Access Management

From the July 2025 release we will deprecate the QR code login functionality. This means that QR code login can no longer be enabled on new tenants and tenants for which the QR code option is not enabled.

Being able to add custom text in some capacity to the IDP login pages would allow better explanation to end users about things like username format. For example, indicating to the user whether they should be using their email address versus their standard username.

Over time, we've seen an significant decline in the use of Radius as authentication. Besides this we expect that radius will not be safe to use in the future. Therefore we decided to deprecate Radius authentication on the long term. Our first step is to disable adding any new radius servers.

As an administrator I do not want to be able to disable the entire local login IDP. Disabling the local login can cause many issues since when the main IDP is in error it is not possible to login as a local administrator anymore. Instead of disabling only the hide option should be available. If restricting the local login is required portal access rules targeted on the Local IDP could be applied.

We would like to have audit logging on the user and group membership changes. This way we can determine what happened when and what was the situation in the past.

Currently we only support the basic attributes to be synced between AzureAD and HelloID. This is caused because the schema on AzureAD application is static and cannot be changed dynamically. But we noticed a desire to synchronise the manager and employeeid. Therefore we added those attributes in the synchronisation altough the settings are limited. The employeeid is put in the additional attributes of a user with the name 'employeeID' which cannot be changed. The manager is calculated to a HelloID user based on based effort (could result in a empty value if the HelloID user is created before the HelloID user account of the manager exists). Please rerun the update if this is the case so after the HelloID user of the manager is created.

We would like to have more insights about the emails that are sent in HelloID. So that we can look back and see if an email is sent with no errors and to who. An overview of sent notifications. Based on specific events HelloID sends out (customized) notifications. We would like to be able to confirm if certain notifications have been sent, and when, through an audit-like overview. Solution: All the email notifications sent through HelloID are available in the audit logging and are shown in a default report. The email audit log contains the following information: from, to, cc, bcc, subject, date sent, status, and source (part in HelloID from where the notification is triggered)

We want to enable DMARC on helloid.com mail domain. This is to monitor the mail traffic send from helloid.com and to prevent misuse of the domain.

We want to deprecate the iframe/embed integration which means that all URL's using /app/iframe/{page} will become obsolete. This is decided because this functionality isn't used often but requires a lot of maintenance which hold back the time and effort we would like to spend on other/new features.

When using Azure as OIDC for HelloID and opening an application connected to HelloID I always have to enter my emailadress first, after entering the emailadress I will be automatically logged into the application since there is already an active session with Azure AD. To prevent entering the emailaddress in the Azure signon screen the domain_hint parameter can be send with the request to Azure. ( https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/home-realm-discovery-policy#domain-hints ) Is it possible to add support for this parameter? e.g. add &domain_hint= helloid.com to the url.