Skip to main content
View as MarkdownOpen in ChatGPTOpen in Claude

Identity Mesh — September 2, 2026

Release Date: September 2, 2026
Release Type: Mixed (New Features, Improvements, Bug Fixes, Security Fixes)

Overview​

This release connects the Mesh assistant to tools you host, lets it build live data tables on demand, introduces a guided Okta connector setup, and brings a new Settings experience for managing connectors, identity providers, and logs.

  • External tool servers — register MCP servers you host, approve the tools the assistant may call, and review every call it makes on your behalf.
  • Live tables in the workspace — ask for "a table of the riskiest service accounts" and the assistant composes a live table widget from your data.
  • Guided Okta connector setup — a five-step wizard with a connection test before you continue.
  • New Settings experience — connectors, identity providers, MCP servers, external agents, and logs managed from one consistent place.

New features​

External tool servers for the assistant​

You can now register MCP servers that you host and let the Mesh assistant use them. Tenant administrators add a server from Settings → MCP servers, choose which of its discovered tools the assistant may call, and mark whether each tool only reads data or can change it.

What you get:

  • A guided setup. Connect, authenticate, discover the server's tools, pick the ones you want to allow, and save. The connection is tested before you can grant tools.
  • Attributed answers. When the assistant uses one of your tools, the answer says which server it came from. Results from external servers are never persisted in Mesh.
  • Safety controls. Tools that change data are held to a stricter grant, and a server marked read-only cannot be given a data-changing tool.
  • Large catalogues. The tool picker scales to servers exposing hundreds of tools.
  • Usage logs. Every external call the assistant makes is recorded with the server, the tool, and the user who asked. Per-server logs and a summary view are available under Settings → Logs.

Why it matters: the assistant can now answer from systems Mesh does not ingest — a ticketing system, an internal knowledge base, a vendor console — without that data being copied into Mesh, and with an audit trail of what was asked and where.

To get started, see Connect an external MCP server.

Live data tables in the agentic workspace​

When you ask the assistant for a data set that no curated widget covers — "show me the riskiest service accounts", "a table of non-human identities by owner" — it now composes a live table widget on the canvas instead of answering with an inline chat table or substituting an unrelated summary widget.

  • The table is bound to your live data and refreshes like any other widget.
  • Columns are taken from the underlying data set.
  • An empty result is shown as an empty table with an explanation, not as an error.

This release ships the first such data set, non-human identities (service accounts and similar principals). Further data sets will follow. See Generative UI.

Guided Okta connector setup​

Setting up an Okta connector is now a five-step wizard — Connection, Authenticate, Collection, Tuning, Review — instead of a single long form.

  • One action per step. Later steps stay locked until the current one is complete.
  • Authenticate the way you already do. Choose an API token or a service-app key; only the fields for the method you picked are shown. The step lists what to set up on the Okta side alongside what to enter in Mesh.
  • Test before you continue. The connection test must pass before you can go on. If a token is missing one of the read scopes the connector needs, the step names the missing scope.
  • Paste your Okta URL. You can paste your Okta admin or preview-domain URL and Mesh derives the organization from it.
  • View mode. An existing connector opens read-only in the same layout, so what you review matches what you configured.

See the Okta connector page for prerequisites and capabilities.

Improvements​

A new Settings experience​

Connectors, identity providers, MCP servers, external agents, and logs now live in one consistent Settings area with a shared look and feel.

  • Manage every integration type from the same tables, forms, and dialogs.
  • Connector health is clearer: a connector you deliberately stopped is now shown differently from one whose state is unknown.
  • Settings for the agentic workspace are available to administrators.

Pagination and page-size controls in the audit log​

The audit log now offers page-size controls (100 or 1,000 rows per page) and page navigation, including jumping directly to the last page. See Audit logging.

On-prem connector management​

  • The connection-test result is easier to read and can be collapsed.
  • The agent detail panel can be resized.
  • The ingestion runs table has a refresh control.

See On-prem connectors.

Faster re-evaluation on large tenants​

Tenant-wide risk re-evaluation and compliance evaluation place less load on the database, so large tenants complete re-evaluation more predictably.

Bug fixes​

Connector sync frequency was not always applied​

The sync frequency configured for a connector is now applied on every schedule refresh. Previously a connector could continue on its default schedule, and a connector that was still initializing could have its next run repeatedly postponed. Connectors whose sync has stopped are now shown as stopped in Settings.

SBOM project identifiers were hidden when they looked like UUIDs​

The SBOM Projects field in the asset detail panel did not display project identifiers that were UUID-shaped, even though the value was correct. The field now shows them.

Compliance grading​

  • An algorithm that no policy rule classifies is no longer reported as Compliant and does not count towards the compliant total.
  • Compliance templates scoped to one tenant are now evaluated only for that tenant.
  • Disabling a compliance template now takes effect at run time.
  • A tenant can create more than one user compliance program.

See Prove continuous compliance.

Universal REST connector ignored required request headers​

When a connector was generated from an OpenAPI specification, header parameters declared in the specification were not carried into the generated template, so APIs that require a protocol header on every request failed. Header parameters are now applied, and the wizard has a Custom request headers section for headers you need to add yourself. See Universal REST connector.

Re-correlation warning overstated what is deleted​

The confirmation dialog and consent statement said that re-correlating deletes every existing correlation. Correlations you asserted or confirmed are preserved; only engine-generated links are rebuilt. The wording now says which links are kept. See Manage the correlation engine.

Security fixes​

  • CVE-2026-56854 — updated the Go cryptography library across the platform.
  • CVE-2026-84304 — updated the gRPC library across the platform.
  • CVE-2026-46600 — updated the Go networking library across the platform.