[PFYasu]

Documents the user-facing changes in the October 2026 deployment window (planned for 2026-10-22), validated against hr/test (6a8c7e77f, 2026-10-20).
Ticket: https://issues.ravendb.net/issue/RDoc-4121

Merge together with the production deployment (2026-10-22), not before. Most of this PR describes behaviour that is only on hr/test. Two exceptions:

• cloud-sso.mdx must go live the same day, because the portal already links to it.
• The CPU priority section and the fixes under Wrong on prod describe prod as it is today. They stay in this PR by decision and go live with the deployment.

One commit; its message follows the same sections as this description.

External SSO & User Management (new page)

New cloud/cloud-sso.mdx, added to sidebarsCloud.js. The portal's ssoDocsUrl (/docs/article-page/latest/csharp/cloud/cloud-sso) already 301s to /cloud/cloud-sso, so no redirect entry is needed.

• Availability (Account features, staff activation, Contact sales), who can configure it, the two management types and what switching between them deletes.
• IdP requirements: discovery document, HTTPS issuer, client_secret_post, email + sub in the ID token, email_verified (checked at the first sign-in).
• Connect wizard; provider notes for Okta, Microsoft Entra ID, Google and other OIDC providers; SCIM provisioning and tokens; group to role mapping.
• The SCIM userName becomes the SSO user's email and must match the ID token's email claim, or the first sign-in fails. Okta: Application username format = Email. Entra ID: map mail to userName when principal names differ.
• SCIM PUT updates are applied; PATCH can only activate or deactivate a user.
• Signing in with SSO (the IdP asks for credentials every time), the seven sso_* error messages, managing, resetting and disabling the connection.
• An account owner who tries SSO gets You don't have access to this account yet.: the owner's login is local, so the sign-in finds no SSO login to match. The access-denied row does not name the owner.
• The SSO settings page shows its actions menu (Edit, Change management type, Reset identity links, Disable SSO) only to holders of External SSO & User Management.
• Troubleshooting: 401 after a token is revoked or deleted, 403 when the feature is not active, and the userName mismatch.
• No price: the feature is not billed, and connection sharing was cut.

SSO in existing pages

• cloud-overview.mdx: the External SSO login path. Google/GitHub/Microsoft sign-in is no longer called "single sign-on".
• cloud-account.mdx: the new External SSO & User Management role, and what Account with User Management can do once SSO is set up.
• cloud-portal.mdx: the Account features sidebar view and its role gate. cloud-portal-account-tab.mdx: pointer to Account features.
• Users & Access: Cloud users vs SSO users, Add new SSO user, SSO users locked in SCIM mode, and the exception that lets a holder of Account with User Management map that role to an IdP group.
• Product page User Access widget (cloud-portal-products-tab.mdx): SSO users listed by their email address with an SSO badge, their rows locked in SCIM mode, and the server's reason shown when a save fails.
• cloud-security.mdx: MFA for SSO users. An SSO user who already had 2FA on keeps the switch to turn it off, and is not asked for the code when signing in through SSO. Turning 2FA off works for SSO logins only with the SSO UserManager fix, which is on hr/test since 2026-10-19 and ships in the same deployment.

Profile redesign

• MFA rewritten for the Security page:
  • the Enable 2FA switch and the recovery phone step;
  • recovery codes and their alerts (warning at 3 and 2 codes, red at 1 and 0);
  • Reset recovery codes, Forget this browser, and the sign-in notice after disabling 2FA.
  • Links now point to /portal/profile/security.
• The profile menu (Organizations, Invitations, Security, Cookie settings, Logout), sidebar collapse and expand, a new Accepting an invitation section, and the Terms of Use / Privacy Policy / Cookie settings links on the sign-in pages.

Users & Access permissions panel

Search, Set all to, Existing products / New products. Security admin is now a switch inside each product's access-level menu (cloud-account.mdx).

Edit Storage

• Switching between Standard and Premium keeps the capacity, and switching back restores the product's performance.
• A tier-only Azure change no longer stops the node.
• Serverless products cannot switch the storage type.

Daily monitoring report

The daily summary email's suggestions come from that day's events only (checked on TEST on 2026-10-16 against seeded events):

• High CPU for at least 5% of the day, High IO 3%, Low memory 2%.
• Low CPU credits, Not responding and OOM restarts on any occurrence.
• A suggestion whose event is still running is marked as ongoing.

CPU priority (prod behaviour, documented now)

• No switching between Performance (PN) and Shared / Basic / Standard, in either direction. Moving to Performance takes a new product and a data migration, and a PN product cannot change its instance type in the Portal.
• The CPU Priority slider offers only the priorities the product can switch to.
• The tier table lists Shared, and PS10 is no longer called a Performance tier.

