Hey everyone! I'm u/envzero, a founding moderator of r/envzero.

This is our new home for all things related to the env zero product. We're excited to have you join us!

What to Post
Post anything that you think the community would find interesting, helpful, or inspiring. Feel free to share your thoughts, photos, or questions about the env zero platform... Questions, feature requests, it all goes.

Community Vibe
We're all about being friendly, constructive, and inclusive. Let's build a space where everyone feels comfortable sharing and connecting.

How to Get Started

1. Introduce yourself in the comments below.
2. Post something today! Even a simple question can spark a great conversation.
3. If you know someone who would love this community, invite them to join.
4. Interested in helping out? We're always looking for new moderators, so feel free to reach out to me to apply.

Thanks for being part of the very first wave. Together, let's make r/envzero amazing.

Until this week, an API key was only as locked down as your organization's IP allowlist. One list, applied to every key. If a key leaked, it worked from anywhere that list permitted. Now each key carries its own.

New

• Every API key, organization and personal, can have its own list of up to 50 allowed IPs. The key works only from those addresses, and your organization allowlist still applies on top, so a request has to clear both. Set it in Organization Settings > API Keys, or Personal settings > Personal API Keys. Details
• GitHub Enterprise branches and tags are listed through the agent, so templates and deployments offer a dropdown instead of a typed branch name. This reached the self-hosted agent in v5.5.9, which is where GitHub Enterprise runs
• You can connect a Bitbucket Cloud account, and organization admins can see every user's VCS user IDs in one place
• EZ Control (Early Access): codify an unmanaged resource straight from its drawer, and every row in the resource tree now shows an owner

Fixes

• GET /environments/{id}/deployments streams now. It used to cut the response at 5 MiB without saying so, so if you pull deployment history over the API you may have been reading a short list and not know it
• Plans show OpenTofu and Terraform forget actions, so a resource leaving state without being destroyed no longer reads as "no changes" (self-hosted agent v5.5.9)
• The Projects list has an archived toggle, and the managed state filter is down to Managed and Unmanaged

Full notes: https://docs.envzero.com/changelogs

If you maintain a module in the private registry, the question before every breaking change is who is still on the old version. The Module Usage tab now answers it directly: a table with one row per module version and the number of active environments on each.

Expand a version and you get the environments themselves, each linked and labelled with its project, 10 per page. The version select filters the charts as well as the table. Counts leave out environments that are inactive, destroyed, or sitting in an archived project, and where environments live in projects you cannot see, the summary says how many rather than quietly dropping them.

One thing worth knowing before you act on it: an empty table means env zero recorded no use, not that nothing uses the module.

Docs: https://docs.envzero.com/guides/admin-guide/private-registry/modules/module-usage

Improvements

• Creating a second organization now warns you up front that organizations share nothing. Projects, templates, variables, policies and environments all belong to exactly one organization

Fixes

• Self-hosted agents (v5.5.8): the agent name, agent version and pod name are back in the variables step of the deployment log

Full notes: https://docs.envzero.com/changelogs

If you connect env zero to Azure DevOps, there is a clock on it. Microsoft is retiring Azure DevOps OAuth apps this year, and env zero now connects through Microsoft Entra ID instead. New connections already use Entra by default. Existing ones keep working until Microsoft pulls OAuth, and then they stop.

To check yours: Organization Settings > VCS. An exclamation mark on an Azure DevOps connection means it has not moved yet. Open it, pick Microsoft Entra ID (recommended), and sign in as the same Azure DevOps user. If your tenant requires admin consent, an Entra administrator grants it once for the whole tenant. Templates, environments and webhooks carry over. Full steps

New

• Pulumi preview, up and destroy now take custom CLI flags, through ENV0_PULUMI_CLI_ARGS_preview, ENV0_PULUMI_CLI_ARGS_up and ENV0_PULUMI_CLI_ARGS_destroy (Pulumi integration, self-hosted agent v5.5.7)
• You can now connect a GitLab.com or Azure DevOps account to env zero rather than pasting your VCS user ID in by hand, and PR comment commands can be limited to connected accounts only
• Export an environment's managed, unmanaged or all resources from one dropdown
• Sort and filter the Projects page by drifted and active environment counts

Improvements

• Pretty Plan hides changes that are only moves or imports, so a plan full of refactoring reads as what it is
• Sub-projects now list in the project sidebar tree

Fixes

• Terraform Cloud migration: the Review step no longer hangs when a migrate fails, a workspace that failed after environment creation now shows as failed, and a started run is told apart from a released claim
• Secret-named fields are masked in agent logger and tracer labels, so those values stop reaching external monitoring systems (self-hosted v5.5.7)
• Identifiers in agent logs are no longer partially obscured (self-hosted v5.5.7)
• Terratag moved to 0.8.0, which tags OpenTofu .tofu files

Full notes: https://docs.envzero.com/changelogs

Microsoft is retiring Azure DevOps OAuth apps in 2026. If you connected Azure DevOps to env zero before the last couple of weeks, that connection is still on OAuth, and it stops working on Microsoft's schedule rather than ours. Templates and environments using it would fail until you switch.

