Multiple identity providers with group-based access and roles

Single sign-on now supports more than one identity provider. LDAP directories and OIDC issuers are configured as a list, so staff in an Entra-backed directory and a subsidiary with its own directory can sign in side by side. Existing installs migrate automatically on first start and keep signing in unchanged.

Access and roles can be driven by group membership: a provider can be restricted to named groups, and group rules decide who becomes an administrator. The rules are re-applied on every login, so removing someone from a group removes the access or role at their next sign-in. If a provider does not return the group list — Microsoft omits it past roughly 200 memberships — sign-in is refused rather than silently granting or demoting access.

No action required.