diff --git a/src/SolutionInfo.cs b/src/SolutionInfo.cs
index 3ecfd20f03..cab7b9a12b 100644
--- a/src/SolutionInfo.cs
+++ b/src/SolutionInfo.cs
@@ -18,5 +18,5 @@ using System.Resources;
 [assembly: AssemblyVersion("8.0.0")]
 
 // these are FYI and changed automatically
-[assembly: AssemblyFileVersion("8.11.1")]
-[assembly: AssemblyInformationalVersion("8.11.1")]
+[assembly: AssemblyFileVersion("8.12.0")]
+[assembly: AssemblyInformationalVersion("8.12.0-rc")]
diff --git a/src/Umbraco.Core/Services/Implement/PublicAccessService.cs b/src/Umbraco.Core/Services/Implement/PublicAccessService.cs
index 4e3cd96012..fa9f2c55f1 100644
--- a/src/Umbraco.Core/Services/Implement/PublicAccessService.cs
+++ b/src/Umbraco.Core/Services/Implement/PublicAccessService.cs
@@ -62,12 +62,10 @@ namespace Umbraco.Core.Services.Implement
             //start with the deepest id
             ids.Reverse();
 
-            using (var scope = ScopeProvider.CreateScope())
+            using (var scope = ScopeProvider.CreateScope(autoComplete: true))
             {
                 //This will retrieve from cache!
-                var entries = _publicAccessRepository.GetMany().ToArray();
-
-                scope.Complete();
+                var entries = _publicAccessRepository.GetMany().ToList();
                 foreach (var id in ids)
                 {
                     var found = entries.FirstOrDefault(x => x.ProtectedNodeId == id);
diff --git a/src/Umbraco.Examine/ContentValueSetValidator.cs b/src/Umbraco.Examine/ContentValueSetValidator.cs
index 9555566c53..f702e8197d 100644
--- a/src/Umbraco.Examine/ContentValueSetValidator.cs
+++ b/src/Umbraco.Examine/ContentValueSetValidator.cs
@@ -4,7 +4,9 @@ using System.Linq;
 using Examine;
 using Examine.LuceneEngine.Providers;
 using Umbraco.Core;
+using Umbraco.Core.Composing;
 using Umbraco.Core.Models;
+using Umbraco.Core.Scoping;
 using Umbraco.Core.Services;
 
 namespace Umbraco.Examine
@@ -15,9 +17,9 @@ namespace Umbraco.Examine
     public class ContentValueSetValidator : ValueSetValidator, IContentValueSetValidator
     {
         private readonly IPublicAccessService _publicAccessService;
-
+        private readonly IScopeProvider _scopeProvider;
         private const string PathKey = "path";
-        private static readonly IEnumerable<string> ValidCategories = new[] {IndexTypes.Content, IndexTypes.Media};
+        private static readonly IEnumerable<string> ValidCategories = new[] { IndexTypes.Content, IndexTypes.Media };
         protected override IEnumerable<string> ValidIndexCategories => ValidCategories;
 
         public bool PublishedValuesOnly { get; }
@@ -53,25 +55,38 @@ namespace Umbraco.Examine
 
         public bool ValidateProtectedContent(string path, string category)
         {
-            if (category == IndexTypes.Content
-                && !SupportProtectedContent
-                //if the service is null we can't look this up so we'll return false
-                && (_publicAccessService == null || _publicAccessService.IsProtected(path)))
+            if (category == IndexTypes.Content && !SupportProtectedContent)
             {
-                return false;
+                //if the service is null we can't look this up so we'll return false
+                if (_publicAccessService == null || _scopeProvider == null)
+                {
+                    return false;
+                }
+
+                // explicit scope since we may be in a background thread
+                using (_scopeProvider.CreateScope(autoComplete: true))
+                {
+                    if (_publicAccessService.IsProtected(path))
+                    {
+                        return false;
+                    }
+                }
             }
 
             return true;
         }
 
+        // used for tests
         public ContentValueSetValidator(bool publishedValuesOnly, int? parentId = null,
             IEnumerable<string> includeItemTypes = null, IEnumerable<string> excludeItemTypes = null)
-            : this(publishedValuesOnly, true, null, parentId, includeItemTypes, excludeItemTypes)
+            : this(publishedValuesOnly, true, null, null, parentId, includeItemTypes, excludeItemTypes)
         {
         }
 
