Skip to content

2603 Update

Choose a tag to compare

View all tags
@byronjinmsft byronjinmsft released this 25 Mar 22:16
v1.3.38
5395f78
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

AIO2603 (v1.3.38) Public Release Notes

Release date: March 2026
Release type: Stable

Current GA version: 1.3.38 (2603) · Version history

Azure IoT Operations 2603 delivers three GA milestones — no-code data flow graphs, cloud-to-edge management actions, and the MQTT connector — along with unified health status reporting, broker reliability improvements, and connector stability fixes across the platform.

Release Highlights

  • Unified health status across Azure IoT Operations: Core components, data flows, brokers, assets, and connectors now expose consistent health states (Available / Degraded / Unavailable / Unknown) surfaced through Kubernetes custom resources and Azure Resource Manager. Deploy observability resources
  • No‑code data flow graphs now generally available: Build visual data processing pipelines using built‑in transforms (Map, Filter, Branch, Window, Concatenate) without writing custom WebAssembly, with improved reliability, validation, and observability. Process data with data flow graphs
  • Cloud‑to‑edge management actions now generally available: Execute management actions from the cloud to on-premises assets using Azure Resource Manager and Event Grid MQTT messaging. Supports OPC UA, ONVIF, and MQTT connectors with built‑in RBAC access control, managed identity authentication, and activity logs for auditing. Enable and run management actions
  • MQTT connector now generally available: The MQTT connector is now GA, with MQTT asset discovery for external endpoints, payload transformation using WebAssembly modules, and cloud‑to‑edge management actions for command and control scenarios. How to use the connector for MQTT
  • Improved messaging and broker reliability: Enhancements include graceful shutdowns during upgrades, end‑to‑end idempotent replication, improved persistence correctness, and reduced false health signals under load.
  • Stronger connector health and lifecycle stability: OPC UA, Media, ONVIF, REST/HTTP, SSE, and MQTT connectors now surface richer health signals, with improved recovery and redeployment behavior.
  • Enhanced Azure IoT Operations CLI: Updated CLI capabilities for lifecycle management, bulk asset import/export, management actions, and alignment with Azure IoT Operations 2603 APIs and deployed extensions. Azure IoT Operations CLI extension

Upgrade recommended if you rely on OPC UA connectors, MQTT connectors, data flow graphs, cloud-to-edge management actions, or health monitoring — this release delivers GA-quality no-code data flow graphs, GA management actions, GA MQTT connector, unified health status, and critical connector stability fixes.

Upgrade to 2603 from any supported GA version to ensure you receive the latest security patches and feature enhancements. Staying current is recommended for continued support and reliability.

Review before upgrading if you have assets created with older API versions — they may require recreation to report health status correctly (see Known Issues).

Note

Features marked (Preview) are provided as-is and are not recommended for production use. They may be changed or removed without notice.

Version support: Azure IoT Operations 2603 introduces the 1.3.x minor version series. Under the N‑2 version support policy, the supported versions are now 1.3.x, 1.2.x, and 1.1.x. The 1.0.x series (versions 2411 through 2503) is no longer supported. Customers still on 1.0.x should upgrade to remain eligible for Azure support.

Known Issues

For the full list of active known issues, see Known Issues.

  • ⚠️ Newly tracked: Assets created using older API versions may not report health status after upgrading to 2603. Workaround: Run the remediation script documented on the Known Issues page to update affected assets to API version 2026-04-01. Known Issues
  • ✅ Fixed in this release: Data flow graph definitions could not be reused across multiple data flow instances (previously tracked as a known issue).
  • ✅ Fixed in earlier release: Akri webhook certificate expiry error during Azure IoT Operations instance updates or deletions.

Components Overview

This release spans improvements to Observability (unified health reporting), Data flows (GA no-code data flow graphs, cloud-to-edge management actions), Messaging (broker reliability and graceful shutdown), Akri (connector lifecycle), Connectors (MQTT connector now GA; health modeling across OPC UA, Media, ONVIF, REST/HTTP, SSE, MQTT), CLI (management actions, bulk import/export), and Platform (infrastructure-as-code alignment).

