Azure just handed platform teams two things to act on and one you should stop ignoring.
First: Azure DevOps will retire its issuer for workload identity federation in 2027. If your pipelines use Azure DevOps service connections or federated credentials tied to the old issuer, you need a migration plan now not in the migration window. Microsoft is standardizing on the Microsoft Entra issuer for OIDC-based federated credentials. That is the right move: one secure, auditable issuer across Azure's identity stack reduces complexity and the likelihood of ad-hoc credential injection patterns. It is also going to bite organizations that embedded issuer URLs or made fragile assumptions about federation metadata in their IaC and CI templates.
Why this matters: workload federation is the low-friction way to mint short-lived Azure tokens from CI systems. When the issuer changes, trust relationships and token validation change too. Expect audit failures, broken service connections, and pipeline outages if you don't update your federated identity configuration, service principal bindings, and any custom token validators. Start by inventorying Azure DevOps service connections and any automation that parses issuer claims; then plan scripted updates so you don't have to hand-edit hundreds of YAML files later.
Now the big platform update for clusters: AKS now generally supports encryption in transit (EiT) for Azure Files NFS v4.1 volumes via the Azure File CSI driver. Practically, that means pods mounting NFS v4.1 Azure File shares can protect data moving between the node and the file service with TLS, closing a long-noted gap for stateful workloads where network-level protection was inconsistent.
Operationally, this capability is exposed through the Azure File CSI driver and requires NFS v4.1 shares configured for encryption in transit. Enable the driver's EiT options when provisioning persistent volumes and ensure your AKS node images and CSI driver meet the supported minimum versions documented by Microsoft. For compliance-sensitive workloads such as regulated data or multi-tenant clusters enable EiT by default during migration. Don't treat it as optional: unencrypted NFS traffic is an easy audit failure and a straightforward attack surface on misconfigured VNETs.
Microsoft Foundry also widened its hosted model catalog this week, adding additional Anthropic Claude variants and new Cohere models to the lineup for agentic workflows, multimodal reasoning, and Copilot integrations. If you are integrating LLMs into developer automation or supply chain agents, this means more options that trade latency, context length, and reasoning characteristics. Make sure your governance and data loss prevention rules follow model selection; different models have different data handling guarantees. (If you missed earlier shifts in Foundry and hosted agents, see our coverage: Microsoft Foundry: New GPT-5 Variant, Hosted Agents, and Deployment Pricing Update).
On identity governance, Microsoft Entra added governance for Azure role assignments via access packages and promoted account discovery for connected applications to GA. Access packages can now manage eligible and active role assignments at management group, subscription, and resource group scopes using the same request/approval/lifecycle controls you already use for app and group access. Account discovery gives you visibility into orphaned or unmanaged identities inside connected SaaS and LOB apps a small but meaningful improvement for keeping entitlement sprawl in check.
Opinion: the simultaneous push on storage EiT and identity consolidation is exactly how cloud security should evolve lock the data plane and standardize the control plane. Microsoft is addressing two long-standing weak spots instead of piling another policy UI on top of them. That said, the issuer retirement will create avoidable churn for teams that treated OIDC setup as a checkbox. If you've been postponing an inventory of federated principals and service connections, this is the enforced clean-up you didn't ask for but badly need.
If you run AKS with stateful workloads, set EiT on your roadmap this quarter. If you run pipelines in Azure DevOps, inventory and script your federation migration now 18 months looks generous until you start fixing dozens of YAML-defined service connections. And if your org is rolling out LLM features, treat model onboarding as a security change: new model = new data-path, new risks.
Prediction: expect a wave of short-lived outages during issuer migrations next year and a steady uptick in security tickets as teams enable EiT on long-lived file shares. The teams that win will be the ones who automate both identity drift detection and storage configuration drift. The rest will discover that cloud defaults weren't protecting them after all.
Sources
- Azure Kubernetes Service – Encryption in Transit for Azure Files NFS via CSI driver
- Announcements – Microsoft Azure Blog (Microsoft Foundry and frontier models)
- News – Azure on Tech Hub (Foundry GA updates and GPT-5.6 family)
- Microsoft Entra releases and announcements
- Azure Weekly Newsletter Issue 571 (DevOps issuer retirement and monitoring API retirements)