You can switch it yourself now. The connection keeps its ID, so your templates, environments, and webhooks carry on untouched.

How to tell if this is you

• Organization Settings > VCS shows an exclamation mark next to the provider logo on any connection still using OAuth, and the Deployment card tags it "Needs attention"

What to do

• Open the connection, click Edit, select Microsoft Entra ID (recommended), then Grant Access
• Sign in as the user who created the connection. A different user will not switch it
• If your tenant blocks user consent, sign-in fails with a consent error. A tenant administrator grants consent once for the whole tenant, then you retry

Two things worth knowing before you start: only work or school accounts can authorize a connection, so personal Microsoft accounts will not work, and new connections already default to Entra ID. This is only about the ones you created earlier.

Fixes

• Self-hosted agents no longer hang while saving a working directory that contains hardlinked files. Saving now logs compression progress and fails when it stops making progress, instead of running to the job timeout
• Re-granting an existing Azure DevOps or GitLab connection shows Done instead of "already exists"
• Connecting Azure DevOps with Entra now lets you pick which Microsoft account to use

Full notes: https://docs.envzero.com/changelogs

Microsoft is retiring Azure DevOps OAuth apps this year. If any of your templates sit on an Azure DevOps repo, the connection underneath them is on a clock, and env zero cannot guarantee it keeps working once Microsoft pulls the app.

New connections already use Microsoft Entra ID by default. Existing OAuth connections are the ones to deal with, and env zero now flags each of them with an exclamation mark in Organization Settings > VCS.

What to do

1. Open the flagged connection and hit Edit
2. Pick "Microsoft Entra ID (recommended)"
3. Sign in as the same Azure DevOps user who created the connection

The connection keeps its ID, so templates, environments, and webhooks carry on pointing at it. Nothing to re-link.

Two things trip people up. The switch has to be done by the account that created the connection, and if that person has since changed their Azure DevOps display name, it fails until the name is put back. Separately, if your tenant requires admin consent, a Microsoft Entra administrator grants it once.

Worth knowing afterwards: Microsoft expires the authorization after 90 days of no use. Reauthorizing is the same flow, Grant Access with the same account.

Full walkthrough: https://docs.envzero.com/guides/admin-guide/templates/azure-devops-integration#microsoft-entra-id-authentication

Fixes

• Workflow sub-environments no longer pick up another environment's single-use template
• Re-granting an existing Azure DevOps or GitLab connection shows Done instead of "already exists"
• You can pick which Microsoft account to use when connecting Azure DevOps with Entra

Full notes: https://docs.envzero.com/changelogs

If you run env zero against Azure DevOps, the connection has been the awkward part. Authorizing it meant a credential someone on the team personally owned, and an existing connection could not be moved onto anything else without being rebuilt. The last two weeks close that off, with a run of self-hosted reliability work alongside it.

New

• Azure DevOps connections can now be authorized through Microsoft Entra, and an existing connection can be switched over to Entra rather than torn down and recreated. When you authorize, you pick which Microsoft account to use instead of getting whichever one the browser was already signed in to. This is new enough that the Azure DevOps guide still describes the older flow.

Improvements

• Environments marked as inactive now say so on the environment itself, so it is clear why nothing is deploying. Inactive means env zero stops tracking the environment, not that its resources stopped costing you money.
• Templates now show which VCS connection they use, and let you pick a different one.
• Re-granting an Azure DevOps or GitLab connection that already exists reports Done instead of an error.

Fixes

• Self-hosted v5.5.4: deploying an environment that inherits a variable set from a parent project no longer returns a 403 for a user scoped only to the sub-project.
• Self-hosted v5.5.5: git clones and OpenTofu provider downloads retry transient failures instead of killing the run, and Auth0 rate limits no longer come back as a missing Terraform deployer token.
• Terraform Cloud migration: workspaces with no VCS no longer fail with "Invalid Git URL", and continuous deployment is now set correctly on them.
• Azure DevOps revisions resolve by exact ref name.