Observability

New features

  • Unified health status reporting: Added unified health status reporting for core Azure IoT Operations and Azure Device Registry resources, enabling operators to quickly understand system and asset health without relying solely on logs or metrics. Deploy observability resources

  • Multi-surface visibility: Health status is now surfaced on both Kubernetes custom resources and Azure Resource Manager (ARM) resources for supported components.

Improvements

  • Standardized health states: Improved operational visibility by standardizing health states across the platform.

  • Expanded resource coverage: Health status is now reported for the following resources:

    • Broker
    • Data flows
    • Data flow graphs
    • Assets
    • Device inbound endpoints

  • Consistent state model: Each resource reports one of the following health states:

    • Available — functioning as expected
    • Degraded — partially functional with one or more issues
    • Unavailable — not operational and requires attention
    • Unknown — health status cannot be determined

  • Higher-level signal: Health reporting complements existing OpenTelemetry-based metrics and logs by providing a higher-level operational signal rather than raw telemetry alone.

Fixes

  • Reduced false positives: Improved the accuracy and consistency of health signals by using aggregated evaluations over a defined time window, reducing false positives caused by transient conditions.

  • Upgrade reliability: Fixed an issue where health status was not populated correctly for some resources after upgrading to 2603, which could result in operators seeing stale or missing health data until the next refresh cycle.

Known issues

  • ⚠️ Newly tracked: Assets created using older API versions may not report health status after upgrading to 2603. Workaround: Recreate or update the affected asset using the current API version (2026-04-01). Known Issues

Data flows

New features

  • No-code data flow graphs (GA): Introduced visual, no-code data flow graphs with built-in transforms that enable data processing directly in the Azure IoT Operations experience—without writing custom WebAssembly transforms. Use WebAssembly (WASM) with data flow graphs
    • Map: Applies transformation rules to each record, including renaming fields, computing values, setting defaults, removing fields, and enriching from contextual data sources. Supports wildcard field matching.
    • Filter and Branch: Evaluate conditions against message schemas to include, exclude, or route records to different outputs.
    • Window: Aggregates records over time-based windows using built-in functions (including $last).
    • Concatenate: Merges outputs from multiple transforms into a single stream.
  • Cloud-to-edge management actions (GA): Send commands from the cloud to on-premises assets using Azure Resource Manager and Event Grid MQTT messaging (mRPC pattern). Supports OPC UA, ONVIF, and MQTT connectors with built-in RBAC access control, managed identity authentication to Event Grid, and activity logs for auditing and monitoring.

Improvements

  • Health modeling for data flows: Data flow operators, runtime instances, and individual transform stages now report structured health status (Available / Degraded / Unavailable) with specific reason codes for scenarios such as WebAssembly module download failures, module panics, and missing schema references.
  • Kafka target reliability: Improved reliability for Kafka targets by adding message batching and periodic metadata refresh to keep connections alive. Also fixed handling for multi-topic Kafka subscriptions.
  • Enhanced observability: Added data plane metrics for data flow graphs (per-stage and per-graph) and improved logging at source MQTT clients.
  • Improved validation: Duplicate output field rules in transforms are now detected, input reference checking is more robust, and invalid enrich input expressions are blocked in the Window operator.

Fixes

  • Graph reuse: Fixed an issue where the same data flow graph definition could not be reused across multiple data flow instances, which required customers to duplicate graph definitions. (Previously tracked as a known issue.)
  • MQTT header handling: Fixed a regression affecting MQTT header add/remove behavior in data flow pipelines, which could result in incorrect message routing or dropped metadata when using header transforms.
  • MQTT source stability: Fixed an issue where the MQTT source client could enter unnecessary exponential backoff when reconnecting after transient network interruptions, which could result in delayed message ingestion.
  • Wildcard matching: Fixed wildcard field matching to correctly handle quoted field names, which could result in unmatched fields when using special characters in field names.
  • Deployment reliability: Fixed Branch and Concatenate configurations that could cause deployment failures when combining multiple transform stages.
  • Default values: Fixed an issue where JSON null values were not respected for default field values, which could result in unexpected defaults being applied during data transformation.

