systems. ## Prerequisites - An administrator account in Mesh with permission to manage connectors. - Administrative access to your IdP (for example, Microsoft Entra ID or Okta). - The ability to register an application / grant API permissions in your IdP. ## Steps 1. In the Mesh dashboard, open **Admin → Connectors** and choose **Add connector**. 2. Select your identity provider from the **Identity Provider** category. 3. Register Mesh as an application in your IdP and grant the read permissions listed on the connector setup screen (typically directory and sign-in/audit read scopes). 4. Paste the resulting credentials (client ID, tenant/directory ID, and client secret) into the connector configuration. Secret fields are write-only and are never displayed back. 5. Save the connector and run an initial collection. ## Verify - The connector status shows **Connected** and the first collection completes without errors. - Identities from your IdP appear in the dashboard within a few minutes. ## Next step With identities flowing in, connect your first source system: ➡️ [Set up your first connector](./first-connector.md) --- # Getting Started Canonical URL: https://docs.axiad.io/docs/getting-started/ Follow the get-started-fast path: 1. **IdP setup** — connect your identity provider. 2. **First connector setup** — pull in your first source system. 3. **First dashboard view** — orient yourself in the Mesh dashboard. 4. **Investigate a risky identity** — run your first investigation. Detailed walkthroughs for each step are added in the Getting Started section. --- # Investigate a risky identity Canonical URL: https://docs.axiad.io/docs/getting-started/investigate-risky-identity This is the payoff of the get-started path: taking a high-risk identity and understanding *why* it's risky and *what to do* about it. ## Find a candidate 1. From the dashboard, filter identities by **severity: high** or **critical**. 2. Sort by risk so the most pressing identities are at the top. 3. Open the top identity to start the investigation. ## Understand the risk On the identity's detail view, review: - **Correlated accounts** — every account Mesh matched to this identity across your connected systems. Look for orphaned, duplicate, or unexpected accounts. - **Entitlements** — the access this identity holds. Watch for excessive or toxic combinations of privileges. - **Risk signals** — the specific conditions the risk engines flagged, each with a severity and an explanation of the contributing factors. ## Decide and act - Confirm whether the flagged access is expected for this person's role. - Note remediation steps (revoke access, disable a stale account, enforce stronger authentication) and route them through your normal access-management process. - Re-check the identity after the next collection to confirm the signal clears. ## You're up and running You've connected an IdP, pulled in a source system, oriented yourself in the dashboard, and investigated a real risk. From here: - Add more connectors from [Connectors & Integrations](../connectors/index.md). - Deepen your configuration with the [Admin Guide](../admin-guide/index.md). - Learn day-to-day workflows in the [User Guide](../user-guide/index.md). --- # Delegate remediation Canonical URL: https://docs.axiad.io/docs/concepts/delegation Throughout Axiad Mesh, you can delegate remediation to another user to ensure that the risk is addressed by the right person. ## Delegation options ### Bulk delegation If someone in your enterprise is responsible for all of the identity risks, including profiling gaps, you can delegate once to assign every task in the table at the same time. ![Identities and risks table with the Delegate button highlighted above the table for bulk delegation](/img/imported/axiad-mesh-delegation/bulk-delegation.png) ### Single identity delegation To delegate a single identity risk or profiling gap, select **Delegate** from the options in the identity's row, or select **Delegate** on the **Identity details** page. ![Options menu open on an identity row, with the Delegate action highlighted next to View detail and investigate](/img/imported/axiad-mesh-delegation/delegate-row-action.png) ![Identity details page with the Delegate button highlighted below the identity's risk summary](/img/imported/axiad-mesh-delegation/delegate-identity-details.png) ## Delegation process When you select **Delegate**, the **Delegate the investigation** dialog opens. Start typing the user's name in the **Delegate to** field to assign the task to them. ![Delegate the investigation dialog showing name suggestions under the Delegate to field](/img/imported/axiad-mesh-delegation/delegate-to-field.png) Fill out the form with any notes that would assist the assignee, then select **Delegate**. ![Completed delegation form with a note for the assignee and the Delegate button ready to select](/img/imported/axiad-mesh-delegation/delegate-form-notes.png) After you assign a task, the delegate receives an email with a direct link to the relevant page, complete with step-by-step instructions to resolve the risk or close the profiling gap. ![Notification email telling the delegate an investigation was delegated to them, with the scope, the note, and a Go to investigation link](/img/imported/axiad-mesh-delegation/delegate-email.png) > **tip** For the full investigation workflow that leads up to delegation, see [Investigate a risky identity](../getting-started/investigate-risky-identity.md). --- # Entities Canonical URL: https://docs.axiad.io/docs/concepts/entities Entities appear in the Axiad Mesh [bubble chart overview](../user-guide/index.md#bubble-chart-overview) and can be applications, user groups, authenticators, locations, departments, or other meaningful overlaps within your environment. You can see their risk levels in the overview visualization, or dive deeper into them individually to further understand the potential risk and how to remediate it. ![Axiad Mesh dashboard showing the organization's overall risk score, its highest risks, and the bubble chart of entities colored by risk level](/img/imported/axiad-mesh/risk-overview-dashboard.png) ## Entity details When you select an entity (bubble) on the main dashboard, the entity's full details display. The top level provides the most urgent information, including the risk score, the number of identities associated with the entity, and the main risks. ![Entity details view showing an identity provider's risk score and identity count, its top three risks, and the other entities its identities also belong to](/img/imported/entities/entity-details.png) Under the main risks, you can see the other entities that overlap with the identities associated with this entity. This is crucial in determining the blast radius, as all of these entities are threatened by the risk score of the original entity. ## Group entities You can find the main risks across multiple entities by grouping them together to see what overlaps they contain. Select the **+** button next to the associated entities to create a group. ![Grouped entities view with three stacked entities, the top three risks they share, and the other entities their identities also belong to](/img/imported/entities/group-entities.png) Now you have a more limited view where you can see the main risks and view the associated identities. To remove any of the grouped entities, select the **x** in the top right corner of the entity widget. Once you have your entity group, you can take a step deeper and select **View identities** to determine causes of risk and how you can remediate them. For a worked example, follow [Investigate a risky identity](../getting-started/investigate-risky-identity.md). --- # Identities Canonical URL: https://docs.axiad.io/docs/concepts/identities Within an [entity](./entities.md) or group of entities, you can view all of the associated identities to determine and remediate risk, and to fill profiling gaps for a more accurate analysis. ## Identities and risks To view an identity and its specific details, select **View identities** within an entity to open the table of associated identities. ![Identities & risks table listing the identities in the selected entities, each with a risk score, risk labels, status, correlation quality, and user count](/img/imported/identities/view-identities.png) In the **Identities & risks** table, select the row that you'd like to explore. From there, the **Identity details** display. You can also select the **three dots menu** on a row to quickly view and delegate actions. ![Identity details page correlating one person's accounts across connected systems, with a risk pop-up offering Investigate and Delegate actions](/img/imported/identities/identity-actions-menu.png) On the Identity details page, you can view the identity's: - **Risk score** — the overall potential risk for this identity (1–100). - **Main risks** — the cause of the risk score. - **Status** — the current state of the account. - **Quality** — the type of identity. - **Users** — the number of usernames and accounts associated with the identity within the selected entities. You can view additional details for each of the associated users to see more information and their latest activity. If you hover over the **!** icon next to a user, you get quick information and can take action. If you select the icon, Axiad Mesh provides additional details about the risk and how to remedy it. ![Risk details panel explaining an inconsistent identity risk, how to address it, and where to update the user status to remediate it](/img/imported/identities/risk-icon-details.png) With this information, you can make changes yourself to lower the identity's risk score, or you can [delegate](./delegation.md) the task to someone else in Axiad Mesh. ## Profiling gaps Profiling gaps occur when the correlation between user accounts may be inaccurate. Axiad Mesh does its best to associate users to the top-level identity, but sometimes it requires manual engagement to confirm the connection. Removing profiling gaps leads to a more accurate risk score for your organization. You can access the **Profiling gaps** table either from the entity details page or from the homepage risk score widget. Once on the table, select the identity you'd like to investigate. ![Profiling gaps table listing identities with unresolved profiling gaps, their status, correlation quality, and user counts](/img/imported/identities/profiling-gaps-table.png) On the profiling gap side, Mesh provides a powerful correlation diagram showing the relationships between different identity profiles. On the right, strong correlations are displayed, with the arc thickness representing the level of confidence in the connection. On the left, weak correlations that need to be resolved are clearly marked. ![Correlation diagram for one identity, with strongly correlated accounts grouped on the right and a weak user correlation flagged with Investigate and Delegate actions](/img/imported/identities/correlation-diagram.png) If you select a **weak user correlation**, you can view more information about the profiling gap to determine whether these users should be associated. In the UI, you can confirm that they're part of the same identity, or reject the correlation and keep the identities separate. ![Weak user correlation dialog comparing two user accounts side by side and asking whether they belong to the same identity](/img/imported/identities/confirm-correlation.png) Once the gap is remedied, the correlation moves to the right side of the user map. You can also choose to [delegate](./delegation.md) this action to another Mesh user if it requires additional investigation. --- # Concepts Canonical URL: https://docs.axiad.io/docs/concepts/ Axiad Mesh correlates accounts from every connected system into a single view of who — and what — has access in your organization, then scores the risk each one carries. The pages in this section explain the ideas the rest of the documentation builds on: - **[Identities](./identities.md)** — how Mesh correlates accounts from different systems into one identity, and how to review and correct correlations. - **[Entities](./entities.md)** — how identities group into organizational entities so you can see risk by team, department, or function. - **[Delegation](./delegation.md)** — how remediation work is assigned to the person best placed to act on it. - **[Risk scoring](./risk-scoring.md)** — what the risk score means, how it is calculated, and how to read it across the product. - **[Remediation](./remediation.md)** — how risks get fixed: guided steps in the product, delegation with direct user notifications, and automated external remediation through A2A agents. - **[Programs](./programs.md)** — how Mesh tracks organization-wide security initiatives, such as a post-quantum migration or an MFA rollout, as measurable efforts with progress and loss exposure prevented. - **[Policies](./policies.md)** — the rules Mesh evaluates your identities and assets against, including the cryptographic policies behind post-quantum readiness. - **[Investigations](./investigations.md)** — how you drill from a summary into the evidence, and the identity graph and attack-path views you explore along the way. One more mental model lives in the User Guide: [Generative UI](../user-guide/generative-ui.md) explains **workspaces** — the agent-composed views that exist alongside the classic dashboards these concepts describe. The concepts on this page apply identically in both modes. If you are setting up Mesh for the first time, start with [Getting Started](/docs/getting-started) — it links back here whenever a step introduces one of these ideas. --- # Investigations Canonical URL: https://docs.axiad.io/docs/concepts/investigations An **investigation** in Axiad Mesh is a drill-down. Starting from a [workspace](../user-guide/generative-ui.md) widget, you click something — an identity, a finding, a program, a step in an attack path — and Mesh opens a **focus frame**: a full-screen view, composed of detail widgets, all scoped to the one thing you clicked. Investigations aren't a separate feature you navigate to; they're how you follow any risk from the summary down to the evidence. ## Drilling is deterministic A drill is **not** an AI step. Clicking a specific place in a specific widget maps to a pre-defined layout, and that layout dictates exactly which detail widgets appear and how the subject and inherited filters flow into them. The same click always opens the same investigation, and it opens fast — the language model isn't invoked on a drill. Because a focus frame has a stable, shareable URL, an investigation can be handed off by link: bookmark it, paste it into a ticket, or drop it in chat, and the recipient lands on the same drilled-in view. ## Investigating an identity Drilling into an identity composes a focus frame with: - **Identity summary** — name, state, correlation quality, risk score, loss exposure, and owner. - **Open risks** — the identity's findings ranked by severity and confidence and tagged by [risk layer](./risk-scoring.md). - **Correlated peers** — the accounts Mesh has correlated to this identity, ranked by similarity, showing where the correlation came from. - **The identity graph** — the identity's relationships, drawn as a diagram (below). ### The identity graph The identity graph is the **two-hop neighborhood** around one identity: the identity itself, everything correlated to it, and everything correlated to *those* — bounded so it stays fast and always draws the same graph for the same identity. It's a force-directed diagram where nodes are colored by kind — human, non-human identity, role, resource, group — and a legend labels them. Edges represent [identity correlations](./identities.md) and carry a similarity strength; an edge that lies on a **critical access path** is highlighted in red and labeled so you can see how access chains together. The graph is a fast way to answer "what else is this connected to, and does any of it matter?" without leaving the investigation. ## Attack paths (the kill chain) The **kill chain** widget shows your highest-exposure attack path as a left-to-right numbered flow — for example *phishable MFA → session theft → token replay → API access → privilege escalation → data exfiltration* — with the total annual loss exposure of the path. It answers "if an attacker chained our weaknesses together, what's the worst realistic route, and what would it cost?" Drilling into a step opens that step's detail: the attacker technique it maps to, its share of the exposure, the identities it affects, and a timeline of the evidence behind it. ## Moving through an investigation Every focus frame gives you the same controls: - **Subject pill** — the thing you drilled into, shown in the header and editable. Retype it and the whole frame re-binds to the new subject — a quick pivot from one identity or finding to the next without going back to the canvas. - **Inherited filters** — a frame carries in only the filters its layout declares (a time range, a department, a severity), marked as inherited; editing them affects the frame only. - **Step back out** — the frame's Back button, the browser Back button, and the Escape key all close the frame and return you to the canvas exactly where you were. A breadcrumb trail lets you pop to any depth. - **Keep it** — **Pin as workspace** turns the drilled-in view into a saved workspace; an admin can **Save as template** to make the drill layout reusable across the tenant. ## Related concepts - [Identities](./identities.md) — the correlations the identity graph draws. - [Risk scoring](./risk-scoring.md) — the scores and layers findings carry. - [Remediation](./remediation.md) — acting on what an investigation surfaces. - [Generative UI](../user-guide/generative-ui.md#working-with-a-workspace) — the workspace mechanics behind focus frames. --- # Policies Canonical URL: https://docs.axiad.io/docs/concepts/policies A **policy** in Axiad Mesh is a set of rules that Mesh evaluates your identities and assets against. The most developed policies today are **cryptographic compliance policies** — the rules behind post-quantum readiness and the *PQC noncompliant* risk you see in the [PQC dashboard](../user-guide/pqc-dashboard.md). ## What a crypto compliance policy contains A compliance policy is a named rule set that targets a class of cryptographic material — certificates, keys, or the software that uses them. Inside it, there is one rule per cryptographic algorithm, and each rule places that algorithm on a four-level scale: | Level | Meaning | Effect on risk | | --- | --- | --- | | **Preferred** | The algorithm you want assets to use. | Compliant. | | **Acceptable** | Allowed, but not the target state. | Compliant. | | **Deprecated** | On its way out; should be migrated. | Raises a medium-severity risk. | | **Prohibited** | Must not be used. | Raises a critical-severity risk. | A rule can also pin the acceptable key sizes or curves for an algorithm, so a policy can say "this algorithm, but only at this strength." If an asset uses an algorithm a policy hasn't approved, Mesh treats that fail-closed — as a violation — rather than assuming it's fine. ### Deadlines Policies express the *when* of a migration in two places: - **Per-algorithm deadline** — an algorithm can carry a date after which it flips from a warning to a violation, so you get lead time before a "deprecated" algorithm becomes "prohibited." - **Program deadline** — a whole framework (see below) can carry an overall transition window. Together these are what let a post-quantum policy say, for example, that classical public-key algorithms are acceptable today but must be gone by a target year, while post-quantum algorithms are already preferred. ## How policies become risks A compliance engine continuously evaluates every certificate, key, software, and machine asset against all enabled policies. For each asset it reads the algorithms in use and checks them against every rule. When an asset uses a deprecated or prohibited algorithm, Mesh raises a **policy-based risk** — the *PQC noncompliant* tag — on that asset, listing the offending attributes and naming the policy that triggered it. The severity follows the algorithm's level. When an asset stops violating a policy — after remediation, or after a rescan picks up a changed attribute — Mesh resolves the risk on its own. Evaluation runs both when an asset changes and on a regular schedule, so results stay current with your [risk scores](./risk-scoring.md). ## Frameworks Policies can be grouped into a named **framework** — for example a NIST post-quantum baseline. A framework gives each asset a compliance percentage and a severity band, so you can see not just individual violations but how far along a whole standard you are. One framework is active per category at a time, so a [Program](./programs.md) or an Audit & Compliance workspace shows a single authoritative score rather than competing ones. ## Who configures policies Mesh ships a set of **default policies and frameworks** out of the box — including a post-quantum baseline — that apply to every organization. Policies are configured by Axiad: the defaults are ready to use, and custom policies for your organization are available on request. There is no self-serve policy editor in the product today, so to tailor a policy — different algorithms, different deadlines, a custom framework — contact your Axiad representative. The Mesh AI assistant can read your active policies to explain *why* a particular asset is noncompliant and which rule it tripped. ## Related concepts - [PQC dashboard](../user-guide/pqc-dashboard.md) — where policy-based risks appear on your crypto assets. - [Programs](./programs.md) — how a policy framework's progress is tracked as an initiative. - [Risk scoring](./risk-scoring.md) — how policy risks fold into an asset's score. - [Crypto agility](../use-cases/crypto-agility.md) — the end-to-end lifecycle policies sit inside. --- # Programs Canonical URL: https://docs.axiad.io/docs/concepts/programs A **Program** is an organization-wide security initiative that leadership tracks toward a target — for example a post-quantum cryptography migration, a phish-resistant MFA rollout, or a non-human-identity ownership drive. Where a [risk score](./risk-scoring.md) tells you *where you stand today*, a Program tells you *how a deliberate improvement effort is progressing* and what it is worth. Programs surface as the **Programs** widget on the Executive View [workspace](../user-guide/generative-ui.md#persona-workspaces) in the Generative UI, so a CISO can see every active initiative at a glance and open any one for detail. ## What a Program tracks Each Program is a card showing: - **Status** — *On track* (green) or *At risk* (orange). At-risk Programs sort to the top so the ones that need attention are seen first. - **Progress** — a percentage toward the Program's goal, with a progress bar. - **Loss exposure prevented** — the annual loss exposure (in dollars) that reaching the Program's goal has already bought down, tying the initiative to the same [financial quantification](./risk-scoring.md#from-scores-to-loss-estimates) used across Mesh. - **Owner and due date** — who is accountable and when it is expected to land. - **Next milestone** — the immediate next step. The widget header summarizes how many Programs are active; a tenant with none sees a plain "No active programs" state rather than an empty card. ## Where progress comes from For initiatives Mesh can measure directly, progress is **computed from your live risk data** rather than hand-entered. Mesh links a Program to the risk rules and [policies](./policies.md) it is about, then measures the share of in-scope identities or assets that no longer trip those rules — so a post-quantum migration's progress reflects the real proportion of assets that have moved to quantum-safe cryptography, and it moves on its own as collection brings in fresh state. Coverage is recomputed on a regular cadence. Some initiatives aren't mechanically measurable from risk data; those track progress from a value the Program owner maintains. Either way, the card reads the same and the distinction stays behind the scenes. ## Opening a Program Clicking a Program card opens a [focus frame](./investigations.md) with its detail and an **Ask the agent** prompt — a pre-written question scoped to that Program (for example, *"Why is this program at risk, and what is blocking its next milestone?"*) that prefills the workspace chat for you to review and send. The **post-quantum program** opens a dedicated crypto-readiness view: the share of assets that are compliant, a count of quantum-vulnerable assets, a breakdown of vulnerable assets by algorithm, and the crypto [policy](./policies.md) rules in force (preferred versus prohibited algorithms and the transition deadline). This is the same post-quantum picture the [PQC dashboard](../user-guide/pqc-dashboard.md) presents in classic mode. ## Programs versus compliance frameworks Don't confuse the two: - A **Program** (Executive View) is a *company initiative* measured against your own risk data — an effort you are driving to a target. - A **compliance framework** (Audit & Compliance workspace) is a *regulatory standard* — NIST, PCI, ISO — whose controls Mesh maps coverage against. A Program may advance your standing under a framework, but they answer different questions: "how is our MFA rollout going?" versus "how much of PCI do we cover?" ## Related concepts - [Risk scoring](./risk-scoring.md) — the scores and loss estimates a Program moves. - [Policies](./policies.md) — the rules a Program is measured against. - [Remediation](./remediation.md) — how the individual fixes behind a Program get done. - [Generative UI](../user-guide/generative-ui.md) — the Executive View workspace where Programs live. --- # Remediation Canonical URL: https://docs.axiad.io/docs/concepts/remediation Finding a risk is half the job — remediation is how it gets fixed. Mesh supports three complementary paths, from hands-on to fully automated. ## Guided remediation in Mesh Every risk and profiling gap comes with context for resolving it. From an investigation, Mesh shows what the finding means and the step-by-step instructions to resolve it in the source system. See [Investigate a risky identity](../getting-started/investigate-risky-identity.md) for the end-to-end flow. ## Delegation with direct user notification Often the person looking at a risk is not the person who can fix it. [Delegation](./delegation.md) assigns the work to the right owner — for a single identity, or in bulk for every task in a view. The assignee is notified directly: Mesh sends an email with the scope of the work, your notes, and a direct link that takes them straight to the relevant page with step-by-step resolution instructions. They do not need to know Mesh to receive the assignment — the notification carries everything needed to get started. ## Automated external remediation through A2A agents For remediation that lives in another system, Mesh supports the open [A2A (Agent2Agent) protocol](https://a2a-protocol.org). Administrators register external remediation agents with Mesh; the Mesh AI assistant can then discover and invoke them during an investigation — for example, asking an agent in your ITSM or access-management system to act on a finding. Registered agents authenticate with the credentials your administrator configures, nothing is connected by default, and the full data-handling picture is described in [AI features and data handling](../overview/ai-features-data-handling.md). ## Prioritizing what to fix first Not every fix is worth the same. Mesh attaches a ranked list of **remediation actions** to an identity, finding, or asset, ordered by the [loss exposure](./risk-scoring.md#from-scores-to-loss-estimates) each one would buy down — so the action at the top of the list is the one that reduces the most dollars of risk, not just the most findings. Each action names a concrete step — disable an account, rotate a credential, enforce MFA, remove a role, migrate an asset to quantum-safe cryptography, revoke an OAuth grant — against a specific subject, and carries the risk-score points and loss exposure it is predicted to remove. A **remediation plan** view narrows the list to the open work: the actions still proposed, accepted, or in progress. Actions come from three places: a risk engine that recognizes a known fix, the Mesh AI assistant (which proposes actions for a person to approve), or a [what-if scenario](./risk-scoring.md#from-scores-to-loss-estimates) on the loss model. These surfaces help you *decide and assign*; the fix itself still happens through one of the three paths above. ## How resolution shows up in Mesh Remediation happens in your source systems, so Mesh reflects it the way it learns everything else: through collection. After the responsible connector's next collection cycle, resolved risks clear and [risk scores](./risk-scoring.md) recalculate — remediating a risk lowers the score on a later cycle rather than instantly. ## Related concepts - [Delegation](./delegation.md) — assigning remediation work - [Risk scoring](./risk-scoring.md) — how resolved risks change scores - [Identities](./identities.md) — what the risks attach to - [Crypto agility](../use-cases/crypto-agility.md) — the certificate and software remediation lifecycle end to end --- # Risk scoring Canonical URL: https://docs.axiad.io/docs/concepts/risk-scoring Everything Mesh assesses — identities, entities, and non-human assets — carries a risk score. The score is Mesh's answer to a single question: if this thing were compromised, how exposed would your organization be? This page explains what the score means, what goes into it, and how to read it wherever it appears. ## The scale Risk scores range from 1 to 100, with 1 being the least risky and 100 the most. Individual scores roll up into higher-level scores: identity scores contribute to the [entities](./entities.md) those identities belong to, and entity scores roll up into your organization's overall risk score on the dashboard. A score is not a grade you set — Mesh recalculates it as connectors collect new data, so remediating a risk lowers the score on a later collection cycle. ## Severity Alongside the number, Mesh conveys severity so you can triage without memorizing thresholds: - Risk signals are ranked — low, moderate, high, critical — so the most important items surface first. - In lists and detail views, the color of the score conveys its severity band, and severity labels such as "Low Risk" or "Critical Risk" appear where you point to a score. The same score means the same thing everywhere: a tooltip on a list row and the one on the corresponding details page break the score down identically. ## What goes into a score Mesh doesn't score anything in isolation. It first [correlates](./identities.md) accounts, credentials, entitlements, and activity from every connected source into identities, then runs risk engines against the correlated data. Each engine emits signals with a severity — conditions such as excessive access, stale accounts, weak authentication, or known breach exposure — and those signals combine into the score. Because the inputs are correlated, a score reflects more than the object itself. An identity that signs in with a strong authenticator in one system but only a password in another is scored on the weaker path, because that is the path an attacker would take. The more sources you connect, the more complete the correlation and the more accurate the score. ### Direct and inherited risk A score combines two kinds of risk: - **Direct risks** — conditions found on the object itself. For an asset, that might be "No owner"; for an identity, an inconsistent account status. - **Inherited risks** — risks carried over from correlated objects. An asset inherits risk from the assets correlated to it, and an entity is threatened by the risk of the identities and entities that overlap with it. This is how Mesh expresses blast radius: a breach in one place splashes onto everything correlated with it. On an asset, the risk score tooltip makes this split explicit — it lists the direct risk categories on the asset with their counts, followed by a summary of the risks inherited from its correlated assets. ## Risk tags Risk tags label the individual risks that contribute to a score, so you can see not just how risky something is but why. Examples include **PQC noncompliant**, **No owner**, **No linked asset**, and **Insufficient information**. Tags come in two forms: - **Simple risks** state a condition plainly — for example, "This asset has no assigned owner." - **Policy-based risks** show the outcome of a policy assessment — for example, noncompliance with a post-quantum cryptography (PQC) policy — along with the attributes that didn't comply and the policy that triggered the tag. The exact set of tags depends on the risk conditions Mesh detects and the risk policies configured for your organization. For how tags appear on non-human assets, see the [PQC dashboard](../user-guide/pqc-dashboard.md#risk-tags). ## From scores to loss estimates The 1–100 score ranks risk; it doesn't put a currency figure on it. For quantitative analysis, Mesh generates FAIR (Factor Analysis of Information Risk) reports based on Open FAIR v3.0 terminology: - **Loss Magnitude (LM)** — the size of the loss if a loss event occurs. - **Loss Event Frequency (LEF)** — how often a loss event is expected to occur. - **Annualized Loss Expectancy (ALE)** — the resulting yearly loss estimate, with risk-factor breakdowns. See [Reports, exports, and data retrieval](../user-guide/reports-and-exports.md#fair-quantitative-risk-reporting) for what a FAIR report contains and how the model counts losses and identities. In the [Generative UI](../user-guide/generative-ui.md), the same FAIR data appears as live workspace widgets — a headline annual-loss figure, the loss distribution, a breakdown of where the loss comes from, the reduction your remediation has delivered, and a quarterly trend — most visibly on the Executive View. Putting risk in dollars is the heart of the [Quantify risk in dollars](../use-cases/quantify-risk-in-dollars.md) use case. ## Where scores appear - **Dashboard** — your organization's overall risk score widget, and the bubble chart where each entity is sized and colored by risk. - **Entity details** — the entity's score, its main risks, and the overlapping entities that share its blast radius. - **Identities & risks table** — every identity in the selected entities, ranked by score, with risk labels. - **Identity details** — the identity's score, its main risks, and the accounts contributing to it. - **Asset lists and asset details** — machine, software, and crypto assets on the [PQC dashboard](../user-guide/pqc-dashboard.md), each with a score and its breakdown tooltip. Scores surface the same way in [Generative UI](../user-guide/generative-ui.md) workspaces: widgets such as risk gauges and trend views render the same scores as the classic dashboards, from the same data. ## Making scores more accurate Scores are only as good as the correlations behind them. **Profiling gaps** — unconfirmed account associations — can leave a score incomplete. Resolving them, or [delegating](./delegation.md) them to someone who can, gives your organization a more accurate score. See [Identities](./identities.md#profiling-gaps) for how to review and resolve profiling gaps. ## Related concepts - [Identities](./identities.md) — how accounts correlate into identities. - [Entities](./entities.md) — how identities group into entities and how risk overlaps between them. - [Delegation](./delegation.md) — assigning a risk to the right person to remediate. - [Your first dashboard view](../getting-started/first-dashboard-view.md) — a walkthrough of where risk surfaces in the dashboard. --- # Audit logging Canonical URL: https://docs.axiad.io/docs/admin-guide/audit-logging Axiad Mesh keeps an audit log of administrative and security-relevant activity in your tenant. Use it to answer who did what, and when — for compliance reporting, access reviews, and troubleshooting. ## Where to find audit logs In the Mesh dashboard, go to **Settings → Config Management → Audit Logs**. The Audit Logs page shows audit records in a table you can review on screen and ## What Mesh audits The list below is a set of documented examples, not a complete catalog of every event type Mesh records. New event types are announced in the [release notes](/release-notes) as they ship. - **Sign-ins.