2026-08-05

🔐 Enterprise single sign-on

You can now connect your own identity provider — Microsoft Entra ID, Okta, Ping, Google Workspace, or any SAML 2.0 / OIDC provider — so your team signs in with corporate credentials instead of a DevStride password.

• Set it up yourself. Settings → Integrations → Identity Providers walks you through it: pick SAML or OIDC, paste the values your provider gives you, and copy back the values DevStride supplies. Every value we ask for now says what it's for, which aliases your provider might call it (Entra says "Reply URL" for two different things), and where in your provider's admin console to find it. 📚 Enterprise SSO
• Prove you own your domains. Claiming an email domain doesn't route anything until you've proved control of it with a DNS TXT record. This is what stops anyone else claiming your company's domain, and it's what lets us trust the sign-in even though most corporate identity providers never assert that an address is verified.
• Sign in by email address. A member enters their work email at the login page and is handed to your identity provider automatically — no separate URL to remember and share.
• Optional automatic provisioning. Turn on Automatically create members on first sign-in and anyone from a verified domain becomes a member the first time they sign in, in the role you choose. Leave it off and only people you've invited can get in.

Enterprise SSO is opt-in per organization. If you don't configure a provider, nothing about signing in changes.

👤 Sign in with Microsoft

The login page now offers Sign in with Microsoft alongside Google, for personal Microsoft accounts (outlook.com, hotmail.com, live.com, or any address registered as a Microsoft account). It behaves exactly like the Google button: it links to an existing member or accepts an invitation, and never creates an account that wasn't invited.

Company and school Microsoft accounts are served by Enterprise SSO above, not this button.

🚪 A clearer login page

• A persistent Sign in with SSO button, so people whose organization uses single sign-on always have somewhere obvious to go — with no lookup happening as you type.
• The email and password fields stay reachable on short screens and phones. Previously a tall login page could push them out of view with no way to scroll back.
• Better rejection messages. When a credential is refused, the page says which reason applies rather than leaving you guessing.

🔑 Admins can manage identity providers and database access

Manage identity providers and Manage database credentials now ship on the standard Admin role, and both can be granted to any custom role. Previously only an Owner could hold them, which meant a business owner had no way to delegate SSO or BI-tool setup to their administrators. Existing organizations get this automatically — Admin-equivalent roles are granted both on upgrade — and nothing is taken away from anyone. 📚 Database Access

🛠 Fixes

• Large bulk updates through the MCP server no longer time out half-applied. An oversized update is queued and reported back as a job, so either all of it lands or none of it does — and folder relationships and user references in those updates are now applied correctly.
• Jira integration reports real Jira account ids, and a failure syncing one organization no longer affects another.
• Federated account linking is now keyed on the exact subject your provider sends, so a difference in letter case can never link a sign-in to the wrong account.