> ## Documentation Index
> Fetch the complete documentation index at: https://docs.collabase.ch/llms.txt
> Use this file to discover all available pages before exploring further.

# Version 0.9.7-rc

> Microsoft Entra ID sign-in, SCIM group sync, and a more reliable Active Directory sync.

<Update label="v0.9.7-rc" description="Identity & SSO improvements">
  ## What's new in v0.9.7-rc?

  This release focuses on enterprise sign-in and directory sync: new identity providers, safer Active Directory sync, and automatic group provisioning via SCIM.

  ### ✨ New features & improvements

  * **Microsoft Entra ID, Okta & Keycloak:** These are now available as OAuth sign-in providers, alongside Google and GitHub.
  * **Allowed email domains:** Every sign-in provider can be restricted to specific email domains, and automatic account creation can be turned off per provider.
  * **SAML single sign-on:** Signing in via SAML now completes the full sign-in flow end to end.
  * **SCIM group sync:** Group memberships now stay in sync automatically through SCIM, including removals.
  * **SCIM token management:** SCIM tokens can now be listed and revoked from **Admin → Identity Providers**, not just generated.
  * **Scheduled directory sync:** LDAP / Active Directory sync can now run automatically on a schedule, in addition to manual syncs.

  ### 🛠 Stability & Maintenance

  * **Large directory sync:** Fixed an issue where Active Directory environments with more than 1,000 users could have some users incorrectly deactivated during sync.
  * **Sync safety guard:** Directory sync now pauses and asks for confirmation before an unusually large number of users would be deactivated in one run, protecting against misconfigured filters or a temporarily unreachable directory.
  * **Faster configuration changes:** Identity provider settings now take effect immediately after saving, without restarting the application.

  ### 🔒 Security & Vulnerabilities

  * OAuth client secrets are now encrypted at rest.
  * Microsoft Entra ID sign-in now requires a specific organization (tenant) to be configured, so only accounts from your organization can sign in.
  * Added safeguards to prevent an external sign-in from being matched to the wrong existing account when email domains are not restricted.
</Update>