AIO2607 (v1.4.41) Public Release Notes

Release date: July 2026

Release type: Milestone

Current GA version: 2607 · Version history

Azure IoT Operations 2607 is a milestone release that delivers ARM64 platform support (GA), new built-in data flow graph transforms (count-based windows, trigger-based windows, and per-topic throttling), raw data observation via Azure Event Grid, OPC UA connector high availability and recursive tag onboarding, broker backpressure resilience, and critical security fixes.

Release Highlights

• ARM64 platform support now generally available: Azure IoT Operations now supports ARM64 architectures, enabling deployment on ARM64-based Kubernetes clusters with full parity across installation, observability, and lifecycle operations. Supported environments matrix

• Enhanced transforms for data flow graphs: Use the new Throttle transform for better control over your data streams, or the improved Window, Branch, Filter, and Map transforms for more flexible aggregation, routing, validation, and broker state store lookups. Process data with data flow graphs

• In-place transform upgrades: Use the operations experience to upgrade or downgrade a transform right where it is within a data flow graph — no need to delete and add again.

• OPC UA connector high availability: Configure high availability mode for OPC UA assets to achieve near-zero message loss during failover scenarios, improving data reliability for critical industrial workloads.

• Recursive OPC UA tag onboarding: Recursively discover and onboard all tags from a starting node in an OPC UA server's address space into one or more assets, significantly reducing manual configuration for large-scale deployments.

• Broker backpressure resilience: Eliminated the risk of dataflow and application deadlocks when data is re-injected into a backpressured MQTT broker, improving system stability under high-throughput conditions.

• Security vulnerability remediation: Addressed a security vulnerability in dataflow managed identity token handling and updated dependencies to remediate known vulnerabilities.

Upgrade recommended if you deploy on ARM64, rely on data flow transforms, OPC UA connectors, or management actions — this release delivers new GA capabilities, critical stability improvements, and security patches.

Upgrade to 2607 from any supported GA version to ensure you receive the latest security patches and feature enhancements. Staying current is recommended for continued support and reliability.

Version support: Azure IoT Operations 2607 introduces the 1.4.x minor version series. Under the N‑2 version support policy, the supported versions are now 1.4.x, 1.3.x, and 1.2.x. The 1.1.x series is no longer supported. Customers still on 1.1.x should upgrade to remain eligible for Azure support.

Known Issues

For the full list of active known issues, see Known Issues.

• ✅ Fixed in this release: MQTT connector blocks external MQTT brokers with private IPs. Starting in 2605, if an external MQTT broker used a private IP address, the MQTT connector would not connect to it. This is now fully resolved.

Components Overview

This release spans improvements to data flow graphs (new built-in transforms, transform version management), Connectors (OPC UA high availability, recursive tag onboarding, Akri-based OPC UA deployment, MQTT private IP fix, diagnostics improvements), Messaging (backpressure resilience, message expiry correctness, topic filter security), Platform (ARM64 GA), Azure IoT Operations Experience (management actions configuration, raw data observation, transform version picker), CLI (2607 deployment alignment), and Security (managed identity token hardening, dependency updates).

Data Flows & Data Flow Graphs

New features

• Count-based window transform: A new built-in transform that aggregates records based on a configurable record count threshold, enabling count-driven data aggregation directly in data flow graphs without custom WebAssembly modules.

• Trigger-based window transform: A new built-in transform that aggregates records based on trigger conditions, enabling event-driven windowing for scenarios where time-based aggregation is insufficient.

• Per-topic throttle transform: A diagnostic data flow can subscribe to selected MQTT topics and use the new Throttle transform to apply independent message-rate limits before forwarding sampled messages to cloud endpoints such as Azure Event Grid. This enables raw data observation while controlling cloud egress volume.

• Date and time expression functions: Map, Branch, Filter, and Accumulate transforms now support built-in date and time functions including now, duration_between, day_of_week, format_timestamp, epoch conversion, and timestamp parsing.

• Dynamic DSS lookup keys: Dataset enrichment can now derive Distributed State Store (DSS) lookup keys from fields in each incoming message, enabling per-message enrichment without static keys or separate graph deployments.

• Transform version management: Data flow transforms now support minimum Azure IoT Operations version compatibility checks and a version picker in the transform catalog, enabling operators to select compatible transform versions during pipeline configuration.

Improvements

• Branch schema validation: Branch transforms can now validate incoming messages against their schemas and route valid and invalid messages through separate output paths, allowing invalid messages to be sent to a dedicated topic for inspection or further processing.

