# Improved MCP client sign-in and Client Workload identification

Client Workloads have more ways to identify MCP clients, and MCP sign-in follows the Identity Providers you assign. This release also includes fixes for MCP sessions, Client Workload editing, and the Aembit MCP Server.

## MCP client identification and sign-in

* **Redirect URI and CIMD Client ID together** - One Client Workload can now carry both a Redirect URI and a CIMD Client ID identifier. See [Redirect URI](/user-guide/access-policies/client-workloads/identification/redirect-uri/).
* **Enforce SSO for CIMD Client IDs** - A Client Workload with only a CIMD Client ID can now turn on **Enforce SSO** and select its Identity Providers. See [CIMD Client ID](/user-guide/access-policies/client-workloads/identification/cimd-client-id/).
* **Assigned Identity Providers only** - With **Enforce SSO** on, the MCP sign-in page lists only the Identity Providers assigned to the Client Workload.
* **Native MCP clients** - Dynamic Client Registration accepts an `application_type` of `native` or `web`, so native clients can register custom-scheme redirect URIs such as `vscode://`. See [MCP Authorization Server reference](/user-guide/deploy-install/mcp-authorization-server/reference-mcp-auth-server/).
* **Trailing slash in URL paths** - The **URL Path** of an MCP Server Workload can now end in `/`, such as `/mcp/`.

## Fixes

* **Revoke sessions by email** - On an Identity Provider’s **Sessions** tab, a full email address in **Filter Users** now enables **Revoke filtered**. See [Manage MCP user sessions](/user-guide/administration/identity-providers/manage-mcp-user-sessions/).
* **Aembit MCP Server and Resource Sets** - Aembit MCP Server tools now load for users whose access covers only Resource Sets other than the default one.
* **Fewer sign-in prompts** - MCP clients such as VS Code no longer ask users to sign in again after a token refresh. This applies when the Client-to-Gateway Access Policy uses the OIDC ID Token Credential Provider.
* **Saved Identity Provider selection** - An existing Client Workload with **Enforce SSO** on and no saved Identity Providers now opens with none selected, and **Save** requires at least one.