Messaging and MQTT

New features

  • Structured health reporting: The Broker custom resource definition (CRD) now reports detailed health states (Available / Degraded / Unavailable) with specific reason codes and messages. Health status is periodically refreshed to detect stale conditions.

Improvements

  • Duplicate message prevention during recovery: When the broker recovers from a failure or retry scenario involving replicated messages, it could previously deliver the same message more than once. The broker now tracks which messages have already been processed across replication chains, ensuring each message is delivered exactly once even during retries and recovery.

  • Graceful shutdown: The broker daemon, authentication service, health manager, and probe now shut down more gracefully, reducing false availability signals during upgrades and restarts.

  • Persistence reliability: Improved reliability of the disk-backed message store, including:

    • Correct dirty-state tracking
    • Accurate disk usage accounting on restart
    • Store hash verification
    • Ensuring all partitions commit cross-chain patches to disk
    • Fixed an internal message index to correctly persist and restore state.

  • Backpressure resilience: Health probes are now isolated from broker backpressure, preventing false availability alerts under high-throughput conditions.

  • Listener NodePort passthrough: The nodePort property on listener ports is now correctly applied to LoadBalancer services.

  • VMware Tanzu compatibility: Updated broker pod security contexts to comply with VMware Tanzu container security policies.

Fixes

  • Connection cleanup: Fixed an issue where client TCP connections could linger after disconnection, which could result in resource exhaustion and degraded broker performance under sustained connect/disconnect workloads.
  • CRD deletion: Fixed an issue in the MQTT broker operator where deleting a custom resource could leave stale resources behind, which could result in orphaned Kubernetes objects requiring manual cleanup.
  • Metrics reporting: Fixed an issue where store metrics were not reported for all broker workers, which could result in incomplete monitoring dashboards when using OpenTelemetry-based observability.
  • Memory usage: Fixed an issue where session tags stored during disaster recovery could consume unnecessary memory, which could result in increased broker memory footprint over time in environments with disaster recovery enabled.
  • Message store correctness: Fixed peek logic when a message store partition is empty, which could result in incorrect message ordering during partition recovery.

Akri

Improvements

  • Connector health modeling: Improved connector health modeling to provide more accurate Available / Degraded / Unavailable states.
  • Lifecycle reliability: Improved reliability of connector lifecycle management during endpoint updates and reallocations.
  • Azure Device Registry integration stability: Improved integration stability with Azure Device Registry (ADR) for device and endpoint update notifications.

Fixes

  • Notification subscriptions: Fixed an issue where connectors were automatically re-subscribed to device update notifications after endpoint deletion and recreation, which could result in unexpected duplicate notifications and increased messaging overhead.
  • Connector cleanup: Fixed an issue where old connectors were not terminated when a device's endpoint type or version was updated, which could result in stale connectors consuming cluster resources.
  • Health recovery: Fixed an issue where connector health could remain Unavailable after an internal restart even when the connector had recovered, which could result in false alerts and unnecessary operator intervention.
  • Health state accuracy: Fixed issues that could cause stale or incorrect health state reporting across connector resources, which could result in misleading operational dashboards.
  • Secret propagation: Fixed an issue where secret reference updates from Azure Key Vault were not passed to connector pods when secrets were rotated or updated, which could result in connectors using stale credentials and failing to authenticate.

Known issues

Connectors

OPC UA

The OPC UA connector is now an optional component. It can be controlled via the --feature opcua.mode flag during az iot ops create or az iot ops update. The connector remains enabled by default. See How to use the connector for OPC UA

New features

  • Reusable sessions: Added shared endpoint and reusable session support, enabling multiple assets to reuse a single OPC UA session.

  • Dataset read operations: Added read operations for datasets, including support for Read management actions.

  • Condition refresh: Added automatic condition refresh for event notifiers with configurable intervals.

