Docs Home
We recommend using Azure Native.
Version 6 of the Azure Classic provider is the first major release since April 2022. There are some breaking changes which are detailed in this document. Version 6 of the pulumi-azure provider is based on version 4 of the terraform provider. The original release notes can be found in the 4.0 upgrade guide.
Upgrade to version 5.89.0 of the provider and resolve any deprecation warnings before moving to version 6.
Subscription ID is now mandatory
The subscription id configuration is now always required. This can be set via the environment variable ARM_SUBSCRIPTION_ID or the provider configuration property subscriptionId. This was already required when using any authentication method except for the CLI.
Provider Registration Options
The previous version of the provider would automatically register a predefined list of resource providers in Azure, unless disabled with the skipProviderRegistration configuration option.
In version 6, the default set of resource providers is reduced to a smaller default set with the option to specify an alternative pre-defined set and specify a custom list of resource providers.
resourceProviderRegistrationsis the name of the set of resource providers to automatically register.core- A minimal set of RPs that are deemed necessary for a subscription, the list of RPs in this set can be found upstream hereextended- An expanded set of RPs as suggested by the community, the list of RPs in this set can be found upstream hereall- A complete set of RPs that might be needed to utilize any functionality in the provider, the list of RPs in this set can be found upstream herenone- No resource providers should be automatically registeredlegacy- A set of automatically registered RPs from earlier versions of the provider, this is only provided for forwards compatibility and will be removed in a future major version release
resourceProvidersToRegistersis a list of resource provider names to register in addition to the set specified withresourceProviderRegistrations
Case Sensitive Enums
In the previous upstream version enum strings were made case sensitive for better strictness and to resolve some persistent diff issues. We delayed passing on this change until this next major version to ensure we had a good migration experience which could avoid fixing the case causing replacements.
Once you have upgraded to v6, performing a preview will report any properties with incorrect casing and will indicate the allowed values. The casing will need to be fixed in your program before being able to continue with your deployment.
List of resource properties affected
| Resource | Properties |
|---|---|
appservice.AppService | dotnetFrameworkVersionjavaContainermanagedPipelineModeremoteDebuggingVersion |
appservice.CertificateOrder | productType |
appservice.FunctionApp | dotnetFrameworkVersion |
analysisservices.Server | querypoolConnectionMode |
automation.RunBook | runbookType |
automation.Schedule | frequencyweekDaysmonthlyOccurrence |
cdn.Endpoint | geoFilters.actionoptimizationType |
cdn.Profile | sku |
compute.Image | osDisk.osTypeosDisk.osStateosDisk.cachingdataDisk.caching |
compute.Snapshot | createOption |
compute.VirtualMachineDataDiskAttachment | cachingcreateOption |
containers.ContainerGroup | ipAddressTypeosTyperestartPolicy |
containers.KubernetesCluster | loadBalancerSku |
cosmos.Account | offerTypekindconsistencyPolicy.consistencyLevelcapabilities.name |
cosmos.GremlinGraph | indexingMode |
dns.CaaRecord | record.tag |
eventhub.Namespace | sku |
eventhub.EventHub | encoding |
network.FirewallPolicy | intrusionDetection.trafficBypasses.protocol |
hdinsight.HBaseCluster | tierroles.*.vmSize |
hdinsight.HadoopCluster | tierroles.*.vmSize |
hdinsight.InteractiveQueryCluster | tierroles.*.vmSize |