Wrong on prod, fixed on the way

• Continue with email instead of Send Magic Link; dropped the outdated single-operator note.
• Account benefits: a fully used one-time credit is listed under Expired.
• Retrying a failed payment:
  • there is no Pay Now button since the Billing & Costs redesign (August 2025). Unpaid costs show a We couldn't process your payment banner with Retry payment, which opens a Confirm payment dialog (Confirm and pay). Both pages describe that flow now; the #pay-now anchor is kept;
  • the example: the previous billing period ends on February 25, not 27.
• Restoring a backup (cloud-backup-and-restore.mdx): the dialog is now Restore Link, with steps 1-7 instead of lettered callouts, a 2-hour default validity that Token Expiration extends to 36 hours with Regenerate restore link, and a restore-time estimate. The restore key covers standard backups and unencrypted databases; the database's own key is needed only for snapshot backups of encrypted databases.
• Azure Standard disks: 100 MB/s, not 60.
• Additional nodes are unavailable for PS and PN, Serverless and yearly contracts, not only PS.
• Cluster Health suggestions:
  • Not responding was missing; added with its thresholds;
  • the OOM analysis compared the periods the wrong way round.
• Billing:
  • the Cost Details button is on the Current billing period costs widget;
  • Billing history rows have Cost Details and See invoice buttons instead of being clickable.
• Registration (cloud-overview.mdx): the Summary step's Redeem offer (promo codes, on prod since September 2025) was not documented.
• AWS Marketplace (cloud-aws-marketplace.mdx): the landing page shows the Customer Identifier and AWS Account ID (on prod since January 2026); the docs now say they are only needed to convert an existing Cloud account, and the conversion section asks for both.
• Autoscaling (cloud-features.mdx, cloud-instances.mdx): the grace period is a cooldown counted from the last finished resize, manual ones included, not a delay after a threshold is crossed, and its range is 3-1440 minutes, not 3-60. Added how the signals combine: scaling up takes any one signal on any node, scaling down all three signals on every node.

Figures

• Re-shot on hr/test:
  • the login page, with the TEST-only captcha banner cut out;
  • the Portal sidebar, both Users & Access permission panels, the Backups list and both marketplace thank-you pages;
  • the MFA figures, including the Successfully enabled! dialog with the fixed wording, and Edit Tier;
  • the Billing widgets: current billing period, billing history, spending, current billing period costs and account benefits;
  • the Cluster Health overview, chart and instance changes table;
  • Home, with Last logged in at in MM/DD/YYYY HH:mm local time;
  • the Account page, which no longer has a Users section;
  • the product User Access widget with an SSO member and its SSO badge.
• New, for External SSO: the External SSO & User Management card under Account features, the SSO settings page in Sign-in only mode, Users & Access with the Cloud users and SSO users tables, the Add SSO user panel and the External sign-in page.
• Already out of date on prod, re-shot too:
  • the Support plans (the 6 month plan is 40%);
  • the Nodes view with additional nodes;
  • both Azure Premium SSD v2 dialogs, which now carry the "is permanent" warning;
  • the Restore Link dialog and the revealed restore key (a sample key; the link shown was revoked);
  • the Confirm payment dialog.
• New: profile-enable-mfa-phone.png (the recovery-phone step) and profile-reset-recovery-codes.png (Reset recovery codes).
• Removed login-page-email.png: the login figure shows the magic-link form too, so the Login section uses it once at the top.
• From Storybook on hr/test (6a8c7e77f), for views the TEST accounts cannot show:
  • re-shot: the six registration steps, both Marketplace landing pages (with their step numbers redrawn), the Customize step of the New Product wizard, the Serverless product details and the Cluster Health suggestions;
  • new: the connect wizard's Identity provider step, the SSO settings page in SCIM mode, Users & Access with SCIM-provisioned SSO users, the Security page of an SSO user and the profile Invitations page.
• Shots on TEST use example data where the test accounts had none: the SSO issuer shows example.okta.com, copyable URLs use cloud.ravendb.net, and test rows and names were hidden or replaced in the browser before the shot. The Storybook shots use the same kind of data (example.com addresses, the example domain, documentation IP ranges), and the release channels show only 6.2 and 7.2, as on prod.

Not verified on TEST yet

• Okta SCIM field names (SCIM connector base URL, Unique identifier field for users, Authentication Mode). The SSO test run provisioned through a separate Okta catalog app, with each user assigned to both apps; this PR describes SCIM enabled on the OIDC app integration itself.
• Microsoft Entra ID: the Token configuration step and the mail to userName mapping. Entra ID is set up on TEST, but its sign-in never reaches the app: the AWS WAF in front of TEST and PROD refuses the callback, whose query string is over its 2,048-byte limit. A Cloud bug is filed and linked to the deployment.
• The email_verified: false refusal and the client_secret_basic limitation come from the code: Okta neither asserts false nor enforces client_secret_basic, so neither could be reproduced.

The cosmetic-only figures are listed in the ticket. Left as they are: the annotated product-list figures (only their copy icon changed) and Edit Storage with the Azure performance tier (no TEST product has that field).