Skip to main content

What`s new in oneclick™?

Version / Release: 2607.03.053​

Release date: 1 September 2026

Improvements​

Keyboard layout for streaming in the browser​

Several improvements to the keyboard layout that apps use in the browser:

  • Danish layout added: the usage settings of an app configuration now offer "da-DK Qwerty" under "Keyboard layout selected on the remote system". The Danish special characters æ ø å and the characters on AltGr arrive correctly.
  • "Other layout" works as intended: the option previously named "Different layout (use remote system setting)" no longer falls back to the US layout. Characters are now transferred independently of the layout, so they also arrive correctly on remote systems whose layout is not in the list — including characters beyond Western European alphabets such as ą ć ę, ğ ı ş, Greek and Cyrillic characters, and the Euro sign. Shortcuts such as Ctrl+C, Ctrl+V, and Alt+Tab work in this mode as well.
  • Help text for the setting: a help icon next to the setting explains that the layout of the remote system cannot be detected automatically, and which entry to choose. The help text is available in the app configuration and on the app tile in oneclick™ Desk.

A layout from the list transfers all characters reliably, so choose "Other layout" only when the layout of the remote system is unknown or not in the list. In that mode, letter shortcuts such as Ctrl+Z can reach a different letter if the remote system uses a Qwertz-based layout that oneclick™ does not offer. As before, the setting applies to apps that are opened in the browser via oneclick™ Streaming, not to apps opened through the oneclick™ Gateway.

Maintenance mode now takes effect in load balancing pools​

The "Enable maintenance mode" dialog promises that no new logins are allowed on the destinations. In pools with "Sticky user sessions" that promise did not hold: users who had worked on a destination before were connected straight back to it after it went into maintenance, while users without such a binding were distributed correctly. The same pool behaved differently from user to user, and nothing in the admin area showed it.

  • Users whose reuse entry points at a destination in maintenance are now routed to a free destination of the pool instead — silently, without an error message and without anything for them to do.
  • Enabling maintenance mode now releases the reuse entries on the affected destinations, so you no longer have to release them by hand in the pool details. Entries are kept for users in groups that are granted access during maintenance mode, and for users whose session is still running on that destination.
  • Users with a running session can still start further apps on that destination. Moving them while the session is live could damage their Windows profile or leave them with a temporary one. These users now receive a notification asking them to save their documents and sign out of the system.
  • The dialog explains what this means and what to do about it, and the "Show sessions" link takes you to the details of the affected destination pool. The link appears only for pools that reuse existing user sessions.
  • If every destination of the pool is in maintenance, users now see the maintenance notice instead of a message about missing free resources.

App tiles show pool maintenance before the click​

When an app uses "Best destination of the load balancing pool" as its destination, its tile is now greyed out as soon as every destination of the pool is in maintenance for that user, and shows the maintenance notice on hover. Previously the tile looked normal, and users only found out after clicking and waiting for the start to fail. Tiles change state while users are signed in, so nobody has to sign in again.

  • If only part of the pool is in maintenance, the tile stays available and the app starts on a free destination — unchanged.
  • The tooltip shows your notice when every destination of the pool carries the same one. If the notices differ or none is set, users see a neutral text instead, because a maintenance time taken from one destination could mislead about another.
  • Tiles now apply the same rules as the app start itself. With a specific destination, users of the oneclick™ administration division and cross-division support with "Allow support access during maintenance" now see a usable tile, because the start lets them through anyway.

Group detail view opens without loading every user​

Opening a group in the admin area no longer loads the complete user list of the division first. The "Users" tile now requests only the members of that group and appears while the rest of the page is still loading — previously it waited for the entire list to arrive page by page, which is what made large divisions slow. Emptying a group now shows the empty state immediately instead of leaving the tile on a loading animation. Loading the user list itself is quicker as well, because a check that ran on every page no longer searches data of the whole platform.