** Successful sign-in entries include a **Role** column showing the role — admin or user — granted at sign-in. Entries where a role doesn't apply, such as non-login events, show `-`. Sessions from users with different roles display correctly in the same view. - **Configuration changes.** Changes to integration settings — for example, ServiceNow connection details — are recorded with who made the change and when. - **Asset exports.** The audit log captures the full lifecycle of every asset export: both the start of the export and its final outcome, success or failure. The entries for one export share the same transaction ID, so you can trace it from start to finish. - **AI assistant interactions.** Interactions with the Mesh AI assistant are recorded in the audit log. - **First-run setup.** On a new environment, first-run sign-ins and the creation of the first tenant are audited. - **Edge agent decommissioning.** Decommissioning an on-premises edge agent is recorded in your audit log. See [Set up an on-prem connector](../connectors/on-prem/set-up-on-prem-connector.md). ## What a record contains Depending on the event type, an audit record includes: - **Actor** — the user who performed the action. For example, each asset export entry is attributed to the user who initiated the export. - **Role** — the role granted at sign-in, where applicable. Entries where a role doesn't apply show `-`. - **Transaction ID** — entries that belong to the same operation, such as the start and outcome of an asset export, share one transaction ID. - **Client IP address** — recorded for asset exports triggered through the API. - **Time** — when the event occurred. ### How timestamps display The **Time** column follows your tenant's timestamp display preference — **Browser Timezone** or **UTC** — which a tenant administrator sets on the tenant detail page in the admin area. The column header reflects the selected time zone, values render in the standardized timestamp format used across the product, and hovering over a timestamp shows the full value if the column is too narrow to display it. ## Exporting audit logs Select **Export** on the Audit Logs page to download the audit log as a CSV file. - The export writes records to the file as they're retrieved, so downloads complete reliably even for wide date ranges and large datasets of more than 15,000 records. - The **Export** button is disabled while an export is running, preventing accidental duplicate exports. - Notifications show that an export is in progress and confirm completion with the number of logs exported. - Records aren't duplicated across page boundaries in the exported file, and running several exports back to back works without errors. > **note** Timestamps in exported CSV files are always in UTC, regardless of your tenant's timestamp display preference. This keeps exported data canonical for downstream processing. ## Retention This documentation doesn't state a fixed retention period for audit logs. Audit records are part of your Customer Data — extraction during the term of your agreement and retrieval after termination are governed by the Customer Data terms in your agreement. For the retention commitments that apply to your organization, refer to your agreement with Axiad or contact your Axiad representative. ## SIEM integration CSV export from the Audit Logs page is the supported way to move audit-log data into external tools today. Mesh doesn't currently document a streaming or API-based delivery mechanism for audit logs. If you need to feed audit logs into a security information and event management (SIEM) system, contact your Axiad representative to discuss your requirements. --- # Manage connector credentials Canonical URL: https://docs.axiad.io/docs/admin-guide/credential-management Every connector authenticates to its source system with credentials that you provide — for example, a client secret for Microsoft Entra ID, an API token for Okta, or a client secret and refresh token for Workday. This page explains how Mesh handles those secrets, how an expired or revoked credential shows up, and how to plan rotation and revocation. ## How Mesh handles connector secrets - **Secret fields are write-only.** Fields such as client secrets and API tokens are never displayed back after you save them. You can replace a stored secret by entering a new value, but you can't view the current one. - **Encryption.** At the platform level, Axiad encrypts sensitive data at rest and in transit — see the [Axiad Trust Center](https://trustcenter.axiad.com/) for Axiad's security controls and documentation. Because Mesh never displays a stored secret, the source system is where you mint a replacement: if a secret is lost, create a new one in the source system and update the connector configuration. > **warning** Microsoft shows an Entra ID client secret **Value** only once, immediately after you create it. Copy it into Mesh before you leave the Microsoft portal — otherwise you need to create a new client secret. For the full walkthrough, see [Complete your Marketplace onboarding](../getting-started/complete-onboarding.md). ## How credential expiry shows up When a credential expires or is revoked in the source system, the connector can no longer authenticate, and data collection stops. Mesh reports this through connector health: - **A connector with bad credentials isn't shown as working.** Mesh verifies credentials with a real authentication check, and a connector is only marked **Enabled** after that check succeeds. - **Microsoft Entra ID.** If authentication stalls after setup, an explicit failure state appears in connector health within 30 seconds, and the error includes the specific error code from Microsoft when available. - **Workday.** Collection failures are recorded, and the reason appears in the connector health view, so you can see why a sync is stuck. > **note** Mesh surfaces authentication failures after they happen. To avoid a gap in collection, record each credential's expiry date in your own rotation calendar and rotate before the credential lapses. ## Rotate a credential on an existing connector Use the following general procedure to replace a secret on a connector that's already configured. The exact field names and buttons vary by connector — see the **Authentication** section on the connector's own page for the fields it uses. 1. Create the replacement credential in the source system first — for example, a new client secret in Entra ID or a new API token in Okta. Where the source system allows overlapping credentials, keep the old one active until Mesh is collecting with the new one. 2. In the Mesh dashboard, open **System configurations > Connectors** and open the configuration of the connector you're updating. 3. Enter the new secret into the write-only secret field. The stored value isn't displayed; the value you enter replaces it. 4. Select **Test connection** and confirm that the test succeeds. 5. Save the configuration, then confirm in connector health that the connector authenticates and the next collection completes without errors. 6. After Mesh collects successfully with the new credential, revoke the old credential in the source system. If anything behaves differently during rotation, contact Axiad support. ## Plan rotation for each source - **Microsoft Entra ID** — you choose a client secret's expiration when you create it, and Microsoft imposes a maximum lifetime. See Microsoft's guide, [Add a client secret](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app#add-a-client-secret), for the current options. For the connector's credential fields, see [Microsoft Entra ID: Authentication](../connectors/idp/microsoft-entra-id.mdx#authentication). - **Okta** — API token lifetime is governed by your Okta organization's policies; rotate on the schedule your policy requires. For the connector's credential fields, see [Okta: Authentication](../connectors/idp/okta.mdx#authentication). - **Workday** — the connector uses an API client secret and a refresh token, and you set the refresh token timeout (in days) when you register the API client. See [Create an API client](../connectors/hr/workday-integration.md#create-an-api-client) and [Generate a refresh token for the API client](../connectors/hr/workday-integration.md#generate-a-refresh-token-for-the-api-client) on the Workday page. When your organization rotates a source system's credentials on a schedule, update the connector in Mesh as part of the same change window so collection resumes promptly. ## Revoke access and disconnect When you decommission a connector or offboard a source system, revoke the credential in the source system as well as removing it in Mesh: 1. Remove the connector from **System configurations > Connectors** in Mesh. 2. Revoke or delete the credential in the source system — for example, delete the client secret (or the whole application registration) in Entra ID, or revoke the API token in Okta. Removing the connector in Mesh doesn't invalidate the credential that the source system issued, so revoking it in the source system ensures it can't be used anywhere. Data that the connector already collected is governed by the Customer Data terms in your agreement with Axiad. For questions about removing collected data for a specific source, contact your Axiad representative. --- # Identity providers Canonical URL: https://docs.axiad.io/docs/admin-guide/identity-providers/ To securely access Axiad Mesh, add the identity providers (IdPs) that contain your users' login and group role information. Your first IdP is typically added during [initial onboarding](../../getting-started/idp-setup.md), so the steps below are needed only if you have multiple IdPs, or multiple domains whose user logins you need to account for. ## Add an identity provider 1. From the homepage, select the **gear icon** to open the **Settings** page. ![Mesh homepage with the gear icon highlighted in the top navigation](/img/imported/identity-providers/settings-gear.png) 2. Select **Identity providers** in the left-side menu. 3. Review your existing IdPs and their status on the **Identity providers** page. 4. Select **+ Add identity provider**. ![Identity providers page listing existing IdPs, with the Add identity provider button](/img/imported/identity-providers/idp-list.png) 5. In the dialog, select the appropriate **Provider** to show the fields needed for the connection. ![Add identity provider dialog with the Provider selection list open](/img/imported/identity-providers/add-idp-provider.png) :::tip Custom provider If the IdP you want to add isn't listed, contact [Axiad Customer Success](mailto:customer.success@axiad.com) to request it as an enhancement. ::: 6. Fill out the required fields, then select **Test Connection**. 7. After the connection test succeeds, select **Add & connect**. 8. The new IdP appears on your **Identity providers** page. ![Identity providers page showing the newly added IdP in the list](/img/imported/identity-providers/idp-added.png) ## Edit an identity provider You can update an existing IdP connection from the **Identity providers** page. 1. On the row of the IdP that you want to edit, select the three-dot menu, then select **Edit**. ![Identity providers page with the row menu open and Edit highlighted](/img/imported/identity-providers/edit-idp-menu.png) 2. In the **Edit identity provider** dialog, make any changes you want, then select **Test Connection**. ![Edit identity provider dialog showing the connection fields](/img/imported/identity-providers/edit-idp-dialog.png) 3. After the connection test succeeds, select **Save**. Your IdP settings are now updated. ## Disconnect an identity provider You can remove an IdP connection from the **Identity providers** page. 1. On the row of the IdP that you want to remove, select the three-dot menu, then select **Disconnect**. ![Identity providers page with the row menu open and Disconnect highlighted](/img/imported/identity-providers/disconnect-idp-menu.png) 2. Confirm the removal by selecting **Disconnect** in the confirmation dialog. :::note To cancel the removal, select **Never mind** in the confirmation dialog. ::: ![Disconnect confirmation dialog with Disconnect and Never mind buttons](/img/imported/identity-providers/disconnect-idp-confirm.png) 3. The IdP connection no longer appears on the **Identity providers** page. ## Provider-specific configuration The pages in this section describe configuration steps for specific IdP integrations that build on the generic processes above — for example, [SailPoint](../../connectors/governance/sailpoint-integration.md), [Okta](../../connectors/idp/okta.mdx), and [Microsoft Entra ID](../../connectors/idp/microsoft-entra-id.mdx). --- # Microsoft Entra ID identity provider integration Canonical URL: https://docs.axiad.io/docs/admin-guide/identity-providers/microsoft-entra-id You can integrate your Microsoft Entra ID identity provider (IdP) with Axiad Mesh to ensure that your users are securely signing in to the portal. The integration requires updates on both Entra ID and Axiad Mesh. ## Entra ID configuration steps > **warning** These steps are Axiad's current understanding of the configuration. Because Entra ID is a third-party product, there may be slight variations between your experience and what this guide describes. We work hard to keep things as up to date as possible, but depending on the versions in use, the latest updates, and so on, there may be some mismatches. If you find any significant differences or anything that doesn't make sense, contact Axiad support so we can update this guide. > **note** The Entra ID steps are similar for both integrations with Axiad Mesh — as an IdP and as a [connector](../../connectors/idp/microsoft-entra-id.mdx). However, it's important that each integration type has its own enterprise application in Entra ID to ensure that the permissions are assigned accordingly. ### Create a new enterprise application 1. Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator. 2. Navigate to **Identity > Enterprise applications**. 3. Select **New application**. 4. On the **Browse Microsoft Entra Gallery** page, select **Create your own application**. 5. In the **Create your own application** pane, set the **Name** to a friendly name. 6. Select **Register an application to integrate with Microsoft Entra ID (App you're developing)**. 7. Select **Create**. ![Create your own application pane in the Microsoft Entra admin center](/img/imported/microsoft-entra-id-idp-integration/entra-create-new-app.png) 8. On the **Register an application** page, set the **Name** to the friendly name. 9. Select **Accounts in this organizational directory only (Single tenant)**. The option label includes your directory name, for example *Eagle 101 only - Single tenant*. :::tip[Axiad recommendation] We recommend that you create and test the integration with Axiad Mesh using a single tenant. Upon success, you can then change this setting to a multitenant environment as needed. ::: 10. Select **Register**. ![Register an application page with the single-tenant account type selected](/img/imported/microsoft-entra-id-idp-integration/entra-register-app.png) ### Configure application properties 1. In the Entra admin center, navigate to **Identity > Enterprise applications > All applications**. 2. Locate and open your newly created application. 3. Under **Manage** in the menu, select **Properties**. 4. Select **Yes** for **Enabled for users to sign-in?**. 5. Select **Yes** for **Assignment required?**. 6. Select **No** for **Visible to users?**. 7. Select **Save**. ![Application properties page with sign-in enabled, assignment required, and visibility disabled](/img/imported/microsoft-entra-id-idp-integration/entra-app-properties.png) 8. Copy the **Application ID** — you need it for the Axiad Mesh configuration steps. ### Configure application owners 1. In the Entra admin center, navigate to **Identity > Applications > Enterprise applications > All applications**. 2. Locate and open your newly created application. 3. Under **Manage** in the menu, select **Owners**. 4. In the **Owners** pane, search for and add the desired application owners. 5. After they're all added, select **Save**. ### Assign users and groups 1. In the Entra admin center, navigate to **Identity > Applications > Enterprise applications > All applications**. 2. Locate and open your newly created application. 3. Under **Manage** in the menu, select **Users and groups**. 4. Search for and select the application users and groups allowed to use Axiad Mesh. ![Users and groups page listing the groups assigned to the application](/img/imported/microsoft-entra-id-idp-integration/entra-app-groups.png) 5. After the users and groups are added, select **Save**. ### Generate a client secret 1. In the Entra admin center, navigate to **Identity > Applications > Enterprise applications > All applications**. 2. Locate and open your newly created application. 3. Under **Manage** in the menu, select **Single sign-on**. 4. On the **OIDC-based Sign-on** page, select **Go to application** in the **Configure application properties** section. 5. Under **Manage** in the menu, select **Certificates & secrets**. 6. Select **New client secret**. 7. On the **Add a client secret** page, provide a **Description**, set **Expires** to the expiration time, and then select **Add**. 8. After the secret is created, copy the **Value** from the **Certificates & secrets** page. :::warning[Important] You can only copy this value immediately after creating it, and it's required for the Axiad Mesh configuration steps. Be sure to copy this value now — you won't have another opportunity, and you would need to create a new client secret instead. ::: ![Certificates and secrets page showing the newly created client secret value](/img/imported/microsoft-entra-id-idp-integration/entra-client-secret.png) ## Axiad Mesh configuration steps > **note** You can integrate your Entra ID IdP with Axiad Mesh in the initial onboarding process as the primary IdP, or as a secondary IdP after you've configured another IdP as the primary IdP. For more information about the initial onboarding process, see the [getting started guide](../../getting-started/index.md). ### Initial onboarding configuration If you're adding Entra ID as your primary IdP during your initial onboarding, complete the following steps. 1. After you open the access link from the Axiad Mesh welcome email, you're prompted to set up your primary IdP. 2. Set the **Domain** to the domain of your Entra ID environment. 3. Select **Microsoft Entra ID** from the **Provider** dropdown. 4. Set the **Microsoft Entra Tenant ID** to the **Tenant ID** of your Entra ID environment. [Learn how to locate your Tenant ID](https://learn.microsoft.com/en-us/entra/fundamentals/how-to-find-tenant). 5. Fill in the fields with the values copied in the Entra ID configuration steps: - Set the **Application (client) ID** to the **Application ID** value copied in [Configure application properties](#configure-application-properties), step 8. - Set the **Client secret value** to the **Value** copied in [Generate a client secret](#generate-a-client-secret), step 8. ![Primary IdP setup form with domain, provider, tenant ID, client ID, and client secret fields](/img/imported/microsoft-entra-id-idp-integration/onboarding-idp-form.png) 6. On the next screen, set the **Admin groups** based on which users you would like to be Axiad Mesh admins when signing in with Entra ID. :::warning[Entra ID group limitations] Only users that are in the groups included in the [Assign users and groups](#assign-users-and-groups) section can access Axiad Mesh. For any groups you add here, be sure that the users are members of any group limitations made in Entra ID. ::: ![Admin groups step of the initial onboarding flow](/img/imported/microsoft-entra-id-idp-integration/onboarding-admin-groups.png) 7. Select **Continue**, and you're signed in to the Axiad Mesh portal for the first time. ### Secondary IdP configuration If you already have your initial IdP connected and need to add a new one, or you need to replace the existing one, you can connect your Entra ID IdP from the Axiad Mesh administrative portal. 1. From the homepage, select the gear icon to open the **Settings** page. ![Axiad Mesh homepage with the settings gear icon highlighted](/img/imported/microsoft-entra-id-idp-integration/settings-gear.png) 2. Select **Identity providers** from the left menu and select **+ Add identity provider**. ![Identity providers settings page with the Add identity provider button](/img/imported/microsoft-entra-id-idp-integration/add-identity-provider.png) 3. On the **Add identity provider** page, set the **Domain** to the domain of your Entra ID environment. 4. Select **Microsoft Entra ID** from the **Provider** dropdown. 5. Set the **Microsoft Entra Tenant ID** to the **Tenant ID** of your Entra ID environment. [Learn how to locate your Tenant ID](https://learn.microsoft.com/en-us/entra/fundamentals/how-to-find-tenant). 6. Fill in the fields with the values copied in the Entra ID configuration steps: - Set the **Application (client) ID** to the **Application ID** value copied in [Configure application properties](#configure-application-properties), step 8. - Set the **Client secret value** to the **Value** copied in [Generate a client secret](#generate-a-client-secret), step 8. 7. Set the **Admin groups** based on which users you would like to be Axiad Mesh admins when signing in with Entra ID. :::warning[Entra ID group limitations] Only users that are in the groups included in the [Assign users and groups](#assign-users-and-groups) section can access Axiad Mesh. For any groups you add here, be sure that the users are members of any group limitations made in Entra ID. ::: ![Add identity provider form filled out for Microsoft Entra ID](/img/imported/microsoft-entra-id-idp-integration/add-identity-provider-form.png) 8. After the fields are filled out, select **Test Connection**. 9. Upon a successful test, select **Add & Connect**. 10. After the setup completes, the new IdP is listed on the **Identity providers** page. ![Identity providers page listing the newly added Entra ID provider](/img/imported/microsoft-entra-id-idp-integration/identity-providers-list.png) --- # Okta identity provider integration Canonical URL: https://docs.axiad.io/docs/admin-guide/identity-providers/okta You can integrate your Okta identity provider (IdP) with Axiad Mesh to make sure that your users sign in to the portal securely. The integration requires updates on both Okta and Axiad Mesh. > **info** This guide covers using Okta to sign in to the Axiad Mesh portal. To collect identity data from Okta for correlation and risk analysis, see the [Okta connector reference](../../connectors/idp/okta.mdx) instead. ## Okta IdP configuration steps > **warning** These steps are Axiad's current understanding of the configuration. Because Okta is a third-party product, there may be slight variations between your experience and what this guide describes. We work hard to keep things as up to date as possible, but depending on the versions in use, the latest updates, and so on, there may be some mismatches. If you find any blatant differences or anything that doesn't make sense, contact Axiad support with feedback on this article. 1. Sign in to your Okta administrative portal and go to **Applications** under the **Applications** menu. 2. Select the **Create App Integration** button. 3. On the **Create a new app integration** page, select **OIDC - OpenID Connect** as the **Sign-in method**. 4. Select **Web Application** as the **Application Type**. ![Okta's Create a new app integration page with OIDC - OpenID Connect selected as the sign-in method and Web Application as the application type](/img/imported/okta-identity-provider-integration/okta-create-app-integration.png) 5. Under **General Settings** on the **New Web App Integration** page, set the **App integration name** to a friendly name, for example **Axiad Mesh**. 6. Enable **Client Credentials** for the **Grant type** option. 7. Add the **Sign-in redirect URI**: - The format for this is `https://mesh.axiad.io/oauth2/callback?domain=`. - Replace `` with the name that matches the UPN domain component — for example, **acme.com** for users such as **johnsmith@acme.com**. - Copy this domain value — you enter it in the **Domain** field during the Axiad Mesh configuration steps. :::tip Multiple domain support You can configure multiple IdP connections in Axiad Mesh to handle multiple domains. ::: 8. Under **Assignments**, select **Limit access to selected groups**, and then specify the groups that are allowed to access Axiad Mesh. - This step is optional but encouraged, to make sure that only the users you want to access Axiad Mesh have the ability to do so. 9. Select **Save**. 10. Copy the following information from the Okta setup to complete the configuration in Axiad Mesh: - Okta Tenant ID - Client ID - Client Secret :::note The **Okta Tenant ID** is the value without the `okta-` prefix, and it shouldn't include the `-admin` suffix. ::: ## Axiad Mesh configuration steps > **note** You can integrate your Okta IdP with Axiad in the initial onboarding process as the primary IdP, or as a secondary IdP after you configured another IdP as the primary IdP. For more information about the initial onboarding process, see [Complete your Marketplace onboarding](../../getting-started/complete-onboarding.md). ### Initial onboarding configuration If you're adding Okta as your primary IdP during your initial onboarding, complete the following steps. 1. After you select the access link in the Axiad Mesh welcome email, you're prompted to set up your primary IdP. 2. Set the **Domain** to the domain value included in the Okta redirect URI (step 7 of the Okta configuration). 3. Select **Okta Single-sign-on** from the **Provider** list. 4. Fill in the fields with the values you copied from the Okta configuration (step 10). ![Initial configurations wizard on the Set up primary IdP step, with Okta Single-sign-on selected as the provider and fields for the Okta tenant ID, Okta client ID, and client secret value](/img/imported/okta-identity-provider-integration/onboarding-idp-okta-fields.png) 5. On the next screen, set the **Admin groups** based on which users you want to be Axiad Mesh admins when they sign in with Okta. :::warning Okta group limitations Only users that are in the groups you selected in step 8 of the Okta configuration can access Axiad Mesh. For any groups you add here, be sure that their members are included in any group limitations made in Okta. ::: ![Initial configurations wizard on the Assign admins step, with the required Admin groups field](/img/imported/okta-identity-provider-integration/onboarding-admin-groups.png) 6. Select **Continue**, and you're signed in to the Axiad Mesh portal for the first time. ### Secondary IdP configuration If you already have your initial IdP connected and need to add a new one, or you need to replace the existing one, you can connect your Okta IdP from the Axiad Mesh administrative portal. 1. From the home page, select the gear icon to open the **Settings** page. ![Axiad Mesh home page with the gear icon highlighted in the upper-right corner](/img/imported/okta-identity-provider-integration/settings-gear-icon.png) 2. Select **Identity providers** from the left menu, and then select **+ Add identity provider**. ![Identity providers page with the Add identity provider button highlighted](/img/imported/okta-identity-provider-integration/identity-providers-add.png) 3. On the **Add identity provider** page, set the **Domain** to the domain value included in the Okta redirect URI (step 7 of the Okta configuration). 4. Select **Okta Single-sign-on** from the **Provider** list. 5. Fill in the fields with the values you copied from the Okta configuration (step 10). 6. Set the **Admin groups** based on which users you want to be Axiad Mesh admins when they sign in with Okta. :::warning Okta group limitations Only users that are in the groups you selected in step 8 of the Okta configuration can access Axiad Mesh. For any groups you add here, be sure that their members are included in any group limitations made in Okta. ::: ![Add identity provider dialog with Okta Single-sign-on selected and fields for the domain, Okta tenant ID, Okta client ID, client secret value, and admin groups](/img/imported/okta-identity-provider-integration/add-identity-provider-okta.png) 7. After the fields are filled out, select **Test Connection**. 8. After a successful test, select **Add & Connect**. 9. When the setup is complete, the new IdP appears on the **Identity providers** page. ![Identity providers page showing the newly added IdP in the list](/img/imported/okta-identity-provider-integration/identity-providers-list.png) --- # Admin Guide Canonical URL: https://docs.axiad.io/docs/admin-guide/ Configuration, tenant management, connector orchestration, job scheduling, and audit. Use the pages in this section for sign-in identity providers, roles and access, credential management, audit logging, and troubleshooting. ## Generative UI availability The [Generative UI](../user-guide/generative-ui.md) dashboard mode (the **Classic | Agentic** toggle and the Workspaces experience) is enabled per tenant and is off by default while it rolls out: - When it's off, users don't see the mode toggle, and opening Workspaces directly shows a "generative dashboard not enabled" message rather than an error. - Enabling it is a tenant-level change — contact your Axiad representative to turn it on for your organization. - Turning it on adds a mode; it changes nothing about your classic dashboards, data, or permissions. This is also summarized in the [Overview](../overview/index.md#generative-ui-availability). --- # Signing in, roles, and access Canonical URL: https://docs.axiad.io/docs/admin-guide/roles-and-access You sign in to Axiad Mesh through your organization's identity provider (IdP) by using single sign-on (SSO). This page explains how signing in works, what the **Admin** and **User** roles can do, how admin access is granted through your IdP groups, and what happens when you sign out. ## How signing in works On the Mesh sign-in page, enter your work email address and continue. Mesh redirects you to your organization's IdP sign-in page, and after you authenticate, you land on the Mesh homepage. ![Axiad Mesh sign-in page with an email address field](/img/imported/end-user-onboarding/login-page.png) ### Dedicated sign-in URLs Your organization can also have its own dedicated sign-in URL, in the form `{tenant}.mesh.axiad.io`. With a dedicated URL, you don't need to enter your organization's domain when signing in, and the URL always takes you to your own organization's tenant. Here's what to expect when you use a dedicated URL: - If you already have an active session with your IdP, opening the URL signs you in silently, with no interaction. - If you don't have an active session, you're taken to your organization's IdP sign-in page and returned to Mesh after you authenticate. - If you have more than one active IdP session, you see the standard account selection screen and sign in with the account you choose. - Bookmarks to the URL keep working after sign-out, session timeout, and later visits. - If your organization's sign-in configuration is incomplete, you see a clear authentication failure message instead of a partial sign-in. When your organization has a dedicated URL, all sign-ins route through it: entering your work email on the generic Mesh URL redirects you to your organization's dedicated URL to complete sign-in. If your organization can't be resolved during sign-in, you see an explicit error page. Organizations without a dedicated URL keep using the generic URL — nothing changes for them. ## Get a dedicated sign-in URL To set up a dedicated sign-in URL for your organization: 1. Contact Axiad support to have the dedicated URL configured. 