Resolved Issues and Bug Fixes
Read more about resolved issues and bug fixes in this release.
Enterprise Server
Event definitions did not recognize time comparison filters
We've fixed an issue where event definitions did not recognize time comparison filters. The modifier is now applied correctly to the properties used as the right-hand values in filters.
INC-289925
Organizational unit deletion preserves and moves child objects
Deleting an organizational unit no longer deletes its child organizational units. All objects located directly below the deleted organizational unit are moved to its parent. Objects further down the hierarchy remain below their current parent. Direct child organizational units get the parent as their PARENTOU if it referenced the deleted organizational unit. Identities directly in the deleted organizational unit continue to be moved to the parent as before; identities in child organizational units remain assigned to those organizational units. Each move is logged.
For details, see Deleting an organizational unit documentation.
Incorrect Operation shown in Task details for completed jobs
We've fixed an issue in the Provisioning Jobs dashboard where the Task details dialog displayed the original values instead of the mapped values for the General properties, such as Operation, after the job was completed. This happened when a task mapping changed the operation, for example, when Delete or DeleteIfExists was mapped to Update. While the job was in the Review state, the dialog showed the mapped values correctly.
The operation executed in the target system was not affected, because it was always the one defined in the task mapping. The issue was only visual. The Task details dialog now shows the same mapped values for the General properties for completed jobs as in the Review state.
INC-319532
Role and Policy Engine
Calculation failed when revoking a pre-valid resource assignment
We've fixed an issue where revoking a resource assignment that was not yet valid (with a future validFrom date) caused the calculation to fail. The revocation set validTo to the current time, which was earlier than validFrom. Revoking a pre-valid assignment now sets validTo equal to validFrom.
INC-318824
RoPE Assignment Explorer - Information message is no longer written for retired assignments
When RoPEContextMembershipsIncludeInvalid is set to false (default value), RoPE no longer writes the information message Direct assignment for ‘X’ was ignored because identity isn’t in the business context it’s defined for when the resource assignment is Obsolete, Disabled, or Locked and the identity is outside the assignment’s business context. The message is still written for Active assignments.
An existing message remains visible until RoPE saves a new calculation for that identity. RoPE saves a calculation when assignments or warnings change, but not when only an information message changes.
INC-318332
Omada Data Warehouse
Extension attributes: property definition changes not propagated through attributes
Previously, changes to a property definition were not propagated to the associated extension attribute when the two were linked indirectly through an attribute. In these cases, the extension attribute kept its previous definition.
Changes are now propagated correctly: for example, if you increase the length of the text property NAME from 20 to 40 characters, the associated extension attribute is updated to a text type with a length of 40 characters.
Access request
Bulk approval of access requests failed with a post action error
We've fixed an issue where approving a large number of access requests in bulk failed with the error An unexpected exception occurred while submitting the survey questions. Only some of the selected requests were saved, and the remaining ones stayed pending approval.
INC-320842
Managers unable to approve certain access requests
We've fixed an issue where managers could not approve certain access requests, although the same requests could be approved after 30 to 90 minutes.
INC-315462
Surveys
Access review removed access that was still granted through a business role
We've fixed an issue where, in an access review survey with the dontCreateNegativeVerdictsForImplicitAssignments and applyExpiresAfterDaysToRemoveVerdict settings enabled, removing a direct assignment also removed the access that the identity had through a business role. Only the removed direct assignment is now obsoleted.
The fix includes a change to CalculatedAssignmentVerdictSurveyPostActionHandler. For details, see Changes to CalculatedAssignmentVerdictSurveyPostActionHandler.
INC-315690
Omada Identity Analytics
Access Intelligence not showing outliers correctly
Previously, the pop-up widget in the Access Intelligence dashboard would sometimes show incorrect outliers, that is, identities outside the selected scope that have a given resource, or identities in the scope that do not have it. We have improved the filtering, so the pop-up widget now shows the correct outliers.
INC-319385
Connectors
REST/REST Relay connectivity: job failing when the GET lookup returns HTTP 204
In REST and REST Relay connectivity, when the existence check performed by operations such as CreateOrUpdate or CreateIfNotExists returned HTTP 204 (No Content), the object was incorrectly treated as found, which caused the job to fail. An HTTP 204 response is now treated as object not found.
INC-317113
Incorrect values shown in the Operations Dashboard for Processed last hour and Processed last 24 hours
In the Operations Dashboard, the Processed last hour and Processed last 24 hours sections showed incorrect values when relayed connectivity provisioning jobs were used, because those jobs were counted twice. This issue has been fixed.
INC-318786
SAP connectivity: queries created manually missing the required settings
In SAP connectivity, queries created manually lacked the required settings (such as the SOAP request envelope). As a result, previewing a query caused the Preview failed: xml is empty or whitespace error. These settings are now shown in the query editor.
INC-320331
Import Worker and Provisioning Worker services shown twice in the Operations Dashboard
We've fixed an issue where the import worker and provisioning worker services appeared twice in the Operations Dashboard, although only one instance of each service was operational. The heartbeat dashboard for the Cloud Application Gateway now shows correctly the instance assigned to the import worker and provisioning worker services.
INC-319524
Other
Filter expression validation
We've fixed an issue where invalid expressions on the right side of a filter expression were not validated correctly.
INC-293504
Reduced exposure of page variables
Removed unnecessary JavaScript variables from publicly accessible pages, including the logon, logout, and password reset pages.
INC-320835
RoPE refreshes master data for each calculation batch
In the September 2026 Cloud Update, RoPE loaded customer settings, data object types, and properties only when the service started. For example, after a customer setting was changed or a property was added, a RoPE instance that had been running since before the change could continue using the old information. When multiple instances were running, they could use different versions of the configuration.
RoPE now refreshes this master data at the start of each calculation batch.
INC-320287
INC-321242
Documentation
Missing information on the email template
We have added documentation for the default email templates sent during the SoD evaluation process, describing when each one is sent and how it is triggered, and clarifying why the Evaluate identity violations template shows no results under Usage in Email templates.
INC-320134
Survey post action handlers were not documented
We've added a new reference page describing every built-in post action handler. See Built-in post action handlers.
INC-318270
Incomplete documentation for the Desired state account rule
We have expanded the documentation for the DesiredStateAccountRule customer setting to cover its purpose, its behavior when enabled and disabled, why it defaults to False, and typical use cases. We have also clarified how the setting maps to the Desired state rule when migrating to the Horizons solution, and added upgrade recommendations.
INC-318724