         public ContentValueSetValidator(bool publishedValuesOnly, bool supportProtectedContent,
-            IPublicAccessService publicAccessService, int? parentId = null,
+            IPublicAccessService publicAccessService,
+            IScopeProvider scopeProvider,
+            int? parentId = null,
             IEnumerable<string> includeItemTypes = null, IEnumerable<string> excludeItemTypes = null)
             : base(includeItemTypes, excludeItemTypes, null, null)
         {
@@ -79,6 +94,16 @@ namespace Umbraco.Examine
             SupportProtectedContent = supportProtectedContent;
             ParentId = parentId;
             _publicAccessService = publicAccessService;
+            _scopeProvider = scopeProvider;
+        }
+
+        [Obsolete("Use the ctor with all parameters instead")]
+        public ContentValueSetValidator(bool publishedValuesOnly, bool supportProtectedContent,
+            IPublicAccessService publicAccessService, int? parentId = null,
+            IEnumerable<string> includeItemTypes = null, IEnumerable<string> excludeItemTypes = null)
+            : this(publishedValuesOnly, supportProtectedContent, publicAccessService, Current.ScopeProvider,
+                  parentId, includeItemTypes, excludeItemTypes)
+        {
         }
 
         public override ValueSetValidationResult Validate(ValueSet valueSet)
@@ -103,7 +128,7 @@ namespace Umbraco.Examine
                     && variesByCulture.Count > 0 && variesByCulture[0].Equals("y"))
                 {
                     //so this valueset is for a content that varies by culture, now check for non-published cultures and remove those values
-                    foreach(var publishField in valueSet.Values.Where(x => x.Key.StartsWith($"{UmbracoExamineIndex.PublishedFieldName}_")).ToList())
+                    foreach (var publishField in valueSet.Values.Where(x => x.Key.StartsWith($"{UmbracoExamineIndex.PublishedFieldName}_")).ToList())
                     {
                         if (publishField.Value.Count <= 0 || !publishField.Value[0].Equals("y"))
                         {
@@ -134,7 +159,7 @@ namespace Umbraco.Examine
                 || !ValidateProtectedContent(path, valueSet.Category))
                 return ValueSetValidationResult.Filtered;
 
-            return isFiltered ? ValueSetValidationResult.Filtered: ValueSetValidationResult.Valid;
+            return isFiltered ? ValueSetValidationResult.Filtered : ValueSetValidationResult.Valid;
         }
     }
 }
diff --git a/src/Umbraco.Tests.AcceptanceTest/cypress/integration/Content/content.ts b/src/Umbraco.Tests.AcceptanceTest/cypress/integration/Content/content.ts
index 22f1f883d0..1a40e8451f 100644
--- a/src/Umbraco.Tests.AcceptanceTest/cypress/integration/Content/content.ts
+++ b/src/Umbraco.Tests.AcceptanceTest/cypress/integration/Content/content.ts
@@ -574,7 +574,7 @@ context('Content', () => {
 
         // Create content with content picker
         cy.get('.umb-tree-root-link').rightclick();
-        cy.get('.-opens-dialog > .umb-action-link').click();
+        cy.get('[data-element="action-create"]').click();
         cy.get('[data-element="action-create-' + pickerDocTypeAlias + '"] > .umb-action-link').click();
         // Fill out content
         cy.umbracoEditorHeaderName('ContentPickerContent');
diff --git a/src/Umbraco.Tests/UmbracoExamine/UmbracoContentValueSetValidatorTests.cs b/src/Umbraco.Tests/UmbracoExamine/UmbracoContentValueSetValidatorTests.cs
index 8bdb0c71c7..330529a5db 100644
--- a/src/Umbraco.Tests/UmbracoExamine/UmbracoContentValueSetValidatorTests.cs
+++ b/src/Umbraco.Tests/UmbracoExamine/UmbracoContentValueSetValidatorTests.cs
@@ -8,6 +8,7 @@ using Umbraco.Core;
 using Umbraco.Core.Models;
 using System;
 using System.Linq;
+using Umbraco.Core.Scoping;
 
 namespace Umbraco.Tests.UmbracoExamine
 {
@@ -17,10 +18,14 @@ namespace Umbraco.Tests.UmbracoExamine
         [Test]
         public void Invalid_Category()
         {
-            var validator = new ContentValueSetValidator(false, true, Mock.Of<IPublicAccessService>());
+            var validator = new ContentValueSetValidator(
+                false,
+                true,
+                Mock.Of<IPublicAccessService>(),
+                Mock.Of<IScopeProvider>());
 