hdinsight.KafkaCluster | tierroles.*.vmSize |
hdinsight.SparkCluster | tierroles.*.vmSize |
iotcentral.Application | sku |
iot.IoTHub | endpoint.encoding |
keyvault.Certificate | certificatePolicy.keyProperties.keyType |
compute.VirtualMachine | licenseTypestorageOsDisk.osTypestorageOsDisk.managedDiskTypestorageDataDisk.managedDiskTypeosProfileWindowsConfig.winrm.protocol |
compute.ScaleSet | licenseTypeupgradePolicyModeprioritystorageProfileOsDisk.managedDiskTypestorageProfileDataDisk.managedDiskType |
lb.LoadBalancer | sku |
lb.NatPool | protocol |
lb.NatRule | protocol |
lb.Probe | protocol |
lb.Rule | protocol |
loganalytics.DataSourceWindowsEvent | eventTypes |
logic.IntegrationAccountBatchConfiguration | recurrence.frequencyrecurrence.schedule.monthly.weekdayrecurrence.schedule.weekDays |
logic.Standard | connectionString.typedotnetFrameworkVersion |
logz.Monitor | plan.billingCycleplan.planIdplan.usageType |
media.ServicesAccount | storageAuthenticationTypekeyDeliveryAccessControl.defaultAction |
monitor.MonitorAutoscaleSetting | profile.recurrence.days |
mssql.Database | threatDetectionPolicy.disabledAlertsthreatDetectionPolicy.emailAccountAdminsthreatDetectionPolicy.state |
mssql.Elasticpool | sku.namesku.tiersku.family |
mssql.ServerSecurityAlertPolicy | state |
mysql.Server | version |
network.ApplicationGateway | backendHttpSettings.protocolbackendHttpSettings.cookieBasedAffinityfrontendIpConfiguration.privateIpAddressAllocationhttpListener.protocolprivateLinkConfiguration.ipConfiguration.privateIpAddressAllocationsku.namesku.tierprobe.protocolwafConfiguration.firewallMode |
network.ExpressRouteCircuit | sku.tiersku.family |
network.NetworkSecurityGroup | securityRule.protocolsecurityRule.accesssecurityRule.direction |
network.NetworkSecurityRule | protocolaccessdirection |
network.PublicIpPrefix | ipVersion |
network.PublicIp | ipVersionsku |
network.Route | nextHopType |
network.RouteTable | nextHopType |
network.VirtualNetworkGatewayConnection | typeipsecPolicy.dhGroupipsecPolicy.ikeEncryptionipsecPolicy.ikeIntegrity |
network.VirtualNetworkGateway | typevpnTypevpnClientConfiguration.vpnClientProtocols |
notificationhub.NotificationHubNamespace | namespaceType |
policy.PolicyDefinition | policyType |
postgresql.Server | version |
recoveryservices.Vault | sku |
recoveryservices.ReplicatedVM | targetDiskTypetargetReplicaDiskType |
redis.Cache | skuName |
redis.LinkedServer | serverRole |
securitycenter.Automation | action.typeruleSet.rule.operatorruleSet.rule.propertyType |
servicebus.Namespace | sku |
servicebus.SubscriptionRule | filterType |
servicebus.Topic | status |
sql.Database | createModeimport.storageKeyTypeimport.authenticationTypeimport.operationModeeditionthreatDetectionPolicy.disabledAlertsthreatDetectionPolicy.emailAccountAdminsthreatDetectionPolicy.state |
sql.ManagedInstance | licenseType |
sql.SqlServer | threatDetectionPolicy.disabledAlertsthreatDetectionPolicy.state |
storage.Account | accountKindaccountTieraccountReplicationTypeaccessTiernetworkRules.bypass |
synapse.SqlPoolSecurityAlertPolicy | policyState |
synapse.WorkspaceSecurityAlertPolicy | policyState |
trafficmanager.Profile | monitorConfig.protocolprofileStatus |
Removed Resources
Resources which were previously deprecated have now been removed. Some removed resources have direct replacements which can be directly migrated to by updating your code. Other services have been retired by Azure and therefore have no direct migration to an alternative.
Replaced Resources
These resources were previously deprecated and have now been removed in favor of a new resource. To migrate to the replacement resource, update your Pulumi program to use the new type, leaving the logical name the same, and fix any properties which don’t align, then your existing resource will automatically be migrated.