Fixes

• Connector startup resilience: Fixed issues where data flow connectors could permanently stop processing after transient startup failures (such as state store timeouts) and where the state manager retry loop lacked backoff, causing Kubernetes API flooding. Connectors now recover gracefully from transient startup errors with proper exponential backoff.

• Status client performance: Fixed status client inefficiencies that could overload the Kubernetes API under high connector counts, including a thundering herd pattern in concurrent resource updates and an unnecessary GET request that blocked ConfigMap writes. The status client now batches updates efficiently and writes directly without redundant reads.

• Operator ConfigMap update ordering: Fixed a race condition in operator reconciliation where ConfigMap updates could arrive out of order, causing stale configuration to be applied to data flow components.

• Custom resource cleanup ordering: Fixed an issue where the CRD deletion job attempted to patch custom resources before removing webhook configurations, which could cause the deletion to hang.

• WebAssembly runtime resilience: Fixed multiple issues affecting WebAssembly transform reliability: data flow pods could become permanently stuck after a WASM graph controller restart, the controller could serve partial artifacts due to non-atomic file writes, and channel closures could cause unrecoverable backpressure buildup. The WASM runtime now handles controller restarts, ensures atomic artifact delivery, and automatically recovers from channel failures.

• Upgrade status job transient error handling: Fixed an issue where the upgrade status job failed immediately on transient Kubernetes API errors instead of retrying. The job now retries transient failures before reporting an error.

• Redundant MQTT keepalive traffic: Fixed an issue where the MQTT client sent redundant PINGREQ packets even when other outgoing packets already satisfied the keepalive interval, generating excessive log noise. The client now correctly suppresses keepalives when regular traffic is flowing.

• Transform schema rendering: Fixed issues where certain transform schema fields could not be rendered correctly in the configuration UI, affecting the Branch, Throttle, Map, Window, and Filter modules. Schemas now use compatible type representations across all built-in transforms.

• Window transform boundary handling: Fixed an issue where burst-input messages were incorrectly accumulated across window boundaries, causing data from one window to leak into the next. Window boundaries are now enforced correctly.

• Health status after upgrade: Fixed an issue where the health status ConfigMap was not created after upgrading from version 1.3 to 1.4, which could prevent health status reporting from initializing on upgraded clusters.

• Dataflow and dataflow graph metrics accuracy: Fixed an issue where active dataflow and dataflow graph metrics reported flaky or inconsistent values, which could produce misleading monitoring dashboards. Metrics are now reported consistently.

• Concurrent token request handling: Fixed a thundering herd issue where concurrent system-assigned managed identity token requests during pod startup caused HTTP 429 throttling responses from the token endpoint, leading to pod crashes. Token requests are now serialized with backoff.

Akri

New features

• Readiness-driven health evaluation: Connectors now use readiness-driven health evaluation when a readiness probe is configured, falling back to existing pod event-based health logic otherwise.
• Improved connector observability: connector instance counts can now be broken down by protocol (endpoint type), and a new ac...

AIO2606 (v1.3.137) Public Release Notes

Release date: June 2026

Release type: Patch

Current GA version: 2606 · Version history

Azure IoT Operations (AIO) 2606 is a security and stability-focused patch release that delivers critical security vulnerability remediation across MQTT broker authorization, registry endpoints, and onboarding components, reliability improvements for OPC UA and dataflow connectors, and enhanced testing coverage for connector resilience.

Upgrade to 2606 from any supported GA version to ensure you receive the latest security patches and reliability enhancements. Staying current is recommended for continued support and reliability.

Release Highlights

• Critical security vulnerability remediation: Addressed three high-priority security vulnerabilities including globe metacharacter injection in broker authorization, arbitrary audience/host token minting in registry endpoints, and incomplete ABAC conditions in onboarding role assignment.

• OPC UA connector session management enhancements: Improved session lifecycle management with configurable method-execution client idle timeout and fixed issues preventing endpoints from transitioning between states correctly.

• Dataflow health status and enrichment reliability: Fixed issues where dataflow health status could become stuck in a degraded state after transient failures, and resolved problems with the Map transform when enriching datasets with multiple records.

• MQTT connector resilience improvements: Fixed an issue where async task panics could silently fail, addressed MQTT source status reporting on disconnect, and enhanced broker authorization handling with improved attribute matching validation.