2. Ask your IdP administrator to add the following redirect URL to the Mesh app registration in your IdP: ```text https://{tenant}.mesh.axiad.io/oauth2/callback?domain={domain} ``` Each dedicated URL is bound to exactly one tenant, with strict isolation between organizations. ## Roles Axiad Mesh has two levels of access: - **Admin** — access to the visualization tool plus settings to manage IdPs, connectors, and users. - **User** — access to the visualization tool only. Your role is granted at sign-in, based on your IdP group membership: members of your organization's nominated admin groups sign in as admins, and everyone else signs in as a user. To see which role was granted for each session, open **Settings > Config Management > Audit Logs** and check the **Role** column: - Successful sign-in entries show the authenticated user's role. - Entries where a role doesn't apply — for example, events other than sign-ins — show "-". This gives your compliance and security teams clear visibility into the privilege level of each session. ## Admin groups Admin access is controlled by the IdP groups your organization nominates as admin groups: - You nominate your first admin groups during [onboarding](../getting-started/complete-onboarding.md). Only members of the nominated groups have admin access, so include a group that you belong to — otherwise you lose admin access once onboarding is complete. - You can add more admin groups at any time after onboarding. If you need to add, remove, or rename your organization's admin groups, contact your Axiad representative for the current procedure. > **note** Because the role is granted at sign-in, changes to admin groups or to a user's group membership take effect the next time that user signs in — not in their current session. ## Sign out and sessions To sign out of Axiad Mesh, select your name in the top-right corner and select **Sign out**. ![The user menu in the top-right corner, open to show the Sign out option](/img/imported/end-user-onboarding/sign-out.png) Signing out of Mesh also ends your IdP session. This works with Microsoft Entra ID, Okta, and other OpenID Connect-compliant IdPs. - After you sign out, you're returned to the Mesh sign-in page. - Opening Mesh again requires you to sign in — either by selecting an account or by entering credentials. Silent re-authentication after sign-out isn't possible. - Silent sign-in for normal visits is unchanged; only signing out ends the IdP session. > **tip** Always sign out when you finish working on a shared or public computer. Because signing out ends both your Mesh session and your IdP session, the next person to open Mesh can't be silently signed back in as you. ## If you're locked out If you can't sign in to Axiad Mesh — for example, after a change to your IdP configuration or your admin groups — contact Axiad support. ## Axiad personnel access to your tenant Axiad limits its own personnel's access to your data through the access management controls documented in the [Axiad Trust Center](https://trustcenter.axiad.com/): - Axiad personnel are provisioned with access to Customer Data based on need-to-know criteria and the least-privilege principle. - User identifiers are unique and readily identifiable to the Axiad personnel they're assigned to; Axiad personnel never use shared or group user IDs to access Customer Data. - Axiad personnel use phishing-resistant, hardware-based multi-factor authentication. - Axiad periodically reviews whether personnel who have access to Customer Data still require it. --- # Troubleshooting and getting help Canonical URL: https://docs.axiad.io/docs/admin-guide/troubleshooting-and-support This page collects the most common issues Axiad Mesh administrators run into — sign-in and onboarding, connectors, and exports — along with how to check service status and what to include when you contact Axiad. ## Sign-in and onboarding issues ### You see a "Things are getting set up" page after signing in If you sign in and land on a **Things are getting set up** page instead of the dashboard, nothing is wrong with your account. This page appears while your organization's connectors are still being configured. Once connectors are integrated and sharing data, the homepage displays your identity ecosystem visualization instead. ![The Things are getting set up page, shown while connectors are still being configured](/img/imported/end-user-onboarding/things-getting-set-up.png) If you're a standard user, check with your Mesh administrator on the state of connector setup. If you're the administrator, see [Connectors & Integrations](../connectors/index.md) to add your first connector. ### Your onboarding welcome link has expired The sign-in link in your Axiad welcome email is tied to a temporary account and expires. If the link expires before you complete your initial configuration, contact Axiad for a new one. For the full first-time setup flow, see [Admin onboarding](../getting-started/admin-onboarding.md). ### Problems with the onboarding email verification code Opening an onboarding link presents a verification screen before onboarding starts. A 6-digit code is sent to the same email address the link was issued to. - The code expires after about 10 minutes. If it expires before you enter it, request a new code — you don't need a new onboarding link. - After three failed code attempts, the link is invalidated. Contact Axiad support or request a new onboarding link. - The link and code are consumed together once onboarding starts — neither can be reused. ### Your session expired mid-task If your session expires while you're working, sign back in. After you authenticate, you return to the page you were on — including asset list and asset details pages — and can pick up where you left off. ### Your organization can't be resolved at sign-in If your organization uses a dedicated sign-in URL (in the form `{tenant}.mesh.axiad.io`) and Mesh can't resolve your organization during sign-in, you see an explicit error page rather than a silent fallback to the generic sign-in. If this happens, contact Axiad support — dedicated sign-in URLs are configured by Axiad. ## Connector issues ### Start with connector health Connector health is your primary diagnostic for data-collection problems: - **Authentication failures** surface the specific error returned by the source system. For Microsoft Entra ID, this includes the error code from Microsoft when available. - If **Entra ID authentication stalls** after setup, an explicit failure state appears in connector health within 30 seconds. - **Workday sync failures** record the reason in connector health, so you can see why a Workday sync is stuck. A connector is marked **Enabled** only after authentication actually succeeds, so an Enabled connector has authenticated at least once. If a connector fails its configuration test while you're setting it up, the error text tells you what to fix. ### A connector stops collecting The most common cause of a previously working connector that stops collecting is an expired credential, such as a client secret or API token that reached the end of its validity period in the source system. Check connector health for the authentication error, then rotate the credential — see [Manage connector credentials](./credential-management.md). ### Users deleted in Entra ID still appear in Mesh Deletions in Microsoft Entra ID propagate to Axiad Mesh: after each successful full synchronization, users no longer present in Entra ID are marked **Terminated**, and risk findings for Terminated users are cleared automatically. Two things to know about this safety net: - It runs only after a complete, successful full synchronization — never after a partial or incremental one. If a deletion hasn't propagated yet, wait for the connector's next full synchronization. - It only affects users from that specific connector. Users from other connectors are never touched. If users deleted in Entra ID still appear as Active after your connector has completed a full synchronization, contact Axiad support. ### On-premises collection through the edge agent For systems collected through the Axiad edge agent, check the agent before the connector: 1. In **Settings → On-prem agents**, check the agent's status. The [status table](../connectors/on-prem/set-up-on-prem-connector.md#step-4--wait-for-the-agent-to-come-online) explains what **Unenrolled**, **Enrolled**, **Stale**, and **Decommissioned** mean. 2. If the agent isn't healthy, work through the [edge agent troubleshooting table](../connectors/on-prem/run-the-edge-agent.md#troubleshooting) with your agent operator — it maps common symptoms (permission errors, expired enrollment tokens, blocked outbound connections) to fixes. ## Export issues - **An export seems stuck or you can't start another one.** While an export is running, the **Export** button is disabled and notifications show that the export is in progress. When it completes, a notification confirms the number of records exported. - **An export fails with a temporary error.** After a temporary service error, the export checks the actual job status instead of declaring failure. If an export is already running, its status is displayed. You can retry after a temporary error — you're never left without a way to retry. - **You need to trace a failed export.** The audit log records both the start of every export and its final outcome, success or failure. The entries for one export share the same transaction ID, so you can trace it from start to finish. Each entry is attributed to the user who initiated the export, and exports triggered through the API also record the client IP address. ## Checking service status The Axiad Mesh status page is at [https://status.mesh.axiad.io/](https://status.mesh.axiad.io/). - It's public and read-only — no sign-in is required. - It ignores browser cookies entirely, so it loads reliably from any network, including corporate networks where cookies from other sites accumulate. - From inside the product, select your name or avatar to open the user menu and select **Axiad Mesh Status**. The link opens in a new browser tab, so your current session is preserved. For current availability and incident information, check the status page directly. ## Contacting Axiad - **New connector or identity provider requests.** If the connector you need isn't listed, contact [Axiad Customer Success](mailto:customer.success@axiad.com) to request it as an enhancement. - **Account and tenant changes.** Contact Axiad support — through your Axiad account team or the support contact in your agreement — for: - A dedicated sign-in URL for your organization. - A replacement onboarding link, or help after a verification-code lockout. - Changing your organization's default dashboard (Human Identity or Non-Human Identity). ### What to include in a support request The more precisely you can point at the problem, the faster it gets resolved. Include: - **Your tenant or organization name**, and your dedicated sign-in URL if you have one. - **What you did and when.** Note that timestamps in CSV exports are always UTC, regardless of your tenant's timestamp display preference — say which time zone your times are in. - **Transaction IDs** from the relevant audit-log entries, so Axiad can trace the exact operation. - **The exact error text from connector health**, including any source-system error code (for example, a Microsoft error code from Entra ID). --- # End-user onboarding Canonical URL: https://docs.axiad.io/docs/user-guide/end-user-onboarding Welcome to Axiad Mesh! As a first-time user, this is what you can expect. > **note** This is the onboarding experience for a **Standard** Mesh user (no administrative privileges in Axiad Mesh). If you're an admin user, see the [Admin Guide](../admin-guide/index.md) instead. You can sign in to Axiad Mesh by using the step-by-step guide below. ## First-time sign-in To kick off your Axiad journey, you'll have access to the Axiad Mesh environment set up by your admins. You'll receive an invite email from Axiad with a link that takes you directly to the web application. 1. From the Axiad welcome email, select the sign-in link, which opens a web browser. 2. On the sign-in page, enter your email address and select **Next**. ![Axiad Mesh sign-in page with an email address field and a Next button](/img/imported/end-user-onboarding/login-page.png) 3. After you authenticate through your identity provider (IdP), you land on the Axiad Mesh homepage. Depending on how much your admins have completed, you could immediately see the bubble chart visualization, or you may see a **Things are getting set up** page. ![The Things are getting set up page, shown while connectors are still being configured](/img/imported/end-user-onboarding/things-getting-set-up.png) :::note Subsequent sign-ins Once the connectors are integrated, the homepage displays your identity ecosystem visualization so you can instantly see the overview of your environment. ::: ![Axiad Mesh homepage showing the identity ecosystem bubble chart visualization](/img/imported/end-user-onboarding/homepage-visualization.png) 4. To sign out of Axiad Mesh, select your name in the top-right corner and select **Sign out**. ![The user menu in the top-right corner, open to show the Sign out option](/img/imported/end-user-onboarding/sign-out.png) ## Welcome to Axiad Mesh Once your Axiad Mesh dashboard is set up, you can quickly get the information you need, with options to dig deeper into each entity, identity, and potential risk. ### Mesh widgets On the left-hand side of the application, you can see the quick-reference widgets that give you an immediate snapshot of your environment and the world of cybersecurity. ![The quick-reference widgets: overall risk score, highest risks, and industry news feed](/img/imported/end-user-onboarding/mesh-widgets.png) The first widget is your organization's **overall risk score**. Mesh generates it by compiling the individual risk scores from identities, applications, credentials, behavior, and other sources into a top-level rating. Scores range from 1 to 100, with 100 being the riskiest. Here, you can also address **profiling gaps** (that is, unconfirmed account associations) to get a more accurate risk score for your organization. The next widget details your organization's **highest risks** to help you understand why you have the score that you have. You can then use this information to improve your security posture and simultaneously lower your risk score. The last widget includes an **industry news feed** to give you an immediate heads-up on the latest happenings in the cybersecurity world. ### Bubble chart overview The main bubble chart visualization is made up of *entities*, each with their own risk score and organized by level of riskiness, with the highest risk bubbling up at the top. An entity could be an application, location, authentication method, department, or something else that spans your environment. From here, you can hover over each bubble to get a preview of the assessment, or select an entity to get complete information about it, including risk score details, associated identities, potential blast radius, and more. You can also group entities together to see how they overlap and what risks are possible with those relationships. > **tip** Check out more articles within the [User Guide](./index.md) to see how you can turn this high-level overview into remedial actions. --- # Frequently asked questions Canonical URL: https://docs.axiad.io/docs/user-guide/faq ## Do I need an account to read these docs? No. This documentation site is fully public. You need a Mesh account only to use the product itself. ## How does Mesh decide an identity is risky? Mesh runs pluggable risk engines against correlated identity data (accounts, entitlements, activity, and external signals such as breach exposure). Each engine emits signals with a severity, and the dashboard ranks identities so you can triage the most important items first. See [Your first dashboard view](../getting-started/first-dashboard-view.md). ## How often is data refreshed? Each connector collects on its configured schedule. Risk engines evaluate the correlated data after collection, so new signals may take a collection cycle or two to appear. ## Which systems can I connect? Connectors are organized by category (identity providers, HR, ITSM, cloud & directory, endpoint). Browse [Connectors & Integrations](../connectors/index.md) for the current list and per-connector prerequisites. ## Where do I report a documentation issue? Documentation is maintained as code. Open a pull request or issue against the `mesh_docs_svc` repository. --- # Generative UI Canonical URL: https://docs.axiad.io/docs/user-guide/generative-ui Axiad Mesh has two dashboard modes. In **Classic** mode you navigate fixed dashboards. In **Agentic** mode you describe the view you want, and the Mesh agent composes it for you: a **workspace** of live widgets assembled on a canvas, built from the same tenant data the classic dashboard shows. > **note** Agentic mode is enabled per tenant and is off by default while it rolls out. If the mode toggle doesn't appear in your header, or Workspaces reports that the generative dashboard isn't enabled, ask your administrator — see [Generative UI availability](../admin-guide/index.md) in the Admin Guide. ## Switching modes A **Classic | Agentic** toggle sits in the app header. Selecting **Agentic** takes you to **Workspaces**; selecting **Classic** returns you to the dashboard you know. The toggle is pure navigation — your browser's back and forward buttons work, no preference is stored, and nothing is lost in either direction. Use the mode that suits the task at hand. ## Composing a workspace A new workspace starts with a single question: **"What report do you want to generate?"** Type what you need in your own words — for example "Compose a board briefing on our identity risk posture" — or start from a starter chip such as **CISO board briefing**, **CFO risk exposure**, or **SOC incident summary**. The Mesh agent selects widgets from a curated catalog and lays them onto the canvas — placeholders appear immediately and fill with live data. Widgets stream in one at a time as the agent decides on each, and a short plain-language note explains what it added and why. For example, asking for a post-quantum readiness report composes a workspace like this: ![A PQC Readiness workspace composed by the Mesh agent, with a readiness index gauge, discovery coverage, quantum-vulnerable asset breakdown, and migration priorities](/img/generative-ui/pqc-readiness-workspace.png) Two properties of this design are worth knowing: - **The agent composes; it doesn't sit between you and your data.** Once a widget is on the canvas, it renders and refreshes directly from your tenant data. Refreshes are fast and deterministic, and the numbers match what the classic dashboards show. - **If your request is ambiguous, the agent asks.** Rather than guessing, it presents option cards so you choose the direction before it composes. ### How composition stays fast and repeatable The agent runs **once**, at compose time — the slow, generative step where it reads your request and decides which widgets to place. Everything after that is deterministic: refreshing a widget, clicking to drill in, or re-running a query goes straight to your data with no AI in the loop. That's why a composed workspace behaves like a normal dashboard once it exists, and why two people who open the same workspace see the same numbers. A composed report holds **at most five widgets** — if you ask for "everything," the agent composes the five most important angles and offers more in a follow-up. The agent can only place widgets that already exist in the catalog and can only read data through pre-approved queries; it never writes its own queries, invents a widget, or reaches another user's or tenant's data. ### When the agent asks first When a request could reasonably mean more than one thing, the agent stops and shows a **choice card** above the composer instead of guessing. There are two kinds: - **Which view do you mean?** A short question with two to four suggested interpretations as buttons — for example, "Top risk programs by score" versus "Top compliance programs by coverage." A **Something else…** field lets you phrase your own. - **Which widget do you want?** When your words map to more than one valid widget — "programs" could mean security programs or a software inventory, "graph" could mean the identity graph or a risk-trend chart — the buttons name the candidate widgets so you can pick the one you meant. Your choice is recorded in the conversation and drives the next composition. The agent asks, then waits — nothing is composed until you answer. ### Persona workspaces Three ready-made workspaces cover common roles, so you can start from a composed view instead of a blank canvas. Selecting a persona chip composes its view instantly and reliably — the same set of widgets every time: - **Executive View** — posture and trend at leadership altitude: the organization risk score, a 90-day risk-score trend, the [Daily Briefing](#the-daily-briefing), total [annual loss exposure](../concepts/risk-scoring.md#from-scores-to-loss-estimates), tracked [Programs](../concepts/programs.md), and the loss reduction your remediation has delivered. - **Audit & Compliance** — framework coverage, a control-coverage heatmap, and a cyber-insurance readiness score. - **Security Operations** — the identity risk cluster, top findings, the top attack path (kill chain), the identity-exposure breakdown, and an inventory of the autonomous AI agents active in your tenant. ![The Executive View persona workspace, showing organization risk score, total annual loss exposure, tracked programs, the risk score trend, and the morning briefing](/img/generative-ui/executive-view.png) ### The widget catalog Every widget the agent places comes from a **curated, platform-wide catalog** of around three dozen widget types. They span the domains Mesh reports on: identity risk (risk-score gauge, trend, top findings, risk-bubble cluster), compliance and audit (framework coverage, control heatmap, insurance readiness), financial risk quantification (the annual-loss-expectancy family of widgets), attack paths (the kill-chain walkthrough), and non-human and agentic-AI inventory. Because the catalog is curated, every placed widget renders your real data rather than numbers the agent made up. You don't have to go through the agent to add one. The **+ Add widget** palette lets you browse the whole catalog grouped by category and drop a widget onto the canvas yourself. Each widget carries a small freshness label so you always know how current its data is: **live** for real-time, per-entity lookups, and **as of <date>** for views built from a daily rollup. Promoting a frozen snapshot into a live, refreshing widget is always something *you* do (see [Snapshot, live, and curated](#snapshot-live-and-curated)) — the agent never does it silently. ### The Daily Briefing The **Daily Briefing** (shown on the Executive View) is a once-a-day, scannable summary of what changed across your identity-risk posture overnight and what needs attention today. An overnight rollup compares today against yesterday and produces an ordered list — movements in your organization risk score, newly flagged findings, notable day-over-day changes in finding volume, and dark-web credential exposures. Because it's computed on a schedule and cached per day, everyone in your organization sees the same briefing, and it isn't rewritten by the AI on every page load. The card splits into two groups: **Needs attention** items that call for a decision, above informational **FYI** items. A colored dot marks each item's severity. On a Needs-attention item, an action button **prefills the workspace chat** with a suggested follow-up — for example, a request to open a remediation ticket — for you to review and send. It never sends on its own and never takes an action directly; you stay in control of the handoff. ## Working with a workspace - **Drill in with focus frames.** Select a row, card, or finding and it opens as a **focus frame** — a full-screen view on top of the canvas, composed of detail widgets scoped to the one thing you clicked. Drilling is deterministic: the click maps to a pre-defined layout, so the same click always opens the same set of detail widgets and the AI isn't involved. See [Investigations](../concepts/investigations.md) for what each drill contains. - **Pivot without leaving.** The frame header shows an editable **subject pill**. Retype the subject and the whole frame re-binds to it — a fast way to jump from one identity or finding to the next. - **Only the relevant filters follow you in.** A frame inherits just the filters its layout declares (a time range, a department), shown as inherited; editing them affects the frame only. - **Step back out** with the frame's Back button, the browser Back button, or the Escape key. The breadcrumb trail lets you pop to any depth. - **Talk to the agent.** The conversation panel covers the whole workspace; each widget also has its own chat drawer for questions scoped to that widget. Widget conversations last for your session and aren't saved. ![A widget conversation in a workspace: the risk score trend widget is selected and the agent answers "Where are the largest spikes or drops in this trend?" with a table of the largest swings and their causes](/img/generative-ui/widget-chat.png) - **Inspect any widget.** The Inspector opens a tabbed view so you can trust a number before you put it in front of others: - **Overview** — what the widget is, its data source, its rung (see below), and who composed it and when. - **Query** — the pre-approved query the widget runs. - **Audit** — a timeline of changes, such as when the widget was promoted. - **Promote** — the **Make live** action, available when the widget is a frozen snapshot. ### Snapshot, live, and curated A composed widget sits on one of three rungs, and the Inspector always shows which: 1. **Snapshot** — a frozen, one-off answer that won't refresh. 2. **Live** — bound to a data source and refreshing on demand. This is the default for widgets the agent composes. 3. **Curated** — a platform- or tenant-blessed template that anyone can reuse. You move a widget up the ladder with **Make live** (snapshot → live); admins curate views for the whole tenant. The agent always defaults to a live widget and never promotes one silently — promotion is your decision. ## Organizing and sharing - **Pin** the workspaces you return to; the left rail keeps **Pinned** and **Recents** groups so your important views stay one click away. - **Share** a workspace when it's ready: workspaces start private to you and can be shared with your organization. - **Save as template** so others can start from your composition with their own view of the data. - **Turn a drill-in into its own workspace.** From a focus frame, **Pin as workspace** saves the drilled-in view as a first-class workspace; an admin can **Save as template** to make that drill layout reusable across the tenant. - **Deep link** to a workspace view — including a drilled-in focus frame — with a stable URL you can bookmark or paste into a ticket. ## The classic dashboard isn't going away Both modes coexist. The fixed navigation, the bubble chart overview, and the [PQC dashboard](./pqc-dashboard.md) all work as before, and everything in this User Guide that describes the classic dashboard remains accurate. Many teams live in classic dashboards for routine monitoring and compose workspaces for briefings, reviews, and investigations. ## Permissions, data handling, and auditing The generative experience follows the same rules as the rest of Mesh: - You only see data your account is permitted to see, and your organization's data stays fully isolated. - Personal data is tokenized before any AI request leaves the platform and restored in responses — see [AI features and data handling](../overview/ai-features-data-handling.md). - AI interactions are recorded in the [audit log](../admin-guide/audit-logging.md). ## Current limitations - Per-widget conversations aren't saved — they last for your session. - Some widgets may show limited data while their sources finish rolling out in your tenant. - Availability is per tenant during the rollout, and details of the experience may evolve — new capabilities are announced in the [release notes](/release-notes). --- # User Guide Canonical URL: https://docs.axiad.io/docs/user-guide/ How to use the Mesh dashboard day to day: signing in, navigating views, reading risk signals, and running investigations. Welcome to Axiad Mesh! As a first-time user, this is what you can expect. > **note** This is the onboarding experience for a **Standard** Mesh user (no administrative privileges in Axiad Mesh). If you're an admin setting up Mesh for your organization, see the [Getting Started](../getting-started/index.md) walkthroughs and the [Admin Guide](../admin-guide/index.md). ## First-time sign-in To kick off your Axiad journey, you have access to the Axiad Mesh environment set up by your admins. You receive an invite email from Axiad with a link that takes you directly to the web application. 1. From the Axiad welcome email, select the sign-in link, which opens a web browser. 2. On the sign-in page, enter your email address and select **Next**. 3. After you authenticate through your identity provider (IdP), you land on the Axiad Mesh homepage. Depending on how much your admins have completed, you could immediately see the bubble chart visualization, or you may see a **Things are getting set up** page. > **note** Once the connectors are integrated, the homepage displays your identity ecosystem visualization so you can instantly see the overview of your environment. To sign out of Axiad Mesh, select your name in the top right corner and select **Sign out**. ## Welcome to Axiad Mesh Once your Axiad Mesh dashboard is set up, you can quickly get the information you need, with options to dig deeper into each entity, identity, and potential risk. ### Mesh widgets On the left-hand side of the application, quick reference widgets give you an immediate snapshot of your environment and the world of cybersecurity. - The first widget is your organization's **overall risk score**. Mesh generates it by compiling the individual risk scores from identities, applications, credentials, behavior, and other sources into a top-level rating. Scores range from 1 to 100, with 100 being the riskiest. Here, you can also address **profiling gaps** (unconfirmed account associations) to get a more accurate risk score for your organization. - The next widget details your organization's **highest risks** to help you understand why you have the score that you have. You can use this information to improve your security posture and simultaneously lower your risk score. - The last widget is an **industry news feed** that gives you an immediate heads-up on the latest happenings in the cybersecurity world. ### Bubble chart overview The main bubble chart visualization is made up of *entities*, each with its own risk score and organized by level of riskiness, with the highest risk bubbling up at the top. An entity could be an application, location, authentication method, department, or something else that spans your environment. From here, you can hover over each bubble to get a preview of the assessment, or select an entity to get complete information about it, including risk score details, associated identities, potential blast radius, and more. You can also group entities together to see how they overlap and what risks are possible with those relationships. > **tip** Continue with the other pages in this section, such as the [FAQ](./faq.md), or follow [Investigate a risky identity](../getting-started/investigate-risky-identity.md) to turn this high-level overview into remedial actions. --- # PQC dashboard: The crypto-vulnerable asset overview Canonical URL: https://docs.axiad.io/docs/user-guide/pqc-dashboard Axiad Mesh tracks the machines, software, and cryptographic assets in your environment and their exposure to post-quantum cryptography (PQC) risk. The **Crypto-vulnerable asset overview** — the PQC dashboard — is where you browse those assets, understand why each one carries risk, and act on what you find. ## Two dashboards, one switch Mesh has two primary dashboards, and the **Identify** switch toggles between them: - **Identity risk assessment** — human identities: the people in your organization and the accounts, credentials, and entities correlated to them. - **Crypto-vulnerable asset overview** (the PQC dashboard) — the machine, software, and crypto assets in your environment and the risks they carry. Mesh remembers whether your organization works primarily in the identity or asset dashboard and takes you there when you sign in, so you don't have to pick a dashboard on every visit. You can still switch dashboards at any time during a session — the redirect only happens once, at sign-in. To change the default dashboard for your organization, contact Axiad support. The **Identify** switch is separate from the **Classic | Agentic** dashboard mode toggle: Identify chooses which classic dashboard you're on, while the mode toggle switches between classic dashboards and [Generative UI](./generative-ui.md) workspaces. In Agentic mode, the same crypto estate can be composed as a workspace — for example an operator view with discovery coverage, compliance status, algorithm lifecycle, and crypto-agility breakdowns: ![An Operator workspace in Generative UI showing discovery coverage, compliance status, NIST security-strength categories, algorithm lifecycle, and a crypto-agility heatmap](/img/generative-ui/operator-workspace.png) ## Asset types The asset inventory covers three asset types, each with its own tab in the asset list. The same three types are available programmatically through the [Analytics OData API](../api-reference/analytics-odata.mdx): | Asset type | What it covers | OData entity set | |---|---|---| | Machine | Machines in your environment; key attributes include the operating system version | `MachineAssets` (entity type `MachineAsset`) | | Software | Software products, with a version and a normalized product name | `SoftwareAssets` (entity type `SoftwareAsset`) | | Crypto (certificate) | Certificates and other cryptographic elements | `CryptoElements` (entity type `CryptoElement`) | ## The asset list Each asset type has its own list. All three lists behave the same way. ### Sorting Every column is sortable, in ascending or descending order. Each asset tab keeps its own sort state — sorting one tab doesn't affect the others — and your sort state is preserved when you page through results or navigate back in the browser. ### Status column The Status column appears directly after the asset name and shows the current lifecycle status of each asset, sourced from your ServiceNow CMDB integration. The available values depend on the asset type and on what the source system reports. Assets with no reported status show **Unknown**, and Unknown always sorts last, keeping assets that need attention easy to triage. ### Key attributes Alongside the name, status, and risk score, the asset list and the asset details view show these attributes: | Attribute | Applies to | Description | |---|---|---| | OS Version | Machine assets | The machine's operating system version (for example, 10.0.19045) | | Version | Software assets | The software product's version (for example, 2.3.1) | | Product | Software assets | The normalized product name | | Mesh unique asset ID | All asset types | A stable identifier assigned by Mesh | | External ID | All asset types | The asset's identifier in the source system | If an attribute isn't populated for an asset, the column shows a dash (`-`). OS Version and Product values depend on data from your connected sources and can show a dash until the next connector sync completes. ### Advanced Filters An **Advanced Filters** box on each asset tab lets you narrow the list with column-based filters from a single place: - Filter controls match each column's data type: text search, dropdown, or range. - The table updates in real time as you apply filters. - A single reset control clears all applied filters at once. - Active filters are clearly indicated and stay applied until you reset them, including across data refreshes. - If no assets match, an empty state appears with an option to reset the filters. - Filtering handles mixed or incomplete column data gracefully: invalid values are ignored, and unknown values are grouped at the end. **OS Version** (Machine assets) and **Version** (Software assets) are available as filter fields. Both use text matching — contains, equals, matches one of a list, and is-empty checks — consistent with how they sort. There is no version-aware greater-than or less-than comparison. Each field applies only to its own asset type and is marked not