This announcement contains a comprehensive list of updates and fixes that will be introduced in Identity Manager on-prem LTS version 7.0.3.
Want the full details? Click the link below!
Important Dates
- The update is scheduled to be released on October 2, 2026.
New
| Component | Description |
|---|---|
| Connectors and Integrations | The Salesforce SCIM connector now supports the OAuth2 client credentials flow. Set ApplicationId and ApplicationKey to the Connected App’s Consumer Key and Secret respectively and leave Login and Password empty. Salesforce is deprecating the resource owner password credentials flow on September 1, 2026 — migration to client credentials is required before that date. |
| UI / UX | The Assigned Roles page now includes a “Denied” option in the workflow state filter, allowing denied assignments to be viewed and filtered. |
Fixes
| Component | Description |
|---|---|
| Access Control and Workflows | A bulk workflow using a picker control on a multi-valued property crashed when the picker submitted a null value. The null value is now handled correctly and the workflow completes successfully. |
| Access Control and Workflows | Action buttons on the Policy Simulation Roles and Rules pivots were visible to users holding a permission whose name shared a prefix with the required permission. Permissions are now matched exactly. |
| Access Control and Workflows | Clearing an Int32 or Int64 property value in a workflow form and submitting failed with an “Invalid int” error (HTTP 500). The value is now cleared successfully. |
| Access Control and Workflows | Configuration-Import failed with a NotSupportedException when deploying Razor templates containing an @functions block. These templates now compile correctly. |
| Access Control and Workflows | SendNotificationsTask crashed when a RoleReviewNotification’s recipient was an assigned profile with an email attribute set. Profile notifications are now sent correctly to the assigned profile’s email address. |
| Configuration | Reloading the Workforce module from the UI could drop a manually-overridden scaffolded parent item that had no ConfigurationFileItem record, leaving its child items orphaned in the configuration. The import now merges the existing database state into the re-import so manual overrides are preserved. |
| Connectors and Integrations | The agent could time out during long-running export or provisioning operations, causing the operation to fail even if the server was still processing. The agent now checks the server’s last progress and retries or logs a clear error and stops if the server appears stalled. |
| Jobs and Policy | A job scheduled at a time within the daylight saving time clock-forward gap could cause the scheduler to crash. The scheduler now skips ahead to the next valid occurrence after the gap. |
| Jobs and Policy | Profile assignments were not calculated when a ProfileRule used a SubExpression and its parent ProfileRuleContext specified an EntityType. Profile assignments are now calculated correctly in this configuration. |
| Jobs and Policy | The Send-Notifications task failed with an unhandled error and sent no notifications when a role policy notification had more than one reviewer identified by a profile email (e.g. a shared mailbox). The task now completes successfully. |
| Jobs and Policy | When a composite role denied a single role with a bounded end date, no cancellation provisioning order was created for the deny period, so the target account kept the denied access instead of being removed for that window. The cancellation order is now correctly emitted for the deny window. |
| Jobs and Policy | When keeping a non-conforming role via Role Reconciliation, the assignment’s context-bound end date behavior was not applied correctly. The kept assignment now respects the configured end date locking mode. |
| UI / UX | Resource type counters (ResourceCount, AssignmentCount, OrphanCount) were computed only incrementally and could drift permanently from actual values. These counts are now recalculated during complete synchronization and non-dirty classification runs, ensuring accurate counter resets. |
| UI / UX | The role assignment approval history showed only the last approver for roles with a multi-step manual approval workflow, omitting earlier reviewers. All reviewers are now displayed. |
| UI / UX | When the UI language is French, role create/edit notifications displayed an extra “de” prefix (e.g. “Le de Rôle Simple test a bien été ajouté”). Single Role, Composite Role, and Resource Type notifications now display the correct wording in French. |
Need help with this update?
There are many different ways to get help with our products!
| Situation | Action |
|---|---|
| If you feel the product is broken and not working as intended… | Contact Support |
| If you have a question you’d like to ask other experts… | Create a discussion in the community: Identity Manager > Discussions & Questions |
| If you have a feature request… | Let our product team know directly: Identity Manager > Ideas |
| If you have something cool to show… | Show everyone what you built: Identity Manager > Show & Tell |
What are your thoughts?
We are always happy to hear from our users on what you like, and what you hope to see in the future. Please, share your thoughts below!