|
| 1 | +--- |
| 2 | +title: Azure API Management - Trusted service connectivity retirement (March 2026) |
| 3 | +description: Azure API Management is retiring trusted service connectivity to supported Azure services as of March 2026. Use alternative networking options for secure connectivity. |
| 4 | +#customer intent: As an Azure admin, I want to determine if my API Management service is affected by the trusted service connectivity retirement so that I can plan necessary changes. |
| 5 | +author: dlepow |
| 6 | +ms.author: danlep |
| 7 | +ms.date: 12/05/2025 |
| 8 | +ms.topic: reference |
| 9 | +ms.service: azure-api-management |
| 10 | +ai-usage: ai-assisted |
| 11 | +--- |
| 12 | + |
| 13 | + |
| 14 | +# Trusted service connectivity retirement (March 2026) |
| 15 | + |
| 16 | +[!INCLUDE [api-management-availability-all-tiers](../../../includes/api-management-availability-all-tiers.md)] |
| 17 | + |
| 18 | +Effective 15 March 2026, Azure API Management is retiring trusted service connectivity to supported Azure services - Azure Storage, Key Vault, Key Vault Managed HSM, Service Bus, Event Hub, and Container Registry. If your API Management resource relies on this feature to communicate with these services after 15 March 2026, the communication will fail. Use alternative networking options to securely connect to those services. |
| 19 | + |
| 20 | +API Management services created on or after 1 December 2025 no longer support trusted service connectivity. Contact Azure support if you need to enable trusted service connectivity in those services until the retirement date. |
| 21 | + |
| 22 | +## Is my service affected by this change? |
| 23 | + |
| 24 | +First, check for an Azure Advisor recommendation: |
| 25 | + |
| 26 | +1. In the Azure portal, go to [Advisor](https://ms.portal.azure.com/#view/Microsoft_Azure_Expert/AdvisorMenuBlade/~/overview) |
| 27 | +1. Select the **Recommendations > Operational excellence** category. |
| 28 | +1. Search for "**Disable trusted service connectivity in API Management**". |
| 29 | + |
| 30 | +**If you don't see a recommendation**, your API Management resource isn't affected by the change. |
| 31 | + |
| 32 | +**If you see a recommendation**, your API Management resource is affected by the breaking change and you need to take action: |
| 33 | + |
| 34 | +1. Determine if your API Management resource relies on trusted service connectivity to Azure services. |
| 35 | +1. If it does, update the networking configuration to eliminate the dependency on trusted service connectivity. If it doesn’t, proceed to the next step. |
| 36 | +1. Disable trusted service connectivity in API Management. |
| 37 | + |
| 38 | +### Step 1: Does my API Management resource rely on trusted service connectivity? |
| 39 | + |
| 40 | +API Management should no longer rely on trusted service connectivity to Azure services. Instead, it should establish a networking line of sight. |
| 41 | + |
| 42 | +To verify if API Management relies on trusted connectivity to Azure services, check the networking configuration of all Azure Storage, Key Vault, Key Vault Managed HSM, Service Bus, Event Hub, and Container Registry resources that API Management connects to: |
| 43 | + |
| 44 | +#### For Storage accounts |
| 45 | + |
| 46 | +1. Go to **Networking** under **Security + networking**. |
| 47 | +1. Select **Manage** in the **Public network access** tab. |
| 48 | +1. API Management may rely on trusted service connectivity if **Allow trusted Microsoft services to access this resource** is selected if: |
| 49 | + - **Public network access** is set to **Disable**, or |
| 50 | + - **Public network access** is set to **Enable** and **Public network access scope** is set to **Enable from selected networks**. |
| 51 | +1. API Management may rely on trusted service connectivity if API Management is configured under **Resource instances**, if **Public network access** is set to **Enable** and **Public network access scope** is set to **Enable from selected networks**. |
| 52 | + |
| 53 | + :::image type="content" source="media/trusted-service-connectivity-retirement-march-2026/network-connectivity-storage.png" alt-text="Screenshot of trusted connectivity settings to Azure Storage in the portal."::: |
| 54 | + |
| 55 | +#### For Event Hubs and Key Vault Managed HSM |
| 56 | + |
| 57 | +1. Go to **Networking** under **Settings**. |
| 58 | +1. Select **Manage** in the **Public access** tab. |
| 59 | +1. API Management may rely on trusted service connectivity if **Allow trusted Microsoft service to access this resource** is selected if: |
| 60 | + - **Public network access** is set to **Disable**, or |
| 61 | + - **Public network access** is set to **Enable** and **Default action** is set to **Enable from selected networks**. |
| 62 | + |
| 63 | +#### For Service Bus (Premium only) and Key Vault |