             var result = validator.Validate(ValueSet.FromObject("555", IndexTypes.Content, new { hello = "world", path = "-1,555" }));
-            Assert.AreEqual(ValueSetValidationResult.Valid, result);            
+            Assert.AreEqual(ValueSetValidationResult.Valid, result);
 
             result = validator.Validate(ValueSet.FromObject("777", IndexTypes.Media, new { hello = "world", path = "-1,555" }));
             Assert.AreEqual(ValueSetValidationResult.Valid, result);
@@ -33,7 +38,11 @@ namespace Umbraco.Tests.UmbracoExamine
         [Test]
         public void Must_Have_Path()
         {
-            var validator = new ContentValueSetValidator(false, true, Mock.Of<IPublicAccessService>());
+            var validator = new ContentValueSetValidator(
+                false,
+                true,
+                Mock.Of<IPublicAccessService>(),
+                Mock.Of<IScopeProvider>());
 
             var result = validator.Validate(ValueSet.FromObject("555", IndexTypes.Content, new { hello = "world" }));
             Assert.AreEqual(ValueSetValidationResult.Failed, result);
@@ -45,7 +54,12 @@ namespace Umbraco.Tests.UmbracoExamine
         [Test]
         public void Parent_Id()
         {
-            var validator = new ContentValueSetValidator(false, true, Mock.Of<IPublicAccessService>(), 555);
+            var validator = new ContentValueSetValidator(
+                false,
+                true,
+                Mock.Of<IPublicAccessService>(),
+                Mock.Of<IScopeProvider>(),
+                555);
 
             var result = validator.Validate(ValueSet.FromObject("555", IndexTypes.Content, new { hello = "world", path = "-1,555" }));
             Assert.AreEqual(ValueSetValidationResult.Filtered, result);
@@ -63,7 +77,9 @@ namespace Umbraco.Tests.UmbracoExamine
         [Test]
         public void Inclusion_Field_List()
         {
-            var validator = new ValueSetValidator(null, null,
+            var validator = new ValueSetValidator(
+                null,
+                null,
                 new[] { "hello", "world" },
                 null);
 
@@ -79,7 +95,9 @@ namespace Umbraco.Tests.UmbracoExamine
         [Test]
         public void Exclusion_Field_List()
         {
-            var validator = new ValueSetValidator(null, null,
+            var validator = new ValueSetValidator(
+                null,
+                null,
                 null,
                 new[] { "hello", "world" });
 
@@ -95,7 +113,9 @@ namespace Umbraco.Tests.UmbracoExamine
         [Test]
         public void Inclusion_Exclusion_Field_List()
         {
-            var validator = new ValueSetValidator(null, null,
+            var validator = new ValueSetValidator(
+                null,
+                null,
                 new[] { "hello", "world" },
                 new[] { "world" });
 
@@ -111,7 +131,11 @@ namespace Umbraco.Tests.UmbracoExamine
         [Test]
         public void Inclusion_Type_List()
         {
-            var validator = new ContentValueSetValidator(false, true, Mock.Of<IPublicAccessService>(),
+            var validator = new ContentValueSetValidator(
+                false,
+                true,
+                Mock.Of<IPublicAccessService>(),
+                Mock.Of<IScopeProvider>(),
                 includeItemTypes: new List<string> { "include-content" });
 
             var result = validator.Validate(ValueSet.FromObject("555", IndexTypes.Content, "test-content", new { hello = "world", path = "-1,555" }));
@@ -127,7 +151,11 @@ namespace Umbraco.Tests.UmbracoExamine
         [Test]
         public void Exclusion_Type_List()
         {
-            var validator = new ContentValueSetValidator(false, true, Mock.Of<IPublicAccessService>(),
+            var validator = new ContentValueSetValidator(
+                false,
+                true,
+                Mock.Of<IPublicAccessService>(),
+                Mock.Of<IScopeProvider>(),
                 excludeItemTypes: new List<string> { "exclude-content" });
 
             var result = validator.Validate(ValueSet.FromObject("555", IndexTypes.Content, "test-content", new { hello = "world", path = "-1,555" }));
@@ -143,7 +171,11 @@ namespace Umbraco.Tests.UmbracoExamine
         [Test]
         public void Inclusion_Exclusion_Type_List()
         {
-            var validator = new ContentValueSetValidator(false, true, Mock.Of<IPublicAccessService>(),
+            var validator = new ContentValueSetValidator(
+                false,
+                true,
+                Mock.Of<IPublicAccessService>(),
+                Mock.Of<IScopeProvider>(),
                 includeItemTypes: new List<string> { "include-content", "exclude-content" },
                 excludeItemTypes: new List<string> { "exclude-content" });
 