Connectors

Fixes (MQTT)

• Connector async task panic handling: Fixed an issue where panics in connector async tasks could cause the MQTT connector to stop processing device data without surfacing a clear failure signal. The connector now properly surfaces and logs async task failures to enable faster diagnosis.

OPC UA

Fixes

• Session management and idle timeout: Fixed an issue where OPC UA Commander opened and closed sessions too frequently in certain customer scenarios. The method-execution client idle timeout is now configurable, allowing operators to tune session lifecycle behavior for their specific workloads.

• Action request expiration handling: Fixed an issue where actions were enqueued in the OPC UA execution queue even if the request had already expired. Expired requests are now properly rejected before reaching the execution queue.

• Endpoint state transitions: Fixed an issue where changed endpoints never transitioned to other states, causing them to remain in an inconsistent state. Endpoints now correctly transition between states in response to configuration changes and operational events.

MQTT

Fixes

• Broker authorization attribute matching: Fixed an issue where MQ Broker authorization with attributes expected all attributes from the Security Access Token (SAT) to match configured patterns. Authorization validation now correctly handles partial attribute matching according to configured policies.

Dataflows

Fixes

• Health status state machine recovery: Fixed an issue where dataflow graph health status could become stuck at Degraded after a download timeout. The health status state machine now correctly transitions out of degraded states when operations succeed.

• Map transform enrichment with multi-record datasets: Fixed an issue where the 1P "Map" transform failed to enrich records when the context dataset contained multiple records and belonged to an asset. The enrichment logic now correctly handles multi-record context datasets.

• Source status unavailability reporting on disconnect: Fixed an issue where the MQTT source status was not reporting unavailable when the connector disconnected. The source now correctly reports availability state changes on connection events.

Platform

Fixes

• Meta Operator recovery from transient failures: Fixed an issue where an Azure IoT Operations instance custom resource (CR) could become permanently stuck in Failed state after a transient upgrade failure. Instance recovery is now more resilient to temporary failures during upgrades and cluster scaling events.

Security

Fixes

• Glob metacharacter injection in BrokerAuthorization: Fixed a critical security vulnerability where special characters in BrokerAuthorization state-store key pattern substitution could be interpreted as glob metacharacters, potentially allowing unauthorized access. Key pattern matching now properly escapes metacharacters.

• RegistryEndpoint arbitrary audience/host for MSI token minting: Fixed a critical security vulnerability where RegistryEndpoint allowed arbitrary audience and host values when minting Managed Service Identity (MSI) tokens. Token minting now enforces strict validation of audience and host parameters.

• Azure IoT Operations Onboarding role self-assignment: Fixed a critical security vulnerability where the Azure IoT Operations Onboarding role had incomplete Attribute-Based Access Control (ABAC) conditions, allowing identities to self-assign the Contributor role. ABAC conditions have been strengthened to prevent role self-escalation.

• Schema Registry vulnerability remediation: Addressed security vulnerabilities in Schema Registry components by updating affected dependencies to patched versions.

Known Issues

• Inconsistent default authentication behavior on Akri Operator: The Akri Operator may display inconsistent default authentication behavior in certain configurations. Refer to updated documentation for recommended authentication configuration patterns.
• MQTT Connector blocks external MQTT brokers with private IPs. Starting 2605, if the external MQTT broker has a private IP, the MQTT connector will not connect to it. This will be fully resolved in 2607.

AIO2605 (v1.3.105) Public Release Notes

Release date: May 2026

Release type: Patch

Current GA version: 2605 · Version history

Azure IoT Operations (AIO) 2605 is a security and reliability-focused patch release that delivers network security hardening for MQTT, REST, and SSE connectors, vulnerability remediation across the MQTT connector and Schema Registry, improved MQTT connector resilience, and reduced logging noise in the REST and SSE connectors.

Upgrade to 2605 from any supported GA version to ensure you receive the latest security patches and reliability enhancements. Staying current is recommended for continued support and reliability.

Release Highlights

• Connector address validation and network security hardening: The MQTT, REST, and SSE connectors now validate configured server URLs against restricted address ranges, preventing connections to internal, loopback, link-local, and cloud-reserved endpoints.

• MQTT connector data forwarding resilience: Fixed an issue in the MQTT connector's data forwarding pipeline that could block further processing of datasets. The connector now handles forwarding errors gracefully without disrupting other datasets.

• OPC UA connector session management improvements: The OPC UA connector's model change observer now supports multiple subscribers per endpoint using a single shared session, significantly reducing session overhead.

