Azure Monitor HTTP Data Collector API Hits Official Retirement Milestone

On September 14, 2026, Microsoft officially retired its legacy HTTP Data Collector API for Azure Monitor. While existing ingestion pipelines meeting strict TLS 1.2+ requirements will continue to transmit data in an unsupported operational mode, the legacy endpoint is now frozen, restricted to critical security fixes, and no longer validated against newer Azure Monitor capabilities or custom table schemas. Microsoft directs all workloads to the modern Azure Monitor Logs Ingestion API. This retirement carries immediate operational weight for platform engineers, SecOps teams, and SREs managing hybrid cloud telemetry. The HTTP Data Collector API historically served as the primary entry point for ingesting custom application logs, on-premises syslog collectors, and third-party SaaS event streams into Log Analytics and Microsoft Sentinel. The transition requires engineering teams to replace legacy HMAC-SHA256 workspace shared key authentication with Entra ID (OAuth 2.0) managed identities or service principals, restructuring how telemetry forwarders authenticate across distributed environments. In the broader cloud observability landscape, this shift reflects an industry-wide transition away from dumb ingestion endpoints toward programmable, schema-enforced telemetry pipelines. Legacy collection mechanisms often resulted in runaway ingestion costs and "schema explosion" because backend stores dynamically created columns for arbitrary JSON fields. By routing ingestion through Data Collection Rules (DCRs) and Data Collection Endpoints (DCEs), Azure Monitor brings native ingestion-time data shaping—allowing teams to filter, mask PII, and normalize schema via KQL before data lands in destination tables. This parallels modern architectures seen in OpenTelemetry pipelines and decoupled data collectors. In practice, practitioners must immediately audit Log Analytics workspaces for classic custom log tables (suffixed with `_CL`) and associated Azure Functions, Logic Apps, or daemonsets still targeting the legacy API. Beyond updating endpoint URLs and authentication mechanisms, teams must accommodate request payload limits—the Logs Ingestion API enforces a 1 MB uncompressed request limit compared to the legacy 30 MB ceiling—requiring proper batching and retry logic in client-side telemetry forwarders. Teams should prioritize establishing standardized DCRs to preserve pipeline reliability, maintain ingestion compliance, and unlock fine-grained RBAC controls.