applicable on other tabs. The NHI dashboard, the asset lists, and the asset details page share one filter area with the same interaction model, and your filter selections carry across NHI screens for the rest of your session — drilling into a detail page doesn't drop your context. ## Asset details Select an asset to open its details page. ### Risk score breakdown Point to the asset's risk score to see why the asset has its score. The tooltip breaks the score down into: - A header: "The asset's score reflects:" - One line per direct risk category on the asset, with its count — for example, "Risks associated to this asset: No owner (3)" - A summary of inherited risks — for example, "Risks inherited from 38 correlated assets (190)" Severity is conveyed by the color of the score. The same tooltip appears on the asset list and on the asset details page, so a score means the same thing in both views. ### The Risks section The Risks section of the asset details page explains each risk tag on the asset: - **Simple risks** state the condition plainly — for example, "This asset has no assigned owner" or "This asset is not linked to any hardware asset." - **Policy-based risks**, such as noncompliance with a post-quantum cryptography (PQC) policy, show the outcome of the policy assessment, the specific attributes that didn't comply, and the name of the policy that triggered the tag. Each tag opens its own explanation. Long explanations open in a dismissible dialog, and if risk data is missing for an asset, a generic explanation is shown. ### Certificate details For crypto assets, certificate cards display the **Subject DN**, **Serial Number**, **Issuer DN**, **Signature Algorithm**, **Key Size**, and **Owner**. Together these fields let you uniquely identify each certificate — including certificates that share the same subject — and match it to records in external systems such as ServiceNow. ### Correlated assets The Correlated Assets section lists the assets correlated to the one you're viewing, in a table that matches the main asset list: - Sort and filter on all relevant columns, with pagination when an asset has many correlations. - Correlated assets are grouped into Software, Certificate, and Machine tabs, with a filtered count reported for each tab — including tabs with zero matches. - A **Filters** button next to the section header opens the same filter dialog you use on the main asset list, with the same five categories: Risk, Platforms, Owners, Organizations, and Locations. Active filters render as chips that you can remove individually or clear all at once. - Filters applied here are scoped to the Correlated Assets section and kept separate from the main asset list filters. They persist as you switch tabs and as you move from asset to asset during the same session. ## Risk tags Risk tags label the individual risks on an asset: - Tags are shown without the asset-type suffix — for example, "PQC noncompliant" rather than "PQC noncompliant: Crypto". The asset type is visible elsewhere on the page. - Hover over a tag in the asset list for a summary tooltip. Open the full explanation from the Risks section on the asset details page. - Examples of tags you might see include **PQC noncompliant**, **No owner**, **No linked asset**, and **Insufficient information**. The exact set depends on the risk conditions Mesh detects and the risk policies configured for your organization. For questions about policy configuration, such as PQC compliance policies, contact your Axiad representative. ## Take action from asset details The asset details page offers two actions: - **Delegate investigation** — assign the investigation of the asset to a teammate. See [Delegate remediation](../concepts/delegation.md). - **View in ServiceNow** — open the matching record in ServiceNow, signing you in through single sign-on. If the ServiceNow integration isn't enabled for your tenant, the button is disabled with a message that says so. ## Export asset data You can export from any NHI asset screen. When you start an export, Mesh asks you to choose: - **All data** — exports the full dataset, regardless of any active filters. - **Filtered data** — exports only the records matching your active filters, so the export reflects exactly what you filtered for on screen. Exports and downloaded files always use UTC timestamps, regardless of your tenant's timestamp display setting, so shared data stays consistent. While an shown. For more on report generation and export formats, see [Reports and exports](./reports-and-exports.md). --- # Reports, exports, and data retrieval Canonical URL: https://docs.axiad.io/docs/user-guide/reports-and-exports Axiad Mesh gives you several ways to get data out of the platform: - **CSV exports** from dashboard asset screens and the audit log. - **FAIR reports** for quantitative risk analysis. - The **Analytics OData API** for BI and analytics tools. - **Bulk retrieval** of your Customer Data during and after your agreement. ## CSV exports from the dashboard Asset screens include an **Export** action that downloads the data as a CSV file. ### All data or filtered data When you export from a non-human identity (NHI) asset screen, Mesh asks you to choose between **All data** and **Filtered data**, and the export matches your choice exactly: - **Filtered data** contains exactly the records that match your active filters, including any Advanced Filters applied on the asset list. What you filter is what you export. - **All data** contains the full dataset for that screen, regardless of any active filters. This removes any ambiguity about whether an export reflects the on-screen view or the full dataset. If you need a scoped export, build the filter set first, then choose **Filtered data**. ### Large exports Export queries are optimized for large exports, so they complete promptly even for tenants with large asset or identity inventories. ### Export progress and retries While an export runs, the **Export** button is disabled and the job's progress is shown. If an export is already running, its status is displayed instead of an error message. If a temporary service error occurs while an export starts, the export enters a verifying state and checks the actual job status instead of declaring failure. You're never left without a way to retry: once the earlier job has genuinely finished or failed, you can start the export again. ## Timestamps in exports Tenant administrators can choose how timestamps display in the dashboard — in each viewer's browser time zone or in UTC. That preference affects the interface only: > **note** CSV exports and downloaded files always use UTC, regardless of the tenant timestamp display preference. If a downstream pipeline parses timestamps from Mesh exports, treat every exported timestamp as UTC — the display preference never changes exported data. This keeps exported data canonical for downstream processing, no matter how individual viewers have timestamps displayed. ## Export accountability Every export is recorded in the audit log, from start to finish: - Both the initiation of an export and its final outcome — success or failure — are logged. - The entries for one export share the same transaction ID, so you can trace an export from start to finish. - Each entry is attributed to the user who initiated the export. - For exports triggered through the API, the client IP address is also recorded. This gives you full accountability for export operations and lets you troubleshoot failed exports directly from the audit log. For more on working with audit logs, see the [Admin Guide](../admin-guide/index.md). The audit log itself also exports to CSV: records are written to the file as they're retrieved, so downloads complete reliably even for wide date ranges and datasets of more than 15,000 records. Records aren't duplicated across page boundaries, and running several exports back to back works without errors. ## FAIR quantitative risk reporting Mesh can generate a full FAIR (Factor Analysis of Information Risk) report, enabling quantitative risk analysis based on the industry-standard FAIR methodology. You generate the report for a chosen scope of assets and consume the results directly from the dashboard. A full FAIR report includes: - **Annualized Loss Expectancy (ALE)** quantification with risk-factor breakdowns. - **Impact views** at the aggregate level and per asset block. - **Export-ready output** for further analysis outside Mesh. The exact steps to generate a report depend on your tenant configuration. If you don't see FAIR reporting in your dashboard, contact your Axiad representative. ### Open FAIR v3.0 terminology FAIR reporting uses Open FAIR v3.0 standard terminology, so reports stay consistent with the language risk stakeholders expect: | Label in Mesh | Former label | | --- | --- | | Loss Magnitude (LM) | Single Loss Expectancy (SLE) | | Loss Event Frequency (LEF) | Annual Rate of Occurrence (ARO) | Existing reports adopt the current labels automatically, with no breaking changes for existing integrations. ### How the model counts losses and identities - **Primary loss forms** scale with the number of affected identities. - **Secondary loss forms** — competitive advantage, fines and judgments, and reputation — apply once per breach event, not once per identity, as the Open FAIR standard requires. - **Each unique identity is counted once** across all risk rules. If several risk rules flag the same people, those people aren't double-counted in the loss calculation. The model's input assumptions and constants aren't documented here. For details about how the figures are derived for your environment, contact your Axiad representative. ## Programmatic access: The Analytics OData API For BI and analytics tools, Mesh provides a read-only, tenant-isolated OData v4 API. You can query it with standard OData options — for example from Power BI Desktop via **Get Data → OData Feed**. The API currently covers these entity sets: - `MachineAssets` — machine assets - `SoftwareAssets` — software assets - `CryptoElements` — cryptographic elements - `NhiAssets` — non-human identity assets See the [Analytics OData API reference](../api-reference/analytics-odata.mdx) for authentication, entity types, and supported query options. ## Retrieving your data in bulk **During the term of your agreement**, you can extract Customer Data from the Service using the mechanisms described on this page — dashboard CSV exports and the Analytics OData API. **On termination or expiration**, upon your written request made before the effective date of termination, Axiad makes a file of your Customer Data available for download, at no cost, for 30 days following the end of the agreement's term. The file is provided in an industry-standard format — for example, JSON or CSV. After the 30-day period, Axiad has no obligation to maintain or provide the data and may delete it unless legally prohibited. Retention periods for collected identity and audit data during the term are governed by your customer agreement — refer to your agreement or contact your Axiad representative for specifics. For Axiad's security and compliance documentation, see the [Axiad Trust Center](https://trustcenter.axiad.com/). --- # Achieve post-quantum readiness Canonical URL: https://docs.axiad.io/docs/use-cases/crypto-agility Post-quantum migration is a discovery-and-ownership problem before it is a cryptography problem. You can't migrate what you can't see, and you can't fix what no one owns. Axiad Mesh drives the whole cycle: **ingest** your cryptographic estate, **correlate** which cryptography lives in which software on which machines and who owns it, **assess** what's quantum-vulnerable against policy, **notify** the owner, and track the fix as your teams **remediate** it in your own systems. The [PQC dashboard](../user-guide/pqc-dashboard.md) is where this lives in the product; this page is the lifecycle behind it. ## 1. Ingest Mesh builds its picture of your cryptographic estate from two lanes: - **Your inventory.** Certificates, **certificate templates**, software assets, and machine assets are brought in through Mesh's offline import — you (or an upstream discovery tool) publish inventory files and Mesh collects them on a schedule. Certificate templates carry the algorithm and key-usage profile of your certificate authority, which matters for the next step. - **Software cryptographic profiles.** For the software your organization actually runs, Mesh produces a per-product cryptographic profile: the algorithms it uses, its certifications (such as FIPS 140-2/140-3 and Common Criteria), any deprecated primitives it still relies on, and a post-quantum readiness assessment framed against the NIST migration horizon. This turns a bare software list into a map of the cryptography inside it. ## 2. Correlate Discovery is only useful if the pieces connect. Mesh links your crypto estate together: - **Certificate → its cryptography.** A certificate inherits its algorithm and key-usage profile from the **certificate template** it was issued under — so importing your CA's templates makes each certificate's crypto attributes appear automatically, without hand-tagging. - **Certificate → machine.** Each certificate records the machine it's installed on. - **Software → machine, and software → its cryptography.** Software assets carry their own algorithm, deprecation, and certification data. The result is the answer to the question migration actually turns on: *which certificate, using which algorithm, lives in which software, on which machine.* You explore these links in the **Software / Certificate / Machine** correlation tabs on an asset's detail view. ## 3. Assess Mesh evaluates every certificate, key, software, and machine asset against your [cryptographic policies](../concepts/policies.md) in real time. A policy marks each algorithm **preferred**, **acceptable**, **deprecated**, or **prohibited**, optionally with a migration deadline — so a post-quantum baseline can say classical public-key algorithms are acceptable today but prohibited after a target year, while post-quantum algorithms are already preferred. Assets that use a deprecated or prohibited algorithm pick up a **PQC noncompliant** risk, and every crypto asset carries an owner — a missing one surfaces its own **No owner** risk, because an unowned certificate is one nobody will migrate. Grouped into a framework, these roll up to a post-quantum compliance percentage and the vulnerable-by-algorithm breakdown you see on the [post-quantum Program](../concepts/programs.md). ![A post-quantum readiness workspace in Axiad Mesh Generative UI showing discovery coverage, compliance status, NIST security-strength categories, algorithm lifecycle, and a crypto-agility heatmap](/img/generative-ui/operator-workspace.png) ## 4. Notify A finding with an owner is a task; a finding without one is a dead end. Mesh routes crypto-agility work to the responsible owner through [delegation](../concepts/delegation.md): the assignee receives a direct notification with the scope of the work, your notes, and a link that takes them straight to the asset and its resolution steps — they don't need to know Mesh to act on it. ## 5. Remediate The actual rotation or reissuance happens in **your** certificate authority or certificate-lifecycle system — Mesh is the system of insight and coordination that tells you *what* to rotate, *why*, and *who* should do it, and then verifies it happened. Mesh discovers the vulnerable asset, prioritizes it by the [loss exposure](../concepts/risk-scoring.md#from-scores-to-loss-estimates) it carries, assigns it to the owner, and deep-links to the record in your CMDB — but it does not itself issue or rotate certificates. Once your team rotates the certificate or migrates the software in its own system, Mesh reflects the fix the way it learns everything else — on the next collection cycle the asset is re-evaluated, the PQC-noncompliant risk clears, and your [risk score](../concepts/risk-scoring.md) and the post-quantum Program's progress recalculate. That closes the loop: discover → assign → migrate in your system → verified as resolved. ## Why this matters Crypto agility isn't a one-time project — algorithms deprecate, standards move, and the post-quantum transition will unfold over years. Because Mesh continuously ingests, correlates, and re-assesses, your post-quantum readiness stays a live number rather than a point-in-time audit, and the moment a policy changes — a new prohibited algorithm, a nearer deadline — the assets that just fell out of compliance light up on their own. ## Related - [PQC dashboard](../user-guide/pqc-dashboard.md) — the product surface for crypto assets. - [Policies](../concepts/policies.md) — the algorithm rules behind the assessment. - [Programs](../concepts/programs.md) — tracking the migration as an initiative. - [Remediation](../concepts/remediation.md) and [Delegation](../concepts/delegation.md) — assigning and resolving the work. --- # Govern non-human and agentic identities Canonical URL: https://docs.axiad.io/docs/use-cases/govern-nonhuman-identities Non-human identities — service accounts, API keys, workload identities, certificates, secrets — already outnumber human accounts in most environments, often many times over. Now AI agents are joining them, acting on their own and frequently running on credentials no one has audited. They're where the least-watched risk hides, because the tools built for human users weren't built to see them. ## Bring them into view Axiad Mesh treats non-human identities as first-class. It correlates and scores service accounts, machine identities, certificates, and AI agents the same way it does human users — so they appear in the same [risk model](../concepts/risk-scoring.md), ranked against everything else rather than living in a blind spot. For AI agents specifically, Mesh maintains an inventory of the autonomous agents active in your tenant — what each one is, who owns it, where it came from, and the risk it carries — so the agents operating in your environment are accounted for instead of invisible. ![An NHIs-by-type inventory in Axiad Mesh Generative UI, listing non-human identities across kinds — workload identities, AI agents, service principals, RPA bots, managed identities, OAuth apps, service accounts — each with a risk score and dormant and no-owner counts, beside a widget chat answering which are unowned](/img/generative-ui/nhi-by-type.png) ## Score the risk that's specific to them Non-human identities fail in their own ways, and Mesh scores for it: a dormant service account, an over-provisioned workload identity, an expiring or weakly-signed certificate, an agent with standing access it rarely uses. Because these roll into the same dollar-ranked model as everything else (see [Quantify risk in dollars](./quantify-risk-in-dollars.md)), a risky machine identity can — and often should — outrank a human finding. ## Find the owner and drive the fix The hardest part of a non-human identity is that no one remembers owning it. Mesh tracks ownership on every asset and surfaces a **No owner** risk when it's missing, because an unowned credential is one nobody will rotate. From there the standard [remediation](../concepts/remediation.md) paths apply — guided steps, delegation to the right owner, or automated external remediation — so a finding becomes an assigned, tracked task instead of a dead end. ## Related - [Identities](../concepts/identities.md) — human and non-human, correlated the same way. - [Risk scoring](../concepts/risk-scoring.md) — how non-human risk is measured. - [Remediation](../concepts/remediation.md) — assigning and resolving the work. - [Crypto agility](./crypto-agility.md) — the certificate side of non-human identity, end to end. --- # Use Cases Canonical URL: https://docs.axiad.io/docs/use-cases/ The [Concepts](/docs/concepts) explain the individual ideas in Axiad Mesh. These pages put them to work — the outcomes customers run Mesh for, end to end. - **[Quantify risk in dollars](./quantify-risk-in-dollars.md)** — turn a flat list of findings into a ranked set of decisions by putting a financial figure on each risk, so you act on the handful that matter most. - **[Unify the identity sprawl](./unify-identity-sprawl.md)** — correlate every account, credential, and access level scattered across your systems back to a single identity, and see the relationships you didn't know you had. - **[Govern non-human and agentic identities](./govern-nonhuman-identities.md)** — bring the service accounts, workload identities, and AI agents that outnumber your people into view, and manage the risk they carry. - **[Achieve post-quantum readiness](./crypto-agility.md)** — discover your cryptographic estate, find what's quantum-vulnerable and who owns it, and drive migration. - **[Prove continuous compliance](./prove-continuous-compliance.md)** — measure your posture against frameworks and policies continuously, and show movement rather than a point-in-time snapshot. Each use case works in both the classic dashboards and the agent-composed [Generative UI](../user-guide/generative-ui.md) — the concepts are identical in either mode. --- # Prove continuous compliance Canonical URL: https://docs.axiad.io/docs/use-cases/prove-continuous-compliance Compliance is usually a snapshot: a report assembled for an audit, accurate the day it's produced and drifting from that moment on. Axiad Mesh treats it as a **live measurement** instead — your posture against a framework is a number that updates as your environment changes, so you can prove where you stand today and show movement over time. ## Policies that evaluate continuously Mesh evaluates your identities and assets against [policies](../concepts/policies.md) — the rules that define what's acceptable, from cryptographic algorithm choices to identity-hygiene expectations. Evaluation runs continuously: when an asset changes and on a regular schedule, so a violation is caught as it appears and clears on its own once it's fixed. The result is a posture that reflects reality now, not the last time someone ran a scan. ## Roll policies up into frameworks Individual violations are hard to report on; a **framework** makes them board-ready. Policies group into a named framework — for example a NIST post-quantum baseline — that gives each asset a **compliance percentage** and a severity band, so you can see not just individual gaps but how far along a whole standard you are. One framework is active per category at a time, so you get a single authoritative score to report rather than competing ones. ## See it, and share it The **Audit & Compliance** [persona workspace](../user-guide/generative-ui.md#persona-workspaces) composes this into a view built for exactly this conversation: framework coverage, a control-coverage heatmap, and a cyber-insurance readiness score. It's the picture you hand to an auditor, a regulator, or an insurer — and because it reads live data, it's current every time you open it. ![An Audit & Compliance workspace in Axiad Mesh Generative UI, with a control-coverage heatmap scoring MITRE, PCI-DSS, NIST, and ISO across authentication, authorization, non-human, and privileged controls, and a cyber-insurance readiness score of 92 percent weighted across six pillars](/img/generative-ui/audit-compliance-workspace.png) ## Show movement, backed by an audit trail Continuous measurement is what lets you show *movement* — a coverage percentage climbing quarter over quarter as remediation lands — instead of a flat attestation. And every action behind that movement is recorded: Mesh keeps an [audit log](../admin-guide/audit-logging.md) of what changed, so the story you tell an auditor is backed by evidence rather than assertion. ## Related - [Policies](../concepts/policies.md) — the rules and frameworks behind the score. - [Achieve post-quantum readiness](./crypto-agility.md) — the most developed compliance surface today. - [Audit logging](../admin-guide/audit-logging.md) — the evidence trail. - [Generative UI](../user-guide/generative-ui.md) — the Audit & Compliance workspace. --- # Quantify risk in dollars Canonical URL: https://docs.axiad.io/docs/use-cases/quantify-risk-in-dollars Your visibility tools already surface hundreds of findings. The hard part isn't finding them — it's knowing which ones actually matter. A 1–100 severity score tells you *how bad*; it doesn't tell you *how much*. When everything is flagged urgent, nothing gets fixed. Axiad Mesh turns that flat list into a ranked set of decisions by putting a **dollar figure** on each risk. ## From score to money Alongside the [risk score](../concepts/risk-scoring.md), Mesh quantifies risk using the industry-standard **FAIR** model, expressed as an **annual loss expectancy** — the yearly financial exposure a risk represents. See [From scores to loss estimates](../concepts/risk-scoring.md#from-scores-to-loss-estimates) for how the model works. This covers every kind of identity, not just people: the financial cost of a compromised human, machine, or agent identity is scored the same way, so a service account with broad access and weak credentials can rank above a low-privilege human account even if its raw severity looks similar. ## Rank, don't triage Because each risk carries a dollar figure, Mesh can **rank** them by impact instead of leaving you to triage a flat list. You act on the handful of risks that reduce the most exposure, and Mesh **rescores dynamically** as your environment changes — so the priority list stays current instead of going stale the moment it's generated. ## Put it in front of the board In an agent-composed [workspace](../user-guide/generative-ui.md), quantification appears as a family of live widgets: a headline annual-loss figure, a probabilistic loss distribution, a breakdown of where the loss comes from, the reduction your remediation has already delivered, and a quarterly trend. The **Executive View** persona workspace leads with these, so a CISO can put risk in the language a board understands — money and movement, not a longer list of findings. ![An Executive View workspace in Axiad Mesh Generative UI, leading with the organization risk score, total annual loss exposure, tracked programs, the risk trend, and the morning briefing](/img/generative-ui/executive-view.png) ## Close the loop Quantification isn't the end — it's what makes prioritization honest. From the ranked list you drive [remediation](../concepts/remediation.md), and as fixes land, the loss figure and its trend come down on the next collection cycle. That turns "we have a lot of findings" into "we reduced exposure by this much this quarter." ## Related - [Risk scoring](../concepts/risk-scoring.md) — the scores and FAIR loss model. - [Remediation](../concepts/remediation.md) — acting on the ranked list. - [Generative UI](../user-guide/generative-ui.md) — the Executive View that leads with dollars. --- # Unify the identity sprawl Canonical URL: https://docs.axiad.io/docs/use-cases/unify-identity-sprawl One person is rarely one account. They're an HR record, a directory user, a handful of application logins, a VPN certificate, maybe a privileged account they forgot about. Multiply that across your workforce, your contractors, and the machine identities that outnumber them, and you have **identity sprawl** — access scattered across systems that no single tool sees whole. You can't secure what you can't see as one thing. ## Correlate accounts back to one identity Axiad Mesh connects to your identity providers, HR systems, cloud platforms, and infrastructure and correlates every account into a single [identity](../concepts/identities.md). A person or a service spread across half a dozen systems shows up as **one** entity, with all its accounts, credentials, and access levels in view — including the sprawl you didn't know you had, surfaced by pointing out gaps and matches in your data. Identities then group into [entities](../concepts/entities.md) — teams, departments, functions — so you can see risk by part of the organization, not just per account. ## See the relationships that create risk Sprawl matters because weakness in one place undermines strength in another. Mesh doesn't score a single account on a single application in isolation — it looks at one identity across many applications, and many identities across many applications with different credential types, to see how a compromise in any one place could cascade. If a user is protected by a FIDO2 authenticator in one system but signs in to another with only a password, how secure is the first system once an attacker has that password? Mesh surfaces exactly these relationships. The [identity graph](../concepts/investigations.md#the-identity-graph) draws the neighborhood around any identity — the accounts correlated to it and the access that chains through it — and highlights the paths that carry the most risk. ![The identity blast-radius graph in Axiad Mesh Generative UI, centered on an agentic identity whose offboarded human owner still chains through a group and resources to a production data store, with the critical path and ownership edge highlighted and a risk-layer score breakdown below](/img/generative-ui/identity-graph.png) ## You stay in control of correlation Correlation is a judgment, and Mesh keeps it transparent. Strong matches are grouped automatically; weaker ones are flagged for review rather than assumed. When Mesh isn't sure, it shows you the two accounts **side by side** with the details behind the match, so you can decide whether they're really the same identity — and **confirm** or **reject** the correlation yourself. If a call needs someone with more context, you can [delegate](../concepts/delegation.md) it. The unified view of an identity stays accurate because the uncertain calls are made by a person, not assumed by the system. ## Related - [Identities](../concepts/identities.md) — how correlation works and how to review it. - [Entities](../concepts/entities.md) — grouping identities to see organizational risk. - [Investigations](../concepts/investigations.md) — the identity graph and drilling into relationships. --- # Offline connector Canonical URL: https://docs.axiad.io/docs/connectors/custom-offline/offline The **Offline connector** brings data into Axiad Mesh from **files** rather than a live API. Use it when a source system has no connector of its own, when the data is produced by an internal tool or export, or when a system can't be reached directly from Mesh — but you can still publish its data as files. It's also the path for **cryptographic inventory**: certificates, certificate templates, software, and machine assets that feed [post-quantum readiness](../../use-cases/crypto-agility.md) often arrive this way. ## How it works You publish your data as **JSON files** and give Mesh a single **index file** — a plain list of the file locations, one per line. On each collection cycle, Mesh reads the index, fetches every listed file, and ingests its records. To add or refresh data, update the files and the index; Mesh picks up the changes on the next cycle. Each record in a file declares: - the **source** the data came from, - the **category** of records it contains, and - the **entities** themselves. ## What you can import The Offline connector ingests the same kinds of entities a live connector would, including: - **Identities and access** — users, groups, group memberships, applications, resources, credentials, and organizational structure such as departments and locations. - **Cryptographic assets** — certificates, certificate templates, software assets, and machine assets. These populate the [PQC dashboard](../../user-guide/pqc-dashboard.md) and drive the [crypto-agility](../../use-cases/crypto-agility.md) lifecycle, where Mesh correlates which software uses which certificate on which machine, and who owns it. ## When to use it Reach for the Offline connector when: - the source system has no direct connector and no reachable API; - data is exported or generated by an internal or third-party tool; - you're piloting with a data sample before wiring a live integration; or - you're bringing in a cryptographic inventory produced by a discovery process. For systems that *do* expose a REST API, the [Universal REST connector](../universal-rest.md) is usually the better fit — it collects live, on a schedule, without you maintaining files. ## Set it up The exact file format and the fields each category expects depend on your data. To set up an Offline import — including where to host the files and the index — contact [Axiad Customer Success](mailto:customer.success@axiad.com), who will provide the templates and walk you through it. ## Related - [Universal REST connector](../universal-rest.md) — for systems with a live API. - [Crypto agility](../../use-cases/crypto-agility.md) — the end-to-end lifecycle Offline-imported crypto assets flow into. - [Connectors & Integrations](../index.md) — the full connector catalog. --- # SailPoint Connector Integration Canonical URL: https://docs.axiad.io/docs/connectors/governance/sailpoint-integration Integrate SailPoint as a connector in Axiad Mesh to retrieve user, application access, credential, and entitlement data. This gives Mesh broad visibility into the non-identity-centric applications that SailPoint provisions identities to or draws identity information from. Setting up the integration has two parts: configure a new API client in SailPoint, then add SailPoint as a connector in the Mesh administrative portal. ## Prerequisites - Administrative access to your SailPoint portal, with permission to create an API client. - A Mesh administrator account with permission to manage connectors. - Your SailPoint **Tenant ID**. ## Step 1 — Create a SailPoint API client > **warning** These steps reflect Axiad's current understanding of the SailPoint configuration. Because SailPoint is a third-party product, there may be slight variations between your experience and what this guide describes. We work hard to keep things as up to date as possible, but depending on the versions and updates in use, there may be some mismatches. If you find any significant differences or anything that doesn't make sense, please share feedback with Axiad support. To create a new API client, complete the following steps in the SailPoint administrative console: 1. In the SailPoint portal, go to **Admin → Global → Security Settings**. 2. On the **Security Settings** page, select **API Management** in the side menu. 3. Select **+ New**. 4. Enter a friendly name for the **Description**. 5. Check the **Client Credentials** and **Refresh Token** boxes. 6. In the **Refresh Token** list, choose how long the token should be valid. 7. Add the following **Scopes**: - `idn:identity:read` — view identities. - `sp:auth-user:read` — view user authentication system details. - `sp:scopes:all` — grant access to all rights associated with the user's or system's capabilities. 8. Select **Create**. 9. Copy the **Client ID** and **Client Secret** values. You'll enter them in Mesh in the next step. > **warning** The **Client ID** and **Client Secret** won't be available after you close the window. If you don't copy them now, you'll need to create another new API client and copy those values instead. ## Step 2 — Add the connector in Mesh You can add SailPoint as a connector from the Mesh administrative portal. 