| Removed Resource | Replacement Resource |
|---|---|
core.TemplateDeployment | core.ResourceGroupTemplateDeployment |
portal.Dashboard | portal.PortalDashboard |
databricks.WorkspaceCustomerManagedKey | databricks.WorkspaceRootDbfsCustomerManagedKey |
datafactory.IntegrationRuntimeManaged | datafactory.IntegrationRuntimeSsis |
graph.Account | graph.ServicesAccount |
monitoring.ActionRuleActionGroup | monitoring.AlertProcessingRuleActionGroup |
monitoring.ActionRuleSuppression | monitoring.AlertProcessingRuleSuppression |
sql.Database | mssql.Database |
sql.ElasticPool | mssql.ElasticPool |
sql.FailoverGroup | mssql.FailoverGroup |
sql.FirewallRule | mssql.FirewallRule |
sql.ManagedDatabase | mssql.ManagedDatabase |
sql.ManagedInstanceActiveDirectoryAdministrator | mssql.ManagedInstanceActiveDirectoryAdministrator |
sql.ManagedInstanceFailoverGroup | mssql.ManagedInstanceFailoverGroup |
sql.ManagedInstance | mssql.ManagedInstance |
sql.SqlServer | mssql.Server |
sql.VirtualNetworkRule | mssql.VirtualNetworkRule |
Replaced Data Sources
| Removed Data Source | Replacement Data Source |
|---|---|
hybrid.getComputeMachine | arcmachine.get |
Retired Resources
These resource do not have a direct replacement and the old resource will need to be deleted or removed from state then recreated using alternative resources.
| Retired Resource | Notes |
|---|---|
appservice.Environment | This resource covered App Service Environment v1 and v2 which were retired on 2024-08-31. ASE v3 is current, and covered by appservice.EnvironmentV3. |
cdn.FrontdoorRouteDisableLinkToDefaultDomain | This resource is superseded by the linkToDefaultDomain property in the cdn.FrontdoorRoute resource. |
cosmosdb.NotebookWorkspace | CosmosDb Notebook Workspace is deprecated by Azure and only offers short-lived notebooks at this point. |
databoxedge.Order | The creation of DataBox Edge Orders is not supported by the Azure API. |
servicebus.NamespaceNetworkRuleSet | This resource is superseded by the networkRuleSet property in the servicebus.Namespace resource. |
sql.ActiveDirectoryAdministrator | This resource is superseded by the azureadAdministrator property in the mssql.Server resource. |
Retired Services
| Service | Resources | Notes |
|---|---|---|
iot | TimeSeriesInsightsAccessPolicyTimeSeriesInsightsEventSourceEventhubTimeSeriesInsightsEventSourceIothubTimeSeriesInsightsGen2EnvironmentTimeSeriesInsightsReferenceDataSetTimeSeriesInsightsStandardEnvironment | This Azure Service will be retired on 2025-03-31. |
lab | LabScheduleServicePlanUser | This Azure service is deprecated and on the road to retirement. |
monitoring | LogzMonitorLogzSubAccountLogzSubAccountTagRuleLogzTagRule | This Azure service is being retired. |
mariadb | ConfigurationDatabaseFirewallRuleServerVirtualNetworkRulegetMariaDbServer | This service is replaced by MySQL Flexible Server. |
media | AccountFilterAssetFilterAssetContentKeyPolicyJobLiveEventLiveEventOutputServiceAccountStreamingEndpointStreamingLocatorStreamingPolicyTransform | Azure Media Services was retired June 30th, 2024. |
mediaservices | Account | Azure Media Services was retired June 30th, 2024. |
mysql | ActiveDirectoryAdministratorConfigurationDatabaseFirewallRuleServerServerKeyVirtualNetworkRulegetServer | Azure Database for MySQL Single Server was retired on 2024-09-16 and users should migrate to Azure Database for MySQL Flexible Server. |
videoanalyzer | AnalyzerEdgeModule | This service was retired in June 2024. |
Resource Property Breaking Changes
About 150 resources saw changes to properties that might require a manual update. For the full list please see the upstream upgrade guide.
- 16 properties are no longer “Computed”. If you experience a diff as a result of this change you may need to use ignoreChanges.
- 31 properties had their default value updated.
- 4 resources have new properties that are required, so you’ll need to add them if you use these resources.
- 32 deprecated properties were removed (10 from KubernetesCluster).
- The other changes are properties that were renamed or replaced by a related property.
Other
Instances of the apimanagement.ApiTag resource will need to be recreated upon upgrading so that the tag revision can be included in the resource ID.