Azure DevOps Server July 2026 Patch: Fix Now, Then Test NTLM Before September

0

Focus keyphrase: Azure DevOps Server July 2026 patch.

The Azure DevOps Server July 2026 patch is not one of those sleepy “install whenever” updates. Microsoft shipped July 21 patches for the current Azure DevOps Server release and Azure DevOps Server 2022 Update 2, and the same month also warned on-prem teams that Git/libcurl’s September 2026 NTLM removal can break HTTPS Git operations if Kerberos is not actually working end-to-end.

Translation: patch the server, then test authentication before your build agents start doing their best impression of a confused raccoon in a data center.

Patch now

July 21 fixes

Install Patch 6 for Azure DevOps Server or Patch 11 for Azure DevOps Server 2022.2 after backup and maintenance-window checks.

Check identity

AD trust validation

The current server patch adds validation so Azure DevOps Server only connects to trusted Active Directory domains when resolving identities.

Do before Sept.

NTLM exits Git/libcurl

Microsoft says HTTPS Git operations against Azure DevOps Server will stop working for customers relying on NTLM when Git/libcurl removes NTLM support.

What changed in the Azure DevOps Server July 2026 patch?

Microsoft’s July 21 announcement covers two on-prem Azure DevOps Server patch lines:

  • Azure DevOps Server: Patch 6.
  • Azure DevOps Server 2022 Update 2: Patch 11.

Both releases begin retiring the legacy TFVC check-in policies feature. Saving legacy TFVC check-in policies is now disabled by default, while existing policy data remains readable. Microsoft says administrators can temporarily re-enable saving per project if needed, but future patches will continue the phased retirement. In other words: if your process still depends on legacy TFVC check-in policy saves, now is the polite warning bell before the louder one.

The current Azure DevOps Server patch also adds validation to ensure the server only connects to trusted Active Directory domains when resolving identities. Azure DevOps Server 2022 Update 2 Patch 11 includes the TFVC retirement change and fixes an issue where Pie and Area charts could show summarized values that did not match the underlying work item query after certain parent-child relationship changes.

Admin takeaway: treat this as both a security/maintenance patch and a process-discovery exercise. The patch is small; the legacy process dependency hiding behind it may not be.

Why NTLM makes this more urgent

The July patch is timely on its own, but the bigger operational story is the September 2026 NTLM deadline. Microsoft warned that NTLM support will be removed from libcurl, which Git uses for HTTP(S) operations. For Azure DevOps Server customers relying on NTLM authentication, Git over HTTPS can stop working.

The sneaky bit: an environment may look like it uses Kerberos because IIS is configured with Negotiate, but SPNEGO can silently fall back to NTLM when Kerberos is not fully configured. That means “it works today” is not proof that Kerberos is healthy. It may just mean NTLM has been quietly holding the ladder.

Kerberos readiness timeline
Now
Install July patches in a maintenance window.
This week
Confirm whether Git clients and agents use Kerberos or NTLM.
August
Fix SPNs, DNS aliases, delegation, load balancer, and client reachability issues.
September
NTLM removal in Git/libcurl can break HTTPS Git operations if unresolved.

Azure DevOps Server July 2026 patch checklist

Here is the practical runbook I’d use for an on-prem Azure DevOps Server estate.

1. Identify your line. Confirm whether each deployment is Azure DevOps Server current release or Azure DevOps Server 2022 Update 2.
2. Read the exact release note. Match the patch, hash, and release note entry before installing. Do not let “close enough” manage your ALM platform. It is bad at that job.
3. Back up first. Validate SQL backups, Azure DevOps Server backups, config database recoverability, and rollback expectations.
4. Install in a maintenance window. Include application tiers, job agents, reporting dependencies, and comms for build/release teams.
5. Verify installation. Microsoft says to run <patch-installer>.exe CheckInstall on the Azure DevOps Server machine using the patch installer you downloaded.
6. Inventory TFVC check-in policies. Find projects still saving legacy TFVC check-in policies and plan a migration path.
7. Test Git authentication. Validate Kerberos from developer machines, build agents, service accounts, VPN/non-corporate network paths, and any automation runners.

How to spot NTLM dependency before Git breaks

Microsoft recommends validating whether Git connections are using Kerberos or NTLM because a successful Git operation does not prove which protocol was used. Good checks include:

  • Look for NTLM warnings from Git for Windows or Git Credential Manager.
  • Check Kerberos tickets after a Git operation. A service ticket such as HTTP/tfs.contoso.com indicates Kerberos for that endpoint.
  • Inspect Git HTTP traces in a safe test scenario. NTLM tokens and Kerberos Negotiate tokens look different, and Microsoft’s post shows what to look for.
  • Test build agents separately. They often run under service accounts or network contexts that do not behave like a normal domain-joined admin workstation.

If Kerberos is not feasible for some clients, Microsoft suggests evaluating SSH authentication for Git operations if SSH is supported and enabled in the Azure DevOps Server deployment. That is not a “do it at 4:55 p.m. on Friday” change. Test it with real repositories, real agents, and real humans who will absolutely find the one edge case you missed.

Who should care?

Team Why it matters First action
Azure DevOps Server adminsPatch installation, identity validation, TFVC policy retirement.Schedule patch and verify CheckInstall.
Security teamsNTLM retirement and trusted-domain validation reduce legacy auth risk.Confirm Kerberos and document exceptions.
Build/release teamsAgents may fail Git fetch/clone if they depend on NTLM.Test representative pipeline agents.
TFVC-heavy projectsLegacy check-in policy saving is disabled by default and being retired.Inventory policy usage and alternatives.

Bottom line

The Azure DevOps Server July 2026 patch deserves a spot on this week’s admin board because it combines immediate patch hygiene with a bigger authentication deadline. Install the right patch, verify it, inventory legacy TFVC policy dependencies, and use the same maintenance cycle to prove Kerberos works before September. Future-you deserves fewer surprise fires. Be kind to future-you.

Sources

Discover more from SharePoint Monkey

Subscribe to get the latest posts sent to your email.