  • Custom MQTT topics: Added support for custom MQTT topics for OPC UA management actions.

  • Improved asset discovery (Preview): Enhanced asset discovery with type‑based discovery and human‑friendly naming.

    [!NOTE]
    This feature is in Preview and is not recommended for production use. It may be changed or removed without notice.

Improvements

  • Health and status reporting: Improved health and status reporting for OPC UA inbound endpoints and assets via Kubernetes custom resources and Azure Resource Manager (ARM).
  • Resilience and stability: Improved resilience and stability using state‑based maintenance.
  • Browse path handling: Improved browse path handling, including support for namespace URI‑based syntax.
  • Schema generation: Improved schema generation for dataset read and write operations.
  • Logging behavior: Improved logging behavior, including revised sampling and queue size defaults.
  • Certificate handling: Improved certificate handling, including configurable Subject Alternative Name (SAN) entries for self‑signed certificates.
  • Deployment cleanup: Removed OPC PLC simulation deployment and related configurations.
  • Cloud event consistency: Updated cloud event headers for OPC UA datasets and events to improve consistency and interoperability.

Fixes

  • CRD field naming: Renamed EventGroups.defaultEventDestination to EventGroups.defaultDestination to align with the custom resource definition (CRD).
  • MQTT reliability: Fixed issues affecting MQTT QoS and TTL handling for OPC UA destinations, which could result in message loss or unexpected delivery behavior.
  • Reconnect behavior: Fixed key‑frame behavior after reconnect, which could result in stale data being sent on the first publish after a session reconnection.
  • Enablement flags: Fixed issues where enabled/disabled flags for assets and devices were not processed correctly, which could result in disabled assets continuing to send data.
  • Schema robustness: Fixed schema generation failures, including issues caused by special characters in event names.
  • Stability under failure: Fixed memory leaks and null reference errors under repeated connection failures, which could result in degraded connector performance over time.
  • Discovery stability: Fixed issues affecting asset discovery stability.

Media

Improvements

  • Health modeling: Improved asset and endpoint health modeling, surfacing availability and failure states through Azure Device Registry (ADR).
  • Reconnect stability: Improved connector reliability and stability during reconnects and redeployments.

Fixes

  • Health recovery: Fixed issues where connector health could remain unhealthy after transient failures.
  • Ingestion reliability: Fixed issues affecting event ingestion reliability during reconnect scenarios.

ONVIF

Improvements

  • Health modeling: Improved asset and endpoint health modeling, surfacing availability and failure states through Azure Device Registry (ADR).
  • Event processing: Improved event ingestion and schema registration for ONVIF assets.

Fixes

  • Health recovery: Fixed issues where connector health could remain unhealthy after transient failures.
  • Event delivery: Fixed issues affecting event delivery reliability for ONVIF event streams.

REST/HTTP

New features

  • Health reporting: Added asset and inbound endpoint health and status reporting to Azure Device Registry (ADR), including availability and failure states with optional messages and reason codes. Health events are periodically re‑reported in the background with deduplication.
  • Failure visibility: Improved visibility into REST endpoint failures (such as connectivity issues and non‑retryable errors) surfaced through ADR connector health.

Improvements

  • Connector SDK upgrade: Upgraded to connector SDK version 2.0.0, improving how asset components receive update notifications and simplifying handling, along with additional bug fixes.

Fixes

  • Sampling interval parsing: Fixed an issue where a missing sampling interval in the asset configuration caused a parsing error when the connector started, which could prevent data ingestion. The connector now correctly falls back to the default value.

SSE

New features

  • Health reporting: Added asset and inbound endpoint health and status reporting to Azure Device Registry (ADR), including availability and failure states with optional messages and reason codes. Health events are periodically re‑reported in the background with deduplication.
  • Failure visibility: Improved visibility into SSE endpoint failures (such as connectivity issues and non‑retryable errors) surfaced through ADR connector health.

Improvements

  • Connector SDK upgrade: Upgraded to connector SDK version 2.0.0, improving how asset components receive update notifications and simplifying handling, along with additional bug fixes.

