Improved MCP client sign-in and Client Workload identification
Client Workloads have more ways to identify MCP clients, and MCP sign-in follows the Identity Providers you assign. This release also includes fixes for MCP sessions, Client Workload editing, and the Aembit MCP Server.
MCP client identification and sign-in
- Redirect URI and CIMD Client ID together - One Client Workload can now carry both a Redirect URI and a CIMD Client ID identifier. See Redirect URI.
- Enforce SSO for CIMD Client IDs - A Client Workload with only a CIMD Client ID can now turn on Enforce SSO and select its Identity Providers. See CIMD Client ID.
- Assigned Identity Providers only - With Enforce SSO on, the MCP sign-in page lists only the Identity Providers assigned to the Client Workload.
- Native MCP clients - Dynamic Client Registration accepts an
application_typeofnativeorweb, so native clients can register custom-scheme redirect URIs such asvscode://. See MCP Authorization Server reference. - Trailing slash in URL paths - The URL Path of an MCP Server Workload can now end in
/, such as/mcp/.
Fixes
- Revoke sessions by email - On an Identity Provider’s Sessions tab, a full email address in Filter Users now enables Revoke filtered. See Manage MCP user sessions.
- Aembit MCP Server and Resource Sets - Aembit MCP Server tools now load for users whose access covers only Resource Sets other than the default one.
- Fewer sign-in prompts - MCP clients such as VS Code no longer ask users to sign in again after a token refresh. This applies when the Client-to-Gateway Access Policy uses the OIDC ID Token Credential Provider.
- Saved Identity Provider selection - An existing Client Workload with Enforce SSO on and no saved Identity Providers now opens with none selected, and Save requires at least one.