• Security vulnerability remediation: Addressed High-severity security vulnerabilities across the MQTT connector and Schema Registry components, including OpenSSL and system library updates.

Connectors

Fixes (MQTT, REST, SSE)

• Address validation and network security hardening: Fixed an issue where the MQTT, REST, and SSE connectors accepted arbitrary URL targets without sufficient address validation. The connectors now block connections to restricted addresses, report configuration errors for blocked addresses, block DNS names that resolve to restricted ranges, and disable automatic HTTP redirect following to prevent bypass of address validation controls.

MQTT

Fixes

• Data forwarding pipeline resilience: Fixed an issue where a failure in the MQTT connector's data forwarding path could block the dataset processing pipeline, affecting all datasets processed by the connector. The connector now isolates forwarding failures to the affected operation without disrupting other datasets.

• Reconnection backoff for external MQTT servers: Fixed an issue where the MQTT connector immediately attempted to recreate a connection after a disconnection. The connector now implements a reconnect delay with exponential backoff.

Known Issues

• MQTT connector template version mismatch during update: When updating to 2605, existing MQTT connector templates may display mismatched metadata versions in the portal. To resolve, delete and recreate the connector template. Alternatively, use the Azure CLI to update the connector. This will be fully resolved in 2606.

REST / SSE

Fixes

• Reduced logging noise: Fixed an issue where the REST connector produced logs on every sampling interval, generating excessive log output. Sampling-interval and status reporting logs have been reduced and error messages improved with more actionable detail.

OPC UA

Fixes

• Excessive session creation for model change observation: Fixed an issue where the OPC UA connector created a separate session for every model change observer, even when sync properties was disabled. The observer now shares a single session per endpoint and is no longer created when sync properties is disabled.

• Unique certificate identity for multi-instance deployments: Fixed an issue where multiple AIO instances connecting to the same OPC UA server generated certificates with the same Common Name. Each instance now generates certificates with a unique subject Common Name.

• OPC UA connector startup race condition: Fixed a race condition during startup where an incorrect signal after connecting to the MQTT broker caused the connector to hang.

Messaging and MQTT

Fixes

• Broker replica recovery during cluster scaling: Fixed an issue where an MQTT broker replica joining an existing cluster could become permanently stuck during recovery. Broker replicas now correctly complete data synchronization before becoming operational.

• Custom authentication diagnostics and connectivity: Fixed an issue where custom authentication failures and certificate parsing errors were silently discarded. Warning-level logs are now emitted for authentication failures, and the network policy has been updated to allow authentication pods to reach custom authentication servers.

• Broker data consistency during pod failures: Fixed an issue where the MQTT broker's internal replication could produce inconsistent data if a broker pod was terminated during state synchronization. State synchronization is now atomic.

• Diagnostics probe memory stability: Fixed an issue where the MQTT broker diagnostics probe could enter an infinite loop and consume unbounded memory under memory pressure. The probe now correctly detects and handles cyclic references.

Dataflows

Fixes

• Unnecessary error logging for optional health status configuration: Fixed an issue where the dataflow engine logged error messages when the optional health status configuration was not present. The configuration is now correctly treated as optional.

• Health status not reported for Kafka delivery failures: Fixed an issue where the dataflow health status was not updated when messages continuously failed to deliver to Kafka destinations. The dataflow now reports an unavailable health status when Kafka delivery fails.

• Proxy support for image pulls: Fixed an issue where proxy environment variables were not passed through to the container runtime during image pulls. Proxy settings are now correctly propagated.

Azure Device Registry

Fixes

• Schema Registry vulnerability remediation: See Security for details.

Azure IoT Operations CLI Extension

New features

• Data flow graph command group: Added a new az iot ops dataflowgraph command group that enables operators to manage DataflowGraph resources associated with a dataflow profile. The group includes apply (create or replace from a JSON configuration file via --config-file), show, list, and delete commands, providing first-class CLI support for dataflow graph lifecycle management.

• Data flow graph configuration validation: The az iot ops dataflowgraph apply command now validates node connection directions and enforces required graph node configuration parameters before submission, surfacing actionable client-side errors instead of relying on server-side rejection.

• Mgmt actions clientIdPrefix: The az iot ops mgmt-actions enable command now sets clientIdPrefix on the EG MQTT dataflow endpoint it creates.

Fixes

• Friendly error for invalid configuration files: Fixed an issue where CLI commands that accept --config-file surfaced a raw parser traceback for malformed JSON. The CLI now raises a clear, user-friendly error message identifying the invalid file.