| 64 | + |
| 65 | +1. Go to **Networking** under **Settings**. |
| 66 | +1. API Management may rely on trusted service connectivity if **Allow trusted Microsoft services to bypass this firewall** is selected if you're using the **Allow public access from specific virtual networks and IP addresses** or **Disable public access** options. |
| 67 | + |
| 68 | +#### For Container Registry (Premium pricing plan only) |
| 69 | + |
| 70 | +1. Go to **Networking** under **Settings**. |
| 71 | +1. API Management may rely on trusted service connectivity if **Allow trusted Microsoft services to access this container registry** is checked under **Firewall exception** if **Public network access** is set to **Selected networks** or **Disabled**. |
| 72 | + |
| 73 | +### Step 2: Eliminate dependency on trusted service connectivity |
| 74 | + |
| 75 | +If you verified that API Management relies on trusted connectivity to Azure resources, you need to eliminate this dependency by establishing a networking line of sight for communication from API Management to the listed services. |
| 76 | + |
| 77 | +You can configure the networking of target resources to one of the following options: |
| 78 | + |
| 79 | +- Enable public connectivity from all networks. |
| 80 | + |
| 81 | +- Set a network security rule to allow API Management traffic based on the IP address or virtual network connectivity. |
| 82 | + |
| 83 | +- Secure traffic from API Management with Private Link connectivity. |
| 84 | + |
| 85 | +- Use Network Security Perimeter to secure your Azure backends and allow traffic from API Management, if supported (for example, for Azure Storage). Learn more about Network Security Perimeter: |
| 86 | + |
| 87 | + - [What is a network security perimeter?](/azure/private-link/network-security-perimeter-concepts#onboarded-private-link-resources) |
| 88 | + |
| 89 | + - [Transition to a Network Security Perimeter in Azure](/azure/private-link/network-security-perimeter-transition) |
| 90 | + |
| 91 | +### Step 3: Disable trusted service connectivity in API Management |
| 92 | + |
| 93 | +After ensuring that API Management doesn’t access other Azure services using trusted service connectivity, you must explicitly disable trusted connectivity in your API Management service to acknowledge you have verified that the service no longer depends on trusted connectivity. |
| 94 | + |
| 95 | +To do so, set a custom property `Microsoft.WindowsAzure.ApiManagement.Gateway.ManagedIdentity.DisableOverPrivilegedAccess` to `"True"` on the [API Management resource](/rest/api/apimanagement/api-management-service/create-or-update). For example: |
| 96 | + |
| 97 | + |
| 98 | +```json |
| 99 | +{ |
| 100 | + "type": "Microsoft.ApiManagement/service", |
| 101 | + "apiVersion": "2025-03-01-preview", |
| 102 | + "name": "string", |
| 103 | + "identity": { |
| 104 | + "type": "SystemAssigned" |
| 105 | + }, |
| 106 | + "location": "string", |
| 107 | + "properties": { |
| 108 | + "customProperties": { |
| 109 | + "Microsoft.WindowsAzure.ApiManagement.Gateway.ManagedIdentity.DisableOverPrivilegedAccess": "True" |
| 110 | + } |
| 111 | + }, |
| 112 | + "sku": { |
| 113 | + "capacity": "1", |
| 114 | + "name": "Developer" |
| 115 | + } |
| 116 | +} |
| 117 | +``` |
| 118 | + |
| 119 | +The Azure Advisor recommendation should disappear within a day or two of disabling the trusted connectivity on the API Management service. |
| 120 | + |
| 121 | +## What is the deadline for the change? |
| 122 | + |
| 123 | +After 15 March 2026, the trusted connectivity from API Management to supported Azure services - Azure Storage, Key Vault, Key Vault Managed HSM, Service Bus, Event Hubs, and Container Registry - is retired. If your API Management resource relies on this feature to establish communication with these services, the communication will start failing after that date. |
| 124 | + |
| 125 | +## Help and support |
| 126 | + |
| 127 | +If you have questions, get answers from community experts in [Microsoft Q&A](/answers). If you have a support plan and you need technical help, create a [support request](https://portal.azure.com/#view/Microsoft_Azure_Support/HelpAndSupportBlade/%7E/overview). |
| 128 | + |
| 129 | +1. Under **Issue type**, select **Technical**. |
| 130 | +1. Under **Subscription**, select your subscription. |
| 131 | +1. Under **Service**, select **My services**, then select **API Management Service**. |
| 132 | +1. Under **Resource**, select the Azure resource that you're creating a support request for. |
| 133 | +1. For **Summary**, type a description of your issue, for example, "Trusted service connectivity". |
| 134 | + |
| 135 | +## Related content |
| 136 | + |
| 137 | +See all [upcoming breaking changes and feature retirements](overview.md). |
0 commit comments