Administration

This release adds tenant branding to the REST API, fixes the initiator recorded in audit records for denied sign-ins, and shows background task results in the language of the user who started the task.

Tenant branding REST API

New feature for integration developers.

Integrations can now read and update a tenant's branding through REST API v2: the colors, the custom CSS, and the logo of the Sign-In page and the top navigation bar, including upload and download of the logo image. The endpoints are guarded by the new Branding permission, and a tenant administrator can manage only their own tenant. See Tenant branding in the REST API Developer Guide.

In the web portal, the branding form now states the 64 KB limit correctly. The limit is unchanged, but the text said 100 KB. The form also accepts SVG files that start with an XML prolog, comment, or doctype.

See Branding.

Audit trail attribution for denied sign-ins

Changed behavior for administrators.

The audit record for a password sign-in denied by an IP address restriction no longer shows the target account as the initiator, because nobody proved that identity. The account stays as the record's parent and in its details, and the record belongs to the account's tenant, so tenant administrators still see it. REST API and SSO denials keep the initiator, because the identity was verified first.

See Audit trail.