Skip to main content
View as MarkdownOpen in ChatGPTOpen in Claude

Identity Mesh — September 10, 2026

Release Date: September 10, 2026
Release Type: Mixed (New Features, Improvements, Bug Fixes, Security Fixes)

Overview​

This release connects your HR system to Mesh as an authoritative identity source, and moves the last of the general settings onto the newer settings experience.

  • Unified HRIS connector — authorize your HR provider once and Mesh ingests worker records, employment status, and organizational context in a consistent shape, whichever HR platform you run.
  • ServiceNow CMDB connector — collect configuration items from your ServiceNow CMDB as a native connector, with incremental sync.
  • General settings on the new settings experience — the General tab now uses the same settings surface as the rest of the product.

It also closes a cross-tenant authorization gap in onboarding, restores the missing breach name on dark web risks, and fixes an error that blocked AI remediation whenever an administrator was viewing a customer tenant.

New features​

Unified HRIS connector​

Your HR system is the authoritative record of who works for your organization. Mesh can now ingest it through a single unified connector, rather than a separate one-off integration per HR platform.

What you get:

  • One authorization, normalized output. You authorize Mesh to your HR provider once. Mesh ingests the identity signals it needs — employee identifiers, employment status, hire and termination timing, manager and department context, employment type, and work location — normalized into a consistent shape regardless of which HR platform you use.

  • Added from the connectors page or the assistant. Add the connector from System configurations, or ask the AI assistant to set it up.

  • A visible pending state. A new connector shows Connection pending until your provider finishes the initial handover, so a connector that is still linking is never mistaken for one that has failed.

  • New platforms without new connectors. Because the connector normalizes at the provider boundary, additional HR platforms become available without a separate integration for each.

Why it matters: worker records give Mesh a trusted anchor for correlation, and they are what let Mesh spot an account that has outlived the person it belonged to — a leaver whose access is still live, or a mover carrying access their new role does not need.

To set it up, see Connect your HR system. For what employment status means once it is flowing, see Employment status, and Troubleshoot HR connectors if a connector does not come online.

ServiceNow CMDB connector​

Mesh can now collect configuration items from your ServiceNow CMDB through a native connector, instead of a hand-built REST configuration.

What you get:

  • A preset in the connector catalog. Choose ServiceNow CMDB in the wizard, supply your instance URL and credentials, test the connection, and save — the collection template comes from the catalog rather than being assembled by hand.

  • Computers, software, certificates and containers arrive as assets. Containers are collected as software, and are not yet linked to the machine that hosts them.

  • Ownership and placement context. Computers and certificates carry owner, location and department, along with certificate expiry and algorithm detail and machine install date and organization. Software carries its publisher and version.

  • Incremental sync. After the first collection, each run fetches only the records that changed.

  • Custom tables. Collection can be extended beyond the standard tables.

  • Machines listed in collection drawers. A connector's collection drawer now lists machines alongside software and cryptography, rather than omitting the machines those assets sit on.

The connector is read-only — every data request is a read, and Mesh never creates, changes or deletes anything in ServiceNow.

For setup steps, what each ServiceNow table becomes in Mesh, and what to check when a connector saves but no data arrives, see the ServiceNow CMDB entry in the integration catalog.

Improvements​

General settings moved to the new settings experience​

The General settings tab now uses the same settings surface as the rest of the product, so navigation, layout, and behavior match everywhere instead of the General tab being the one page that worked differently.

Bug fixes​

Dark web risks showed an empty breach name​

The dark web drawer described an identity as compromised "in a data breach ()" — with the breach name missing — in every tenant, and the per-risk loss-exposure export carried an empty breach value on every row. The name was being read from a field the dark web analysis never populates, while the value itself was recorded alongside the risk.

Both the drawer and the export now read the recorded value.

No action needed: the correction applies to the risks you already have as soon as it is deployed. Nothing is re-evaluated, and no new lookups are made against the breach data source.

AI remediation failed while viewing a customer tenant​

Opening a risk drawer while viewing a customer tenant returned a bare "Something went wrong" notice instead of the remediation panel, for every risk type. This affected administrators viewing a tenant other than their own; the panel now loads normally in that context.

Security fixes​

An administrator of one tenant could drive another tenant's onboarding​

Two onboarding operations keyed their writes on a tenant identifier supplied by the caller, and verified it against the signed-in session only for callers in the onboarding role. An administrator of one tenant could therefore progress and complete onboarding for a different tenant. Both operations now confirm that the target tenant matches the session before any change is written.

Rejected cross-tenant attempts on those operations, and on tenant profile updates, are now recorded in your audit log, so an attempt leaves a trace rather than appearing only in access logs. See Audit logging.

Renaming a tenant through onboarding is restricted to tenants still onboarding​

Renaming a tenant through the onboarding flow now requires that tenant to still be in onboarding, so a live tenant can no longer be renamed by that path. Administrators renaming a tenant from the admin area are unaffected, and updates that do not change the name behave as before.