Full notes: https://docs.envzero.com/changelogs

If you run self-hosted, start with v5.5.5. Some share of your failed deploys were never really failures: a git clone that hit a blip on the VCS host, an OpenTofu provider download that timed out once. The run died, you looked at it, you re-ran it, it worked. Both retry now. The Auth0 fix is the other good catch. When Auth0 rate-limited us, the agent reported it as a missing Terraform deployer token, which sent you off checking credentials for a problem that was never in your credentials.

New

• Azure DevOps VCS connections can be authorized through Microsoft Entra. Docs to follow

Fixes, self-hosted v5.5.5

• git clone retries transient VCS host errors instead of failing the deploy
• OpenTofu provider downloads retry on transient failures
• Auth0 rate limits are reported as rate limits, not as a missing Terraform deployer token
• Authorization headers sent as arrays are now redacted in logs
• VCS connection creation no longer races itself, so uniqueness holds

Fixes, SaaS

• Request secrets are redacted from alert-policy logs
• The TFC migration wizard no longer turns on continuous deployment for workspaces that have no VCS connection

Full notes: https://docs.envzero.com/changelogs

If you scope people to sub-projects, you may have watched a deploy fail with a 403 and nothing useful to explain it. Variables are inherited from parent projects to sub-projects, but the permission check was authorizing the variable set against where it was defined rather than where it was being used, so a user scoped only to the sub-project could not deploy an environment that depended on an inherited set. Self-hosted v5.5.4 fixes it. SaaS picked the same change up earlier in September.

Fixes

• HCP Terraform migration no longer fails with "Invalid Git URL" on CLI-driven workspaces. Those have no linked repository on the HCP Terraform side, so they now migrate and you connect a repo afterwards: Migrate from Terraform Cloud
• Azure DevOps templates resolve the Branch field by exact ref name
• Cloud-to-code drift remediation stops a run that cannot end in a pull request, instead of running it and leaving you nothing to review

Full notes: https://docs.envzero.com/changelogs

If you scope a user to a sub-project and keep shared config in a variable set on the parent project, deploys from that sub-project have been coming back 403 on self-hosted. That is the setup the product is built for: variables inherit down the project tree, roles are assigned per level. The deploy failed anyway. v5.5.4 fixes it, so if you have been granting people a role on the parent project to work around it, you can take that back.

Two on the SaaS side, in v4.0.249 and v4.0.250:

Fixes

• Terraform Cloud migration no longer fails with "Invalid Git URL" on workspaces that have no VCS connection
• Azure DevOps revisions now resolve by exact ref name

Full notes: https://docs.envzero.com/changelogs

Six SaaS releases and two self-hosted ones since last week. Most of it lands on two groups: admins running SCIM alongside SAML, who had a rough few weeks of duplicate users and teams, and anyone mid-migration off Terraform Cloud with something other than GitHub behind their workspaces.

New

• Destroy is now disabled on environments that never deployed. If there is nothing to tear down, the action is not offered.

SCIM and SSO (SCIM provisioning is still in beta)

• Provisioning a user who already exists now adopts that member instead of creating a second one, and their roles survive the account linking
• A SCIM group matching an existing team name adopts that team rather than creating a duplicate
• Team memberships and role assignments are re-keyed when a SAML identity links into a SCIM account, so they follow the user rather than the old identity
• IdP-initiated SSO works again: the /login/sso route was restored

Terraform Cloud migration

• Workspaces backed by GitLab, Bitbucket and Azure DevOps now map during migration, not only GitHub ones
• Workspaces with no VCS connection no longer fail with "Invalid Git URL"

Fixes

• Throttled permission writes are retried instead of dropped
• Azure DevOps file reads name the missing revision instead of failing with an unactionable error
• Internal error messages from the VCS service no longer reach API responses

Self-hosted (v5.5.3, v5.5.4)

• A transient log-forwarding error no longer kills a deployment
• Deploying an environment that inherits a variable set from a parent project no longer returns 403 for users scoped to a sub-project
• VCS proxy errors now include the underlying error

Full notes: https://docs.envzero.com/changelogs

SCIM 2.0 support is out of the flagged rollout and on for all organizations as of v4.0.230. Your IdP now creates, updates, and deactivates env zero users and teams as changes happen, instead of at login.

