[Breaking change]: Local auth is disabled by default on Azure resources

[eerhardt]

Description

In 9.4 we are disabling local auth on the following integrations:

• Azure EventHubs
• Azure WebPubSub

Note, there may be more changes to the following if these issues are fixed in 9.4:

• Disable Local Auth on Azure ApplicationInsights aspire#9796
• Disable Local Auth on Azure LogAnalyticsWorkspace aspire#9797
• Disable Local Auth on Azure SignalR aspire#9798

Version

Other (please put exact version in description textbox)

Previous behavior

Previously these Azure resources were created with the default value for disable local auth, which was false.

New behavior

Now these Azure resources are created with disable local auth true.

Type of breaking change

• Binary incompatible: Existing binaries might encounter a breaking change in behavior, such as failure to load or execute, and if so, require recompilation.
• Source incompatible: When recompiled using the new SDK or component or to target the new runtime, existing source code might require source changes to compile successfully.
• Behavioral change: Existing binaries might behave differently at run time.

Reason for change

This is a better security default. Some Azure environments are configured to reject resources with local auth being enabled.

Recommended action

If you are using the Aspire client integrations for the service, no change is necessary. Your app will continue to function as before.

If you are using a SAS token or other connection string with an access key, you will either need to re-enable local auth via the .ConfigureInfrastructure method, or change your application to use Entra ID Auth.

Affected APIs

• AddAzureEventHubs
• AddAzureWebPubSub

---

Associated WorkItem - 447404