@@ -163,7 +195,11 @@ namespace Umbraco.Tests.UmbracoExamine
         [Test]
         public void Recycle_Bin_Content()
         {
-            var validator = new ContentValueSetValidator(true, false, Mock.Of<IPublicAccessService>());
+            var validator = new ContentValueSetValidator(
+                true,
+                false,
+                Mock.Of<IPublicAccessService>(),
+                Mock.Of<IScopeProvider>());
 
             var result = validator.Validate(ValueSet.FromObject("555", IndexTypes.Content, new { hello = "world", path = "-1,-20,555" }));
             Assert.AreEqual(ValueSetValidationResult.Failed, result);
@@ -187,7 +223,11 @@ namespace Umbraco.Tests.UmbracoExamine
         [Test]
         public void Recycle_Bin_Media()
         {
-            var validator = new ContentValueSetValidator(true, false, Mock.Of<IPublicAccessService>());
+            var validator = new ContentValueSetValidator(
+                true,
+                false,
+                Mock.Of<IPublicAccessService>(),
+                Mock.Of<IScopeProvider>());
 
             var result = validator.Validate(ValueSet.FromObject("555", IndexTypes.Media, new { hello = "world", path = "-1,-21,555" }));
             Assert.AreEqual(ValueSetValidationResult.Filtered, result);
@@ -203,7 +243,11 @@ namespace Umbraco.Tests.UmbracoExamine
         [Test]
         public void Published_Only()
         {
-            var validator = new ContentValueSetValidator(true, true, Mock.Of<IPublicAccessService>());
+            var validator = new ContentValueSetValidator(
+                true,
+                true,
+                Mock.Of<IPublicAccessService>(),
+                Mock.Of<IScopeProvider>());
 
             var result = validator.Validate(ValueSet.FromObject("555", IndexTypes.Content, new { hello = "world", path = "-1,555" }));
             Assert.AreEqual(ValueSetValidationResult.Failed, result);
@@ -230,7 +274,10 @@ namespace Umbraco.Tests.UmbracoExamine
         [Test]
         public void Published_Only_With_Variants()
         {
-            var validator = new ContentValueSetValidator(true, true, Mock.Of<IPublicAccessService>());
+            var validator = new ContentValueSetValidator(true,
+                true,
+                Mock.Of<IPublicAccessService>(),
+                Mock.Of<IScopeProvider>());
 
             var result = validator.Validate(new ValueSet("555", IndexTypes.Content,
                 new Dictionary<string, object>
@@ -288,7 +335,11 @@ namespace Umbraco.Tests.UmbracoExamine
                 .Returns(Attempt.Succeed(new PublicAccessEntry(Guid.NewGuid(), 555, 444, 333, Enumerable.Empty<PublicAccessRule>())));
             publicAccessService.Setup(x => x.IsProtected("-1,777"))
                 .Returns(Attempt.Fail<PublicAccessEntry>());
-            var validator = new ContentValueSetValidator(false, false, publicAccessService.Object);
+            var validator = new ContentValueSetValidator(
+                false,
+                false,
+                publicAccessService.Object,
+                Mock.Of<IScopeProvider>());
 
