Azure just dropped three changes platform teams can't ignore: the Azure DevOps issuer for workload identity federation has a hard retirement date (July 1, 2027), the Data Collector API for Azure Monitor Logs will be removed on September 14, 2026, and AKS has promoted TLS-based Encryption in Transit for Azure Files NFS v4.1 to GA via the Azure File CSI driver.
The retirement of the Azure DevOps issuer is the sharpest corner here. If your pipelines use federated credentials tied to the Azure DevOps issuer, you'll need to migrate those federations to the Microsoft Entra issuer well before July 1, 2027. This isn't just a change of URL; it's a security boundary shift that touches pipeline service connections, federated credentials on service principals or workload identities, and any automation that assumes the legacy issuer string. Microsoft gave a long runway, but long runways lull teams into complacency treat this like a project, not a calendar note.
Why the DevOps issuer retirement matters
Consolidating to the Microsoft Entra issuer is the correct architecture move: single issuer, consistent audit trail, and better lifecycle controls through Entra's governance features. But it's also going to be disruptive for enterprises with hundreds of pipelines and third-party extensions that hardcode issuer values. Migration tasks you'll see in practice:
- Inventory pipelines and federated credentials that reference the Azure DevOps issuer.
- Re-issue or update federated credentials to use the Microsoft Entra issuer (and validate token audience/claims expectations).
- Update any service principal or workload identity configurations and automation that parse issuer values.
Data Collector API retirement: logs and the DCR pivot
The Log Analytics HTTP Data Collector API (often called the Data Collector API) retires on Sep 14, 2026. The supported migration path is to use Data Collection Rules (DCRs) and, where applicable, Data Collection Endpoints (DCEs) for custom log ingestion. If you run custom log ingestion pipelines using the Data Collector API scripts, lightweight agents, or third-party tools plan the migration now. DCRs (and DCEs) are more policy-driven and centrally managed, which improves governance, but the migration is non-trivial: you'll map collectors to DCRs/DCEs, convert ingestion formats, and validate throttling/retention behavior under the DCR/DCE semantics.
AKS storage gets less sloppy
On the storage side, AKS has moved Encryption in Transit (EiT) for Azure Files NFS v4.1 to GA via the Azure File CSI driver. That matters if you run stateful workloads on Azure Files over NFS v4.1 think databases in pods, legacy stateful apps, or file-backed sidecars. The GA release brings TLS encryption on the wire for NFS shares, removing a common blind spot where storage traffic inside a VNet could still be intercepted. If you're in regulated environments, enable EiT on your Azure File shares and update CSI StorageClasses to use the Azure File CSI driver configuration that enables TLS; include this in your compliance checklist.
Entra Agent ID and governance the identity platform tightens
Microsoft Entra also pushed a batch of governance features: account discovery for connected apps (GA), access package-based role governance at Management Group/Subscription/Resource Group scopes, and object-level Source of Authority switching. Most notable is the Entra Agent ID platform hitting GA and the simultaneous retirement of the legacy Agent registry and Agent collections blades. That's a real consolidation: Microsoft is standardizing agent identity primitives into a single platform.
Practical takeaway: if you integrate agentic AI or automation (and many teams do), you'll want to adopt Agent ID now. It centralizes lifecycle, gives better audit surfaces, and aligns agent identities with Entras governance model which is exactly where these identities should have been years ago.
A final, blunt take
Microsoft is doing the right thing by consolidating identity and tightening telemetry paths, but the execution window is uneven: storage EiT GA is an easy win; Entra Agent ID consolidation is overdue and welcome; the issuer and API retirements are the parts that will break things if you don't treat them as projects. Start an inventory sprint: federated issuers, Data Collector API consumers, CSI StorageClasses using Azure Files NFS. If you have sprawling pipelines or bespoke log collectors, those are the two places most likely to bite you under a deadline.
If you want a quick next step: map who owns pipeline federation and custom log ingestion today, then book a migration backlog item for each owner. Microsoft has set the endpoint; it's on platform teams to get there without firefighting in production.
Related reading: if you're evaluating agent-hosted AI services and how identities play into hosting, see our piece on Microsoft Foundry: New GPT-5 Variant, Hosted Agents, and Deployment Pricing Update and for CSI driver details, see our previous coverage of AKS: TLS encryption in transit for Azure Files NFS v4.1 via Azure File CSI driver.