--- cuppy_hub: azure cuppy_path: changelog/2026-10-20-identity-family.md cuppy_section: docs cuppy_doc: VDPF-2ZH3 cuppy_doc_uuid: 55b2de36-7c37-4e1a-ab60-17e68ad636a5 cuppy_permalink: https://cuppy.io/azure/d/VDPF-2ZH3 cuppy_version: 1 cuppy_updated: 2026-10-23T16:16:52.575Z cuppy_canonical: https://cuppy.io/azure/docs/changelog/2026-10-20-identity-family cuppy_mcp: https://cuppy.io/mcp cuppy_body_sha256: 98a82d97e72f178acd06a3cebdc5c0845dc9f8525f897ee2c7608fdbe375ca86 # cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks. --- # Azure hub — first release, identity and access (2026-10-20) ## What's in it 22 documents: this note, `HUB.md`, `_boot/START.md`, 7 guides, 11 reference documents and 2 patterns. All are in family 1, identity and access: - **Error catalogues:** - Entra token errors for apps and for users - Federated-credential errors - `@azure/identity` SDK errors - Managed identity errors - RBAC errors - Azure Policy - Key Vault access - **Guides:** - Triaging access denied - GitHub Actions OIDC - Managed identities - Service principals and credential rotation - Assigning roles idempotently - The portal escape hatch - **Patterns:** GitHub Actions to Azure; app to Key Vault with a managed identity. ## 2026 changes captured - **GitHub immutable OIDC subjects.** Repositories created, renamed or transferred after July 15, 2026 present `repo:@/@:…`. - **Key Vault defaults and retirements.** Azure RBAC is the default permission model from API 2026-02-01 (verified in the REST spec: `enableRbacAuthorization` defaults to false in 2025-05-01, true from 2026-02-01). All earlier control-plane API versions retire on February 27, 2027. - **Tool versions.** `azure/login@v3`, `@azure/identity` 4.14.0 and the Azure CLI 2.91 command surface. ## How it was verified - Microsoft sources were read from their public git repositories at a pinned commit (`azure-docs@dd032389`, `entra-docs@5695853e`, `azure-sdk-for-js@30c1cf9f`, `azure-rest-api-specs@c783b658`, `azure-management-docs@af7b3831`, `Azure/login@487024fc`). Key Vault pages, which have no public repository, were read from Learn. - Every `az` command and flag: 120 commands checked against Azure CLI 2.91.0's own help, 0 issues. - Every TypeScript block type-checks under `tsc --strict` against the installed `@azure/*` packages. The Bicep block compiles and lints clean with Bicep 0.48.1. - SDK error strings were read from the `@azure/identity` 4.14.0 code, which differs from Microsoft's troubleshooting guide. Both wordings are indexed. ## Known gaps - Families 2–10 are planned. Documents point at them in prose and link only to what exists. - Statements the sources didn't confirm are marked as the hub's reading, or as field practice with their sources. - Every document is `status: draft` until the post-import checks pass. --- You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 107 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/azure/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.