Release v0.91.0
Jul 04, 2026
Sign your technicians in with your own identity provider, pin agent versions per partner or per organization, see which VPN clients are active on every device, and pick up a wave of SSO and update-policy fixes.
Added
- Single sign-on for your technicians. Your MSP staff can now sign in to the Breeze dashboard through your own identity provider (Microsoft Entra, Okta, or any OIDC provider) — separate from the customer-facing SSO you may already offer your client organizations. Self-hosted deployments can also brand the login page with their own logo, colors, and an SSO button.
- Pin agent versions where you want them. Hold your whole fleet on a known-good agent version, or stage a new release to a single organization before rolling it wider. Pins can be set at the partner level and overridden per organization, and a pin never falls back to an unintended version — if a pinned build doesn't exist for a device's platform, the device simply stays put.
- See VPN clients at a glance. Devices now report which VPN clients are installed and actively connected, so you can verify remote workers are on the VPN — or spot unsanctioned ones — from the device page.
- Expired enrollment keys clean themselves up. Expired keys are automatically removed after a grace period (7 days by default), there's a one-click 'Delete expired' action, and the key list now shows a readable short code instead of a 'Hidden' placeholder.
Improved
- Settings that are easier to navigate and harder to lose work in. Partner Settings gets the same grouped sidebar navigation as Organization Settings, and both pages now tell the truth about saving: you're asked before unsaved edits are discarded, and a failed save keeps your work on screen instead of wiping the page.
- Connect AI assistants to Breeze more easily. Claude and ChatGPT can now connect to the Breeze MCP server out of the box, via an opt-in setting for self-hosted deployments.
Fixed
- Customer single sign-on works reliably on self-hosted deployments. Organization SSO sign-in could silently fail on production-configured deployments — the login button wouldn't appear and sign-ins didn't complete. It now works end-to-end, with rate limiting on sign-in attempts and cleanup of duplicate identity records added along the way.
- Locked agent-update policies are actually enforced. If you locked an update policy or maintenance window for your organizations, devices could still receive automatic updates outside it. The setting shown in the UI is now the setting that's enforced.
- Duplicate imports give a clear answer instead of an error. Importing a catalog item that already exists (and nine similar situations across the product) now responds with a clear 'already exists' result instead of a generic server error, and large distributor catalog imports no longer tie up the system while they enrich items.
- Clearing a discovered asset's display name saves cleanly. Emptying the Display Name field on a discovered asset's info page no longer fails with a cryptic error.
Version 0.91.0 is an identity and fleet-control release: your technicians can sign in with your identity provider, and you decide exactly which agent version every organization runs.
The headline is partner single sign-on. Breeze has long supported SSO for your client organizations — now your own technicians get the same treatment, signing in to the MSP dashboard through Microsoft Entra, Okta, or any OIDC-compatible identity provider, with password sign-in tucked away when SSO is enforced. Self-hosted deployments can also put their own branding on the login page. Alongside the new capability, this release fixes customer SSO on self-hosted deployments, where sign-ins could silently fail, and closes a loophole that let staff bypass SSO enforcement through password reset.
The second theme is control over your agent fleet. Version pins let you hold every device on a known-good agent release or trial a new one with a single organization before rolling it out — and a companion fix means locked update policies and maintenance windows are now genuinely enforced at update time, not just displayed in the UI. Add VPN presence telemetry, self-cleaning enrollment keys, and a friendlier settings experience, and this is a recommended upgrade across the board: four quick idempotent database updates, no new required configuration, and no breaking changes.