# Identity Mesh — May 13, 2026 **Release Date**: May 13, 2026\ **Release Type**: Mixed (Feature, Bug Fixes) ------------------------------------------------------------------------ ## Overview This release introduces two single sign-on capabilities: a dedicated sign-in URL for your organization, and identity provider sign-out when you sign out of Mesh. It also fixes three sign-in and sign-out issues, presents correlated assets as a table on the asset details page, and simplifies the Identify switch menu. ------------------------------------------------------------------------ ## New features ### Dedicated sign-in URL for your organization Your organization can now access Mesh through its own dedicated URL, in the form `{tenant}.mesh.axiad.io`. You no longer need to enter your organization's domain when signing in, and the URL always takes you to your own organization's tenant. The generic Mesh URL remains available and works as before. What you'll see: - If you already have an active session with your identity provider, opening your organization's URL signs you in silently, with no interaction. - If you don't have an active session, you're taken to your organization's identity provider sign-in page and returned to Mesh after you authenticate. - If you have more than one active identity provider session, you see the standard account selection screen and sign in with the account you choose. - Bookmarks to your organization's URL keep working after sign-out, session timeout, and later visits. - If a tenant's sign-in configuration is incomplete, you see a clear authentication failure message instead of a partial sign-in. Each dedicated URL is bound to a single organization, with strict isolation between tenants. If you'd like a dedicated URL for your organization, contact Axiad support to have one configured. Your identity provider administrator then needs to add the following redirect URL to the Mesh app registration in your identity provider: `https://{tenant}.mesh.axiad.io/oauth2/callback?domain={domain}` ------------------------------------------------------------------------ ### Sign out now also ends your identity provider session Previously, signing out of Mesh ended only your Mesh session. Your identity provider session — for example with Microsoft Entra ID or Okta — stayed active in the browser. On a shared or public computer, the next person to open Mesh could be silently signed back in as you. Signing out now ends both sessions: - After you sign out, you're returned to the Mesh sign-in page. - Opening Mesh again requires you to sign in — either by selecting an account or by entering credentials. Silent re-authentication after sign-out is no longer possible. - Silent sign-in for normal visits is unchanged; only signing out ends the identity provider session. - This works with Microsoft Entra ID, Okta, and other OpenID Connect-compliant identity providers. This closes a security gap on shared and public computers. It pairs with the sign-out fix described under Bug fixes below. ------------------------------------------------------------------------ ### Correlated assets shown as a table on the asset details page The asset details page previously displayed correlated assets as tiles, which were hard to scan, sort, or filter when an asset had many correlations. Correlated assets now appear in a table that matches the main asset list: - Sort and filter on all relevant columns. - Pagination when an asset has many correlated assets. - The same look and behavior as the asset list, so both views feel consistent. ------------------------------------------------------------------------ ### Simpler Identify switch menu The Identify switch menu no longer shows redundant subheadings under each entry. The menu items now show only their primary labels — "Identity risk assessment" and "Crypto-vulnerable asset overview" — with tighter, more consistent spacing. ------------------------------------------------------------------------ ## Bug fixes ### Silent sign-in restored Users with an active identity provider session were being shown the sign-in screen when entering Mesh through the generic URL, instead of being signed in silently. Silent sign-in now works again: returning users with an active session enter Mesh without an unnecessary credential prompt. ------------------------------------------------------------------------ ### Sign out fully clears your session Signing out did not fully end the session. After closing every browser window and reopening the browser, you could land back in Mesh without being asked for credentials — a security concern on shared or borrowed computers. Signing out now clears the session completely, and any later visit requires a fresh sign-in. ------------------------------------------------------------------------ ### Duplicate dedicated sign-in URLs prevented In rare conditions, the same dedicated sign-in URL could be assigned to more than one tenant. Uniqueness is now strictly enforced, so each dedicated URL always belongs to exactly one organization. No action is needed. ------------------------------------------------------------------------ ## Known issues ### Machine asset risk score tooltip shows only a generic label On the asset details page for a machine asset, pointing to the risk score shows only the severity label (for example "Critical Risk") instead of the detailed breakdown of the score — the risks on the asset itself and the risks inherited from correlated assets. Fixed in the [May 20, 2026 release](/release-notes/2026-05-20). ### Asset details panel can hide the Risks section and action buttons for crypto assets On the asset details page for a crypto asset, the left panel doesn't scroll. On common laptop screen sizes, this can hide the Risks section and the "Delegate investigation" and "View in ServiceNow" buttons. As a workaround, use a taller window or reduce the browser zoom until the content fits. Fixed in the [May 20, 2026 release](/release-notes/2026-05-20).