1. From the homepage, select the gear icon to open the **Settings** page. 2. On the **Connectors** page, select **Add connector** — in the middle of the page if this is your first connector, or in the upper right of the screen. 3. In the dialog, set **Name** to a friendly name. This name appears on the **Connectors** page. 4. Select **SailPoint** from the **Provider** list. 5. Select your **Instance Type** from the list: - **FedRAMP** — your SailPoint deployment is a FedRAMP instance. - **Custom** — you have a custom domain for your SaaS SailPoint deployment. - **Commercial** — you have a standard enterprise SailPoint deployment. 6. Set the **SailPoint Tenant Identifier** to your SailPoint **Tenant ID** value. 7. Set the **SailPoint Client Identifier** to the **Client ID** value you copied from SailPoint. 8. Set the **SailPoint Client Secret** to the **Client Secret** value you copied from SailPoint. 9. Once all values are provided, select **Test connection**. 10. Following a successful test, select **Add & connect** to complete the configuration. ## Verify - Your SailPoint connector appears on the **Connectors** page. --- # HR system connectors Canonical URL: https://docs.axiad.io/docs/connectors/hr/ Your HR system is the authoritative record of who works for your organization. Connecting it gives Mesh a trusted anchor for identity correlation: worker records confirm who a person is, where they sit in the organization, and whether they're still employed. ## Why connect an HR system - **Anchor correlation.** HR records give Mesh a reliable, person-level source to correlate accounts against, improving correlation quality and reducing profiling gaps. See [Identities](../../concepts/identities.md). - **Catch joiners, movers, and leavers.** Employment status from HR lets Mesh spot accounts that outlive the people they belong to — a leaver whose accounts are still active, or a mover who kept access their new role doesn't need. Stale and orphaned accounts are among the risk signals Mesh flags. See [Risk scoring](../../concepts/risk-scoring.md). - **Attribute ownership.** Knowing who owns what — and which department or location they belong to — lets Mesh group risk by [entity](../../concepts/entities.md) and route [delegated remediation](../../concepts/delegation.md) to the right person. ## Available HR connectors - **Workday** — available today. See the [Workday setup guide](./workday-integration.md). - **TriNet** — supported. Add it from the connector list in the dashboard. ## Expanding HRIS coverage Mesh is expanding its HR information system (HRIS) coverage so that all widely used HR platforms can connect through an integration partnership. Availability varies by platform and rolls out over time. To ask about a specific HRIS, contact [Axiad Customer Success](mailto:customer.success@axiad.com). For the full list of systems Mesh connects to, see the [integration catalog](../integration-catalog.md). --- # Workday connector integration Canonical URL: https://docs.axiad.io/docs/connectors/hr/workday-integration Integrate Workday as a connector in Axiad Mesh to bring in the user data needed to fill out your environment and let Axiad find correlations, risks, and gaps in your population. To set up Workday as a connector, first configure Workday for API access, then add it as a connector in the Mesh administrative portal. ## Workday configuration steps > **warning** These steps reflect Axiad's current understanding of the configuration. Because Workday is a third-party product, there may be slight variations between your experience and what this guide describes. We work hard to keep things as up to date as possible, but depending on the versions in use and the latest updates, there may be some mismatches. If you find any significant differences or anything that doesn't make sense, let us know through Axiad support. To configure Workday for API access, complete the following steps. You can then add Workday as a connector in Axiad Mesh. ### Create an Integration Systems User and security group 1. In Workday, create an **Integration Systems User (ISU)** and set up its credentials. 2. Create an **Integration Systems Security Group (Unconstrained)**. 3. Bind the newly created ISU to the new security group. ![Workday Integration Systems Security Group configuration](/img/imported/workday-connector-integration/workday-security-group.png) 4. Add **Domain Security Policies** to the **Integration Systems Security Group** as follows: - Under **Domain Security Policies permitting View access**, add **View: Supervisory Organization**. - Under **Domain Security Policies permitting Get access**, add: - **Manage: Location** - **Manage: Organization Integration** - **Worker Data: Current Staffing Information** - **Worker Data: Public Worker Reports** ![Workday domain security policy permissions for the security group](/img/imported/workday-connector-integration/workday-domain-permissions.png) ### Create an API client 1. In Workday, locate the **Register API Client for Integration** task. :::warning Important Be sure to select **Register API Client for Integration** rather than just **Register API Client**. Axiad Mesh requires the former because it uses the OAuth 2.0 Client Credentials grant flow. ::: 2. Set the **Client Name** to a friendly name that's meaningful to the integration. 3. Set the **Client Grant Type** to **Authorization Code Grant**. 4. Check the **Support Proof Key for Code Exchange (PKCE)** option. 5. Set the **Access Token Type** to **Bearer**. 6. Set the **Redirect URI** to a syntactically valid URL. The integration doesn't use this value, but the client configuration requires one. 7. Set the **Refresh Token Timeout** to your preferred number of days. 8. Check the **Grant Administrative Consent** option. ![Workday Register API Client for Integration form](/img/imported/workday-connector-integration/workday-api-client.png) 9. Select the scopes that this API client can access. The required scopes are: - **Organization and Roles** - **System** 10. Check the **Include Workday Owned Scope** option. 11. Complete the creation, then copy the **Client ID** and **Client Secret** values. You need them for the Axiad Mesh configuration steps. ### Generate a refresh token for the API client 1. In Workday, locate the **View API Clients** report. 2. In the **API Clients for Integrations** tab, locate your newly created API client. 3. Click the three-dot menu button next to the client's name, hover over **API Client**, and then click **Manage Refresh Tokens for Integrations**. 4. In the **Workday Account** field, add the **ISU** account that you created in [Create an Integration Systems User and security group](#create-an-integration-systems-user-and-security-group). ![Workday Manage Refresh Tokens for Integrations dialog](/img/imported/workday-connector-integration/workday-refresh-token.png) 5. Click **OK** to generate the refresh token. 6. Copy the refresh token to use in the Axiad Mesh configuration steps. ## Axiad Mesh configuration steps You can add Workday as a connector easily from the Mesh administrative portal. 1. From the homepage, click the gear icon menu button to open the **Settings** page. ![Mesh homepage with the Settings gear icon](/img/imported/workday-connector-integration/mesh-settings-gear.png) 2. On the **Connectors** page, click the **Add connector** button — either in the middle of the page if this is your first connector, or in the top-right side of the screen. ![Mesh Connectors page with the Add connector button](/img/imported/workday-connector-integration/mesh-add-connector.png) 3. In the pop-up window, set the **Name** to a friendly name that appears on the **Connectors** page. 4. Select **Workday** from the **Provider** dropdown. 5. Set the **Workday tenant** to the Workday **Organization ID**. :::tip Retrieve your Workday Organization ID You can find the Organization ID in the URL of your Workday console, or by clicking the user icon in the top right, selecting **My Account**, and then selecting **Organization ID**. Copy that value and paste it into the **Workday tenant** field. ::: 6. Set the **Workday API `client_id`** and **Workday API `client_secret`** fields to the values that you copied in the final step of [Create an API client](#create-an-api-client). 7. Set the **Workday API `refresh_token`** to the value that you copied at the end of [Generate a refresh token for the API client](#generate-a-refresh-token-for-the-api-client). ![Mesh Add connector dialog with the Workday configuration fields](/img/imported/workday-connector-integration/mesh-workday-connector-config.png) 8. After you provide all the values, click the **Test connection** button. 9. Following a successful test, click **Add & connect** to complete the configuration. Your Workday connector now appears on the **Connectors** page. --- # Identity provider connectors Canonical URL: https://docs.axiad.io/docs/connectors/idp/ Your identity provider is the anchor data source for identity correlation: Mesh reads users, groups, and sign-in signals from it and correlates them with accounts from every other connected system. This section covers IdPs as **data connectors** — the reference pages and setup guides for pulling identity data into Mesh. If you are looking for how your organization **signs in to Mesh** with an identity provider, that is a separate configuration: see [Identity providers (sign-in)](/docs/admin-guide/identity-providers) in the Admin Guide. To add an IdP connector, follow [Connect your identity provider](/docs/getting-started/idp-setup) in Getting Started, then use the pages here for provider-specific configuration detail. --- # Microsoft Entra ID Canonical URL: https://docs.axiad.io/docs/connectors/idp/microsoft-entra-id The Microsoft Entra ID (formerly Azure AD) connector brings directory identities, group memberships, and sign-in signals into Axiad Mesh. As an identity-provider connector, it is typically the first connector you configure. ## Prerequisites - A Mesh administrator account with permission to manage connectors. - An Entra ID tenant with the ability to register an application. - Directory read and audit-log read permissions. ## Authentication Mesh authenticates as a registered application using the client-credentials flow: 1. Register an application in Entra ID. 2. Grant the required Microsoft Graph read permissions. 3. Create a client secret and record the client ID and tenant (directory) ID. Provide the client ID, tenant ID, and client secret in the connector configuration. Secret fields are write-only. ## Capabilities ## Data model The connector maps Entra ID users to Mesh identities, and groups/roles to entitlements, which the risk engines then evaluate. ## Setup 1. Complete **Authentication** above. 2. In **Admin → Connectors**, add the **Microsoft Entra ID** connector. 3. Enter the credentials and configure the collection schedule. 4. Save and run an initial collection. ## Troubleshooting - **Authentication failed** — verify the client secret has not expired and the app has the required Graph permissions with admin consent granted. - **No sign-in data** — confirm the audit-log read scope is present. --- # Okta Canonical URL: https://docs.axiad.io/docs/connectors/idp/okta Okta Workforce Identity — users, groups, group memberships, sign-in events ## Prerequisites - A Mesh administrator account with permission to manage connectors. - Credentials for authentication: Token (stored write-only). ## Authentication **Method:** Bearer token Mesh authenticates with a bearer token. | Field | Required | Secret | Description | | --- | --- | --- | --- | | `Token` | Yes | Yes (write-only) | | ## Capabilities ## Data model ### User accounts - `display_name` - `email` - `id` - `identity_key` - `job_title` - `principal` - `status` ### Groups & membership - `description` - `id` - `identity_key` - `name` ### Entitlements & relationships - `identity_key` - `object_category` - `object_key` - `relationship_type` - `subject_key` ### Sign-in / audit events ## Setup 1. Complete authentication as described above. 2. In Admin → Connectors, add the connector and enter its configuration. 3. Save and run an initial collection. ## Troubleshooting _This information is not yet available from the connector schema._ --- # Set up the Microsoft Entra ID connector Canonical URL: https://docs.axiad.io/docs/connectors/idp/set-up-microsoft-entra-id Integrate Microsoft Entra ID as a connector in Axiad Mesh to get the user data necessary to fill out your environment and for Axiad to find correlations, risks, and gaps in your population. The integration requires updates on both Entra ID and Axiad Mesh. For an overview of what this connector collects, see the [Microsoft Entra ID connector reference](./microsoft-entra-id.mdx). ## Entra ID configuration steps > **warning** These steps are Axiad's current understanding of the configuration. Because Entra ID is a third-party product, there may be slight variations between your experience and what this guide describes. We work hard to keep things as up to date as possible, but depending on the versions in use, the latest updates, and so on, there may be some mismatches. If you find any blatant differences or anything that doesn't make sense, contact Axiad support so we can update this article. > **note** The Entra ID steps are similar for the integration as an identity provider and as a connector with Axiad Mesh; however, it's important that each integration type has its own enterprise application in Entra ID to ensure that the permissions are assigned accordingly. ### Create a new enterprise application 1. Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator. 2. Go to **Identity > Enterprise applications**. 3. Select **New application**. 4. On the **Browse Microsoft Entra Gallery** page, select **Create your own application**. 5. In the **Create your own application** pane, set the **name** to a friendly name. 6. Select **Register an application to integrate with Microsoft Entra ID (App you're developing)**. 7. Select **Create**. {/* screenshot: Entra admin center — "Create your own application" pane with the app-registration option selected (original image EntraCreateNewApp.png is no longer available) */} 8. On the **Register an application** page, set the **Name** to the friendly name. 9. Select **Accounts in this organizational directory only ( - Single tenant)**. :::tip Axiad recommendation We recommend that you create and test the integration with Axiad Mesh using a single tenant. Upon success, you can then change this setting to a multitenant environment as needed. ::: 10. Select **Register**. {/* screenshot: Entra admin center — "Register an application" page with single-tenant account type selected (original image EntraRegisterApp.png is no longer available) */} ### Configure application properties 1. In the Entra admin center, go to **Identity > Enterprise applications > All applications**. 2. Locate and open your newly created application. 3. Under **Manage** in the menu, select **Properties**. 4. Select **Yes** for **Enabled for users to sign-in?** 5. Select **Yes** for **Assignment required?** 6. Select **No** for **Visible to users?** 7. Select **Save**. {/* screenshot: Enterprise application Properties page with the sign-in, assignment, and visibility settings (original image EntraAppProperties(2).png is no longer available) */} 8. Copy the **Application ID** — you need it in the Axiad Mesh configuration steps later in this guide. ### Generate a client secret 1. In the Entra admin center, go to **Identity > Applications > Enterprise applications > All applications**. 2. Locate and open your newly created application. 3. Under **Manage** in the menu, select **Single sign-on**. 4. On the **OIDC-based Sign-on** page, select **Go to application** in the **Configure application properties** section. 5. Under **Manage** in the menu, select **Certificates & secrets**. 6. Select **New client secret**. 7. On the **Add a client secret** page, provide a **Description**, set **Expires** to the expiration time, and then select **Add**. 8. After the secret is created, copy the **Value** from the **Certificates & secrets** page. > **warning** You can only copy this value immediately after creating it, and it's required for the Axiad Mesh configuration steps. Be sure to copy this value now, because you won't have another opportunity — otherwise you need to create a new client secret instead. {/* screenshot: Certificates & secrets page showing the new client secret and its Value column (original image EntraClientSecret.png is no longer available) */} ### Add API permissions 1. From the **Certificates & secrets** page, select **API permissions** under the **Manage** menu item. 2. Select **Add a permission**. 3. On the **Request API permissions** page, select **Microsoft Graph**. 4. Select **Application permissions** for the type of permissions required. 5. Under **Select permissions**, search for and select `Application.Read.All`. 6. Select **Add permissions**. {/* screenshot: Request API permissions page with Microsoft Graph application permissions selected (original source image no longer available — recapture from the live product) */} 7. Repeat steps 2 through 6 for each of the following permissions (instead of `Application.Read.All`): - `AuditLog.Read.All` - `Directory.Read.All` - `Group.Read.All` - `UserAuthenticationMethod.Read.All` - `UserAuthMethod-Passkey.Read.All` 8. On the **API permissions** page, review the permissions in the table, and then select **Grant admin consent for **. 9. The **Status** column should update all permissions to **Granted**. {/* screenshot: API permissions table with all six Graph permissions showing Granted status (original image image-1739301866808.png is no longer available) */} ## Axiad Mesh configuration steps You can add Entra ID as a connector from the Mesh administrative portal. 1. From the homepage, select the gear icon menu button to open the **Settings** page. {/* screenshot: Mesh homepage with the gear icon menu button highlighted (original image image-1738879228034.png is no longer available) */} 2. On the **Connectors** page, select the **Add connector** button — either in the middle of the page if this is your first connector, or at the top right of the screen. {/* screenshot: Connectors page with the Add connector button (original image image-1738879440263.png is no longer available) */} 3. In the dialog, set the **Name** to a friendly name that appears on the **Connectors** page. 4. Select **Microsoft Entra ID** from the **Provider** list. 5. Set the **Microsoft Entra tenant ID** to your Entra environment's tenant ID. - [Learn how to find your tenant ID](https://learn.microsoft.com/en-us/entra/fundamentals/how-to-find-tenant) 6. Set the **Application (client) ID** to the **Application ID** value you copied in [Configure application properties](#configure-application-properties). 7. Set the **Client secret value** to the client secret **Value** you copied in [Generate a client secret](#generate-a-client-secret). {/* screenshot: Mesh Add connector dialog with the Entra ID provider fields filled in (original image "Screenshot 2025-02-11 at 11.05.40 AM.png" is no longer available) */} 8. Select the **Test connection** button once all values are provided. 9. Following a successful test, select **Add & connect** to complete the configuration. 10. Your Entra ID connector now appears on the **Connectors** page. --- # Connectors & Integrations Canonical URL: https://docs.axiad.io/docs/connectors/ Mesh connects to identity providers, HR systems, ITSM, cloud, directory, and endpoint sources. Connectors provide Axiad Mesh with the information it needs to correlate identities and create risk scores for users and resources — the visualizations on the main dashboard are built from the data your connectors share. Connectors are organized by source-system category. Per-source reference pages (Overview, Prerequisites, Authentication, Capabilities, Data Model, Setup, Troubleshooting) are added in this section. ## Add a connector Before you add any connectors, the Axiad Mesh homepage shows a prompt to add the first one. 1. Select **Add connector**. You arrive on the **System configurations > Connectors** page. 2. Select **Connect** on the application that you want to integrate. :::tip Custom connector If the connector you need isn't listed, contact [Axiad Customer Success](mailto:customer.success@axiad.com) to request it as an enhancement. ::: 3. Fill in the connection information the application requires. 4. After you complete the required fields, select **Test configuration**. 5. After the configuration passes the test, select **Add & connect**. The **Connectors** page now shows the configured connector. 6. To integrate another connector now or at any time, select **+ Add** on this settings page and repeat steps 2 through 5. After your connectors start sharing data with Axiad Mesh, the bubble chart on the main dashboard starts to fill out. For a guided first-time walkthrough — connecting your identity provider first, then your first source system — see [Connect your identity provider](../getting-started/idp-setup.md) and [Set up your first connector](../getting-started/first-connector.md) in Getting Started. --- # Integration catalog Canonical URL: https://docs.axiad.io/docs/connectors/integration-catalog This page lists the systems Mesh connects to, grouped by the same categories as the connector documentation. Connectors bring accounts, entitlements, and activity from these systems into Mesh, where they're correlated into identities and scored for risk. The catalog grows regularly — new connectors are announced in the [release notes](/release-notes) as they ship, and some integrations are enabled in waves after they're announced. If a system you need isn't listed, or isn't yet available in your tenant, contact [Axiad Customer Success](mailto:customer.success@axiad.com) to request it. ## Identity providers Your identity provider is the anchor data source for correlation. See the [identity provider connectors overview](./idp/index.md). - **Okta** — [setup guide](./idp/okta.mdx) - **Microsoft Entra ID** — [setup guide](./idp/microsoft-entra-id.mdx) - **Auth0** ## HR systems Authoritative worker data for correlation and lifecycle context. See the [HR system connectors overview](./hr/index.md). - **Workday** — [setup guide](./hr/workday-integration.md) - **TriNet** ## Identity governance - **SailPoint** — [setup guide](./governance/sailpoint-integration.md) ## ITSM and ticketing - **ServiceNow** — also powers asset lifecycle status and record matching on the [PQC dashboard](../user-guide/pqc-dashboard.md) - **Jira** - **Confluence** - **PagerDuty** - **Linear** ## Cloud and SaaS - **Amazon Web Services** - **Box** - **Databricks** - **Datadog** - **DocuSign** - **Dropbox** - **GitHub** - **GitLab** - **HashiCorp Vault** - **Salesforce** - **Slack** - **Snyk** ## Directories - **Google Workspace** - **LDAP** - **Active Directory** ## Access management - **JumpCloud** - **OneLogin** ## On-premises systems Systems inside your own network — behind a firewall or VPN, with no public endpoint — connect through the Axiad edge agent, an outbound-only connector you run on your premises. See [on-prem connectors](./on-prem/index.md). ## Custom and offline imports For systems the catalog doesn't cover: - The [universal REST connector](./universal-rest.md) integrates systems that expose a REST API, without waiting for a dedicated connector. - Custom and offline imports bring in data from systems that can't be reached directly. See the Custom & Offline section of this documentation for examples, or contact [Axiad Customer Success](mailto:customer.success@axiad.com) to discuss your source. ## Planned additions Connectors announced as planned in the release notes include Snowflake, Kubernetes, 1Password, Cisco Duo, and BambooHR. Watch the [release notes](/release-notes) for availability. ## Add a connector All connectors are added the same way: select the provider from the provider list when adding a connector in the dashboard. See [Connectors & Integrations](./index.md) for the steps, or follow [Set up your first connector](../getting-started/first-connector.md) for a guided first-time walkthrough. --- # On-prem connectors Canonical URL: https://docs.axiad.io/docs/connectors/on-prem/ Most Mesh connectors reach your source systems directly from the cloud. But some systems live inside your own network — behind a firewall or VPN, with no public endpoint. **On-prem connectors** let Mesh collect from those systems by running a small piece of software, the **Axiad edge agent**, inside your environment. The agent makes only **outbound** connections to Mesh. You never open an inbound port, and your internal systems are never exposed to the internet. ## Who does what Setting up an on-prem connector involves two roles. They can be the same person, but they often aren't. - **Mesh administrator** — works in the Mesh dashboard. Registers an agent, hands its install command to whoever runs your servers, then configures and tests connectors once the agent is online. - **Agent operator** — works on a host inside your network (often your IT or infrastructure team). Runs the agent and keeps it running. The two roles hand off exactly once: the administrator issues a **one-time enrollment token**, and the operator uses it to bring the agent online. ## How it fits together 1. The **administrator** registers an agent in the dashboard and gets a one-time token plus a ready-to-run command. 2. The **operator** runs that command on a host in your network. The agent enrolls and connects — outbound only. 3. The **administrator** sees the agent turn **Enrolled**, adds one or more connectors to it, and tests each connection. 4. Mesh collects from your internal systems through the agent, on the schedule you set. ## What you'll need - A host inside your network running **Linux with Docker** (or a compatible container runtime) that can reach your internal systems and make outbound **HTTPS (443)** to Mesh. - A **Mesh administrator** account with permission to manage connectors. > **note** The edge agent is **outbound-only**. It opens no inbound ports, so there's no firewall rule to add for incoming traffic — only outbound HTTPS to Mesh. ## Start here - **[Set up an on-prem connector](./set-up-on-prem-connector.md)** — for Mesh administrators: register an agent, then add and test connectors. - **[Run the edge agent](./run-the-edge-agent.md)** — for agent operators: install, run, and verify the agent on a host in your network. --- # Run the edge agent Canonical URL: https://docs.axiad.io/docs/connectors/on-prem/run-the-edge-agent This guide is for the person who runs the **Axiad edge agent** on a host inside your network — usually someone on your IT or infrastructure team. Your Mesh administrator will send you a **one-time enrollment token** and a **command** to run. > **note** If you manage connectors in the Mesh dashboard instead, see **[Set up an on-prem connector](./set-up-on-prem-connector.md)**. ## What the edge agent is The edge agent is a small container you run on a host inside your network. It lets Mesh collect from internal systems that aren't reachable from the internet. It connects **out** to Mesh over HTTPS and keeps a secure channel open — it never accepts inbound connections, so you don't open any firewall ports for it. ## Before you begin You'll need: - A **Linux host** inside your network with **Docker** (or a compatible container runtime) installed. - **Outbound HTTPS (443)** from that host to Mesh. **No inbound ports.** - Network reachability from that host to the internal systems you want Mesh to collect from. - From your Mesh administrator: the **one-time enrollment token** and the **run command**. > **warning** The enrollment token is valid for a short time and can be used **only once**. Run the command soon after you receive it. If it expires, ask your administrator to issue a new one. ## Step 1 — Prepare the data directory The agent runs as a **non-root user** (uid `65532`) and keeps a little state on disk, so create its data directory and give it ownership. The command from your administrator includes these two lines: ```bash sudo mkdir -p /var/lib/axiad-edge sudo chown 65532:65532 /var/lib/axiad-edge ``` > **warning** If you skip this, the container fails to start with an error like `mkdir .../store: permission denied`. ## Step 2 — Pull and run the agent Run the command your administrator gave you. Your token and the exact image version are filled in for you; it looks like this: ```bash docker pull axiadciregistry.azurecr.io/mesh-edge-agent: docker run -d --name axiad-edge-agent --restart unless-stopped \ -e ENROLL_TOKEN='' \ -e MESH_SSRF_ALLOW_PRIVATE=1 \ -v /var/lib/axiad-edge:/var/lib/mesh-edge \ axiadciregistry.azurecr.io/mesh-edge-agent: ``` What the parts mean: - **`ENROLL_TOKEN`** — your one-time enrollment token. The agent uses it once to enroll, then keeps its own identity, so you won't need it again. The token also tells the agent where Mesh is — there's nothing else to configure. - **`MESH_SSRF_ALLOW_PRIVATE=1`** — lets the agent reach systems on your private network. Leave it in if any target is internal (the usual case); you can omit it if every target is publicly reachable. - **`-v /var/lib/axiad-edge:/var/lib/mesh-edge`** — gives the agent the data directory you prepared in Step 1. - **`--restart unless-stopped`** — brings the agent back automatically after a reboot. ## Step 3 — Verify it enrolled and connected Watch the logs: ```bash docker logs -f axiad-edge-agent ``` Look for these lines, in order: - **`enroll: success`** — the agent registered with Mesh. - **`connect: gateway stream open`** — the secure channel is up. - **`heartbeat: initial tick sent`** — it has checked in and is healthy. You can also ask the agent directly: ```bash docker exec axiad-edge-agent agent status ``` - Enrolled: `agent kid=... issued_at=... not_after=...` (the `not_after` value is when its certificate expires — renewal is automatic). - Not yet enrolled: `agent: not enrolled`. Once it's up, let your administrator know — the agent will show **Enrolled** in the Mesh dashboard. ## Keeping it running - **Restart:** `docker restart axiad-edge-agent`. The agent reuses its stored identity and reconnects — no new token needed. - **Stop:** `docker stop axiad-edge-agent`. It shuts down cleanly (`boot: shutdown complete`) and won't start again until you tell it to. - **After a host reboot:** `--restart unless-stopped` starts it automatically. - **Certificate renewal:** handled automatically while the agent is running — nothing for you to do. - **Decommission:** if your administrator decommissions the agent in Mesh, it shuts itself down and won't reconnect. To retire a host yourself, stop and remove the container (`docker rm -f axiad-edge-agent`) and delete `/var/lib/axiad-edge`. ## Behind a proxy If the host reaches the internet through an HTTP proxy, pass it to the container the usual Docker way, for example by adding `-e HTTPS_PROXY=http://proxy.example.com:8080` to the `docker run` command. ## Troubleshooting | Symptom | Fix | | --- | --- | | Container exits immediately; logs show `mkdir .../store: permission denied` | The data directory isn't owned by uid `65532`. Re-run the `chown` from Step 1. | | Logs show `enroll: ENROLL_TOKEN expired` or `enroll: ENROLL_TOKEN required...` | The token expired or wasn't passed. Ask your administrator to issue a new one and re-run. | | You never see `connect: gateway stream open` | The host can't reach Mesh outbound on 443. Check your egress firewall and DNS. | | A connector test can't reach an internal system | Confirm the host can reach that system, and that `MESH_SSRF_ALLOW_PRIVATE=1` is set. | > **tip** For more detail while diagnosing, add `-e MESH_LOG_LEVEL=debug` to the `docker run` command. ## Verify - `docker logs` shows `enroll: success` and `connect: gateway stream open`. - `docker exec axiad-edge-agent agent status` shows `agent kid=...`. - Your administrator sees the agent as **Enrolled** in Mesh. --- # Set up an on-prem connector Canonical URL: https://docs.axiad.io/docs/connectors/on-prem/set-up-on-prem-connector This guide is for **Mesh administrators**. You'll register an edge agent, hand its install command to your agent operator, then add and test connectors once the agent is online. > **note** If you're the person who runs the agent on a server, see **[Run the edge agent](./run-the-edge-agent.md)** instead. ## Before you begin - A **Mesh administrator** account with permission to manage connectors. - An **agent operator** — someone who can run a container on a host inside your network. You'll hand them a command; they can start as soon as you issue it. - Details for the internal system you want to connect: its **base URL** and how it **authenticates** (for example, an API token). ## Step 1 — Open On-prem agents In the Mesh dashboard, go to **Settings → On-prem agents**. This page lists the agents running in your environments and notes that they are **outbound-only**. If you haven't added one yet, you'll see *"No on-prem agents yet."* ## Step 2 — Register an agent Select **Add on-prem agent**. In the dialog: - **Name** — a name you'll recognize later, for example `prod-east-1`. - **Labels (optional)** — `key=value` pairs that help you filter the list, for example `region=us-east-1, env=prod`. Select **Issue token →**. ## Step 3 — Copy the token and command Mesh shows a **one-time enrollment token** and a ready-to-run command: - **Enrollment token** — select **Copy**. - **Run on the customer host** — the full command your operator runs. Select **Copy** in the top-right of the command block. > **warning** The enrollment token is shown **once**. Copy it before you close the dialog — otherwise you'll need to register the agent again to get a new one. Send both the token and the command to your agent operator over a secure channel. They'll follow **[Run the edge agent](./run-the-edge-agent.md)**. Tick **"I've copied the token. I understand it can't be shown again."