Bug Fixes​

  • Filter requests to the oneclick™ API apply all filters again: Requests to the /filter endpoints now evaluate every filter that is sent — OR combinations, several filters within one filter group, and several filter groups — and they apply sort, limit, start, and page again. Previously only the first filter of the first group took effect, so a request returned more records than expected without reporting an error. Excluding filters (not) match correctly again as well, and a malformed filter or sort parameter now returns a clear error instead of an empty list. The includes parameter is unaffected: it was removed deliberately and this fix does not restore it.
  • Login via an identity provider recovers automatically: After a service interruption, login via an identity provider (Single Sign-on) could keep failing until the platform was restarted manually. oneclick™ now detects this state itself and corrects it automatically.
  • Networks with an overlapping address range can be created again for cloud connections: For AWS, Azure, Google Cloud, Open Telekom Cloud, Ionos, Exoscale, Vultr, Orange, Huawei, and Ventus, a second network with an overlapping CIDR range in the same connection is accepted again — these Cloud Providers allow identical address space within one cloud account. The check stays in place for STACKIT and IPsec connections, where an overlap does cause a conflict. Networks and subnets that failed to be created or have already been deleted no longer occupy their address range, so you can create a failed network again with the same range. The check now also applies when you edit the CIDR range of a network or add a subnet.
  • AD/LDAP sync no longer proposes users with a second connection for deletion: Users who are still synchronized through a second AD/LDAP connection no longer appear in the list of users proposed for deletion during sync.
  • AD/Azure import no longer aborts entirely when one user hangs: A single user whose processing used to stall no longer aborts the whole import — it continues for the remaining users.
  • AD/LDAP credentials no longer appear in API responses: The AD/LDAP connection's username and password are no longer returned in the corresponding API responses.
  • STACKIT and OpenStack connections report the actual error: Errors from STACKIT and OpenStack connections now show the provider's actual message instead of a generic one, and a missing response now results in a timeout instead of an indefinite wait. If the multi-project query gets no response at all, it is now reported as a clear error instead of silently returning an empty list.
  • Open Telekom Cloud pricing is now complete: Instances of the ecsflex family are now shown with a price as well.
  • AD sync group display corrected: The group display in AD sync now uses the correct separator throughout and shows the right label for empty groups.

Version / Release: 2607.01.013​

Release date: 17 July 2026

Improvements​

New "static" autoscaling mode for destination pools​

Destination pools now have a second autoscaling mode. The existing elastic mode creates and deletes virtual machines (VMs) depending on load. The new static mode instead only starts and stops the destinations already in the pool and never creates or deletes VMs. This is handy for starting and stopping RDS hosts by load, or for keeping a fixed number of VDIs powered on and free so users can start right away. You set how many systems should run at a minimum and maximum, and oneclick™ handles the rest automatically based on the current load.

Pools start on the first connection and scale down to zero when idle​

Destination pools with load balancing and autoscaling now run fully on demand. If no VM is running and a user wants to connect, oneclick™ automatically starts one. When the last user logs out at the end of the day, the last VM is shut down automatically after a set time, so a pool can scale all the way down to zero. This means no VMs sit idle unnecessarily, and your customers only pay for the time the systems are actually in use.

More insight and control for autoscaling​

Several changes make autoscaling easier to configure and monitor, and safer to set up:

  • Autoscaling history: the destination pool details now include an autoscaling log. For each scaling action it shows when it happened, what was scaled, why, and whether it succeeded — including the exact error if it failed. Entries are kept for four weeks.

  • Cooldown to prevent flapping: a new cooldown setting makes autoscaling wait after a load-based action before it scales in the opposite direction, so a VM sitting near a threshold no longer starts and stops repeatedly.
  • Idle shutdown: in static mode, a running VM that has had no active users for longer than a configurable idle time is shut down (down to the minimum), even when other heavily loaded VMs keep the pool average above the threshold. Freshly started, just-woken, and maintenance VMs are exempt.
  • Clearer guidance when switching mode: when you switch the autoscaling mode, a note explains the effects of both options. Elastic mode creates and deletes VMs based on load (which can incur cloud provider costs), while static mode never creates or deletes VMs. Autoscaling only ever deletes VMs it created itself; manually added VMs are never touched. Selecting an elastic profile for a pool requires an explicit confirmation, and a grace period prevents short-lived errors from triggering immediate deletions.
  • Maintenance mode is respected: VMs in maintenance mode are never started, stopped, or deleted by autoscaling.
  • Inline threshold hints: when a load criterion (CPU, RAM, or users) is configured so that it no longer affects scaling, an inline hint now points this out.
  • Clearer info texts: the tooltips for the start/stop timeout, the execution interval, and the force-scale-down warning have been reworded for clarity.

Event profile logs now record skipped events​

Event profile execution logs now also record events that were skipped. Each entry includes a timestamp and, where available, the reason — for example "Condition not met" or "Skipped by user". Previously, skipped events were not listed in the log.

See where a policy or event profile is used before deleting it​

The delete confirmation dialog for policies and event profiles now lists where the item is currently in use and notes that it will no longer take effect there after deletion — so you can gauge the impact before you confirm.

Policy details show affected users and app instances​

The policy details view can now show which users and which app instances a policy actually affects, derived from its rules. The boxes reveal the affected sets when you click, so you can review a policy's reach without piecing it together manually.