MQTT

The MQTT connector is now generally available in Azure IoT Operations.

New features

  • Asset discovery: MQTT asset discovery for external MQTT endpoints, with persistence so discovered assets survive restarts and redeployments.
  • Payload transformation: MQTT payload transformation using WebAssembly modules for schema and format mapping.
  • Cloud‑to‑edge management actions: Cloud‑to‑edge management actions over MQTT for command and control scenarios.
  • Health reporting: Added comprehensive device and endpoint health and status reporting to Azure Device Registry (ADR), including availability and failure signals.

Improvements

  • Configuration clarity: Simplified and clarified broker configuration flags and metadata fields.

Fixes

  • Parsing robustness: Fixed topic filter, client ID, and endpoint parsing edge cases that could result in connection failures when using non-standard topic patterns or special characters in client identifiers.

Azure Device Registry

New features

  • Asset and device health reporting: Assets and devices now report structured health states through Azure Device Registry. See Observability for the full platform-wide health model.
  • Cloud-based management actions (GA): Configure and execute management actions on assets from the cloud using Azure Resource Manager, routed through Event Grid MQTT messaging at the namespace level. Includes built-in RBAC access control, managed identity authentication, and activity logs for auditing.

Improvements

  • API version support: Added support for the latest Azure Device Registry Resource Provider API versions, enabling use of the current GA and preview APIs with Azure IoT Operations.
  • Upgrade compatibility: Improved Azure Device Registry compatibility during upgrades, ensuring required resources are correctly reconciled when moving between Azure IoT Operations versions.
  • Schema Registry reliability: Improved Schema Registry integration reliability across data flows, connectors, and upgrade scenarios.

Fixes

  • Outdated CRDs: Fixed an issue where Azure Device Registry Custom Resource Definitions (CRDs) were outdated in the Azure IoT Operations extension, which could prevent use of newer API versions.
  • Missing edge metadata: Fixed an issue where Azure Device Registry API versions were not available on the edge because package metadata was missing at rollout time, which could block deployments that depend on newer API features.
  • Schema Registry reconciliation: Fixed issues that could cause Schema Registry operations to fail or stall during reconciliation and upgrade flows, which could result in blocked deployments or incomplete schema propagation.

Azure IoT Operations Experience

New features

  • No-code data flow graphs now generally available: Visually chain built-in and custom transforms to create advanced data processing and inference pipelines — no code or IT involvement required. Data flow graphs overview
  • MQTT connector now generally available: Onboard MQTT devices as assets and route data to specified unified namespace destination topics using the MQTT connector. Configure the connector for MQTT

Improvements

  • OPC UA endpoint guard: Users cannot create an OPC UA device inbound endpoint in deployments where the OPC UA connector is optional or not enabled. Once the OPC UA connector is enabled, OPC UA device inbound endpoints become available.

Fixes

  • Bug fixes and performance improvements: Resolved issues to make the experience more intuitive, seamless, and secure.

Azure Portal

New features

  • Optional OPC UA connector deployment: Azure portal now enables customers to optionally deploy OPC UA during Azure IoT Operations instance creation or add it later as a connector, eliminating the previous mandatory OPC UA deployment and providing a more flexible, modular deployment experience.

Fixes

  • Bug fixes and performance improvements: Resolved issues to make the portal experience more intuitive, seamless, and secure.

Azure IoT Operations CLI

New features

  • Management Actions command group: Added a new command group, az iot ops mgmt-actions, for managing Azure IoT Operations Management Actions. Available commands include:

    • enable: Bootstraps the Azure IoT Operations instance and associated resources (Azure Device Registry namespace and Event Grid namespace) to enable management actions.
    • disable: Tears down the configuration created by enable, reversing management actions across associated resources.
    • show: Verifies whether management actions are enabled for an Azure IoT Operations instance.
    • execute: Executes asset-defined management actions. By default, validates the input payload against the associated request schema, if one exists.

  • End-to-end quickstart scripts: Added end-to-end quickstart scripts demonstrating how to enable management actions using the CLI against the OPC UA simulator.