**, then select **Close**. > **tip** The token is valid for a short time and can be used only once. If it expires before your operator uses it, just add the agent again to issue a fresh one. ## Step 4 — Wait for the agent to come online Back on the **On-prem agents** list, your agent appears with a **Status**. Once your operator runs the command, the status turns **Enrolled** within a minute or so. | Status | Meaning | | --- | --- | | **Unenrolled** | Registered, but hasn't connected yet. | | **Enrolled** | Connected and healthy. | | **Stale** | Was enrolled, but hasn't checked in recently. | | **Decommissioning** / **Decommissioned** | Being shut off / no longer trusted. | The list also shows each agent's **Agent ID**, **Last seen**, **Labels**, and **Cert expires**. > **note** The agent renews its own certificate automatically while it's running. The **Cert expires** column is informational — you don't need to act on it. ## Step 5 — Add a connector to the agent Select the agent's row to open its details, then open the **Connectors** tab and select **+ Add connector**. Follow the guided steps to point Mesh at your internal system — its base URL, the data you want to collect, and how to authenticate. Give the connector a **display name** and save it. Connectors on an agent are grouped by status: **Running**, **Pending**, **Failed**, and **Disabled**. ## Step 6 — Test the connection While adding or editing a connector, select **Test connection**. Because the test runs **on the agent — inside your network** — it can reach systems that aren't publicly accessible. - On success, you'll see **Connection successful**. - On failure, you'll see an error describing what to fix (for example, *authentication failed*). ## Managing an agent Open an agent to see its details across several tabs: - **Overview** — agent version, platform, when it enrolled, when it was last seen, and its labels. - **Connectors** — the connectors running on this agent. - **Activity**, **Heartbeats**, **Logs** — its recent history and check-ins. To permanently retire an agent, open it and select **Decommission**, then confirm. This stops the agent from being trusted the next time it tries to connect, and the action is recorded in your audit log. Use it when a host is retired or you suspect it's compromised. ## Verify - The agent shows **Enrolled**. - Your connector shows **Running**, or you saw **Connection successful**. - Data from your internal system appears in Mesh on its next collection. ## Next step Hand off to your operator if you haven't already: **[Run the edge agent](./run-the-edge-agent.md)**. Or add more connectors to the same agent — one agent can serve several internal systems. --- # Universal REST connector Canonical URL: https://docs.axiad.io/docs/connectors/universal-rest Not every system in your environment has a dedicated Mesh connector — and you shouldn't have to wait for one to get its identity data into Mesh. The universal REST connector lets you integrate any system that exposes a REST API, using a template that describes how Mesh should talk to it. ## How it works The universal REST connector is template-driven. A template describes your system's API to Mesh: - **Endpoints** — where to fetch users, groups, and other identity data. - **Authentication** — how Mesh authenticates to the API, with secrets stored write-only like any other connector credential. - **Pagination** — how to walk through large result sets. Once configured, the connector behaves like any other source: it collects on a schedule, and the data is normalized into Mesh, correlated into [identities](../concepts/identities.md), and scored for [risk](../concepts/risk-scoring.md) exactly as data from a dedicated connector would be. Setup is guided: a conversational flow walks you through the application name, the base URL, the OpenAPI or Swagger specification, and the authentication scheme, then validates the specification and helps you select which data to collect. See [AI features and data handling](../overview/ai-features-data-handling.md) for how the guided setup handles your data. ## When to use it | Your situation | Best fit | |---|---| | The system has a dedicated connector in the [integration catalog](./integration-catalog.md) | Use the dedicated connector — it's purpose-built for that system's data model | | The system has a REST API but no dedicated connector | Use the universal REST connector | | The system has a REST API but is only reachable inside your network | Combine approaches: run the connector through the [edge agent](./on-prem/index.md) | | The system can't be reached over an API at all | Use a custom or offline import — see the Custom & Offline section of this documentation | If you're unsure which path fits, contact [Axiad Customer Success](mailto:customer.success@axiad.com) — a dedicated connector for your system may already be planned. New connectors are announced in the [release notes](/release-notes). ## Authoring a template Templates describe the specifics of your system — its endpoints, its authentication scheme, and how its records map onto Mesh's data model. Work with Axiad to author the template for your system: contact [Axiad Customer Success](mailto:customer.success@axiad.com) with your system's API documentation, and Axiad helps you build and validate the template. ## What to expect after setup - The connector appears on the **Connectors** page alongside your other connectors, with the same health reporting. - Collected accounts are correlated to identities and contribute to risk scores like data from any other source. - Credentials follow the same rules as other connectors — see [Manage connector credentials](../admin-guide/credential-management.md). --- # Analytics OData API Reference Canonical URL: https://docs.axiad.io/docs/api-reference/analytics-odata Read-only, tenant-isolated OData v4 interface for Mesh analytics data. Browse the entity sets below and query them with standard OData options (for example from Power BI Desktop via Get Data → OData Feed). ## Authentication **Method:** OAuth 2.0 / OIDC (user-authenticated) The API is read-only and strictly tenant-isolated. Requests are authenticated with organization-approved user credentials (SSO / OAuth2 / OIDC), aligned with Mesh Dashboard authentication; each dataset is scoped to a single tenant. Send the bearer token in the `Authorization` header. ## Entity sets | Entity set | Entity type | | --- | --- | | `MachineAssets` | [`MachineAsset`](#machineasset) | | `SoftwareAssets` | [`SoftwareAsset`](#softwareasset) | | `CryptoElements` | [`CryptoElement`](#cryptoelement) | | `NhiAssets` | [`NhiAsset`](#nhiasset) | ## Entity types ### MachineAsset | Property | Type | Nullable | Key | | --- | --- | --- | --- | | `id` | `Edm.String` | No | Yes | | `name` | `Edm.String` | No | No | | `assetType` | `Edm.String` | Yes | No | | `riskScore` | `Edm.Int32` | Yes | No | | `lastSeen` | `Edm.DateTimeOffset` | Yes | No | ### SoftwareAsset | Property | Type | Nullable | Key | | --- | --- | --- | --- | | `id` | `Edm.String` | No | Yes | | `name` | `Edm.String` | No | No | | `version` | `Edm.String` | Yes | No | | `vendor` | `Edm.String` | Yes | No | | `riskScore` | `Edm.Int32` | Yes | No | ### CryptoElement | Property | Type | Nullable | Key | | --- | --- | --- | --- | | `id` | `Edm.String` | No | Yes | | `algorithm` | `Edm.String` | No | No | | `keyLength` | `Edm.Int32` | Yes | No | | `deprecated` | `Edm.Boolean` | Yes | No | ### NhiAsset | Property | Type | Nullable | Key | | --- | --- | --- | --- | | `id` | `Edm.String` | No | Yes | | `name` | `Edm.String` | No | No | | `assetType` | `Edm.String` | Yes | No | | `riskScore` | `Edm.Int32` | Yes | No | ## Query options | Option | Description | | --- | --- | | `$filter` | Filter the collection by a boolean expression. | | `$select` | Return only the named properties. | | `$orderby` | Sort the collection by one or more properties. | | `$top` | Return at most N records (pagination). | | `$skip` | Skip the first N records (pagination). | | `$count` | Include the total match count with the response. | --- # API Authentication Canonical URL: https://docs.axiad.io/docs/api-reference/authentication Axiad Mesh APIs require authenticated, tenant-scoped requests. This page covers the auth model at a high level; the full generated endpoint reference (delivered by a separate story) documents each operation's specifics. ## Auth model - Axiad Mesh APIs use **OAuth2** for authentication. - Requests are **tenant-scoped**: you only ever access data belonging to your own tenant. - Multi-tenant isolation is enforced by the platform. ## Required headers Authenticated requests include a bearer token obtained through the standard OAuth2 flow. ```http Authorization: Bearer Accept: application/json ``` ## Where to go next - The **API Reference** section (generated from published OpenAPI specs) documents endpoints, schemas, and per-service details. - See the [Admin Guide](../admin-guide/index.md) for tenant and access configuration. --- # Export a CycloneDX 1.6 CBOM for global-catalog software Canonical URL: https://docs.axiad.io/docs/api-reference/cbom/export-global-cyclone-dx Resolves the `(name, version, publisher)` query to global-catalog rows (latest **complete** snapshot only — the read is freshness-gated) and renders ONE CycloneDX 1.6 document. - **With `publisher`:** exact fingerprint lookup → at most one component. - **Without `publisher`:** `name`+`version` may match several publisher variants; all are emitted as components in the single document, each with its own `mesh:pqc_compliant` and `mesh:pqc_state` properties. On a **catalog miss** the request is recorded for fulfillment and the endpoint returns `202` (not `404`): eligibility is decided at nightly build time by the fail-closed public gate, never at request time. Request --- # Fetch this OpenAPI 3.1 spec for the global CBOM export Canonical URL: https://docs.axiad.io/docs/api-reference/cbom/get-global-cyclone-dx-open-api-spec Returns this OpenAPI 3.1 contract as YAML, so procurement and vendor tooling can retrieve the machine-readable API definition at runtime. It uses the same authentication as the export itself. --- # Mesh Global Software CBOM Export Canonical URL: https://docs.axiad.io/docs/api-reference/cbom/mesh-global-software-cbom-export Returns a CycloneDX 1.6 Crypto Bill of Materials (CBOM) for a piece of software, drawn from Axiad Mesh's global software catalog. Intended for vendor and procurement CBOM consumption — for example, evaluating the post-quantum readiness of software before you adopt it. This endpoint is **not** tenant-scoped: it serves only public catalog data and returns the same result for every authenticated caller. Authentication is still required (see Security).
A bearer access token obtained through the standard OAuth 2.0 flow (the same authentication used by the rest of the Axiad Mesh API). Present it in the `Authorization: Bearer ` header. See [API Authentication](/docs/api-reference/authentication) for how to obtain a token.
Security Scheme Type: http
HTTP Authorization Scheme: bearer
Bearer format: JWT
--- # Software CBOM Canonical URL: https://docs.axiad.io/docs/api-reference/cbom/software-cbom Export a Crypto Bill of Materials for a piece of software. ```mdx-code-block ``` --- # API Reference Canonical URL: https://docs.axiad.io/docs/api-reference/ Query and export your Axiad Mesh data programmatically. This section documents the customer-facing APIs and how to authenticate to them. - **[Analytics OData API](./analytics-odata.mdx)** — a read-only, tenant-isolated interface you can point BI and analytics tools at (for example Power BI, via **Get Data → OData Feed**). Browse the entity sets and the OData options they support. - **[Software CBOM Export](./cbom/mesh-global-software-cbom-export.info.mdx)** — fetch a CycloneDX Crypto Bill of Materials for a piece of software, to evaluate its post-quantum readiness before you adopt it. Interactive endpoint reference with request parameters, responses, and code samples. - **[Authentication](./authentication.md)** — how to authenticate your API requests. Both APIs use the same OAuth 2.0 authentication, and the OData API scopes every response to your organization's data. The CBOM export reads from a shared, public software catalog, so it returns the same result for every authenticated caller. ## Machine-readable specs The Software CBOM Export publishes its **OpenAPI 3.1 spec** at [`/openapi/cbom-export.yaml`](/openapi/cbom-export.yaml) — point your API tooling or AI agents at it directly. Every endpoint page in this section also has a plain-Markdown twin (append `.md` to its URL), so agents can read the reference without rendering the page. For the dashboard-driven ways to get data out — CSV exports and FAIR reports — see [Reports, exports, and data retrieval](../user-guide/reports-and-exports.md). --- # Identity Mesh — January 16, 2026 Canonical URL: https://docs.axiad.io/release-notes/2026-01-16 **Release Date**: January 16, 2026 ## Overview This release improves the experience of managing cryptographic assets, speeds up data reconciliation in large environments, and fixes issues reported during post-quantum cryptography (PQC) evaluations. Key highlights: - The ServiceNow integration now uses single sign-on, so you are no longer prompted for credentials. - Reconciliation now processes only records that changed, which shortens processing time in large deployments. - More accurate risk classification for cryptographic assets. - New sorting options in asset lists. ## Bug fixes ### Authentication and single sign-on - The **View in ServiceNow** link now signs you in through single sign-on instead of prompting you for credentials. The link also opens the correct ServiceNow record for cryptographic assets. ### Risk assessment - Cryptographic assets that are installed on machines are no longer incorrectly classified as orphaned. - Removed misleading risk labels from tooltips, so the displayed risk score is easier to interpret. ## Improvements ### Faster reconciliation - Reconciliation now detects which records changed since the last run and processes only those records instead of the full dataset. When nothing changed, the run completes almost immediately. A full reconciliation still runs automatically when needed. ### Sorting in asset lists - You can now sort cryptographic asset lists by the **Owner** and **Installed On** columns. - You can now sort software asset lists by the **Installed Machines** count. --- # Identity Mesh — January 23, 2026 Canonical URL: https://docs.axiad.io/release-notes/2026-01-23 **Version:** Identity Mesh 01-23-2026\ **Release Date:** January 23, 2026\ ------------------------------------------------------------------------ ## Overview This release improves how cryptographic assets are displayed, makes asset ownership visible across all asset types, and fixes issues reported during post-quantum cryptography (PQC) evaluations. Key highlights: - The ServiceNow integration now uses single sign-on, so you are no longer prompted for credentials. - The owning group is now shown for every asset type. - Cryptographic assets now display key size and the full signature algorithm. - New sorting and filtering options in asset lists. - Dashboard widget refinements based on customer feedback. - Machine assets imported from ServiceNow always display a usable name. ------------------------------------------------------------------------ ## Bug fixes ### Authentication and single sign-on - The **View in ServiceNow** link now signs you in through single sign-on instead of prompting you for credentials. The link also opens the correct ServiceNow record for cryptographic assets. ### Data integrity - Fixed an issue where the external identifier of a machine asset could be missing from correlated asset data, which affected asset correlation. ------------------------------------------------------------------------ ## Improvements ### Sorting and filtering - You can now sort and filter cryptographic asset lists by the **Owner** and **Installed On** columns. This makes it easier to spot patterns, for example which owners have the most cryptographic assets. ### Dashboard widgets - The **Top Assets** widget has a refined layout, with updated colors, typography, icons, and interactive states, and improved spacing between the header, tabs, and bar charts. The **View more** button is now hidden when fewer than five bars are displayed, and asset counts and bar order update as you select filters or bars. - The **Top Categories** widget now respects your active filters, including the selected organization, so its data matches the rest of the dashboard. ### Asset display - Machine assets imported from ServiceNow now always display a usable label: the asset name when it is available, otherwise the asset's ServiceNow identifier. This prevents blank asset labels in the dashboard. - Cryptographic assets now show both the key size and the full signature algorithm, including the hashing algorithm. Both appear in the asset detail view and in all lists, giving you better visibility for PQC analysis. - The owning group is now displayed for every asset type, including cryptographic, software, and machine assets. It appears in the asset detail view and in all lists, improving ownership visibility and accountability. - Machine ownership data is more accurate: when a machine has no owning group in the source system, Mesh now uses the individually assigned owner instead. ------------------------------------------------------------------------ This release also includes internal testing and reliability improvements. --- # Identity Mesh — January 30, 2026 Canonical URL: https://docs.axiad.io/release-notes/2026-01-30 **Version:** Identity Mesh 01-30-2026\ **Release Date:** January 30, 2026\ ## Overview This release adds configurable report downloads, CSV export for Non-Human Identities, and more reliable naming for assets imported from ServiceNow. It also fixes a display issue on the correlated assets screen. Key highlights: - Choose the download format for reports. - Export Non-Human Identity data to CSV. - Reliable names for machine assets imported from ServiceNow. - Key size now displays correctly for correlated assets. ------------------------------------------------------------------------ ## New features ### Reporting and export - **Configurable report download format.** You can now choose the format in which reports are downloaded, giving you more flexibility when generating and exporting reports. - **CSV export for Non-Human Identities.** You can now export Non-Human Identity data to a CSV file. Exports are delivered as direct downloads from secure storage, so large files download faster and more reliably. ### Product analytics - The dashboard now collects product usage analytics. This helps us understand how features are used and prioritize improvements. ### Asset management - Machine assets imported from ServiceNow now always display a usable label: the asset name when it is available, otherwise the asset's ServiceNow identifier. This improves asset identification and keeps naming consistent during ServiceNow synchronization. ------------------------------------------------------------------------ ## Bug fixes ### Asset display - Fixed an issue where the key size was not displayed on the correlated assets screen. Key size information now appears as expected, restoring full visibility for cryptographic asset analysis. --- # Identity Mesh — February 2, 2026 Canonical URL: https://docs.axiad.io/release-notes/2026-02-02 **Version:** Identity Mesh 02-02-2026\ **Release Date:** February 2, 2026\ ------------------------------------------------------------------------ ## Overview This release focuses on platform scalability and stability. There are no changes to product features in this release. ------------------------------------------------------------------------ ## Improvements ### Scalability - The services that compute risk data can now scale data ingestion and request handling independently. This improves responsiveness and reliability for deployments with high data volumes. This release also includes internal integration updates with no impact on product functionality. --- # Identity Mesh — February 6, 2026 Canonical URL: https://docs.axiad.io/release-notes/2026-02-06 **Version:** Identity Mesh 02-06-2026\ **Release Date:** February 6, 2026\ ------------------------------------------------------------------------ ## Overview This release improves cryptographic asset identification and display, speeds up software data synchronization from ServiceNow, fixes export and search issues, and adds accessibility improvements to support post-quantum cryptography (PQC) evaluations and day-to-day use. Key highlights: - Serial number and issuer distinguished name shown for cryptographic assets, so you can uniquely identify each certificate. - Full signature algorithm display, for example RSA-SHA256. - Faster software data synchronization from ServiceNow. - Fixed the installed machines count in software asset exports. - Fixed search for software assets. - Asset lists now show only active certificates. - Accessibility improvements toward WCAG 2.1 Level AA conformance. ------------------------------------------------------------------------ ## Bug fixes ### Cryptographic asset identification - The cryptographic asset detail view now shows the serial number and issuer distinguished name in addition to the subject distinguished name. Previously, certificates that shared the same subject distinguished name were hard to tell apart. You can now uniquely identify each certificate and match it to records in ServiceNow and other systems. ### Export - The software asset CSV export now shows the correct installed machines count. Previously, the export showed zero while the asset list showed the correct values. Exported data now matches what you see in the product, so you can rely on it for reporting and analysis. ### Search - Searching for a software asset by name now returns results. Previously, the search bar could return no results for software assets that exist, making them hard to find. ### Display - Corrected misleading text and labels so that what you read matches how the product behaves. - Restored the active tab indicator on the **View Assets** panel and corrected the formatting of the signature algorithm display. ### Certificate filtering - Asset lists now show only active certificates. Revoked certificates are excluded, which reduces clutter and shortens loading times. ------------------------------------------------------------------------ ## Improvements ### Faster software synchronization - Software records from ServiceNow that were already processed are no longer reprocessed when only their update timestamps change. Synchronization completes significantly faster, especially in environments with large software inventories. ### Signature algorithm display - Cryptographic assets now show the combined signature and hashing algorithm, for example RSA-SHA256 or ECDSA-SHA384, instead of only the asymmetric algorithm, for example RSA. This makes it easier to compare cryptographic methods across certificate sources and assess PQC readiness. ------------------------------------------------------------------------ ## Accessibility improvements This release includes the first phase of improvements toward Web Content Accessibility Guidelines (WCAG) 2.1 Level AA conformance: - Better keyboard navigation. - Improved screen reader compatibility. - Color contrast adjustments for better visibility. - Focus indicators on interactive elements. - Clearer labels for assistive technologies. - More accessible forms. These changes improve the experience for everyone, including people who rely on keyboard-only navigation or screen readers, and support enterprise accessibility requirements. ------------------------------------------------------------------------ This release also includes internal integration updates with no impact on product functionality. --- # Identity Mesh — February 13, 2026 Canonical URL: https://docs.axiad.io/release-notes/2026-02-13 **Version:** Identity Mesh 02-13-2026\ **Release Date:** February 13, 2026\ ## Overview This release focuses on post-quantum cryptography (PQC) readiness and day-to-day usability. Certificates are now easier to identify uniquely, asset filters return complete results, your preferred dashboard is remembered between sessions, and risk tags are easier to read. The release also fixes an issue that could interrupt data exports and resolves a security vulnerability. ------------------------------------------------------------------------ ## Improvements ### Your dashboard preference is remembered Identity Mesh now remembers whether your organization works primarily in the Non-Human Identity (NHI) or Human Identity (HI) dashboard and takes you there when you sign in. You no longer need to select a dashboard on every visit. You can still switch dashboards at any time during a session — the redirect only happens once, at sign-in. To change the default dashboard for your organization, contact Axiad support. ### Serial number and issuer shown for certificates Certificate cards in the correlated assets view now display the Serial Number and Issuer DN alongside the existing fields (Subject DN, Signature Algorithm, Key Size, and Owner). Previously only the Subject DN was shown, which made it impossible to tell apart certificates that share the same subject. With these two additional fields you can uniquely identify each certificate and match it to records in external systems such as ServiceNow — an important step for PQC asset tracking and compliance. Machine and software asset cards are unchanged. ### Simpler risk tags Risk tags no longer repeat the asset type in the label. For example, "PQC noncompliant: Crypto" now appears as "PQC noncompliant". The asset type is still visible elsewhere on the page, so tags are shorter and asset lists are easier to scan. The change applies consistently across all Non-Human Identity screens. ------------------------------------------------------------------------ ## Bug fixes ### Asset filters now return all matching assets Filtering the asset list previously returned only assets that carried at least one risk. Filters now return every matching asset, whether or not it has a risk, and the counts shown in the widget, the filter dialog, and the bubble chart now match the asset list. To reflect this behavior, the "Assets at risk by" widget has been renamed "Assets by". ### Data exports complete reliably Fixed a service error that could interrupt data exports. Exports now complete without interruption. ### Security vulnerability resolved Resolved a security vulnerability that a recent update had inadvertently reintroduced. Validation confirmed the reported vulnerability is remediated. --- # Identity Mesh — February 19, 2026 Canonical URL: https://docs.axiad.io/release-notes/2026-02-19 **Version:** Identity Mesh 02-19-2026\ **Release Date:** February 19, 2026\ ## Overview This release upgrades the Go runtime that powers all Identity Mesh services, along with their supporting components and dependencies, to the latest stable version. It is an infrastructure-only release: there are no changes to features, the interface, or how you use the product, and no action is required on your part. ## What this means for you - **No functional changes.** Everything works exactly as before. - **Improved performance.** The updated runtime includes memory-management and scheduling optimizations that improve throughput across the platform. - **Enhanced security.** The upgrade brings the latest runtime security patches and updated dependencies, reducing exposure to known vulnerabilities. - **Verified stability.** The release was validated through a phased rollout across test and staging environments before production. Smoke testing confirmed no regressions in data ingestion, risk scoring, reconciliation, identity correlation, report generation, or sign-in. ------------------------------------------------------------------------ --- # Identity Mesh — February 20, 2026 Canonical URL: https://docs.axiad.io/release-notes/2026-02-20 **Version:** Identity Mesh 02-20-2026\ **Release Date:** February 20, 2026\ ## Overview This release delivers two usability enhancements based on customer feedback: a quick link to the Axiad Mesh system status page from the user menu, and sorting on every column of the asset and identity tables. Both changes streamline everyday investigation and monitoring workflows. ## Improvements ### Axiad Mesh status link in the user menu You can now check system availability without leaving the dashboard. - An "Axiad Mesh Status" link has been added to the user menu (the menu under your name or avatar). - The link opens [https://status.mesh.axiad.io/](https://status.mesh.axiad.io/) in a new browser tab, so your current session is preserved. - It sits alongside the other external resource links, such as "Axiad Knowledge Center". - The link is visible to all users, regardless of role, and is fully reachable with keyboard navigation. ### Sort by any column in asset and identity tables Every column in the asset and identity tables now supports sorting. - Click a column header to sort ascending; click again to sort descending. - The table updates immediately to reflect the selected sort order. - Your sort choice is kept across table refreshes and data updates until you change or reset it. - If a sort returns no results, the table shows an empty-state message with an option to reset the sorting. - Mixed or unexpected values are handled gracefully: unknown values are grouped at the end of the list. This makes it faster to find and focus on the assets or identities that matter during an investigation. --- # Identity Mesh — February 25, 2026 Canonical URL: https://docs.axiad.io/release-notes/2026-02-25 **Version:** Identity Mesh 02-25-2026\ **Release Date:** February 25, 2026\ ## Overview This release expands Identity Mesh's integration coverage with a new connector framework that adds support for 14 third-party systems. Connectors built on this framework synchronize users, groups, applications, and related entities into Identity Mesh. The Jira connector is available first, with the remaining integrations to follow. Existing connectors are unaffected. ------------------------------------------------------------------------ ## New features ### 14 new third-party integrations Identity Mesh can now synchronize identity data from the following systems: - **Identity and access:** Auth0, Google Workspace - **Cloud infrastructure:** AWS - **Development and collaboration:** GitHub, Jira, Confluence, Linear, Databricks - **Business applications:** Box, DocuSign, Dropbox, PagerDuty, Datadog, Snyk **Available now:** Jira. The remaining integrations will be enabled in upcoming releases. What these connectors do: - Synchronize users, groups, applications, roles, projects, and permissions from the connected system into Identity Mesh - Support incremental sync, so recurring syncs transfer only what changed — faster and lighter on the connected system - Track sync progress and recover automatically if a sync is interrupted, resuming where they left off - Prevent the same sync job from running twice at once - Scale automatically with sync workload You set up these connectors the same way as existing ones: select the provider from the provider list when adding a connector in the dashboard. ### No impact to existing connectors All existing connectors, including Microsoft Entra ID and ServiceNow CMDB, continue to work unchanged. This release introduces no changes to existing functionality. ------------------------------------------------------------------------ ## Known issues - **Jira projects and project roles:** project and project-role information is not yet synchronized. Support will be added in a future release. - **Users missing required fields:** a small percentage of Jira users may be skipped during sync if their account is missing an email address or name. - **Entity coverage:** not every entity type is mapped yet for every integration. Additional coverage is being added iteratively. - **Jira user identifiers:** Jira user identifiers may appear in two different formats depending on the account's age. A consistent format is planned. - **Last sign-in:** last sign-in information is not yet populated for Jira users. --- # Identity Mesh — February 27, 2026 Canonical URL: https://docs.axiad.io/release-notes/2026-02-27 **Version:** Identity Mesh 02-27-2026\ **Release Date:** February 27, 2026\ ## Overview This release makes everyday work in the dashboard faster: you can now apply several filters at once and clear them all in one click, and certificate algorithm details appear in a consistent, readable format across the product. It also fixes an issue that prevented accepting or rejecting weak user correlations. The improvements apply to both the Human Identity (HI) and Non-Human Identity (NHI) dashboards. ------------------------------------------------------------------------ ## New features ### Multi-select filters with clearer controls Filtering across the dashboards now supports selecting several values at once, with better visibility into what is applied. - Select multiple filters at the same time from any filter dialog. - Active filters are displayed prominently, each with its own remove control. - A "Clear all filters" control at the dashboard level removes every active filter in one click. - You can remove filters directly from the asset list drawer without leaving the view. - The dashboard updates in real time as you add or remove filters. - The filter area adapts when many filters are active, so the view stays readable. This reduces clicks in complex filter scenarios, gives clear visual feedback on the data you are looking at, and speeds up risk analysis and investigation workflows — including analysis of crypto-vulnerable assets. ### Consistent public key algorithm display Asset lists and detail pages now show a "Public Key Algorithm" field that combines the algorithm and key size in a standardized, readable format. It replaces the previous "Key Size" field. The Signature Algorithm field is unchanged. Examples of the new format: - **RSA:** RSA-2048, RSA-4096 - **DSA and DH:** DSA-2048, DH-2048 - **Elliptic curve:** EC-P256, EC-P384 for NIST curves; other curves show as EC- followed by the curve name - **Edwards curve:** ED25519, ED448 - **Post-quantum:** ML-KEM-768, ML-DSA-65 The format is applied consistently across tables, detail pages, and exports, and covers both older and current algorithm naming variations. This makes it easy to judge cryptographic strength at a glance — for example, distinguishing RSA-2048 from RSA-4096 — which is especially useful when evaluating post-quantum readiness. ------------------------------------------------------------------------ ## Bug fixes ### Accepting or rejecting weak user correlations works again Accepting or rejecting a weak user correlation through the Profiling Gaps workflow previously failed with an error. This is now fixed: - Accepting a correlation merges the users into the same identity. - Rejecting a correlation keeps the users in separate identities. - Confirmation messages display correctly, and the profiling gaps count updates immediately. This release also includes reliability and performance improvements. --- # Identity Mesh — March 6, 2026 Canonical URL: https://docs.axiad.io/release-notes/2026-03-06 **Version:** Identity Mesh 03-06-2026\ **Release Date:** March 6, 2026\ ## Overview This release strengthens how sensitive integration settings are stored, adds user role visibility to audit logs, and fixes an issue where risk scores did not appear on the dashboard for newly onboarded organizations. ## New features ### Secure storage for integration settings Sensitive integration settings, for example ServiceNow connection details, are now stored securely within the platform instead of in static files that could be read from the browser. What this means for you: - Integration settings are no longer exposed in browser-accessible files, improving your security posture. - Configuration changes take effect