Skip to main content
View as MarkdownOpen in ChatGPTOpen in Claude

Identity Mesh — September 30, 2026

Release Date: September 30, 2026
Release Type: Mixed (New Features, Improvements, Bug Fixes, Security Fixes)

Overview​

This release brings certificates from your Kubernetes clusters into your crypto posture, lets you share what you build on the canvas, and gives administrators control over identity providers they no longer use:

  • Certificate collection from Kubernetes — the certificates and issuers that cert-manager manages in your clusters now count toward post-quantum readiness.
  • Share a view or widget by email — invite named colleagues to see a view or a single widget, and remove their access at any time.
  • Remove identity providers you no longer need — with a recorded reason, and a guard that keeps you from removing your last one.

It also adds an Asset dossier for every asset, puts Mesh release notes inside the product, and fixes a group of defects in connector setup, connector health, the AI assistant and asset lists — along with a security fix.

New features​

Certificate collection from Kubernetes​

Mesh can now read the certificates and certificate issuers that cert-manager manages in your Kubernetes clusters, including key algorithm, key size and renewal settings, so workload certificates show up in your post-quantum readiness reporting. The collector uses a read-only credential you provide and never reads private keys. Certificates removed from a cluster are retired in Mesh after the next complete collection.

To add it, go to Settings › Connectors › Add connector › Crypto collectors › Kubernetes.

See Kubernetes.

Share a view or widget by email​

You can now share a whole view, or a single widget from it, with named colleagues. Choose Share at the top of a view, or Share this widget from a widget's menu, enter the address the person signs in to Mesh with, and select Invite — or ask the assistant to do it. The people you invite receive an email and can look at what you shared, but cannot change or re-share it. You can remove their access at any time.

The people you invite must be able to sign in to your Mesh tenant. For working with views and widgets, see Generative UI.

Remove identity providers you no longer need​

Administrators can now remove an identity provider from Settings › Identity providers. Mesh asks why you are removing it and keeps the reason in the audit trail. A removed provider stops accepting new sign-ins and no longer appears in your list. You cannot remove your only active identity provider. If you need a removed provider back, contact Axiad Customer Success.

See Identity providers.

Asset dossier​

Select an asset in an asset list to open its Asset dossier — one place for its details, connections, dependencies and history. One click takes you back to the list you came from.

Release notes inside Mesh​

The workspace sidebar now has a Release notes entry that shows the latest Mesh updates and how many you have not read yet. The newest update is highlighted until you dismiss it, and each entry links to the full release notes.

Improvements​

Data syncs in Settings​

Administrators can review data source sync history on the Data syncs page in Settings. Expand a sync to see its timeline, item counts and details, open the failure breakdown to see why items failed, and export matching syncs as CSV. The settings button on the dashboard now opens Settings in place, and shortcuts such as Add connectors go straight to the right page.

See Data source syncs.

Drill into PQC readiness counts​

In the PQC Readiness Index widget, select a count to see exactly which assets are ready. The list has the same search, export and column options as other asset lists. A count of zero is shown but cannot be opened.

See PQC readiness.

Large workspaces load more reliably​

Widgets on a workspace now load a few at a time, in the order they appear, instead of all at once. On large environments this helps every widget finish loading rather than timing out.

ServiceNow CMDB in the new Settings experience​

You can now add a ServiceNow CMDB connector directly from Settings › Connectors by choosing ServiceNow CMDB under Manual setup, without switching to the classic view.

See ServiceNow CMDB setup.

Bug fixes​

Universal REST connectors import service accounts and keys correctly​

A universal REST connector could map an endpoint only to people, so service accounts, bots and API keys were imported as human users. You can now map an endpoint to non-human identities — choosing a kind such as service account — or to credentials, for both cloud and on-premises connectors. See Universal REST connector.

Test connection now checks your credentials​

For universal REST connectors, Test connection checked only the configuration, so a wrong secret, a wrong URL or an unreachable host could still pass. It now makes one read-only, authenticated request to your system and reports sign-in and permission failures. A connector that previously passed with incorrect credentials will now report a failure.

Large Okta directories finish their first sync​

When an Okta group had more members than a single sync run could collect, the connector restarted that group from the beginning each time, so its first sync never finished and it kept re-running every few minutes. The connector now resumes where it stopped, completes the first sync and returns to its normal schedule. Group memberships are also sent in larger batches, so large groups sync much faster. See Okta.

Large group syncs no longer delay identity updates​

When an identity provider sync carried very large groups — tens of thousands of members — processing them could hold up other identity changes for hours. Those groups are now processed without delaying other updates.

Microsoft Entra ID sign-in collection recovers on its own​

If Microsoft Entra ID expired the position Mesh uses to page through sign-in activity, the connector could stop collecting sign-ins while users and groups kept syncing. Mesh now detects this and restarts sign-in collection automatically.

Connector health no longer reports false credential expiry​

A connector with valid credentials could show Credentials expired when only its sign-in activity feed had failed. Connector health now names the actual problem and the part of the sync it affected. Genuinely expired credentials still show Credentials expired.

Okta setup previews show real sample data​

When adding an Okta connector, the preview could skip the first user, group or application, and could report that dependent data such as group members had no sample. Previews now use real records and show a result for each endpoint, including sign-in, permission, rate-limit and empty-result cases.

Correct counts for ServiceNow CMDB connectors​

For some ServiceNow CMDB connectors, the Collected data panel showed "No entity data yet." even though assets had been collected. It now shows the correct counts.

More accurate answers from the AI assistant​

The assistant now answers questions about assets and risk scores correctly. Questions about the highest risk in your environment cover every asset type, and questions about a year or month no longer miss items that fall on its last day. On the crypto-vulnerable asset overview, location and organization bubbles reflect their real risk, and the riskiest are the ones shown.

The AI assistant handles longer requests​

The assistant no longer stops with "reached the maximum number of tool calls" on ordinary requests. It now looks up several things at once and does not count retries against its limit. If it does reach the limit, it replies with what it found instead of an error.

Remove widgets from chat view​

A widget's menu now offers Remove in chat view as well as dashboard view, so you do not have to switch views to remove a widget you just generated. See Working with widgets.

Widget display choices and loss exposure export​

Widgets with a fixed visualization no longer offer display types they cannot use — the option is shown unavailable with an explanation instead of failing with an error. Exporting the annualized loss exposure widget now includes the loss figures, and loss widgets with no table data no longer download a nearly empty file.

PQC Readiness Index shows a whole number​

The PQC Readiness Index headline now shows a whole number instead of four decimal places. A small but real score shows as "<1" and a nearly complete one as ">99", so the headline never hides or overstates progress.

Asset lists show the Type column​

The software, crypto and machine asset lists show each asset's type again — for example Certificate, Library or Workstation — and the type appears in the asset details panel. You can sort by type and filter on it from a list of the types in your data.

Owner risk in the asset relationship graph​

In the asset relationship graph, a person who owns assets now shows the combined risk of what they own instead of 0, and owners are ranked correctly when the graph shows only the highest-risk items.

Security fixes​

Updated cryptography library in connector data collection​

Connector data collection now uses an updated cryptography library that addresses two medium-severity vulnerabilities, CVE-2026-56855 and CVE-2026-78662.