  • Management endpoint cleanup: Added a new command group, az iot ops ns mgmt-endpoint, with a remove command to delete an instance management endpoint from the Azure Device Registry namespace. This is useful when management actions were enabled but not explicitly disabled.

  • OPC UA deployment control: Added support for controlling OPC UA connector deployment using the --feature opcua.mode flag in both az iot ops create and az iot ops update. Supported values are Disabled and Stable.

    • The OPC UA connector remains enabled by default.
    • When opcua.mode=Disabled, OPC UA–specific CLI commands are blocked until the connector is re-enabled.

  • Connected cluster availability checks: Added retry support for availability checks during ops init and ops create, using the Azure Resource Health API. New parameters include:

    • --health-checks-int
    • --health-checks-max (set to 0 to disable health checks)

  • Instance cloning updates: Updated ops clone to support the new Azure IoT Operations instance API version. No new resources are captured during cloning.

  • Delete command overhaul: Improved az iot ops delete with reduced reliance on Azure Resource Graph and an improved developer experience. The command now supports conditional deletion of Azure Container Storage when it was deployed by the CLI.

  • Namespace device and asset enhancements:

    • Added --filter-clause, --filter-type, and --filter-server parameters to support OPC UA event filtering.
    • Added event add, list, and remove subcommands for ONVIF assets.
    • Added the --start-inst parameter for OPC UA dataset add and update commands.

  • Azure CLI requirement: Increased the minimum supported Azure CLI version to 2.70.0 (check the CLI changelog for the exact minimum).

  • Bulk asset sub-resource management: Added import and export support for asset sub-resources using JSON, YAML, or CSV files.

    • Supported sub-resources include:

      • Datasets (data points)
      • Event groups (events and streams)
      • Management groups (management actions)

    • Users can export configurations, modify them offline, and re-import them using merge or replace mode. Imported configurations are validated against connector metadata to ensure compatibility.

    • Example commands:

  az iot ops asset dataset point export --asset myasset -g myresourcegroup --dataset default

  az iot ops asset dataset point import --asset myasset -g myresourcegroup --dataset default --input-file myasset_default_dataPoints.csv

  az iot ops asset event import --asset myasset -g myresourcegroup --input-file myasset_events.yaml

  az iot ops asset event export --asset myasset -g myresourcegroup --format csv --output-dir myAssetFiles

API version updates

  • Azure IoT Operations instance API: 2026-03-01
  • Azure Device Registry API: 2026-04-01
  • Event Grid namespace API: 2025-02-15

Deployment alignment

The CLI deployment flow has been tuned for Azure IoT Operations 2603 and deploys the following Arc extension versions:

  • Azure IoT Operations: 1.3.38
  • Secret Store: 1.3.0
  • Cert Manager: v0.10.2

Azure-iot-ops-cli-extension: 2.4.0 Release All Releases

Security

Fixes

  • Vulnerability remediation: Addressed all High and Critical security vulnerabilities identified before March 17th, 2026.

Platform Updates

Infrastructure and deployment

  • Infrastructure‑as‑code alignment: Azure IoT Operations continues to align with infrastructure‑as‑code (IaC) practices. New Bicep templates and a Scale Kit approach enable organizations to define factory‑level and site‑level configurations and deploy them consistently across environments. This is particularly beneficial for customers operating many sites or facilities. Learn more: Azure/digital-ops-scale-kit

  • Regional expansion: Azure IoT Operations is now available in the US South Central region.

  • Rancher Kubernetes Engine 2 (RKE2) support: Azure IoT Operations now supports Rancher Kubernetes Engine 2 (RKE2) deployments.

Fixes

  • Upgrade consistency: Fixed issues that could cause platform components to fall out of sync during upgrades, which could result in version mismatches requiring manual intervention.

  • Installation reliability: Fixed issues affecting extension metadata and dependency resolution during installation and update, which could result in failed deployments when installing or updating Azure IoT Operations extensions.

Assets 2
Loading