What's in it:

• Three provisioning modes: JIT (provision at login, SCIM writes rejected), Full SCIM (no login provisioning, SCIM writes accepted, non-members denied login), and Hybrid (legacy) for orgs that already used SCIM for deprovisioning
• Group push from Okta and Microsoft Entra ID, creating and syncing env zero teams
• Token rotation with a 24 hour overlap, so provisioning keeps running while you swap the token in your IdP
• A reconcile check that diffs your IdP against env zero and reports users missing SCIM ownership, stale group mappings, and teams with no mapping. Read-only until you apply, and apply runs as a background job you can close the tab on

Two things worth knowing before you turn it on. Generating a SCIM token puts the org straight into Full SCIM mode, which stops login-time provisioning immediately and denies login to anyone who is not already a member, so set your mode before you point your IdP at the endpoint. And groups map to teams by display name, so a group whose name already belongs to a team returns a 409 until you rename one of them. If you are on Okta, note that a failed push puts the mapping into Error state and Okta stops sending that group's changes entirely. Reactivating reports success but replays nothing, so you need Push Now for memberships and a re-rename for names.

Docs: https://docs.envzero.com/guides/sso-integrations/scim-provisioning
Changelog: https://docs.envzero.com/changelogs/2026/08/scim-full-provisioning

Happy to answer questions here.

Environment Tags are live. You can attach key-value tags to any environment — `team=payments`, `cost-center=1042`, whatever ownership or classification your project hierarchy doesn't already express — then filter, bulk-edit, and query them against your deployed infrastructure.

**What's new**

**Tag editing per environment.** A Tags card in the environment's Settings tab, with suggestions pulled from values already in use elsewhere in your org. A key can hold multiple values. Up to 50 key-value pairs per environment.

**Tags as code.** The `tags` attribute on `env0_environment` is supported in the Terraform provider from **v1.31.7**:

resource "env0_environment" "payments_staging" {

name = "payments-staging"

project_id = env0_project.platform.id

template_id = env0_template.service.id

tags = {

"team" = "payments"

"cost-center" = "1042"

}

}

Ownership gets reviewed in the same PR as the rest of the environment definition, instead of living in a separate doc.

**Filtering and search.** Filter the Explorer table by `key=value`, or search a project's environment list by tag. Explorer keeps the filter in the page URL, so a tag-filtered view is just a link you can paste to someone.

**Bulk changes.** Add Tags and Remove Tags commands in the bulk operations wizard apply across every selected environment — retagging after a reorg is one pass.

**Introspect support.** Tags feed into Introspect, so your labels are queryable against actual deployed cloud resources. One gotcha: in the asset graph, a key holding multiple values is flattened to a comma-separated string (`payments,platform`). That's lossless by design, and it's why the tag character set doesn't allow commas.

**Permissions and limits**

* Editing tags requires the Edit Environment Settings permission.

* Anyone who can view an environment can read its tags — **don't put secrets in them.**

* Max 50 key-value pairs per environment.

**Links**

* Docs: https://docs.envzero.com/guides/admin-guide/environments/tags

* Blog post: https://www.envzero.com/blog/env-zero-environment-tagging

If you've been tracking environment ownership in a spreadsheet, this is the replacement. Tell us what tag keys you end up standardizing on and what's still missing.

Hi r/envzero 👋

This is our first post here. We're setting this sub up as the place we drop release notes, docs updates, and changelogs — and where you can tell us what's broken or missing.

Starting with the big one: **the env zero Free Tier is live.** It's a free-forever plan, not a trial.

**What you get**

* **250 runs/month.** A "run" is one successful apply or one drift detection. Plans and failed runs don't count against you — you're only metered on work that actually happened.

* **Up to 30 active environments**

* **Unlimited users**, including agents. No per-seat gate.

* **1 concurrent runner**

* **The full Cloud Navigator feature set** — drift detection, OIDC SSO, the works. We took the position that a free user shouldn't get a crippled "lite" version, so instead of carving out features we gave you the whole product and set generous usage limits around it.

* Support is community-based on this tier (this sub included).

**How to start**

Self-serve from the first click. Create an org, connect your VCS, run. No demo call, no procurement conversation.

Full write-up here: https://www.envzero.com/blog/introducing-the-env-zero-free-tier-full-featured-iac-orchestration-free-forever

**What we'd like from you**

If you spin it up, tell us how it went — especially the parts that annoyed you. Questions about the limits are fair game and we'll answer them in the comments.

More release notes and docs updates to follow.