immediately, without waiting for a new deployment. - Every configuration change is recorded with who made it and when, giving you a full audit trail. No action is required. ### User roles in audit logs The Audit Logs table (Settings > Config Management > Audit Logs) now includes a Role column that shows the role — admin or user — granted at sign-in. - Successful sign-in entries show the authenticated user's role. - Entries where a role does not apply, such as non-login events, show "-". - Sessions from users with different roles display correctly in the same view. This gives compliance and security teams clear visibility into the privilege level of each session and supports regulatory requirements for access-level logging. ## Bug fixes ### Risk scores not shown for new organizations Fixed an issue where a newly onboarded organization's dashboard showed a risk score of 0 after data was ingested through connectors (for example AWS, Azure, or TriNet), even though risks had already been identified. The bubble chart also appeared flat and grey, with no risk-based sizing. The dashboard now correctly aggregates risk from both human and non-human identities: - Risk scores appear as soon as ingested data has been assessed. - The bubble chart sizes and colors entities according to their risk. - Risk profiles show accurate severity levels and counts. --- # Identity Mesh — March 9, 2026 Canonical URL: https://docs.axiad.io/release-notes/2026-03-09 This release contained internal changes only, with no customer-facing updates. --- # Identity Mesh — March 13, 2026 Canonical URL: https://docs.axiad.io/release-notes/2026-03-13 **Version:** Identity Mesh 03-13-2026\ **Release Date:** March 13, 2026\ ## Overview This release fixes two issues related to audit log reliability: an audit log CSV export that never finished downloading, and asset export outcomes that were missing from the audit log. ## Bug fixes ### Audit log CSV export never completed Fixed an issue where clicking Export on the Audit Logs page (Settings > Config Management > Audit Logs) started the CSV download but never finished — the browser showed the file stuck partway with a "Resuming..." status. The export now writes records to the file as they are retrieved, so downloads complete reliably even for wide date ranges and large datasets of more than 15,000 records. In addition: - The Export button is disabled while an export is running, preventing accidental duplicate exports. - Notifications show that an export is in progress and confirm completion with the number of logs exported. - Running several exports back to back works without errors. - Records are not duplicated across page boundaries in the exported file. ### Asset export outcomes missing from audit logs Fixed an issue where a failed asset export was recorded as successful in the audit log, or not recorded at all, leaving no way to trace export outcomes. Audit logs now capture the full lifecycle of every asset export: - Both the start of an export and its final outcome — success or failure — are logged. - The entries for an export share the same transaction ID, so you can trace an export from start to finish. - Each entry is attributed to the user who initiated the export. - For exports triggered through the API, the client IP address is also recorded. This gives you full accountability for export operations and lets you troubleshoot failed exports directly from the audit log. --- # Identity Mesh — March 20, 2026 Canonical URL: https://docs.axiad.io/release-notes/2026-03-20 **Version:** Identity Mesh 03-20-2026\ **Release Date:** March 20, 2026\ ## Overview This release adds a Status column to the non-human identity (NHI) asset inventory and fixes an error that prevented some users on corporate networks from opening the Axiad Mesh status page. It also includes internal improvements with no customer-facing changes. ## New features ### Status column in the NHI asset inventory A new Status column is available in the NHI asset inventory for all three asset types — Software, Crypto, and Machine. It appears directly after the asset name and shows the current lifecycle status of each asset, sourced from your ServiceNow CMDB integration. Status values by asset type: | Asset type | Status values | |----|----| | Software | Active, Inactive, Unknown | | Crypto (certificate) | Active, Expired, Revoked, Suspended, Unknown | | Machine | Active, Retired, Unknown | - You can sort the column alphabetically in either direction; "Unknown" always sorts last, keeping assets that need attention easy to triage. - Assets with no reported status show "Unknown". - Each asset tab keeps its own sort state — sorting one tab does not affect the others. - Sort state is preserved when you page through results or navigate back in the browser. Existing functionality — pagination, risk scores, and all other columns — is unchanged. ## Bug fixes ### Status page inaccessible from corporate networks Fixed an issue where users on some corporate networks could not open the Axiad Mesh status page (status.mesh.axiad.io) and instead received a "Request Header Fields Too Large" error. The error occurred when browser cookies accumulated from other Axiad sites grew beyond a request size limit. The status page is public and read-only and does not require sign-in, so it now ignores browser cookies entirely. The page loads reliably from any network. No action is required. --- # Identity Mesh — March 27, 2026 Canonical URL: https://docs.axiad.io/release-notes/2026-03-27 **Version:** Identity Mesh 03-27-2026\ **Release Date:** March 27, 2026\ ## Overview This release updates FAIR Lite reporting to Open FAIR v3.0 terminology and adds Advanced Filters to the non-human identity (NHI) asset list. It also includes reliability and performance improvements with no customer-facing changes. ## New features ### FAIR Lite reports aligned to Open FAIR v3.0 All FAIR risk reporting now uses Open FAIR v3.0 standard terminology, keeping your reports credible, auditable, and consistent with the language risk stakeholders expect. - Single Loss Expectancy (SLE) is now labeled Loss Magnitude (LM). - Annual Rate of Occurrence (ARO) is now labeled Loss Event Frequency (LEF). - Existing reports adopt the new labels automatically. - There are no breaking changes for existing integrations. To see the change, open any FAIR Lite report — Loss Magnitude (LM) and Loss Event Frequency (LEF) appear in place of SLE and ARO. ### Advanced Filters for the NHI asset list A new Advanced Filters box is available on the non-human identity (NHI) asset tables — Software, Crypto, and Machine — so you can narrow the asset list with column-based filters from a single place. This makes it faster to find the assets relevant to an investigation. - Filter controls match each column's data type: text search, dropdown, or range. - The table updates in real time as you apply filters. - A single reset control clears all applied filters at once. - Active filters are clearly indicated and stay applied until you reset them, including across data refreshes. - If no assets match, an empty state message appears with an option to reset the filters. Filtering handles mixed or incomplete column data gracefully: invalid values are ignored and unknown values are grouped at the end. Sorting, pagination, and risk scores are unchanged. --- # Identity Mesh — April 2, 2026 Canonical URL: https://docs.axiad.io/release-notes/2026-04-02 **Release Date**: April 2, 2026\ **Release Type**: Feature + Bug Fix ------------------------------------------------------------------------ ## Overview This release delivers four key improvements: an AI assistant for investigating your Mesh data in plain language, detailed explanations for asset risk scores and risk tags, additional asset attributes in the asset list and detail views, and a fix to identity correlation and merging. ------------------------------------------------------------------------ ## New features ### Mesh AI assistant An AI assistant is now available in the dashboard. You can ask questions about your assets, identities, and risks in plain language and get answers grounded in your own data. **Key capabilities:** - Open the assistant from anywhere in the dashboard using the floating action button. - Ask free-form questions or start from guided prompts, for example "Show me expiring certificates". - The assistant only sees data your account is permitted to see, and your organization's data stays fully isolated. - Sensitive values such as personal information and credentials are automatically filtered before any request leaves the platform. - Rate each response with thumbs up or thumbs down. - AI interactions are recorded in the audit log. **Not included in this release:** - A usage analytics view for the assistant - Review and approval of outbound data before it is sent - Advanced feedback workflows such as flagging and escalation - Multi-region and data residency controls - Write operations — the assistant cannot make changes, for example renewing a certificate ------------------------------------------------------------------------ ### Detailed explanations for asset risk scores and tags You can now see a detailed explanation of why a risk score or risk tag was assigned to an asset, which speeds up triage and helps you decide on remediation. **What's included:** - **Simple risks** (for example an orphan asset): a dialog states the condition plainly — for example "This asset has no assigned owner" or "This asset is not linked to any hardware asset." - **Policy-based risks** (for example an asset that is not compliant with a post-quantum cryptography policy): the dialog shows the outcome of the policy assessment and lists the specific attributes that did not comply, along with the name of the triggering policy. - **Multiple risk tags**: each tag opens its own explanation. - Explanations are available from the Risks section of the asset detail view. - Risk tags in the asset list show a summary tooltip on hover. **Edge cases:** - If risk data is missing, a generic explanation is shown. - Long explanations open in a dismissible dialog. **Known limitations:** - Risk explanations are currently available for software assets. Machine and certificate asset detail views do not yet show a Risks section; this is planned for a future release. - Selecting a risk score shows a severity label (for example "Low Risk") but not yet a full score breakdown. - Explanations for the "Insufficient information" risk tag may not list every missing attribute. ------------------------------------------------------------------------ ### Additional asset attributes in the asset list and detail views The asset list and asset detail views now display additional key attributes. **Attributes added:** | Attribute | Applies to | Description | |----------------------|----------------------------|------------------------------------------| | OS version | Machine assets | Operating system version | | Product attribute | Software assets | Normalized product name | | Mesh unique asset ID | All asset types | Stable identifier assigned by Mesh | | External ID | All asset types | Identifier from the source system | **Behavior:** - All four attributes appear in both the asset list table and the asset detail page. - If an attribute is not populated for an asset, a dash (`-`) is displayed. - OS version and Product attribute apply only to their respective asset types. **Data availability:** - OS version and product values depend on data from your connected sources and may show a dash until the next connector sync completes. ------------------------------------------------------------------------ ## Bug fixes ### Identity correlation and merging fix Fixed a bug where some identity correlation records were not resolved even though the matching user record existed, so identity merging was skipped for those users. **Fix:** - Correlation processing now resolves these records and completes identity merging for the affected users. - Correlation jobs now run with less contention, improving reliability on large data sets. **Impact:** - Resolves stale identity correlation data in environments where this condition existed. - Improves identity deduplication and risk score accuracy for the affected identities. ------------------------------------------------------------------------ ## Known issues | Issue | Affected area | Status | |----|----|----| | OS version and product values show a dash (`-`) for machine and software assets until connector sync completes | Machine asset list, software asset list | Awaiting connector data sync | | Selecting a risk score shows a severity label only, not a full score breakdown | Asset detail — risk score | Planned for a future release | | Transitive or indirect identity correlations do not resolve automatically | Identity correlation | Planned for a future release | --- # Identity Mesh — April 8, 2026 Canonical URL: https://docs.axiad.io/release-notes/2026-04-08 **Release Date**: April 8, 2026\ **Release Type**: Bug Fix ------------------------------------------------------------------------ ## Overview This release is a targeted fix that restores the Status column in the asset list view across all asset types. The column was unintentionally removed in a recent update and is now back in its original position. ------------------------------------------------------------------------ ## Bug fixes ### Status column missing from the asset list view The Status column — an existing attribute in the asset list view — was missing from the Software, Crypto, and Machine tabs after a recent update. The column is now reinstated in its original position, so you can again see asset status at a glance. **Where to look:** open the NHI dashboard, select **View Assets**, and check the Software, Crypto, and Machine tabs. The Status column appears in each. This fix is live in production as of April 8, 2026. --- # Identity Mesh — April 9, 2026 Canonical URL: https://docs.axiad.io/release-notes/2026-04-09 **Release Date**: April 9, 2026\ **Release Type**: Enhancement ------------------------------------------------------------------------ ## Overview This release updates a label in the asset detail and list views to improve clarity. The "External ID" label is now "ServiceNow ID", making it clear that the identifier comes from your connected ServiceNow instance. ------------------------------------------------------------------------ ## Improvements ### "External ID" label renamed to "ServiceNow ID" The "External ID" label shown in the asset list and asset detail views has been renamed to "ServiceNow ID". This makes it immediately clear that the ID originates from the connected ServiceNow instance, reducing ambiguity when you investigate assets. **What changed:** - The asset list view now shows "ServiceNow ID" instead of "External ID". - The asset detail view now shows "ServiceNow ID" instead of "External ID". **Note:** this is a short-term label change. A future release will display the source system name based on your connector configuration, so the label stays accurate across all connector types. This change is live in production as of April 9, 2026. --- # Identity Mesh — April 22, 2026 Canonical URL: https://docs.axiad.io/release-notes/2026-04-22 **Release Date**: April 22, 2026\ **Release Type**: Feature + Enhancement + Bug Fix ------------------------------------------------------------------------ ## Overview This release delivers FAIR (Factor Analysis of Information Risk) reporting, a simpler asset attribute label, and significant reliability and speed improvements to data ingestion. It also fixes bugs in risk score accuracy, correlation diagram navigation, connector correlation counts, FAIR ALE (Annualized Loss Expectancy) calculations, and software inventory data integrity, and refines the risk score and risk tag explanations introduced in the [April 2 release](/release-notes/2026-04-02). ------------------------------------------------------------------------ ## New features ### Full FAIR report A full FAIR (Factor Analysis of Information Risk) report is now available, enabling quantitative risk analysis based on the industry-standard FAIR methodology. The report produces Annualized Loss Expectancy (ALE) and impact views you can consume directly from the dashboard. **What's included:** - Generate a complete FAIR report for a chosen scope of assets - ALE quantification with risk factor breakdowns - Impact visualization at the aggregate and per-asset-block level - Export-ready output for further analysis ------------------------------------------------------------------------ ### FAIR report generation fix Report generation has been stabilized so that a full FAIR report returns accurate, reproducible output. Earlier issues affecting report content and calculations have been addressed. **What changed:** - Corrected the data sourcing and aggregation that feed the report - Reports now regenerate reliably under expected load - Report content now matches the risk values shown in the dashboard ------------------------------------------------------------------------ ### Risk score and risk tag explanation refinements The detailed risk explanations introduced in the [April 2 release](/release-notes/2026-04-02) have been refined for clarity and consistency across asset types. **What's included:** - Refined explanation dialogs, available from the asset detail view and from any risk tag or risk score - Policy-based risk explanations now show the outcome of each policy assessment and the specific attributes that did not comply - A consistent explanation experience when an asset carries several risk tags at once **Known limitations:** - Selecting a risk score shows a severity label; a full score breakdown is planned for a future release - Explanations for the "Insufficient information" risk tag depend on how complete the source data is ------------------------------------------------------------------------ ## Improvements ### "Product attribute" label renamed to "Product" The "Product attribute" label is now "Product" across the asset list and asset detail views, matching how software assets are described in day-to-day work. ------------------------------------------------------------------------ ### Faster, more reliable data ingestion Data ingestion has been redesigned to remove intermittent failures that could occur when many records were processed at the same time. **Impact:** - Intermittent ingestion failures under heavy load have been eliminated. - Data from connectors is processed significantly faster — processing throughput has more than doubled under concurrent load. - Stalled ingestion jobs no longer retry indefinitely. ------------------------------------------------------------------------ ## Bug fixes ### Asset risk scores were calculated incorrectly Fixed a defect that produced incorrect risk scores for some assets. Computed scores now match the expected values based on the underlying policy assessment and contributing risk factors. **Impact:** - Risk scores are now consistent across the dashboard and downstream analytics. - Remediation prioritization is no longer skewed by scoring errors. ------------------------------------------------------------------------ ### Displayed risk scores did not match manually calculated values Resolved a related discrepancy where risk scores shown in the dashboard did not match values calculated manually from the same policy inputs. Displayed scores now reconcile with the policy assessment output. ------------------------------------------------------------------------ ### Correlation diagram could not scroll The correlation diagram on the human identity view did not scroll when the list of correlated identities extended beyond the visible area, so items below the initial view were unreachable. You can now scroll to see all correlated entities. ------------------------------------------------------------------------ ### Connector-sourced machine assets showed zero correlated entries Fixed a display bug where some connector-sourced machine asset views showed zero correlated entries even when the machine had correlations visible elsewhere in the product. **Impact:** - Correlation counts now reflect the actual number of correlated machine assets. - You can again navigate from a correlated-entity count to the underlying asset list without losing detail. ------------------------------------------------------------------------ ### FAIR ALE calculation and display fixes A set of fixes for the FAIR ALE calculation and display flow, covering correctness, refresh behavior, and consistency of the values you see. **Includes:** - The block-level "Show ALE & Impact at Block" view did not always refresh when opened. It now refreshes on every open, so the latest values are always shown. **Impact:** - FAIR ALE values now reflect the latest asset and policy state, so you can rely on them for risk quantification and reporting. ------------------------------------------------------------------------ ### Partial software inventory updates no longer overwrite complete asset records Fixed a data-integrity defect where a partial software inventory update arriving after a complete asset record could overwrite it, silently clearing fields that the partial update did not include. **Fix:** - Partial software inventory updates now merge into the existing record instead of replacing it, preserving fields the update does not carry. - Complete asset records are no longer degraded by later partial updates. **Impact:** - No more silent field loss on machine and software asset records after a partial inventory update. - Risk scoring, correlation, and reporting that depend on complete asset attributes stay accurate. ------------------------------------------------------------------------ ## Known issues | Issue | Affected area | Status | |----|----|----| | Selecting a risk score shows a severity label only, not a full score breakdown | Asset detail — risk score | Planned for a future release | --- # Identity Mesh — May 4, 2026 Canonical URL: https://docs.axiad.io/release-notes/2026-05-04 **Release Date**: May 4, 2026\ **Release Type**: Bug Fix ------------------------------------------------------------------------ ## Overview This release recalibrates the FAIR (Factor Analysis of Information Risk) calculation engine. Two critical defects were inflating Annualized Loss Expectancy (ALE) by 3–10 times for organizations with several risk rules and multiple loss forms. With both fixes in place, ALE values now land in the expected range — for a representative environment of about 450 identities, roughly \$1M–\$5M instead of over \$800M. The recalibrated engine is now ready for production use. ------------------------------------------------------------------------ ## Bug fixes ### Secondary loss forms were scaled by the number of affected identities Secondary loss forms — competitive advantage, fines and judgments, and reputation — were multiplied by the number of affected identities. Under the Open FAIR standard, these losses apply once per breach event, not once per identity. **What changed:** - Primary loss forms continue to scale with the number of affected identities. - Secondary loss forms are now applied once per event, as the standard requires. - FAIR constants and loss-form percentages are unchanged. **Impact:** removes a 30–65% inflation of ALE on any risk rule that uses multiple loss forms. ------------------------------------------------------------------------ ### Identities were double-counted across overlapping risk rules When several risk rules flagged the same people, each person was counted once per rule instead of once overall. This inflated the identity count 2–4 times and every loss estimate built on it. **What changed:** - The engine now counts each unique identity once across all risk rules. **Impact:** if three risk rules each flag the same 450 people, the report now counts 450 identities, not 1,350. This removes a roughly threefold inflation from the loss calculation. ------------------------------------------------------------------------ ## Combined outcome | Scenario | Before | After | |----|----|----| | Representative environment of about 450 identities with three overlapping risk rules | \$810M–\$835M ALE | \$1M–\$5M ALE | | FAIR report generation with the recalibrated engine | Not available | Available | --- # Identity Mesh — May 13, 2026 Canonical URL: https://docs.axiad.io/release-notes/2026-05-13 **Release Date**: May 13, 2026\ **Release Type**: Mixed (Feature, Bug Fixes) ------------------------------------------------------------------------ ## Overview This release introduces two single sign-on capabilities: a dedicated sign-in URL for your organization, and identity provider sign-out when you sign out of Mesh. It also fixes three sign-in and sign-out issues, presents correlated assets as a table on the asset details page, and simplifies the Identify switch menu. ------------------------------------------------------------------------ ## New features ### Dedicated sign-in URL for your organization Your organization can now access Mesh through its own dedicated URL, in the form `{tenant}.mesh.axiad.io`. You no longer need to enter your organization's domain when signing in, and the URL always takes you to your own organization's tenant. The generic Mesh URL remains available and works as before. What you'll see: - If you already have an active session with your identity provider, opening your organization's URL signs you in silently, with no interaction. - If you don't have an active session, you're taken to your organization's identity provider sign-in page and returned to Mesh after you authenticate. - If you have more than one active identity provider session, you see the standard account selection screen and sign in with the account you choose. - Bookmarks to your organization's URL keep working after sign-out, session timeout, and later visits. - If a tenant's sign-in configuration is incomplete, you see a clear authentication failure message instead of a partial sign-in. Each dedicated URL is bound to a single organization, with strict isolation between tenants. If you'd like a dedicated URL for your organization, contact Axiad support to have one configured. Your identity provider administrator then needs to add the following redirect URL to the Mesh app registration in your identity provider: `https://{tenant}.mesh.axiad.io/oauth2/callback?domain={domain}` ------------------------------------------------------------------------ ### Sign out now also ends your identity provider session Previously, signing out of Mesh ended only your Mesh session. Your identity provider session — for example with Microsoft Entra ID or Okta — stayed active in the browser. On a shared or public computer, the next person to open Mesh could be silently signed back in as you. Signing out now ends both sessions: - After you sign out, you're returned to the Mesh sign-in page. - Opening Mesh again requires you to sign in — either by selecting an account or by entering credentials. Silent re-authentication after sign-out is no longer possible. - Silent sign-in for normal visits is unchanged; only signing out ends the identity provider session. - This works with Microsoft Entra ID, Okta, and other OpenID Connect-compliant identity providers. This closes a security gap on shared and public computers. It pairs with the sign-out fix described under Bug fixes below. ------------------------------------------------------------------------ ### Correlated assets shown as a table on the asset details page The asset details page previously displayed correlated assets as tiles, which were hard to scan, sort, or filter when an asset had many correlations. Correlated assets now appear in a table that matches the main asset list: - Sort and filter on all relevant columns. - Pagination when an asset has many correlated assets. - The same look and behavior as the asset list, so both views feel consistent. ------------------------------------------------------------------------ ### Simpler Identify switch menu The Identify switch menu no longer shows redundant subheadings under each entry. The menu items now show only their primary labels — "Identity risk assessment" and "Crypto-vulnerable asset overview" — with tighter, more consistent spacing. ------------------------------------------------------------------------ ## Bug fixes ### Silent sign-in restored Users with an active identity provider session were being shown the sign-in screen when entering Mesh through the generic URL, instead of being signed in silently. Silent sign-in now works again: returning users with an active session enter Mesh without an unnecessary credential prompt. ------------------------------------------------------------------------ ### Sign out fully clears your session Signing out did not fully end the session. After closing every browser window and reopening the browser, you could land back in Mesh without being asked for credentials — a security concern on shared or borrowed computers. Signing out now clears the session completely, and any later visit requires a fresh sign-in. ------------------------------------------------------------------------ ### Duplicate dedicated sign-in URLs prevented In rare conditions, the same dedicated sign-in URL could be assigned to more than one tenant. Uniqueness is now strictly enforced, so each dedicated URL always belongs to exactly one organization. No action is needed. ------------------------------------------------------------------------ ## Known issues ### Machine asset risk score tooltip shows only a generic label On the asset details page for a machine asset, pointing to the risk score shows only the severity label (for example "Critical Risk") instead of the detailed breakdown of the score — the risks on the asset itself and the risks inherited from correlated assets. Fixed in the [May 20, 2026 release](/release-notes/2026-05-20). ### Asset details panel can hide the Risks section and action buttons for crypto assets On the asset details page for a crypto asset, the left panel doesn't scroll. On common laptop screen sizes, this can hide the Risks section and the "Delegate investigation" and "View in ServiceNow" buttons. As a workaround, use a taller window or reduce the browser zoom until the content fits. Fixed in the [May 20, 2026 release](/release-notes/2026-05-20). --- # Identity Mesh — May 15, 2026 Canonical URL: https://docs.axiad.io/release-notes/2026-05-15 **Release Date**: May 15, 2026\ **Release Type**: Improvement (Compliance Reporting Accuracy) ------------------------------------------------------------------------ ## Overview This release removes a long-standing false positive from crypto-asset compliance reporting: 3DES was being flagged on certificate templates that don't actually use it. 3DES findings now appear only when key archival is enabled on the certificate template — the only scenario where 3DES is genuinely in use — so you can focus on real key-archival risk instead of filtering noise. ------------------------------------------------------------------------ ## Improvements ### 3DES findings limited to certificate templates that actually use it Most crypto assets were showing 3DES in their non-compliance results even when the algorithm wasn't in use. 3DES only applies when key archival is enabled on the certificate template, but the previous check inferred its presence from an unrelated template setting. What changed: - A 3DES non-compliance finding is now reported only when key archival is enabled on the certificate template. - Certificate templates that don't archive private keys are no longer flagged for 3DES. You should see far fewer 3DES findings after this release. The findings that remain indicate genuine key-archival risk. No action is needed. --- # Identity Mesh — May 20, 2026 Canonical URL: https://docs.axiad.io/release-notes/2026-05-20 **Release Date**: May 20, 2026\ **Release Type**: Mixed (New Features, Improvements, Bug Fixes) ------------------------------------------------------------------------ ## Overview This release introduces conversational tenant onboarding — a guided, chat-based setup experience for administrators signing in to a new tenant for the first time. The two known issues from the [May 13, 2026 release](/release-notes/2026-05-13) — the risk score tooltip showing only a generic label, and the asset details panel hiding content for crypto assets — are fixed in this release. A data-integrity correction also closes a long-standing gap where partial software inventory updates could overwrite complete machine asset records. This release also includes reliability and supportability improvements. ------------------------------------------------------------------------ ## New features ### Conversational tenant onboarding When an administrator signs in to a tenant that hasn't completed setup, they're now guided through a full-page conversational onboarding experience instead of landing on the dashboard. The onboarding assistant walks you through the whole setup in one continuous flow: - Capture your organization profile and role. - Detect integrations that are already configured — for example a pre-provisioned Microsoft Entra ID connection — and acknowledge and skip them. - Guide identity provider setup and recommend connectors for your environment. - Validate each configured integration and run its first sync. - Finish with a summary of what was configured and how the first syncs went. How the flow behaves: - Only capabilities enabled for your tenant are offered; unavailable options are never shown. - Progress is saved at the tenant level and shared across all administrators, so anyone can resume exactly where the flow left off — even after an interruption. - If you skip onboarding, you return to the flow on your next sign-in. Users without administrator access go straight to the dashboard, with a note that onboarding is incomplete. - If several administrators onboard the same tenant at once, both sessions reflect the latest saved progress. - If validation or the first sync fails for an integration, onboarding stays resumable, with that item marked incomplete and the remaining work summarized. When everything completes, onboarding is marked done and you're taken to your dashboard. This replaces the manual setup that previously required moving between several admin pages, and shortens the time from first sign-in to a working tenant. ------------------------------------------------------------------------ ## Improvements ### Machine asset records no longer lose fields after software inventory updates Software inventory updates carry only a subset of a machine asset's fields. Previously, when a partial update arrived after a complete one, it could replace the full record and silently erase field values. Partial updates are now merged into the existing record instead, so machine asset fields are preserved across the full update lifecycle and no longer disappear after a software inventory update. ------------------------------------------------------------------------ ### Same risk score tooltip on the asset list and the asset details page The risk score tooltip on the asset list didn't match the