             var result = validator.Validate(ValueSet.FromObject("555", IndexTypes.Content, new { hello = "world", path = "-1,555" }));
             Assert.AreEqual(ValueSetValidationResult.Filtered, result);
diff --git a/src/Umbraco.Web.UI.Client/src/views/documenttypes/create.html b/src/Umbraco.Web.UI.Client/src/views/documenttypes/create.html
index f9e2402dc6..e370c30581 100644
--- a/src/Umbraco.Web.UI.Client/src/views/documenttypes/create.html
+++ b/src/Umbraco.Web.UI.Client/src/views/documenttypes/create.html
@@ -23,7 +23,7 @@
                     </button>
                 </li>
                 <li data-element="action-documentTypeWithIsElementTypeChecked" class="umb-action">
-                    <button type="button" ng-click="createElement()" class="umb-action-link umb-outline btn-reset" umb-auto-focus>
+                    <button type="button" ng-click="createElement()" class="umb-action-link umb-outline btn-reset">
                         <i class="large icon icon-science" aria-hidden="true"></i>
                         <span class="menu-label">
                             <localize key="create_elementType">Element Type</localize>
diff --git a/src/Umbraco.Web.UI/Umbraco.Web.UI.csproj b/src/Umbraco.Web.UI/Umbraco.Web.UI.csproj
index 69bdeba643..6da1e7bcdf 100644
--- a/src/Umbraco.Web.UI/Umbraco.Web.UI.csproj
+++ b/src/Umbraco.Web.UI/Umbraco.Web.UI.csproj
@@ -347,9 +347,9 @@
         <WebProjectProperties>
           <UseIIS>False</UseIIS>
           <AutoAssignPort>True</AutoAssignPort>
-          <DevelopmentServerPort>8111</DevelopmentServerPort>
+          <DevelopmentServerPort>8120</DevelopmentServerPort>
           <DevelopmentServerVPath>/</DevelopmentServerVPath>
-          <IISUrl>http://localhost:8111</IISUrl>
+          <IISUrl>http://localhost:8120</IISUrl>
           <NTLMAuthentication>False</NTLMAuthentication>
           <UseCustomServer>False</UseCustomServer>
           <CustomServerUrl>
diff --git a/src/Umbraco.Web/Search/ExamineComponent.cs b/src/Umbraco.Web/Search/ExamineComponent.cs
index 16cc8c210a..11778a64bb 100644
--- a/src/Umbraco.Web/Search/ExamineComponent.cs
+++ b/src/Umbraco.Web/Search/ExamineComponent.cs
@@ -639,22 +639,27 @@ namespace Umbraco.Web.Search
                 // perform the ValueSet lookup on a background thread
                 examineComponent._indexItemTaskRunner.Add(new SimpleTask(() =>
                 {
-                    // for content we have a different builder for published vs unpublished
-                    // we don't want to build more value sets than is needed so we'll lazily build 2 one for published one for non-published
-                    var builders = new Dictionary<bool, Lazy<List<ValueSet>>>
+                    // Background thread, wrap the whole thing in an explicit scope since we know
+                    // DB services are used within this logic.
+                    using (examineComponent._scopeProvider.CreateScope(autoComplete: true))
                     {
-                        [true] = new Lazy<List<ValueSet>>(() => examineComponent._publishedContentValueSetBuilder.GetValueSets(content).ToList()),
-                        [false] = new Lazy<List<ValueSet>>(() => examineComponent._contentValueSetBuilder.GetValueSets(content).ToList())
-                    };
+                        // for content we have a different builder for published vs unpublished
+                        // we don't want to build more value sets than is needed so we'll lazily build 2 one for published one for non-published
+                        var builders = new Dictionary<bool, Lazy<List<ValueSet>>>
+                        {
+                            [true] = new Lazy<List<ValueSet>>(() => examineComponent._publishedContentValueSetBuilder.GetValueSets(content).ToList()),
+                            [false] = new Lazy<List<ValueSet>>(() => examineComponent._contentValueSetBuilder.GetValueSets(content).ToList())
+                        };
 
