Azure hub — first release, identity and access (2026-10-20)

What the first release of the Azure hub contains — the identity and access family (Entra ID token errors, federated credentials, managed identities, the TypeScript credential chain, RBAC, Policy, Key Vault access) in 22 documents — how it was verified, the 2026 changes it captures, and what is known to be missing.

markdownreferencev1VDPF-2ZH3area: changelogchangelogrelease notesazure hub first releaseidentity family

Created 21 Oct 2026 · Modified 23 Oct 2026 · 1 version

What's in it

22 documents: this note, HUB.md, _boot/START.md, 7 guides, 11 reference documents and 2 patterns. All are in family 1, identity and access:

  • Error catalogues:
  • Entra token errors for apps and for users
  • Federated-credential errors
  • @azure/identity SDK errors
  • Managed identity errors
  • RBAC errors
  • Azure Policy
  • Key Vault access
  • Guides:
  • Triaging access denied
  • GitHub Actions OIDC
  • Managed identities
  • Service principals and credential rotation
  • Assigning roles idempotently
  • The portal escape hatch
  • Patterns: GitHub Actions to Azure; app to Key Vault with a managed identity.

2026 changes captured

  • GitHub immutable OIDC subjects. Repositories created, renamed or transferred after July 15, 2026 present repo:<org>@<id>/<repo>@<id>:….
  • Key Vault defaults and retirements. Azure RBAC is the default permission model from API 2026-02-01 (verified in the REST spec: enableRbacAuthorization defaults to false in 2025-05-01, true from 2026-02-01). All earlier control-plane API versions retire on February 27, 2027.
  • Tool versions. azure/login@v3, @azure/identity 4.14.0 and the Azure CLI 2.91 command surface.

How it was verified

  • Microsoft sources were read from their public git repositories at a pinned commit (azure-docs@dd032389, entra-docs@5695853e, azure-sdk-for-js@30c1cf9f, azure-rest-api-specs@c783b658, azure-management-docs@af7b3831, Azure/login@487024fc). Key Vault pages, which have no public repository, were read from Learn.
  • Every az command and flag: 120 commands checked against Azure CLI 2.91.0's own help, 0 issues.
  • Every TypeScript block type-checks under tsc --strict against the installed @azure/* packages. The Bicep block compiles and lints clean with Bicep 0.48.1.
  • SDK error strings were read from the @azure/identity 4.14.0 code, which differs from Microsoft's troubleshooting guide. Both wordings are indexed.

Known gaps

  • Families 2–10 are planned. Documents point at them in prose and link only to what exists.
  • Statements the sources didn't confirm are marked as the hub's reading, or as field practice with their sources.
  • Every document is status: draft until the post-import checks pass.

Read this document as markdown — the same bytes an agent receives.