Proxus 2.1: company sign-in, safer upgrades and the AI Assistant on every screen

Proxus 2.1 lets people sign in with their company account through OpenID Connect, Active Directory or LDAP, or Keycloak, and adds two-step verification. The installer now updates, backs up and rolls back an existing installation. A new Region and Time screen sets the plant's time zone and lets each user pick their own time and format. Copilot is now called the AI Assistant and appears on many more screens, and you can open a support request from inside the product. All fixes from 2.0.1 and 2.0.2 are included.

Highlights

Sign-in and security

• Sign in with your company account. The sign-in page can show a button for each identity provider that speaks OpenID Connect, such as Keycloak, Microsoft Entra ID, Okta, Auth0, Authentik or AD FS. Users are created at their first sign-in and get their roles from the provider's groups. Signing out of Proxus also signs out of the provider. See Single sign-on and Choose how people sign in.
• Active Directory and LDAP. People sign in with their directory user name and password; Proxus talks to the domain controllers directly, over LDAPS or StartTLS only. Directory groups, including nested groups, map to Proxus roles. See Active Directory and LDAP sign-in.
• Keycloak, ready to run. The Docker package now has an optional Keycloak profile that reads Active Directory and maps its groups to Proxus roles, without internet access. Windows sign-in (Kerberos) and multi-factor sign-in can be turned on in Keycloak. See Sign in with Keycloak and Active Directory through Keycloak.
• Two-step verification. Anyone who signs in with a Proxus or directory password can turn it on in My Details with an authenticator app, with ten one-time recovery codes. Administrators can be required to set it up, and the REST API and MCP ask for the code too. See Two-step verification.

Installing and running

• An installer that updates, backs up and rolls back. The same install command recognises an existing Proxus and offers a menu: update, back up the configuration, add or remove Keycloak, change the time zone or address, restore a backup and show the status. An update checks the new files, backs up the configuration, starts the new version and rolls back on its own if it does not start cleanly. See Install, Upgrade and Backup and restore.
• Region and time. A new Administration > Region and Time screen sets the plant's time zone, the default number and date format for e-mail and reports, and the time zone of edge gateways in other countries. Everyone sees plant time by default, and each user can choose their own time zone and format in My Details. See Set the region and time.
• Licence capacity warnings. The values per second on the live status screen are now the same number the edge gateways count against the licence. An alarm opens at 70% of the licensed rate, rises at 90% and turns critical when values are dropped, and everyone signed in sees a notification in their own language. See License.

AI Assistant

• Copilot is now the AI Assistant. Only the name changed: providers, keys, conversations, usage history and role limits stay as they were.
• On the screens where you work. Explain or fix a function's code, describe a pipeline in a sentence, fix a Health Check finding, draft the resolution note of an alarm, read tags from a manual's register table in the device wizard, and ask about a dashboard or form results. Alarms, devices, edge gateways, system logs and the Operations Center have their own one-click questions. Every change still comes as a card you approve. See AI Assistant.
• Every answer is checked. Before an answer is final, Proxus compares each number, time and date in it with what the assistant read for that answer. Counts of alarms, durations and dependencies now come from Proxus, not from the model.
• MCP shares the assistant's tools. AI agents that connect over MCP can use the AI Assistant's read tools with the same permissions and scope, and can propose changes that wait in the user's AI Assistant for approval. Direct changes over MCP are now off by default. See MCP server.

Support

• Open a support request from the product. The new Support icon in the header opens a new request in the Proxus portal, with the installation's License ID and version already filled in. See Open a support request.

Sign-in and users

• A provider token can be exchanged for a Proxus API token, so scripts, data platforms and AI agents connect without sharing a Proxus password. The token's signature, lifetime, issuer and audience are checked.
• A ready Keycloak client file can be imported in Keycloak with Clients > Import client. It holds no secret and no addresses.
• Roles mapped from provider or directory groups are updated at every sign-in; roles an administrator gave by hand and that are not in the mapping stay.
• Users who sign in through a provider sign forms with their signature PIN. Change My Password, Reset Password and Force Password Change are no longer shown to directory and provider users.
• Security > Users has a new Sign-in column: Proxus password, Directory (LDAP), Windows, or single sign-on with the provider's name.
• Administrators with a Proxus password can always sign in, even when the directory cannot be reached.

Installer

• Telemetry data is never copied or changed by an update; the new version keeps using it. Steps specific to a version are run on their own.
• Installations use a fixed version instead of latest, so a docker compose pull never upgrades by surprise. The database and message server images are pinned too.
• Your settings stay in .env and your own changes in docker-compose.override.yml; updates touch neither. Installations made with the earlier script are taken over as they are, with their volumes, data and ports.
• Preview versions for partners are installed only by name and are never offered or tagged latest.
• The script in the release package works without internet and uses images loaded with docker load.

Region and time

• Lists, the Operations Center, alarm details, Topology, gateway and target cards, the UNS tree and trend charts all show the user's time. Charts and dashboards use the chosen number and date format.
• Pipeline schedules such as "every day at 06:00" and shift summaries now run on plant time by default. Existing pipelines keep the time zone they had.
• Times in alarm notifications (e-mail, SMS, Slack, Teams and others) are written in plant time and the default format. Times in a gateway's alarm report are shown to each reader in their own time and format.
• Forms, form exports and signature times use the user's time instead of the server's.
• Your own SQL queries, dashboards and reports see telemetry in plant time. The stored data stays in UTC; the Telemetry API and MCP tools return UTC.
• Audit Trail entries are stored in UTC and shown in the reader's time. Existing entries are converted once at the first start.
• Number input reads "12.5" and "12,5" as twelve and a half in every language.
• The CSV and Excel buttons on the query results screen work again. CSV is written the same way for every tool, and Excel files keep real number and date cells.

