EWS worldwide allow-list enforcement is live today; Microsoft retires the Arc Key Vault Secrets Provider Extension (2027)

A quiet night: one dated milestone reached today and one new entry off the Azure Updates feed. Both were verified against their primary sources.

Reached today: EWS worldwide allow-list enforcement

Today is the date in the Exchange Web Services retirement timeline. Microsoft turns on the cloud setting requiring an EWSAllowedAppIDs allow list for all tenants in the worldwide (WW) cloud — from today, setting EWSEnabled = True is no longer enough on its own, and any app not named in the allow list is refused when it calls EWS against Exchange Online. Microsoft auto-seeded lists on 8–9 October for tenants it captured on 2 October, but that backstop only covers apps that ran in the prior 60 days, so anything infrequent can fall outside it. This is a milestone, not the finish line: EWS is fully disabled in April 2027, and the real work is still migrating to Microsoft Graph. We’ve marked the entry passed for today’s date; it stays live as the migration record through 2027.

New: Azure Key Vault Secrets Provider Extension for Arc-enabled Kubernetes retires 9 October 2027

If your Azure Arc-enabled Kubernetes clusters sync secrets from Azure Key Vault using the Secrets Provider Extension (Microsoft.AzureKeyVaultSecretsProvider), that extension is retired on 9 October 2027 — after which it gets no features, bug fixes, security updates, or support. Microsoft’s named successor is the Azure Key Vault Secret Store Extension, which offers equivalent secret sync plus two things the old one lacks: offline access to secrets and workload identity federation, so clusters reach Key Vault without storing long-lived credentials. One caveat worth repeating: this covers the Arc-enabled Kubernetes extension only — the same-named add-on on managed AKS is a separate product and is not in scope, so check which one your clusters run before you plan the move.

The next two weeks on the board

Dates ahead, each verified against its primary source: Windows 11 24H2 end of servicing and Reddit RSS feeds ending (both 13 Oct), Microsoft Sentinel containerized SAP connector images removed (14 Oct), Cloudflare Workers KV legacy API (15 Oct), OpenSSL 3.4 end of life and Minimus shutdown (both 22 Oct), OpenAI GPT-4 / GPT-3.5 / o1 / o3 model removals (23 Oct), Kubernetes 1.34 end of life (27 Oct), Fitbit’s legacy Web API turned off (30 Oct), and OpenAI’s hosted Evals platform going read-only (31 Oct). Full board with live countdowns on the calendar.