Resolved Issues and Bug Fixes
Read more about resolved issues and bug fixes in this release.
UI and UX
Issue in identity view after upgrade
We've fixed an issue in the new UI where forms did not work correctly for Set properties configured with the radio control type. Radio button selections for Set properties are now handled correctly.
INC-318557
Enterprise Server
Identity lookup search inconsistent in suggestions
This update resolves an issue with lookup suggestions for reference properties across the product, such as selecting identity, system, role, and folder fields. Previously, a search could fail to find a match when the search text appeared later in the name, even though the same text was found when it appeared at the beginning. This was especially noticeable in identity lookups, where searching by first name could return inconsistent results, while searching by the person’s last name returned the expected result.
Suggestions now match the search text wherever it appears in the name. As a result, suggestion lists may include additional matches that were previously omitted, such as names containing the search text in the middle. No previously correct suggestions are removed.
INC-313930
Role and Policy Engine
RoPE repeatedly removes and adds the same group for multiple users
We've fixed an issue where assignments were sometimes created for a non-existent account in the same system.
This occurred when two account resources in the same system had different account types but the same actual account name.
INC-317061
RoPE DB timeouts when fetching LoadExplicitlyOwnedObjects
The RoPE SelfManagementExtension now loads explicitly owned objects more efficiently, improving processing speed and reducing memory consumption.
INC-316939
Account types are honored hierarchically
RoPE now honors account types hierarchically when resolving direct assignments and assignment policies.
If the account type is left unset on a direct assignment or an assignment policy, RoPE does not scope the assignment to all account types indiscriminately. Instead, it resolves one assignment for each account type allowed by the assigned resource, provided that the identity has an account of that type or that auto-account creation applies.
Each resolved assignment carries its own single account type. This account type is then used as the scope for child resources. A child resource is assigned through a branch only if it allows the account type resolved for that branch.
For example, an Enterprise Role allows only the Personal account type, while its child AD group allows both Personal and Administrative account types. If the Enterprise Role is directly assigned with the account type left unset and the identity has a Personal account, RoPE resolves the Enterprise Role assignment to Personal. The child AD group is therefore assigned only to the Personal account, even though the AD group itself also allows Administrative accounts.
For more information, see Assignment Policies and Account Types and Account types.
INC-316467
Provisioning jobs created for AD groups that were already assigned
We have fixed an issue where provisioning jobs were created for resources, such as AD groups, that were already assigned. A large number of these jobs could exceed the provisioning threshold and put the provisioning queue on hold.
Paging in the IDS GraphQL client has been improved. All existing resource assignments are now retrieved between imports, and provisioning jobs are no longer created for resources that are already assigned.
INC-318652
Omada Data Warehouse
Emergency Lockout calculation not rerun after SubmitBatch failure
Emergency Lockout identity calculation was not recalculated when SubmitBatch failed in OPS due to a SQL deadlock or timeout.
We improved RoPE-to-OPS communication to ensure transient errors are handled more reliably.
INC-315677
Manager access persisted after employment or department membership expired
This update resolves an issue where a manager could retain access to a former subordinate’s identity through Explicit Owner after the manager relationship had ended. For example, the manager could still view the identity and revoke its resource assignments after the employment record expired or the person was assigned to a new manager.
Manager access is now re-evaluated based on the validity of the underlying employment or department membership.
For customers who need to retain the previous behavior on a specific view, the INCLUDEINVALIDMEMBERSHIPS parameter is available for the following access modifiers:
IdentitiesAccessModifierManagedIdentitiesAccessModifierSecondaryIdentitiesAccessModifierPasswordResetAccessModifierRoleAssignmentsAccessModifier
The parameter defaults to FALSE. Set it to TRUE in the relevant view’s access modifier parameters to include expired or not-yet-valid employment and department memberships when determining manager access. This setting affects only the configured view.
For more information, see Access modifiers documentation.
INC-314986
Import errors not handled and reported correctly
We have fixed an issue where import errors from the SCD package, or errors with an error code below -1,000,000,000, were not reported correctly. As a result, imports such as MS Graph imports could fail without a meaningful error message.
Error handling in the ODW import packages has been corrected. Import errors are now reported with their error code and description.
INC-319591
Connectors
Exchange Online queries failing with the "BadRequest" message
We have fixed the issue where the Exchange Online queries failed, returning the BadRequest message.
INC-318331, INC-318606, INC-318693
Other
Policy Scope Views were not available to non-admin users
We fixed an access issue that prevented non-admin users from viewing Policy Scope Views and their names on the Policies page.
INC-312911
INC-316123
Documentation
Search behavior with special characters, Unicode symbols, and emoji was undocumented
Search tokenization behavior for special characters, Unicode symbols, and emoji in Display name values was not previously documented. We've added guidance on how Omada generates and tokenizes search data, and documented a related known issue where a Display name containing a Unicode symbol or emoji may not be found by plain-text search alone.
INC-319750
Time zone used to calculate time-based access request validity was undocumented
For time-based access requests, the Valid from and Valid to dates and times are calculated using the time zone of the identity for whom access is being requested, not the time zone of the identity submitting the request (for example, a requester in the US submitting for an identity in India). This was not clearly documented, and the August 2026 Cloud Update release notes did not mention that the visibility of the Timezone selector is controlled by the customer setting AccessRequestAPIRequiresTimeZone. We've added documentation clarifying both points.
See Time-based access and AccessRequestAPIRequiresTimeZone in Customer settings.
INC-317313
Calculation log error documentation
We have added documentation for the Cleared - Identity doesn't exist calculation log message, including its cause, impact, and recommended troubleshooting steps.
For more information, see the Calculation log section in the documentation.
INC-314706