Azure SDK's October 2026 release brings Cosmos DB for Rust to GA
Azure published its monthly SDK index on October 28, 2026, and the obvious headline is that the Rust SDK finally has a stable (GA) Cosmos DB client. Two supporting crates shipped alongside it, and the milestone quietly closes a parity gap that's been dragging since Rust joined the Azure SDK family. But product manager Sandeep Sen framed the post less like a feature dump and more like a security update, and that framing holds up.
Azure SDK updates aren't monolithic downloads. They're hundreds of independent, versioned packages spread across NuGet, Maven, npm, PyPI, crates.io, and go.dev, referenced through ordinary dependency tooling. This monthly index is the canonical index for all of it, and it picks the highlights rather than listing every patch. So what landed here actually points somewhere.
Azure SDK Release (October 2026)
October's Azure SDK highlights include Azure Core authentication updates, managed identity improvements for Python and Java, and the first stable Cosmos DB libraries for Rust.
Security and identity lead the month
The Rust milestone is the star, but the real work is in the identity stack. Azure Core 1.63.0 for .NET adds mutual-TLS proof-of-possession for client-certificate auth and the federated-identity flow used by configured credentials. Proof-of-possession binds an access token to a specific key or certificate via the mTLS handshake, meaning an intercepted token can't be replayed without the matching private key. It applies to both client-certificate auth and managed-identity federated flows like workload and pod identities.
That's genuinely useful. Token theft in identity-based breaches has become a boringly common story over the past few years, so defense-in-depth like this is worth the setup, even if it asks you to manage another certificate.
The same release fixes two reliability headaches that have annoyed people for a while. DefaultAzureCredential would stall when the Instance Metadata Service was slow or unreachable. An unavailable managed-identity source could also short-circuit the entire fallback chain, and now it degrades more gracefully instead.
Keep in mind one breaking change for early adopters. If you were experimenting with the experimental proof-of-possession option, the naming flipped: DisableMtlsProofOfPossession = true needs to become EnableMtlsProofOfPossession = false to keep forcing bearer auth.
Azure Identity 1.26.0 for Python extends ManagedIdentityCredential to cover user-assigned managed identities on Azure Arc-enabled servers, selectable by client ID, object ID, or resource ID. That closes a gap for hybrid deployments where Azure management services get stretched to on-prem or other-cloud servers, and token responses that don't confirm the requested identity are now rejected too. Two bugs also get squashed: sync Service Fabric auth now works with MSAL 1.39.0 and later, and a shared-token-cache bug that let AuthorizationCodeCredential and the async OnBehalfOfCredential hand back another account's token is fixed. Multi-tenant apps running on-behalf-of flows should care.
Azure Identity 1.18.7 for Java mirrors part of that work, adding the Azure Arc user-assigned identity support to ManagedIdentityCredential and DefaultAzureCredential, plus fixes for GraalVM native-image compatibility and IMDS discovery timeouts.
Provisioning and Data AI push into AI
While identity gets hardened, Microsoft is also stretching its infrastructure-as-code play. Azure Provisioning is the in-language, declarative approach that's meant to sit alongside Terraform HCL and Pulumi without pulling you out of your native SDK. It opened wide in August with eleven new Azure.Provisioning.* betas, and October keeps the wave going.
In .NET, Provisioning – Databricks, Provisioning – Fabric, and Provisioning – Verified ID all debut at 1.0.0-beta.1. In JavaScript/TypeScript, the core @azure/provisioning-core package and @azure/provisioning-keyvault both enter beta. Throwing Databricks, Fabric, and Verified ID into the mix signals Microsoft is moving the declarative model past classic compute and networking and into AI and data workloads.
There's also a brand-new category this month, Azure Data AI, with .NET's Azure.Data.AI 1.0.0-beta.1 and Python's azure-data-ai 1.0.0b1. It's the tooling layer for feeding, preparing, and orchestrating data around AI workloads. It joins a cluster of AI previews already circulating, including Azure AI Content Safety, Azure AI Fine-Tuning Sessions, and AI Agent Server – Optimization.
The whole thing ties together a bit earlier in the month, when Azure MCP Server 3.0 reached stable on October 12. As an open-source Model Context Protocol implementation, it gives AI agents a consistent way to discover and call Azure operational tools like backup, Advisor, Monitor, and Cosmos DB. Stable provisioning tooling, GA data libraries, and a mature MCP server are all pointing the same direction: define infrastructure in code, then operate it through agents.
What shipped
Beyond the highlights, October delivered a batch of initial stable releases, and management libraries make up most of it. Relationships, Service Groups, and Template Specs landed in Java, alongside Relationships, Service Groups, and Resilience Management in JavaScript and Go. Python got a grab-bag including Resource-Policy, Relationships, Features, Locks, and Template Specs. A lone .NET client library, Cosmos DB, crossed into stability, along with a .NET management entry, Resource Management – Napster Omni Agent API 1.0.0, which will make anyone who remembers the original music service raise an eyebrow.
The betas round out the picture. Web PubSub Chat, the new Azure Data AI and Provisioning entries in .NET, AI Agent Server – Optimization, and a smattering of compute-workload and platform-validation management previews across Java, JavaScript, Python, and Go. Nothing exotic, but it's a broad spread of the "new style" libraries Microsoft has been shipping through its automated generation pipelines.
For the developers reading this
Teams on Rust can productionize Cosmos DB access now, but review the preview-to-GA migration steps first: the preview_dtx, preview_patch, and preview_opentelemetry flags become their unstable_ equivalents, CosmosCredential::MasterKey becomes CosmosCredential::AccountKey, and the User-Agent format changed. Security-minded .NET, Python, and Java teams should plan the mTLS adoption and flip that experimental flag naming, and multi-tenant apps should note the shared-token-cache fix.
Terraform and Pulumi users keeping an eye on alternatives should watch Provisioning mature, especially now that it reaches into Databricks, Fabric, and Verified ID. Head here to the Azure SDK Releases page for October to dig through the full per-language changelogs, or subscribe to the Azure SDK Blog RSS feed for what comes next.