one on the asset details page — the same score could appear to mean different things depending on the view. Both views now show identical tooltip content and behave the same way: - The same text: a header, one line per direct risk on the asset, and a summary of risks inherited from correlated assets. - The same behavior for when and how the tooltip appears and dismisses. - Both views draw from a single source, so they stay in step automatically in future updates. Risk score calculation and the visual score display are unchanged, and the existing behavior when a score is unavailable is preserved. ------------------------------------------------------------------------ ## Bug fixes ### Workday connector failures now visible in connector health When data collection from Workday failed, the connector kept retrying the same failing batch without reporting the error — so a stuck sync looked healthy and only showed up as missing data downstream. Failures are now recorded, and the reason appears in the connector health view, so you can see why a Workday sync is stuck. Retry behavior is unchanged. ------------------------------------------------------------------------ ### Detailed risk score tooltip restored on the asset details page Fixes a regression listed as a known issue in the [May 13, 2026 release notes](/release-notes/2026-05-13), where the risk score tooltip on a machine asset showed only a generic severity label (for example "Critical Risk") instead of explaining why the asset has its score. Pointing to the risk score on the asset details page now shows the full breakdown again: - A header: "The asset's score reflects:" - One line per direct risk category on the asset, with its count — for example "Risks associated to this asset: No owner (3)" - A summary of inherited risks — for example "Risks inherited from 38 correlated assets (190)" Severity is still conveyed by the color of the score. This restores the at-a-glance answer to "why is this asset risky?" during triage, without navigating to other views. ------------------------------------------------------------------------ ### Asset details panel scrolls again for crypto assets Fixes a regression listed as a known issue in the [May 13, 2026 release notes](/release-notes/2026-05-13), where the left panel on a crypto asset's details page had no way to scroll. Content below the visible area was cut off, hiding the Risks section and the "Delegate investigation" and "View in ServiceNow" buttons. The panel now scrolls whenever its content is taller than the window, so all fields, the Risks section, and both action buttons are reachable on standard screen sizes. On windows tall enough to fit everything, no scroll bar appears. You no longer need to zoom out or resize the browser to reach these controls. ------------------------------------------------------------------------ ### Version, Product, and OS version columns now sortable On the software asset list, the Version and Product columns didn't respond to clicks and couldn't be sorted, while the other columns sorted correctly. The OS version column on the machine asset list had the same issue. All three columns now sort correctly, with the same ascending and descending indicators as the other columns. ------------------------------------------------------------------------ ### Dashboard exports can be retried after a temporary error If a temporary service error occurred while starting an export from the dashboard, the export showed a generic "Export failed" message — but trying again produced "A similar export job is already in progress," leaving no way to retry or cancel. You had to wait for the invisible job to finish or expire. What changed: - After a temporary error, the export now enters a verifying state and checks the actual job status instead of declaring failure. - While an export is running, the export button is disabled and the job's progress is shown. - If an export is already running, its status is displayed instead of an error message. There's no longer any ambiguity between "export failed" and "export running," and you're never left without a way to retry. --- # Identity Mesh — May 27, 2026 Canonical URL: https://docs.axiad.io/release-notes/2026-05-27 **Release Date**: May 27, 2026\ **Release Type**: Mixed (New Features, Improvements, Bug Fixes) ------------------------------------------------------------------------ ## Overview This release adds six new connectors — Slack, Salesforce, JumpCloud, OneLogin, HashiCorp Vault, and GitLab — and a tenant-level preference for how timestamps display in the interface. Exports are faster and now match exactly what you see in the filtered asset list. The release also makes missing connector or risk engine components impossible to overlook, and fixes a confusing error message in the onboarding flow. ------------------------------------------------------------------------ ## New features ### Six new connectors: Slack, Salesforce, JumpCloud, OneLogin, HashiCorp Vault, and GitLab You can now bring identity and secrets data into Mesh from six additional providers: - **Slack** - **Salesforce** - **JumpCloud** - **OneLogin** - **HashiCorp Vault** - **GitLab** This group focuses on core identity providers and sources of non-human identity secrets, extending risk and correlation coverage across more of your SaaS and infrastructure estate. Further connectors — including Snowflake, Kubernetes, 1Password, Cisco Duo, and BambooHR — are planned for upcoming releases. ------------------------------------------------------------------------ ### Choose how timestamps display for your tenant Tenant administrators can now choose how interactive timestamps display across the dashboard — in each viewer's browser timezone or in UTC. The setting is on the tenant detail page in the admin area and applies to your whole tenant. - The choice applies consistently across tables, cards, detail panels, tooltips, modals, and log and report status views. - Timestamps use a standardized format in both modes — for example "May 27, 2026 3:04:05 PM." - CSV exports and downloaded files always use UTC, regardless of the display setting, so exported data stays canonical for downstream processing. - Browser-timezone mode follows daylight saving time rules, and setting changes take effect on subsequent views. - If the setting is unavailable or invalid, timestamps fall back to the platform-standard display. This removes ambiguity about how to read timestamps for teams spread across regions. ------------------------------------------------------------------------ ## Improvements ### Faster exports Export queries have been reworked to reduce latency and load for large exports. Exports complete faster — particularly for tenants with large asset or identity inventories. ------------------------------------------------------------------------ ### Exports match your filtered asset list Exports now apply the same filters as the asset list view, including Advanced Filters, so the data you export matches exactly what you see and filter on screen. This removes the discrepancy where an export could differ from the on-screen filtered list: what you filter is what you export. ------------------------------------------------------------------------ ## Bug fixes ### Missing connector or risk engine components no longer go unnoticed Previously, if an internal component of a connector or of the risk engine failed to load, the platform could keep running as though healthy — while the affected connector silently collected no data, or risk evaluation silently ran with some checks missing. The platform now detects this condition immediately at startup and flags it for correction, so it can't surface later as unexplained missing data or under-reported risk. No action is needed. ------------------------------------------------------------------------ ### Onboarding no longer shows a stale error after you enter credentials During conversational onboarding, an error banner saying the assistant was recovering from a credential-entry problem could stay on screen even after a working credential form had appeared — or after you had already submitted your credentials successfully. A successful step could look failed, prompting unnecessary retries or support requests. The banner now clears as soon as a working credential form is available or a submission has completed. It remains only when there's genuinely nothing to act on yet. --- # Identity Mesh — June 3, 2026 Canonical URL: https://docs.axiad.io/release-notes/2026-06-03 **Release Date**: June 3, 2026\ **Release Type**: Mixed (Security Hardening, Improvements, Bug Fixes) ------------------------------------------------------------------------ ## Overview For organizations with a dedicated sign-in URL, sign-in now always goes through that URL — completing the sign-out hardening started in the [May 13, 2026 release](/release-notes/2026-05-13). This release also fixes two issues in the conversational onboarding wizard — invalid Azure Entra ID credentials being accepted silently, and the wizard skipping its setup and validation steps — and removes an "Access Denied" error that could block dashboard navigation after a session expired. This release also includes reliability and code quality improvements. ------------------------------------------------------------------------ ## Improvements ### Sign-in goes through your dedicated tenant URL when one is configured If your organization has a dedicated sign-in URL (in the form `{tenant}.mesh.axiad.io`), all sign-ins now go through it: - Entering your work email on the generic Mesh URL redirects you to your organization's dedicated URL to complete sign-in. - Organizations without a dedicated URL keep using the generic URL — nothing changes for them. - If your organization can't be resolved during sign-in, you now see an explicit error page instead of silently falling back to generic sign-in. Why this matters: signing out could not reliably clear every trace of a session that had been started on the generic URL for an organization that also has a dedicated URL. Routing all sign-ins through the dedicated URL removes that situation entirely, so signing out on a shared or public computer fully clears your session. This completes the sign-out hardening from the [May 13, 2026 release](/release-notes/2026-05-13). Returning users are now always taken to the right sign-in page on their first visit. ------------------------------------------------------------------------ ### "Access Denied" no longer blocks navigation after a session expires After a session expired, signing back in from the asset list or asset details pages could end at an "Access Denied" page instead of returning you to where you were. An overly strict security filter was matching a harmless part of the page address and blocking the redirect. The address format has been adjusted so the filter no longer triggers, and navigation resumes normally after sign-in. Nothing changes in how you use these pages. ------------------------------------------------------------------------ ## Bug fixes ### Azure Entra ID connector now rejects invalid credentials during onboarding In the connector setup step of the conversational onboarding wizard, entering an invalid client ID or client secret for the Azure Entra ID connector previously produced a false success: the wizard reported the connector as configured and active, and it appeared under System Configurations → Connectors with an Enabled status — even though authentication had never succeeded and no data would ever sync. Only a subtle health indicator hinted at the problem, so you could finish onboarding believing the integration worked. What changed: - The wizard now verifies the credentials with a real authentication check before reporting success. - Invalid credentials produce a clear error — including the error code from Microsoft when available — and the wizard stays on the connector setup step. - The connector is only marked Enabled after authentication succeeds. - If authentication stalls after setup, an explicit failure state appears in connector health within 30 seconds. You now get immediate, accurate feedback when credentials are wrong, instead of a connector that looks configured but never syncs. ------------------------------------------------------------------------ ### Onboarding wizard shows its setup and validation steps instead of skipping ahead After identity provider and connector configuration, the onboarding wizard previously jumped straight to the completion step. The setup and validation steps were marked done in the step indicator, but their content was never shown — you got no view of what was configured or what validation actually ran. What changed: - The wizard now pauses at the setup step to confirm the chosen connector and settings, with a Continue button. - It pauses at the validation step to show the validation results before finishing. - The completion step now includes a summary covering profile, integrations, setup, and validation — including any non-blocking warnings — so you keep a final review of everything the wizard did. This restores visibility into what the wizard configured on your behalf, which matters both for confidence during setup and for troubleshooting afterward. --- # Identity Mesh — June 10, 2026 Canonical URL: https://docs.axiad.io/release-notes/2026-06-10 **Release Date**: June 10, 2026\ **Release Type**: Mixed (New Features, Improvements, Operational Fixes) ------------------------------------------------------------------------ ## Overview This release improves filtering across non-human identity (NHI) asset screens: a unified filter experience shared by the dashboard and the asset lists, and the groundwork for filtering correlated assets on the asset details page. It also includes reliability and performance improvements. ------------------------------------------------------------------------ ## New features ### Unified filters across the dashboard and asset lists NHI asset screens previously offered two separate filtering surfaces — a dashboard-level filter and a per-table filter — with different labels, available values, and behavior. You had to rebuild your filters every time you moved between the NHI dashboard and the asset lists. This release replaces both with a single filter area used consistently across every NHI asset screen. **What changed:** - The NHI dashboard, asset lists, and asset details now share one filter area with the same interaction model. - The filter area combines predefined filter values and values you enter yourself in one place, with consistent add, edit, and remove behavior. - Filter selections carry across NHI screens for the rest of your session, so drilling into a detail page no longer drops your context. - Each screen still loads its default unfiltered view when no filters are active. - Exporting from any NHI asset screen now asks you to choose **All data** or **Filtered data**, and the export matches your choice exactly: filtered exports include only the records matching your active filters, and **All data** exports the full dataset regardless of filters. - When your filters match no records, the screen shows a clear empty state with options to adjust or clear the filters. - Filters that don't apply to the current screen are labeled as not applicable rather than hidden. **Why it matters:** you can build a filter set once and carry it through an investigation without reapplying it. The export prompt removes any ambiguity about whether an export reflects the on-screen view or the full dataset. ------------------------------------------------------------------------ ### Groundwork for correlated asset filtering on asset details On the asset details page, the Correlated Assets section (Software, Certificate, and Machine tabs) previously showed every correlated asset with no way to filter. Triaging an asset with hundreds of correlations meant scrolling the entire list. This release adds the underlying support for filtering correlated assets by risk, platform, owner, organization, and location. Filters are scoped to the asset you are viewing and independent of any filters applied on the main asset list. Filtered counts are reported for each tab — including tabs with zero matches — so you can see at a glance how a filter set intersects each asset type. The filter controls appear on the asset details page in the next release. ------------------------------------------------------------------------ ## Improvements This release also includes reliability and performance improvements with no user-visible changes. ------------------------------------------------------------------------ --- # Identity Mesh — June 17, 2026 Canonical URL: https://docs.axiad.io/release-notes/2026-06-17 **Release Date**: June 17, 2026\ **Release Type**: Mixed (New Features, Improvements) ------------------------------------------------------------------------ ## Overview This release completes filtering for correlated assets on the asset details page, refines the tenant-level timestamp display preference, and corrects a misleading message on the **View in ServiceNow** action. ------------------------------------------------------------------------ ## New features ### Filter correlated assets on the asset details page The previous release ([June 10, 2026](/release-notes/2026-06-10)) added the underlying support for filtering the Correlated Assets section on the asset details page. This release adds the controls: you can now filter the Correlated Assets panel directly, using the same filter dialog and chip interaction you already use on the main NHI asset list. **What changed:** - A **Filters** button appears next to the correlated assets header on the asset details page, for all three tabs: Software, Certificate, and Machine. - The filter dialog offers the same five categories as the asset list: Risk, Platforms, Owners, Organizations, and Locations — no new pattern to learn. - Filters applied here are scoped to the Correlated Assets panel and kept separate from the main asset list filters, so the two no longer collide or overwrite each other. - Active filters render as chips below the **Filters** button — including chips for filters that don't affect the currently visible tab, so your full investigation scope stays visible. You can remove chips individually or use **Clear all**. - Applying, removing, or clearing filters refreshes the active tab, returns you to the first page, updates the header total, and refreshes per-tab counts. Tabs with zero matches show 0 explicitly, and a clear empty state appears when no records match. - Filters persist as you switch between the Software, Certificate, and Machine tabs, and as you move from asset to asset during the same session. - If a request fails temporarily, your filter set is preserved so you can retry without rebuilding it. **Why it matters:** triage of correlation-heavy assets moves from scroll-and-scan to filter-and-inspect, using the same filtering you already know from the asset list. ------------------------------------------------------------------------ ### Timestamp display preference refinements The tenant-level timestamp display preference — **Browser Timezone** or **UTC**, introduced in the [May 27, 2026 release](/release-notes/2026-05-27) — is refined in this release: - Daylight saving time is now handled correctly when **Browser Timezone** is selected — no inconsistent rendering across transitions. - Timestamps use one standardized format (for example, Jun 17, 2026 7:47:28 AM) in both modes — only the time zone changes, not the layout. - Changing the setting takes effect immediately: users pick up the new preference without signing out. - If the setting is missing or invalid, timestamps fall back to the platform-standard rendering — no broken timestamps. **Why it matters:** administrators can pick the time zone convention that suits their team without per-user configuration, and the guarantee that exports stay in UTC keeps downstream analysis consistent regardless of the display setting. ------------------------------------------------------------------------ ## Improvements ### Clearer message when the ServiceNow integration is not enabled On the asset details page, the **View in ServiceNow** action is disabled when the ServiceNow integration is not enabled for your tenant. Until now, the message in that state read "ServiceNow ID not available" — wording that suggested the asset lacked a ServiceNow record, when the actual cause was the integration setting. **What changed:** - The message now clearly states that the ServiceNow integration is not enabled for the tenant. - Other disabled states keep their own specific messages. - If your tenant configuration changes during a session, the message updates on the next page view — no stale wording. - The behavior of the action when ServiceNow is enabled is unchanged. **Why it matters:** "the asset doesn't have a ServiceNow ID" and "the integration isn't enabled for your tenant" are different problems — the message now points you at the right one. ------------------------------------------------------------------------ --- # Identity Mesh — June 24, 2026 Canonical URL: https://docs.axiad.io/release-notes/2026-06-24 **Release Date**: June 24, 2026\ **Release Type**: Mixed (New Features, Improvements, Bug Fixes) ------------------------------------------------------------------------ ## Overview This release delivers four features and one bug fix: - **First-run setup for new environments** — the first tenant on a fresh environment can now be created entirely through the product, with no manual setup steps. - **Email code verification for onboarding links** — onboarding links now require a 6-digit code sent to the same email address, protecting sign-up against link interception. - **Universal REST API connector** — connect any REST API that publishes an OpenAPI or Swagger specification, through a guided setup, without waiting for a purpose-built connector. - **Correlation review workflow improvements** — batch decisions on the correlation diagram, one-click quick reject, focus mode, and an always-visible save bar. It also ships the **timestamp display preference** to production and fixes an audit-log view that did not follow that preference. ------------------------------------------------------------------------ ## New features ### First-run setup for new environments On a brand-new environment there was previously no way to create the first tenant through the product — initial setup required manual intervention. This release adds a supported first-run setup path. **What changed:** - When an environment has no tenants yet, the sign-in page offers a first-run setup login for the platform operator. - Signing in through first-run setup opens the guided onboarding experience directly, which creates the first tenant, its first administrator, and its identity provider routing. - First-run login works only while the environment has no tenants. Once the first tenant exists, it is rejected and normal sign-in takes over. - First-run sign-ins and first-tenant creation are audited, and the login is rate-limited and protected against repeated failed attempts. **Why it matters:** standing up a new environment no longer requires out-of-band steps — the first customer can be onboarded entirely through the product. ------------------------------------------------------------------------ ### Email code verification for onboarding links Onboarding invitations are delivered as a sign-in link sent by email. Previously the link was the only factor: anyone who obtained it could complete onboarding. This release adds a second verification step. **What changed:** - Opening an onboarding link now presents a verification screen instead of starting onboarding immediately. - A 6-digit code is sent to the same email address the link was issued to. The code expires after about 10 minutes. - Onboarding starts only after the correct code is entered. The link and code are consumed together — neither can be reused. - If the code expires before you enter it, you can request a new code without needing a new onboarding link. - After three failed code attempts, the link is invalidated — contact Axiad support or request a new onboarding link. **Why it matters:** even if an onboarding link leaks — through a forwarded email, for example — it cannot be redeemed without access to the recipient's mailbox. ------------------------------------------------------------------------ ### Universal REST API connector You can now connect Axiad Mesh to any REST API that publishes an OpenAPI or Swagger specification, without waiting for a purpose-built connector. **What changed:** - A guided, conversational setup walks you through configuring the connector: application name, base URL, the OpenAPI or Swagger specification, and the authentication scheme. The setup validates the specification and helps you select which data to collect. - Connector configurations are versioned, so template upgrades are deliberate rather than automatic. - Connector activity is recorded in more detail, and authentication failures now report the specific error returned by the source system — making setup problems much easier to diagnose. **Why it matters:** adding a new REST data source becomes self-service — an API specification and a short guided setup, instead of a request for a custom connector. ------------------------------------------------------------------------ ### Timestamp display preference The tenant-level timestamp display preference introduced in the previous release ships to production in this cycle. See the [June 17, 2026 release notes](/release-notes/2026-06-17) for the full description. **In summary:** - Tenant administrators choose **Browser Timezone** or **UTC** as the tenant-wide default. - One standardized timestamp format applies across all interactive views. - CSV exports always remain UTC, regardless of the display preference. - Daylight saving time is handled correctly, setting changes take effect immediately, and rendering falls back safely if the setting is missing. A follow-up fix in this release (see Bug fixes below) brings the audit-log view under **Settings → Config Management** in line with the preference — with it, every audit-log view now respects the tenant setting. ------------------------------------------------------------------------ ### Correlation review workflow improvements The correlation review workflow on the human identity dashboard has been overhauled to reduce the time it takes to complete a correlation review session. The individual pieces shipped across recent releases; as of this release, the full set is live. **What's now available:** - Select multiple correlation links directly in the correlation diagram using per-link checkboxes. - Confirm or reject each selected link inline — a single batch can mix confirmations and rejections. - A **Save and Continue** bar stays visible at the top while you scroll. - A persistent "Unsaved changes" banner appears while decisions are pending, and a navigation guard prevents losing them. - One-click quick reject saves a single rejection immediately and moves on, without saving other pending decisions. - Focus mode: click a node to dim unrelated nodes and links (they are not hidden). Click the same node again, or the empty canvas, to exit. - If some decisions in a batch fail to save, results are reported per decision so you can retry only what failed. **Why it matters:** reviewing sessions with many correlation links no longer means acting on one link at a time. Batch decisions, quick reject, and focus mode together are designed to cut review session time by roughly 30 percent on representative workloads. ------------------------------------------------------------------------ ## Improvements This release also includes reliability and performance improvements with no user-visible changes. ------------------------------------------------------------------------ ## Bug fixes ### Audit-log timestamps under Settings → Config Management now follow the tenant preference The timestamp display preference covered most of the product, but the audit-log view under **Settings → Config Management** was missed: its Time column kept a hardcoded "Time (UTC)" header and the old timestamp format, and long values were cut off with no way to read them in full. **What changed:** - The Time column now follows the tenant timestamp preference, and the column header reflects the selected time zone — UTC or your browser's local zone. - Values render in the standardized timestamp format used across the product. - Hovering over a timestamp shows the full value, so nothing is lost when the column is narrow. **Why it matters:** every audit-log view now honors the tenant timestamp preference uniformly. ------------------------------------------------------------------------ --- # Identity Mesh — July 3, 2026 Canonical URL: https://docs.axiad.io/release-notes/2026-07-03 **Release Date**: July 3, 2026\ **Release Type**: Bug Fix ------------------------------------------------------------------------ ## Overview This release delivers a single high-priority bug fix that closes a filtering gap in the NHI asset list. Two fields that already appeared as columns — **OS Version** on Machine assets and **Version** on Software assets — are now also available as fields in **Advanced Filters**. ------------------------------------------------------------------------ ## Bug fixes ### OS Version and Version fields available in Advanced Filters **OS Version** appeared as a sortable column on the Machine asset list and in the asset detail sidebar, but was not offered as a field in Advanced Filters. The same gap applied to the **Version** column on the Software asset list. The two are distinct fields — OS Version is the machine's operating system version (for example, 10.0.19045), while Version is the software product's version (for example, 2.3.1) — and both were addressed together. **What changed:** - **OS Version** can now be used in Advanced Filters on Machine assets. - **Version** can now be used in Advanced Filters on Software assets. - Each field applies only to its own asset type and is marked not applicable on other tabs. - Both fields use text matching — contains, equals, matches one of a list, and is-empty checks — consistent with how they sort today. There is no version-aware greater-than or less-than comparison. - Existing filters and views are unaffected. **Why it matters:** if you can see it as a column, you can now filter by it — closing the gap left when the unified filter area was introduced. No other changes ship in this release. For the most recent feature updates, see the [June 24, 2026 release](/release-notes/2026-06-24). ------------------------------------------------------------------------ --- # Identity Mesh — July 9, 2026 Canonical URL: https://docs.axiad.io/release-notes/2026-07-09 **Release Date**: July 09, 2026\ **Release Type**: Bug Fix ------------------------------------------------------------------------ ## Overview This release delivers an urgent data-integrity fix for the **Azure connector**: users deleted or terminated in Microsoft Entra ID could remain shown as Active in Axiad Mesh and keep non-zero risk counts. Deletions now propagate correctly, affected users are marked Terminated, and their risk findings are cleared — including for accounts that were already stuck before this fix. ------------------------------------------------------------------------ ## Bug fixes ### Azure connector: Deleted Entra ID users no longer remain Active Users deleted or terminated in Microsoft Entra ID continued to appear as Active in Axiad Mesh, with their risk findings still counted. Two problems caused this: deletion events from Entra ID were not being applied, and risk findings were not cleared for users in the Terminated state. Accounts affected in the past could not recover on their own, because their original deletion event had already been missed. **What changed:** - Deletions in Entra ID now propagate to Axiad Mesh — affected users are marked Terminated. - After each successful full synchronization, users no longer present in Entra ID are marked Terminated. This safety net means a missed deletion event can no longer leave an account stuck as Active. It runs only after a complete, successful full synchronization — never after a partial or incremental one — and only affects users from that specific connector, so other connectors' users are never touched. - Risk findings for Terminated users are now cleared automatically. Previously they were removed only after the user record disappeared entirely. - Accounts that were already stuck as Active are corrected as part of the rollout, once the affected connector completes a full synchronization. **What to expect:** these corrections are applied as part of the release rollout — no action is required on your side. If users deleted in Entra ID still appear as Active after your Azure connector has completed a full synchronization, contact Axiad support. ------------------------------------------------------------------------ --- # Identity Mesh — July 15, 2026 Canonical URL: https://docs.axiad.io/release-notes/2026-07-15 **Release Date**: July 15, 2026 **Release Type**: Improvement ## Overview This release adds an exclude-style filter operator to the asset list, making compliance queries such as "all PQC-compliant assets" expressible for the first time. The release also includes reliability and performance improvements. ------------------------------------------------------------------------ ## Improvements ### Filter assets by what they are not Advanced Filters on the asset list now support a **not in** operator for the **Risk Tags** and **Top Risk Reasons** fields. A *not in* filter matches assets that carry **none** of the selected values — a true exclusion. **Why it matters:** some of the most useful compliance views are defined by absence. For example, "PQC-compliant assets" means assets with no unresolved post-quantum cryptography risk. Previously the closest available filter matched assets that had *at least one other* risk, so an asset carrying both a PQC risk and an unrelated risk could wrongly appear in the results. With **not in**, that asset is correctly excluded. **How it works:** - In **Advanced Filters**, choose the **Risk Tags** or **Top Risk Reasons** field and select the **not in** operator, then pick one or more values. - The active filter chip reads, for example, "Risk Tags not in (selected values)." - Multiple values are supported; selecting no values leaves results unchanged. - The operator appears only on fields that support it. ------------------------------------------------------------------------ No other customer-facing changes ship in this release. For the most recent feature updates, see the [July 9, 2026 release](/release-notes/2026-07-09). --- # Release notes Canonical URL: https://docs.axiad.io/release-notes/ Release notes for Axiad Mesh are published here in chronological order, newest first. Each entry summarizes what changed in that release — new features, improvements, and bug fixes — along with any known issues, breaking changes, and actions you may need to take.