⚠️ Action required: Microsoft SSO
Who this affects: instances using Microsoft sign-in on a multi-tenant endpoint — which is the default. MICROSOFT_TENANT_ID defaults to common, so this applies unless you have set it to your own tenant ID. Instances set to a single tenant are unaffected, as are OIDC and Google.
On a multi-tenant endpoint any tenant can assert any email address, so Rallly now needs Microsoft to confirm an address before creating an account from it. Microsoft only sends that confirmation if the app registration asks for it.
This release does not break these sign-ins. If the claims are missing, Rallly still creates the account and logs a warning. A future release will refuse them. Add the claims now so that release is uneventful:
In your Entra app registration, open Manifest and add these to the optionalClaims.idToken array, keeping any entries already there:
{ "name": "verified_primary_email", "source": null, "essential": false, "additionalProperties": [] },
{ "name": "verified_secondary_email", "source": null, "essential": false, "additionalProperties": [] }If optionalClaims is null, replace it with { "idToken": [ ...the two entries... ] }.
Once the claims are present, a Microsoft sign-in whose address is not among the verified ones fails with "Your email address is not verified". Existing users are not affected.
Full instructions: https://support.rallly.co/self-hosting/single-sign-on#microsoft
Data migration
In previous versions, responses were soft-deleted. In this release responses are hard-deleted and previously soft-deleted responses are purged. Back up before upgrading.
Security
This release contains several security fixes. Upgrading is recommended. Advisories with full details, affected versions and credit to the reporters will follow shortly.
Email invites
Hosts can now invite participants by email from the Share dialog: send personal invite links, copy an invitee's link, remove a pending invite, and see when a link has been opened.
Every response now carries an edit token, so the link in a confirmation email edits exactly the response it names. Hosts can still copy the invite link and hand it to someone who responded without leaving an email address.
Full Changelog: v4.14.0...v4.15.0