• Connector template image tag resolution: Fixed an issue where the connector template create flow did not use the correct image tag source. The CLI now resolves the connector image tag from imageConfigurationSettings.tag, ensuring templates reference the intended image version.

Platform

Fixes

• Observability metrics collection during installation: Fixed a race condition during installation where a resource cleanup step could remove freshly installed observability components. The cleanup process now correctly excludes observability resources, ensuring metrics collection is reliably deployed.

Security

Fixes

• MQTT connector vulnerability remediation: Addressed High-severity OpenSSL and system library vulnerabilities in the MQTT connector container image.

• Schema Registry vulnerability remediation: Addressed security vulnerabilities in Schema Registry by updating affected dependencies to patched versions.

• Dataflows WebAssembly runtime vulnerability remediation: Addressed High and Critical severity vulnerabilities in the WebAssembly runtime by updating affected dependencies to patched versions.

AIO2604 (v1.3.70) Public Release Notes

Release date: April 2026

Release type: Patch

Current GA version: 2604 · Version history

Azure IoT Operations (AIO) 2604 is a stability and security-focused release that delivers vulnerability remediation across multiple components, MQTT connector reliability and health reporting improvements, OPC UA connector health state consistency, dataflow stability fixes, and new portal and tooling capabilities.

Release Highlights

• MQTT connector health status improvements: The MQTT connector now surfaces richer health status signals for assets and endpoints, improving operational visibility and enabling faster diagnosis of connectivity issues.

• Data Flow extension for VSCode now generally available: The VS Code extension for building third-party WebAssembly transforms is now GA, enabling developers to author and test custom data transformation modules directly from VS Code.

• Resource status in Azure Portal and CLI: AIO and Azure Device Registry resource health status is now visible in the Azure IoT Operations Experience, Azure Portal, and CLI, giving operators a unified view of resource state across cloud and edge.

• Dataflow graph startup reliability: Fixed a race condition that could prevent dataflow graphs from starting on busy clusters, improving deployment reliability in high-density environments.

• Security vulnerability remediation: Addressed High and Critical security vulnerabilities across Akri, Schema Registry, AIO Observability, and OpenTelemetry SDK components.

Upgrade recommended if you rely on MQTT connectors, OPC UA connectors, dataflow graphs, or health monitoring — this release delivers critical connector stability fixes, improved health reporting, and security patches.

Upgrade to 2604 from any supported GA version to ensure you receive the latest security patches and reliability enhancements. Staying current is recommended for continued support and reliability.

Components Overview

Dataflows

Fixes

• Dataflow graph startup race condition: Fixed an issue where dataflow graphs could fail to start under certain race conditions on busy clusters, which could result in timed-out commands and failed pipeline execution. Dataflow graphs now start reliably regardless of cluster load.

• Client-side retries for transient failures: Fixed an issue where dataflows lacked client-side retry logic, which could cause them to hang indefinitely on transient failures. Dataflows now include retry logic to recover gracefully from transient errors without requiring manual intervention, improving overall messaging reliability.

Connectors

OPC UA

Fixes

• Health state retransmission: Fixed an issue where the OPC UA connector did not periodically retransmit the last known health state for assets and devices, which could cause resources to fall to Unknown status after 5 minutes of stable operation. The connector now retransmits health state every 5 minutes, ensuring that healthy assets and devices maintain accurate status reporting.

MQTT

Fixes

• Health status reporting improvements: The MQTT connector now surfaces improved health status signals for assets and endpoints, providing operators with more accurate and timely visibility into connector health and connectivity state.

• Connector initialization timeout: Fixed an issue where the timeout for loading a transform graph to the connector was insufficient, which could cause dataset processing to fail.

• Asset discovery with numeric identifiers: Fixed an issue where the MQTT connector failed to discover assets when the asset-level identifier derived from MQTT topics started with a digit (common with MAC address-based identifiers), which could prevent assets from being onboarded. The connector now correctly handles identifiers that begin with numeric characters. Connector version 2.0.0 is now available with this fix.

Azure IoT Operations Experience

New features

• Resource status visibility: AIO and Azure Device Registry resource status is now surfaced in the Azure IoT Operations Experience, Azure Portal, and CLI, enabling operators to view resource health and operational state directly from cloud management surfaces.

Security

Fixes

• Vulnerability remediation: Addressed security vulnerabilities across multiple components, including Akri, Schema Registry, and AIO Observability.