Service-change impact report

SYNTHETIC SAMPLE inputs are explicitly marked below; do not treat them as real-environment evidence.

AI-assisted evidence review is not human approval. Nothing was merged or deployed.

Known-revision evidence guards are checked; remaining prose still requires human review.

1. Scope and completeness

Warning: Some inventory resource types are not mapped to Azure Updates products and were not evaluated.

Warning: Some candidates exceeded the per-run limit and were not evaluated in this run.

Warning: The Azure inventory is a synthetic sample, not a real environment.

Warning: The Microsoft 365 notices and tenant profile are synthetic samples.

2. Verdicts

3. Details for Impacted and Needs investigation

This is an AI-assisted evidence review of live run 38012531004, all 12 delivered candidate rows, the original six finding Issues and four new investigation Issues. The run delivered Markdown, HTML and metadata, and the mandatory verify-report job passed. The original October 6 artifact was missing; this does not claim to recover that unpublished report. Inventory/profile facts remain the 2026-10-01 synthetic snapshot, not live environment observations.

This final review yields 2 Impacted, 2 Not impacted (explicitly limited scope), 8 Needs investigation, 0 Cannot evaluate. All notices were readable; incomplete configuration is reported as Needs investigation rather than silently treated as no impact.

The original agent's completion log listed the same 12 candidate keys: 3 Impacted, 3 Needs investigation and 6 Not impacted. Five verdicts change: MC-SAMPLE-001 changes from Impacted to Needs investigation; Azure 557852, 551523, 560948 and 498749 change from Not impacted to Needs investigation because SCM/client, preview-export, reservation-order and subscription-cloud facts were not captured. The remaining seven verdicts are retained with explicit scope and missing facts.

The delivered raw run incorrectly called disks-02 a data disk in its table despite missing role evidence; this reviewed report corrects that assertion. Its broader reservation-investigation verdict is retained: excluding the captured v5 VM is not an account-wide reservation review. Shape/delivery validation is not a substitute for factual review. New investigation findings are Issue 10, Issue 11, Issue 12 and Issue 13. No duplicate original finding or new PR was created.

Azure 500157: Standard HDD OS disks

• Source: https://azure.microsoft.com/updates?id=500157
• Confirmed: the retirement is for Standard HDD OS disks; Standard HDD data disks are explicitly excluded.
• Correction: Issue 7 must separate confirmed disks-01 from the unclassified disks-02. Missing osType is not proof that a disk is a data disk.
• Next step: a human chooses disk type, workload validation and migration window. No disk was converted.

Azure 572770: PowerShell 7.4

• Source: https://azure.microsoft.com/updates?id=572770
• Confirmed: support ends 2026-11-10; the recommended target is 7.6. The Linux Consumption prerequisite does not apply to the captured Windows app.
• Correction: Issue 4 had literal newline escapes and a redacted source link; replace them with proper Markdown and the original URL.
• PR validation: draft PR 9 changes only the runtime parameter. Unit tests, Bicep build, actionlint and offline infrastructure validation passed on the PR commit. No merge, what-if against Azure, deployment or function smoke test was performed.

Azure 557852: TLS 1.0 / 1.1

• Source: https://azure.microsoft.com/updates?id=557852
• Supporting documentation: App Service TLS settings.
• Confirmed: the application endpoint already requires TLS 1.2. SCM TLS can be configured independently; its value and client compatibility are absent.
• Next step: capture those facts. Do not assume a documented default equals observed configuration.

M365 MC-SAMPLE-001: SMS sign-in

• Source: fictional sample MC-SAMPLE-001; this is not a Microsoft announcement.
• Supporting documentation: Microsoft Graph SMS target.
• Correction: the original Impacted verdict overstates the captured evidence. isUsableForSignIn determines primary sign-in and is not included in the profile.
• Next step: obtain the target sign-in flag before deciding impact. No M365 configuration change is authorized.

Azure 493779: Azure Disk Encryption

• Source: https://azure.microsoft.com/updates?id=493779
• Supporting documentation: Managed disk encryption options.
• Confirmed: ADE retires 2028-09-15; the notice warns about unlocking after reboots, not an observed outage in this sample.
• Correction: a Disk Encryption Set or SSE/CMK configuration is not an equivalent ADE detection signal. Issue 8 remains Needs investigation, with the check narrowed to ADE-specific evidence.
• Next step: verify ADE extensions/guest encryption and, only if enabled, review Encryption at Host or another supported migration.

Azure 551523: VM client data preview export

• Source: https://azure.microsoft.com/updates?id=551523
• Confirmed: the retired capability is the VM-client data export preview; AMA generally remains supported.
• Gap: DCR/export settings and actual sender usage are not captured. Azure Monitor presence alone does not prove use.
• Next step: capture the specific preview configuration and destinations. The date is past; no data-loss claim is made.

Azure 498749: Defender for Cloud in 21Vianet

• Source: https://azure.microsoft.com/updates?id=498749
• Confirmed: the retirement is limited to the 21Vianet environment, effective 2026-08-18.
• Gap: the inventory has region values but no explicit cloud identifier. This subscription-wide match cannot be settled from an assumed cloud.
• Next step: record the cloud and then exclude or assess the notice. No Defender setting was changed.

Azure 560948: Select VM-series reservations

• Source: https://azure.microsoft.com/updates?id=560948
• Confirmed: selected-series RI purchases/renewals are retired from 2026-07-01; existing reservations continue through their term.
• Scope: Standard_D2s_v5 is not a named retiring VM series. Reservation orders, renewals and expirations are not captured; this does not exclude account-wide reservation impact.
• Next step: keep Issue 11 as Needs investigation and obtain reservation-order evidence. Do not infer a price increase, affected order or elapsed reservation from the current VM size.

Azure azure-monitor-data-collection-api-retirement: Data Collector API

• Source: https://azure.microsoft.com/updates?id=azure-monitor-data-collection-api-retirement
• Confirmed: the legacy Data Collector API retired 2026-09-14; DCR-based Log Ingestion is the replacement.
• Gap: neither sender implementation nor ingestion usage was captured. IngestionMode=LogAnalytics on Application Insights does not settle unrelated custom log sender behavior.
• Next step: review endpoints, authentication and ingestion telemetry. Keep Issue 2 as Needs investigation.

M365 MC-SAMPLE-002: Legacy Exchange protocol

• Source: fictional sample MC-SAMPLE-002; this is not a Microsoft announcement.
• Confirmed: impact requires actual legacy protocol usage, which is absent from the tenant profile.
• Deadline: the fictional notice provides none. No date is inferred from publication or modification timestamps.
• Next step: obtain protocol-usage evidence. Keep Issue 6 as Needs investigation.

4. Not evaluated in this run

5. Coverage gaps

• Unmapped resource types: microsoft.purview/accounts (1)
• Ignored resource types: microsoft.managedidentity/userassignedidentities (1)

6. Reviewer checklist

• [x] Candidate coverage, known-revision guards and captured-resource labels passed automated validation.
• [ ] A human owner accepts or corrects the evidence and the stated scope.
• [ ] Missing usage, cloud, client or policy settings have been obtained where needed.
• [ ] Owners and dates are assigned to findings before action.
• [ ] Any draft pull request passes checks and receives human approval before deployment.