Resolved Issues

Category synchronization XML exports used by the DLP service failed XML validation when custom category names or descriptions contained unescaped characters (such as &, <, >, or ").

Special characters are now properly escaped in generated XML output, ensuring seamless DLP synchronization.

When applying combined filters (such as Risk + Family) in Cloud Apps exception rules where no matching applications existed, the filter previously fell back to showing partial results rather than returning zero results.

The combo filter logic has been corrected so that an empty intersection across multiple filter criteria accurately returns zero results.

Under specific database transaction timing conditions, delayed rendering commits could lead to stale policy text being written to policy distribution files (FDM).

Policy file generation has been updated to ensure the latest committed policy revisions and hash values are consistently captured across all poll cycles.

SCIM 2.0 user queries previously lacked support for filtering users directly by group identity, which could lead to performance overhead when synchronizing large group memberships.

Added support for SCIM user queries filtered by group ID, enabling identity providers to efficiently retrieve and paginate direct group members.

Scheduled reports configured with "Automatically detect timezone" previously defaulted to midnight-to-midnight UTC due to missing timezone offsets in scheduled execution, producing data that differed from interactive reports run in the local timezone.

The Cloud Scheduler now accurately applies the intended timezone for scheduled report exports, ensuring exported data matches interactive reporting results.

In the audit trail, user logins and automatic account provisioning performed via OpenID Connect (OIDC) were previously recorded as standard password logins, making it difficult to audit authentication methods.

Audit log messages have been updated to explicitly identify when accounts are provisioned or authenticated via OIDC.

Hybrid Sync Service (HSS) log download endpoints previously lacked rate limiting and brute-force protection against unauthorized credential guessing attempts.

Brute-force protection and rate limiting have now been implemented on HSS log download authentication endpoints to safeguard sensitive log data while ensuring legitimate user logins are not throttled.

When synchronizing user accounts with accented characters against pre-existing auto-provisioned portal accounts, accent sensitivity differences caused synchronization batch failures and collision errors.

DirSync now applies accent-normalized comparisons consistent with database collation, allowing accounts to sync cleanly without manual intervention.

In Message Center, attempting to sort the message log by the Action or Reason column caused an error (Unknown column 'Disposition' in 'order clause'), causing the column sort spinner to spin indefinitely.

SQL sorting expressions and column aliases have been corrected to allow smooth sorting across all message table columns.