Redesigned destination pool details​

The destination pool details view has been reworked so that active functions are clearer. Once you enter credentials or choose a default destination, a dedicated tile appears for each — with edit and delete actions — instead of the setting sitting at the top. Removing the tile deactivates the function again.

CPU and RAM on computing resource destinations​

The detail view of a computing resource destination now shows the instance's CPU and RAM directly. The "utilization" value that was shown before has been removed from the list.

Jump from a destination to its connection​

The destination details now link to the details of the underlying connection and network, where the unique key is shown. This makes it easier to identify the right connection — for example when several connections share the same name.

The license detail view now has a tile that links to the user list pre-filtered by that license, and the app configuration detail view links to the app list pre-filtered by that app configuration. You can see what is assigned without setting the filter manually.

Clearer selected state for text-based filters​

Selected filters shown as text now appear bold and underlined. This affects, for example, the "License" filter under Users, so you can tell at a glance which filters are active. Chip-based filters (Groups, Roles) already had a clear selected state.

Reset passwords for several users at once​

Resetting a user's password is now also available from the multi-select above the user table. For a single user, the familiar dialog opens unchanged. When you select several users, oneclick™ sends each of them a sign-in link instead — so you can trigger a password reset for many users in one step, without handling individual passwords.

Refreshed license icons​

The Basic User, Professional User, App Standard, and App High Performance licenses now use dedicated icons that match their license type.

Naming hint when creating multiple VMs​

When you enter a quantity greater than one in VM Create, a suffix hint now shows how the names will be numbered, so it is clear how the created VMs will be named.

Mesh client download button disabled until ready​

The "Download Mesh client" button now stays disabled until the required data has been entered.

Clearer hint text for process input fields​

The hint under process configuration now makes clear that the listed fields are required only when the process is executed, not during creation.

More reliable Active Directory and LDAP synchronization​

AD and LDAP user synchronization now matches existing users by their stable directory identifier (the Azure Graph ID, or objectGUID / entryUUID for LDAP) instead of by email address. Users whose email changes in the directory — for example after a name change — are no longer imported as duplicates, so their group memberships and assignments are preserved. If a changed email already belongs to another local user, the import skips that user and notifies the admin instead of merging automatically. Synchronization of large directories (1,000+ groups) is also much faster, and the synchronization dialog no longer flickers while loading.

Improvements across cloud provider integrations​

  • Open Telekom Cloud: the new ECS flavor families (s9, x1m, p5e) are now bookable. Image creation now also works for source VMs that have only a private NIC, and no longer leaves behind empty network security groups.
  • Exoscale: stopping a VM that is in a transitional state (for example starting or stopping) now waits for a stable state instead of failing with a raw provider error. Unused network security groups are now cleaned up.
  • IONOS: provider errors now surface the actual cause instead of a misleading "Cannot read properties of undefined" message.

Bug Fixes​

  • AD user import no longer crashes for already-existing users: User import from Active Directory no longer aborts with an "Undefined array key" error when an imported user already exists, so the remaining users in the batch are imported reliably.
  • Multi-select delete works for policies, roles, and activities: The "Delete" button in the confirmation dialog is now enabled when deleting policies, roles, or activities from the table's multi-select, matching the behaviour of other tables.
  • App tiles update after a destination is deleted: When an admin deletes a destination that is still used by an app instance, the affected tiles now update automatically and the destination selection is cleared, so the app can be pointed at a valid destination instead of failing to start.
  • Orphaned event profiles can be deleted again: Event profiles whose linked process was removed can now be edited and deleted from the UI instead of returning a technical error.
  • Cloud Subscription connection form validates instead of erroring: Submitting an empty "Cloud Subscription" connection form now shows inline field validation instead of a 500 server error.
  • "New destination" Public Internet form validation clears correctly: After you fill in the public hostname or public IP, the other field no longer stays marked as invalid.
  • Removing a port from a public destination now takes effect: Removing port 3389 from a public destination now correctly affects access and is reflected in the app configuration.
  • Disconnect icon back in the destination filter: The disconnect icon is shown again in the destination table's filter.
  • Corrected documentation and terms links: The STACKIT provider documentation link, the license terms links (after the terms were split into separate Business Terms and Licence Terms), and the German "Load Balance Info" help link now point to valid pages.
  • Password managers target the right fields: Autofill from password managers such as Bitwarden or 1Password now appears on credential fields (for example admin username and password) and no longer on unrelated fields such as search or numeric inputs.
  • Clear sign-in denial when a license cannot be applied: When a user's license cannot be resolved — for example when it belongs to a different division than the one being signed in to — the sign-in is now cleanly refused instead of failing with a server error.