# Identity Mesh — June 3, 2026 **Release Date**: June 3, 2026\ **Release Type**: Mixed (Security Hardening, Improvements, Bug Fixes) ------------------------------------------------------------------------ ## Overview For organizations with a dedicated sign-in URL, sign-in now always goes through that URL — completing the sign-out hardening started in the [May 13, 2026 release](/release-notes/2026-05-13). This release also fixes two issues in the conversational onboarding wizard — invalid Azure Entra ID credentials being accepted silently, and the wizard skipping its setup and validation steps — and removes an "Access Denied" error that could block dashboard navigation after a session expired. This release also includes reliability and code quality improvements. ------------------------------------------------------------------------ ## Improvements ### Sign-in goes through your dedicated tenant URL when one is configured If your organization has a dedicated sign-in URL (in the form `{tenant}.mesh.axiad.io`), all sign-ins now go through it: - Entering your work email on the generic Mesh URL redirects you to your organization's dedicated URL to complete sign-in. - Organizations without a dedicated URL keep using the generic URL — nothing changes for them. - If your organization can't be resolved during sign-in, you now see an explicit error page instead of silently falling back to generic sign-in. Why this matters: signing out could not reliably clear every trace of a session that had been started on the generic URL for an organization that also has a dedicated URL. Routing all sign-ins through the dedicated URL removes that situation entirely, so signing out on a shared or public computer fully clears your session. This completes the sign-out hardening from the [May 13, 2026 release](/release-notes/2026-05-13). Returning users are now always taken to the right sign-in page on their first visit. ------------------------------------------------------------------------ ### "Access Denied" no longer blocks navigation after a session expires After a session expired, signing back in from the asset list or asset details pages could end at an "Access Denied" page instead of returning you to where you were. An overly strict security filter was matching a harmless part of the page address and blocking the redirect. The address format has been adjusted so the filter no longer triggers, and navigation resumes normally after sign-in. Nothing changes in how you use these pages. ------------------------------------------------------------------------ ## Bug fixes ### Azure Entra ID connector now rejects invalid credentials during onboarding In the connector setup step of the conversational onboarding wizard, entering an invalid client ID or client secret for the Azure Entra ID connector previously produced a false success: the wizard reported the connector as configured and active, and it appeared under System Configurations → Connectors with an Enabled status — even though authentication had never succeeded and no data would ever sync. Only a subtle health indicator hinted at the problem, so you could finish onboarding believing the integration worked. What changed: - The wizard now verifies the credentials with a real authentication check before reporting success. - Invalid credentials produce a clear error — including the error code from Microsoft when available — and the wizard stays on the connector setup step. - The connector is only marked Enabled after authentication succeeds. - If authentication stalls after setup, an explicit failure state appears in connector health within 30 seconds. You now get immediate, accurate feedback when credentials are wrong, instead of a connector that looks configured but never syncs. ------------------------------------------------------------------------ ### Onboarding wizard shows its setup and validation steps instead of skipping ahead After identity provider and connector configuration, the onboarding wizard previously jumped straight to the completion step. The setup and validation steps were marked done in the step indicator, but their content was never shown — you got no view of what was configured or what validation actually ran. What changed: - The wizard now pauses at the setup step to confirm the chosen connector and settings, with a Continue button. - It pauses at the validation step to show the validation results before finishing. - The completion step now includes a summary covering profile, integrations, setup, and validation — including any non-blocking warnings — so you keep a final review of everything the wizard did. This restores visibility into what the wizard configured on your behalf, which matters both for confidence during setup and for troubleshooting afterward.