Question about ADF trusted services security toggle.

Question

Question about ADF trusted services security toggle.

Murali Srinivas Kommineni 5

Hi,

We are doing an impact assessment for Microsoft’s Azure Data Factory security change coming on August 1, 2026.

Based on the notice, ADF will retire support for the trusted services firewall exception that allows access to Azure Storage accounts and Azure Key Vault using managed identity.

We have multiple ADFs in use, so I started testing this in our non-production. I enabled the feature flag mentioned in the document by adding feature.enableTrustMIToken=true to the ADF Studio URL. However, after enabling the feature flag, I didn't notice any visible changes in the UI.

We later found the Trusted service setting under Factory settings and changed it from Legacy to Modern. After switching to Modern, I ran the pipeline and it completed successfully without errors.

User's image

As an additional check, I reviewed the Key Vault configuration and noticed that the Key Vault linked service uses managed identity, and the Key Vault firewall has Allow trusted Microsoft services to bypass this firewall enabled. When I disabled that Key Vault exception, the pipeline failed. So I’m trying to clarify exactly what Microsoft is retiring here. Based on the test, the pipeline works with the ADF setting changed to Modern, but it still fails if the Key Vault trusted services firewall exception is disabled.

Could you please confirm if changing the ADF Trusted service setting to Modern is the correct validation for this retirement, or if we still need to migrate the Key Vault access path to private endpoint/managed private endpoint?

User's image

Thanks.

0 comments

1 answer

Your answer

Answer 1

Hello Murali, Greetings! Thanks for raising this question in the Q&A forum.

This is a good real world validation question, and your test results actually make sense once you separate two different things that are easy to conflate here: how Data Factory authenticates itself as a trusted service, versus whether the target resource's firewall is configured to accept trusted service connections at all.

Here is the distinction:

What the Trusted service setting (Legacy vs Modern) actually controls This setting governs the mechanism ADF uses to prove to Azure Storage or Key Vault that the request is genuinely coming from your Data Factory's managed identity, rather than from an arbitrary caller pretending to be a trusted service. Legacy relied on network-level trust (essentially, requests appearing to originate from Microsoft's backbone were implicitly trusted). Modern requires ADF to present a managed identity token that Storage or Key Vault can cryptographically validate as belonging to your specific factory's managed identity. This is the part being retired on August 1, 2026, the Legacy, token-less trust mechanism.

What switching to Modern does not eliminate Even with Modern trusted service auth working correctly, the target resource (Storage account or Key Vault) still needs:

Allow trusted Microsoft services to bypass this firewall enabled on its firewall/networking settings The Data Factory's managed identity explicitly granted permission on that resource, either through an RBAC role assignment (for Storage) or an access policy/RBAC role (for Key Vault) Modern trusted service auth changes how the trust is proven, it does not remove the requirement that trusted service bypass be explicitly enabled and permissioned on the resource itself. So when you disabled the Key Vault's trusted services firewall exception, you removed the mechanism entirely, not just the legacy half of it, which is exactly why the pipeline failed regardless of the ADF-side Modern setting.

  **So to directly answer your question** Yes, changing the ADF Trusted service setting to Modern is the correct validation step for this specific retirement, and your successful pipeline run after that switch confirms your factory is no longer dependent on the legacy mechanism being retired. You do not need to migrate to private endpoint or managed private endpoint purely because of this retirement, as long as you keep **Allow trusted Microsoft services to bypass this firewall** enabled on both the Storage account and Key Vault, and keep the managed identity permissions in place, since that combination is what Modern trusted service auth still relies on.
  
  **When private endpoint/managed private endpoint becomes relevant instead** That path is a separate, stronger networking option, not a required replacement for trusted service auth. You would move to it if your organization wants to eliminate reliance on the trusted service bypass model altogether, for example, for stricter network isolation policies that don't want any firewall bypass exception, even a modern MI-token validated one, enabled at all.
  
  **Recommended validation across your other ADFs** Since this is a factory-level setting, repeat this same test methodically for each ADF instance:
  
  ```yaml
  1. Open ADF Studio > Manage > Factory settings

Confirm Trusted service is set to Modern
Run a pipeline that reads from both the Storage linked service and the Key Vault linked service
Confirm both succeed with trusted service firewall exceptions still enabled (not disabled) on the target resources
```
      
```

Since this retirement is quite recent and specific, I'd also recommend cross-checking your findings directly against the official retirement notice text for your exact ADF version, since Microsoft occasionally updates scoping details on these notices as the retirement date approaches.

If this answer helps you kindly accept the answer which will help others who have similar questions.

Best Regards,

Jerald Felix.