AI Assistant

• In the English interface the assistant is the AI Assistant; in menus it is Monitor > AI Assistant, with AI Assistant Settings and AI Assistant Usage under Platform. Changes made with the assistant show as "AI Assistant · conversation N" in the change history.
• If a value without a source is found, the assistant rewrites its answer and a note says so; a value that still has no source is listed under the answer so you know what to check yourself. The check uses no AI and costs nothing.
• Alarm counts by device, rule, severity or state are counted by Proxus, and alarm count and trigger count are given separately. Alarm history, shift and week summaries and recurring problems use one definition of a period, so their numbers may differ from the previous version.
• All critical alarms come first in the open alarm list, however old. Questions such as "yesterday" or "last week" use calendar periods in the user's time zone.
• Images in answers and summary e-mails are no longer loaded, only shown as links. Shift and week summaries contain only what the owner's roles can read.
• When the hub cannot hear the devices, the assistant says the problem is on the hub instead of calling devices offline. When a tool fails, it says what it could not check and goes on.
• With Claude, the fixed instructions and tool definitions are cached, so later questions in the same conversation use far fewer tokens.

One number on every screen

• "Open alarms" is the same everywhere: the live status screen counts all open alarms and says how many are still unassigned.
• Users limited to one site see only the edge gateways that run their own devices, in the assistant, the site summary and system logs.
• The device list, the data tree, the AI Assistant and MCP apply the same UNS visibility rule. A Deny rule on a tag also keeps its values out of the assistant's answers.
• A device that sends data shows Connected everywhere, and disabled devices are no longer counted as "not sending data".

MCP

• A role's AI Assistant Access now governs MCP too: No access allows nothing but signing in, and changes need at least Ask and propose changes.
• Proposals from an external agent arrive in the user's AI Assistant under External agent (MCP) and change nothing until the user approves. Unanswered proposals expire after 24 hours, and approved changes can be undone.
• MCP now shows rule conditions, function code and device IP addresses, as the assistant does. Secrets are hidden on both sides by the same list.

Fixes

• ClickHouse no longer fills the disk with its own internal logs. Five more internal log tables are off in Docker, Kubernetes and Siemens Industrial Edge installations (also in 2.0.2).
• A new licence reaches the edge gateways without a restart, and every gateway also checks its licence every five minutes. Older (V1) licences no longer drop values; above the limit they warn and raise an alarm (also in 2.0.1).
• Beckhoff bulk reads work on servers set to Turkish. Reads and writes that talk to devices no longer depend on the regional setting (also in 2.0.1).
• The licence agreement at the first sign-in after an upgrade is shown again (also in 2.0.1).
• System log times no longer appear 3 hours ahead, and alarm and gateway times in reports no longer shift by the database server's time zone.
• The Telemetry API and MCP telemetry and log tools return times in ISO 8601 UTC with a Z. Outbound targets always send UTC, and TDengine stores the time the value was read.
• An edge gateway and the hub can run in different time zones. If a connected gateway's clock is more than one minute off, the Operations Center warns.
• A user function that changes a reading in place and also calls Save() no longer writes the values two or three times. Values per second drop in installations that use such functions: the number now shows the real flow.
• The forms app opens after an update behind a CDN or browser cache.
• The device list refreshes Data and Last value every few seconds.
• The interface opens in the browser's language unless a language was chosen in the language selector.
• My Details opens for users who are not administrators.
• Entering a key issued for another installation now shows which License ID it was issued for.
• Hub pages load faster: about 5 MB of unused files were removed. The code editor works without internet.
• The hub, the interface and the edge gateway get a higher limit of open files and connections, so the interface no longer crashes under heavy use.
• Two false Health Check findings and wrong letter case on servers set to Turkish (Heidenhain addresses, work order states) were fixed.

Upgrade notes

• From 2.0.x. If you installed with the installer, run it again and choose update: it takes a backup and rolls back if something goes wrong. If you manage the compose file yourself, set the proxus-ui and proxus-server images to 2.1.0. Database changes run on their own at the first start.
• Region and time. At the first start, the plant time zone comes from the TZ setting and the default format from the installation's culture. Check them in Administration > Region and Time after the update, and choose the time zone of edge gateways in other countries there.
• Interface language. The interface now opens in the browser's language; the installation's culture no longer sets the language of the screens. A choice made in the language selector always comes first.
• Compose settings. The new compose file adds an open-file limit for the containers and pins the database and message server images. The installer applies these on its own; if you manage the compose file yourself, take them over too.
• ClickHouse logs. As in 2.0.2, internal ClickHouse logs collected on older installations can be removed with DROP TABLE system.<name> SYNC. Telemetry tables are not touched.
• Edge gateways. 2.0 edge gateways keep connecting to a 2.1 hub. To get the gateway fixes in this release, update them with Install on the gateway's page.
• MCP changes. Direct changes over MCP are now off by default. If agents must create or change objects directly, allow the methods in the MCP settings. Installations that set this value explicitly are not affected.
• Siemens Industrial Edge and Kubernetes. The fixed Istanbul time zone was removed. On Industrial Edge, choose the plant time zone once in Administration > Region and Time, or times show in UTC. On Kubernetes, set the time zone in the installation's single time zone setting (UTC by default).

More: Upgrade, Backup and restore.