-                    foreach (var index in examineComponent._examineManager.Indexes.OfType<IUmbracoIndex>()
-                        //filter the indexers
-                        .Where(x => isPublished || !x.PublishedValuesOnly)
-                        .Where(x => x.EnableDefaultEventHandler))
-                    {
-                        var valueSet = builders[index.PublishedValuesOnly].Value;
-                        index.IndexItems(valueSet);
-                    }
+                        foreach (var index in examineComponent._examineManager.Indexes.OfType<IUmbracoIndex>()
+                            //filter the indexers
+                            .Where(x => isPublished || !x.PublishedValuesOnly)
+                            .Where(x => x.EnableDefaultEventHandler))
+                        {
+                            var valueSet = builders[index.PublishedValuesOnly].Value;
+                            index.IndexItems(valueSet);
+                        }
+                    }   
                 }));
             }
         }
@@ -685,14 +690,19 @@ namespace Umbraco.Web.Search
                 // perform the ValueSet lookup on a background thread
                 examineComponent._indexItemTaskRunner.Add(new SimpleTask(() =>
                 {
-                    var valueSet = examineComponent._mediaValueSetBuilder.GetValueSets(media).ToList();
-
-                    foreach (var index in examineComponent._examineManager.Indexes.OfType<IUmbracoIndex>()
-                        //filter the indexers
-                        .Where(x => isPublished || !x.PublishedValuesOnly)
-                        .Where(x => x.EnableDefaultEventHandler))
+                    // Background thread, wrap the whole thing in an explicit scope since we know
+                    // DB services are used within this logic.
+                    using (examineComponent._scopeProvider.CreateScope(autoComplete: true))
                     {
-                        index.IndexItems(valueSet);
+                        var valueSet = examineComponent._mediaValueSetBuilder.GetValueSets(media).ToList();
+
+                        foreach (var index in examineComponent._examineManager.Indexes.OfType<IUmbracoIndex>()
+                            //filter the indexers
+                            .Where(x => isPublished || !x.PublishedValuesOnly)
+                            .Where(x => x.EnableDefaultEventHandler))
+                        {
+                            index.IndexItems(valueSet);
+                        }
                     }
                 })); 
             }
@@ -722,12 +732,17 @@ namespace Umbraco.Web.Search
                 // perform the ValueSet lookup on a background thread
                 examineComponent._indexItemTaskRunner.Add(new SimpleTask(() =>
                 {
-                    var valueSet = examineComponent._memberValueSetBuilder.GetValueSets(member).ToList();
-                    foreach (var index in examineComponent._examineManager.Indexes.OfType<IUmbracoIndex>()
-                        //filter the indexers
-                        .Where(x => x.EnableDefaultEventHandler))
+                    // Background thread, wrap the whole thing in an explicit scope since we know
+                    // DB services are used within this logic.
+                    using (examineComponent._scopeProvider.CreateScope(autoComplete: true))
                     {
-                        index.IndexItems(valueSet);
+                        var valueSet = examineComponent._memberValueSetBuilder.GetValueSets(member).ToList();
+                        foreach (var index in examineComponent._examineManager.Indexes.OfType<IUmbracoIndex>()
+                            //filter the indexers
+                            .Where(x => x.EnableDefaultEventHandler))
+                        {
+                            index.IndexItems(valueSet);
+                        }
                     }
                 }));
             }
diff --git a/src/Umbraco.Web/Security/AppBuilderExtensions.cs b/src/Umbraco.Web/Security/AppBuilderExtensions.cs
index 8f33f10eea..23afc36f93 100644
--- a/src/Umbraco.Web/Security/AppBuilderExtensions.cs
+++ b/src/Umbraco.Web/Security/AppBuilderExtensions.cs
@@ -169,11 +169,31 @@ namespace Umbraco.Web.Security
                 // Enables the application to validate the security stamp when the user
                 // logs in. This is a security feature which is used when you
                 // change a password or add an external login to your account.
-                OnValidateIdentity = SecurityStampValidator
-                    .OnValidateIdentity<BackOfficeUserManager, BackOfficeIdentityUser, int>(
+                OnValidateIdentity = context =>
+                {
+                    // capture the current ticket for the request
+                    var identity = context.Identity;
+
+                    return SecurityStampValidator
+                        .OnValidateIdentity<BackOfficeUserManager, BackOfficeIdentityUser, int>(
+                        // This will re-verify the security stamp at a throttled 30 mins
+                        // (the standard/default set in aspnet identity).
+                        // This ensures that if the security stamp has changed - i.e. passwords,
+                        // external logins, or other security profile data changed behind the
+                        // scenes while being logged in, that they are logged out and have
+                        // to re-verify their identity.
                         TimeSpan.FromMinutes(30),
-                        (manager, user) => manager.GenerateUserIdentityAsync(user),
-                        identity => identity.GetUserId<int>()),
+                        async (manager, user) =>
+                        {
+                            var regenerated = await manager.GenerateUserIdentityAsync(user);
+
+                            // Keep any custom claims from the original identity
+                            regenerated.MergeClaimsFromBackOfficeIdentity(identity);
+
+                            return regenerated;
+                        },
+                        identity => identity.GetUserId<int>())(context);
+                }
 
