JWT authentication for ClickHouse services is now generally available

GASep 8, 2026VerifiedAdded Sep 22, 2026

You can now authenticate to your ClickHouse service using JWTs issued by your own identity provider, including Okta, Auth0, Microsoft Entra ID, Keycloak, or any provider that publishes a JWKS endpoint.

Governance Security Pricing Developer tools

Read ClickHouse's release notes

https://clickhouse.com/docs/resources/changelogs/cloud/2026#jwt-authentication-for-clickhouse-services-is-now-generally-available

Summaries of vendors' own notes. Product names and logos belong to their owners; logos via logo.dev.

More ClickHouse Cloud releases

ClickHouse CloudSep 8, 2026

MySQL CDC connector for ClickPipes is now generally available

The MySQL CDC connector for ClickPipes is now production-ready. This release adds automatic parallel snapshotting, delivering up to 27× faster initial loads, along with safer defaults for production deployments, including GTID-based replication and a minimum 72-hour binlog retention period.

GAStreamingData integrationObservabilitySource

ClickHouse CloudAug 31, 2026

New AWS regions: Taipei and Malaysia

ClickHouse Cloud is now available in AWS Taipei (ap-east-2) and AWS Malaysia (ap-southeast-5). Both are set up as Private Regions with ClickPipes support. See the supported regions documentation and Private Region considerations for details.

UpdateRegionsSource

ClickHouse CloudAug 31, 2026

ClickPipes: Private Service Connect supports Global Access

ClickPipes now supports Global Access for cross-region private connections using Private Service Connect (PSC). When enabled, ClickPipes can connect to a PSC endpoint in a different region than the GCP region where the service is running, including regions not natively supported in ClickHouse Cloud (*e.g.* asia-northeast3 (Seoul)).

UpdateRegionsSource

ClickHouse CloudAug 31, 2026

Switch between SAML organizations

SAML users who belong to multiple SAML organizations can now switch between them directly from the org switcher, which re-authenticates them behind the scenes. There's no longer any need to bookmark each organization's URL or manually log out and back in , just bookmark your main organization and switch from there.

UpdateObservabilitySource

ClickHouse CloudSep 22, 2026

HIPAA and PCI support in AWS Seoul and Sydney

HIPAA- and PCI-regulated cells are now available in the AWS Seoul (ap-northeast-2) and AWS Sydney (ap-southeast-2) regions. Select HIPAA or PCI at service creation to run compliant workloads in these regions; see the compliance overview and supported regions for details.

UpdateGovernanceRegionsSource

ClickHouse CloudSep 22, 2026

Replica-aware routing now in public beta

Replica-aware routing is available in public beta for Enterprise customers, with support for native ClickHouse Cloud and BYOC deployments. Once enabled on your account, you can turn it on directly from your service settings. See the announcement.

BetaSource

ClickHouse CloudSep 22, 2026

PromQL support in private preview

You can now store Prometheus metrics in the TimeSeries table engine and query them with PromQL directly against your ClickHouse service, no transpiler or proxy required, so existing collectors, Grafana dashboards, and Prometheus tooling keep working unchanged.

PreviewSQLBIObservabilitySource

ClickHouse CloudSep 22, 2026

On-Demand Compute now in private preview

On-Demand Compute lets eligible, compute-intensive SELECT queries tap additional ClickHouse workers through your existing service and endpoint, no resizing or extra provisioning required.

PreviewSQLPricingApache IcebergSource

Also shipped on Sep 8, 2026

Google Cloud BigQuerySep 8, 2026

Conversational analytics now supports predictive modeling questions using the AI.PREDICT function

Conversational analytics now supports predictive modeling questions using the AI.PREDICT function . This feature is in Preview .

PreviewSource

Snowflake SnowflakeSep 8, 2026

Add and drop hybrid table constraints online (General availability)

With this release, you can add and drop UNIQUE and FOREIGN KEY constraints on an existing hybrid table by using alter table . Previously, you had to define these constraints when you created the table, so adding a foreign key to a table that was already serving a workload meant recreating and reloading the table.

GASource

Snowflake SnowflakeSep 8, 2026

Shadow traffic for gateways (Preview)

With this preview release, you can use a shadow traffic gateway to send all production requests to a primary service endpoint while mirroring a percentage of those requests to one or more shadow endpoints. Responses from shadow endpoints aren't returned to clients.

PreviewData integrationSource

Databricks Databricks Data Intelligence PlatformSep 8, 2026

The partner-powered AI features setting will be removed

On November 1, 2026, Databricks will remove the account- and workspace-level toggle for partner-powered AI features. Each workspace will keep its current setting value: if the setting is enabled, it stays enabled, and if it's disabled, it stays disabled. Removing the toggle doesn't change any setting values.

DeprecationSource

Databricks LakeflowSep 8, 2026

Incremental ingestion for Salesforce formula fields in Lakeflow Connect will soon be generally available

Incremental ingestion for Salesforce formula fields in Lakeflow Connect will soon be generally available. Today, Lakeflow Connect ingests formula fields by taking a full snapshot on each pipeline run by default. When incremental formula field ingestion is generally available, full snapshots will no longer be the default.

GAPricingData integrationPerformanceSource

Databricks Unity CatalogSep 8, 2026

ABAC DENY policies are in Beta

ABAC DENY policies are in Beta in Unity Catalog. DENY policies can be used to explicitly deny the MANAGE ACCESS CONTROL privilege to prevent specified principals, including object owners, from performing access-management operations. They always take precedence over any grant. For details, see ABAC DENY policies (Beta) .

BetaGovernanceObservabilitySource