             };
 
diff --git a/src/Umbraco.Web/Security/BackOfficeClaimsIdentityFactory.cs b/src/Umbraco.Web/Security/BackOfficeClaimsIdentityFactory.cs
index d61d2ea711..2883ae8faf 100644
--- a/src/Umbraco.Web/Security/BackOfficeClaimsIdentityFactory.cs
+++ b/src/Umbraco.Web/Security/BackOfficeClaimsIdentityFactory.cs
@@ -27,12 +27,6 @@ namespace Umbraco.Web.Security
         {
             var baseIdentity = await base.CreateAsync(manager, user, authenticationType);
 
-            // now we can flow any custom claims that the actual user has currently assigned which could be done in the OnExternalLogin callback
-            foreach (var claim in user.Claims)
-            {
-                baseIdentity.AddClaim(new Claim(claim.ClaimType, claim.ClaimValue));
-            }
-
             var umbracoIdentity = new UmbracoBackOfficeIdentity(baseIdentity,
                 user.Id,
                 user.UserName,
@@ -40,12 +34,16 @@ namespace Umbraco.Web.Security
                 user.CalculatedContentStartNodeIds,
                 user.CalculatedMediaStartNodeIds,
                 user.Culture,
-                //NOTE - there is no session id assigned here, this is just creating the identity, a session id will be generated when the cookie is written
+                // NOTE - there is no session id assigned here, this is just creating the identity, a session id will be generated when the cookie is written
                 Guid.NewGuid().ToString(),
                 user.SecurityStamp,
                 user.AllowedSections,
                 user.Roles.Select(x => x.RoleId).ToArray());
 
+            // now we can flow any custom claims that the actual user has currently
+            // assigned which could be done in the OnExternalLogin callback
+            umbracoIdentity.MergeClaimsFromBackOfficeIdentity(user);
+
             return umbracoIdentity;
         }
     }
diff --git a/src/Umbraco.Web/Security/ClaimsIdentityExtensions.cs b/src/Umbraco.Web/Security/ClaimsIdentityExtensions.cs
new file mode 100644
index 0000000000..aa8549462d
--- /dev/null
+++ b/src/Umbraco.Web/Security/ClaimsIdentityExtensions.cs
@@ -0,0 +1,34 @@
+using System.Linq;
+using System.Security.Claims;
+using Umbraco.Core.Models.Identity;
+using Constants = Umbraco.Core.Constants;
+
+namespace Umbraco.Web.Security
+{
+    internal static class ClaimsIdentityExtensions
+    {
+        // Ignore these Claims when merging, these claims are dynamically added whenever the ticket
+        // is re-issued and we don't want to merge old values of these.
+        private static readonly string[] IgnoredClaims = new[] { ClaimTypes.CookiePath, Constants.Security.SessionIdClaimType };
+
+        internal static void MergeClaimsFromBackOfficeIdentity(this ClaimsIdentity destination, ClaimsIdentity source)
+        {
+            foreach (var claim in source.Claims
+                .Where(claim => !IgnoredClaims.Contains(claim.Type))
+                .Where(claim => !destination.HasClaim(claim.Type, claim.Value)))
+            {
+                destination.AddClaim(new Claim(claim.Type, claim.Value));
+            }
+        }
+
+        internal static void MergeClaimsFromBackOfficeIdentity(this ClaimsIdentity destination, BackOfficeIdentityUser source)
+        {
+            foreach (var claim in source.Claims
+                .Where(claim => !IgnoredClaims.Contains(claim.ClaimType))
+                .Where(claim => !destination.HasClaim(claim.ClaimType, claim.ClaimValue)))
+            {
+                destination.AddClaim(new Claim(claim.ClaimType, claim.ClaimValue));
+            }
+        }
+    }
+}
diff --git a/src/Umbraco.Web/Umbraco.Web.csproj b/src/Umbraco.Web/Umbraco.Web.csproj
index b85b81bb9e..d02d4f6a03 100644
--- a/src/Umbraco.Web/Umbraco.Web.csproj
+++ b/src/Umbraco.Web/Umbraco.Web.csproj
@@ -290,6 +290,7 @@
     <Compile Include="Security\BackOfficeExternalLoginProviderErrorMiddlware.cs" />
     <Compile Include="Security\BackOfficeExternalLoginProviderErrors.cs" />
     <Compile Include="Security\BackOfficeExternalLoginProviderOptions.cs" />
+    <Compile Include="Security\ClaimsIdentityExtensions.cs" />
     <Compile Include="Security\SignOutAuditEventArgs.cs" />
     <Compile Include="Security\UserInviteEventArgs.cs" />
     <Compile Include="Services\DashboardService.cs" />