The Azure DevOps Server July 2026 patch wasn’t a sleepy “install whenever” update. On July 21, Microsoft shipped patches for the current Azure DevOps Server release and Azure DevOps Server 2022 Update 2, and the same month warned on-premises teams that Git/libcurl’s planned September 2026 removal of NTLM could break HTTPS Git operations wherever Kerberos isn’t working end to end.
In short: patch the server, then prove your authentication works. If you haven’t done both yet, do them now, and check the release notes for anything newer than the July patches.
Patch
July 21 fixes
Patch 6 for Azure DevOps Server, or Patch 11 for Azure DevOps Server 2022.2, after backup and maintenance-window checks.
Identity
AD trust validation
The current server patch only connects to trusted Active Directory domains when resolving identities.
Authentication
NTLM leaves Git/libcurl
Microsoft warned that HTTPS Git operations relying on NTLM stop working once Git/libcurl drops NTLM support.
What the Azure DevOps Server July 2026 patch changed
Microsoft’s July 21 announcement covered two patch lines:
Both began retiring legacy TFVC check-in policies. Saving them is disabled by default, while existing policy data stays readable. Admins can temporarily re-enable saving per project, but Microsoft said later patches would continue the phased retirement, so treat this as the early warning.
The current-release patch also added validation so the server only connects to trusted Active Directory domains when resolving identities. Patch 11 for 2022 Update 2 included the TFVC change plus a fix for Pie and Area charts showing totals that didn’t match the underlying work item query after certain parent-child changes.
Admin takeaway: treat this as both patch hygiene and process discovery. The patch is small; the legacy dependency behind it may not be.
Why NTLM makes this urgent
Microsoft warned that NTLM support was being removed from libcurl, which Git uses for HTTP(S), with September 2026 as the planned date. Azure DevOps Server customers relying on NTLM can lose HTTPS Git access once their clients pick up that change.
The catch: an environment can look like it uses Kerberos because IIS is set to Negotiate, while SPNEGO silently falls back to NTLM when Kerberos isn’t fully configured. “It works today” doesn’t prove Kerberos is healthy; NTLM may be quietly holding things up.
Azure DevOps Server July 2026 patch checklist
- Identify your line: current Azure DevOps Server or 2022 Update 2.
- Read the exact release note and match the patch and hash before installing.
- Back up first: SQL and Azure DevOps Server backups, configuration database recoverability and rollback expectations. See the Azure DevOps Server backup runbook.
- Install in a maintenance window covering application tiers, job agents and reporting dependencies, with notice to build and release teams.
- Verify the install by running
<patch-installer>.exe CheckInstallon the server with the installer you downloaded. - Inventory TFVC check-in policies still being saved, and plan a migration path.
- Test Git authentication from developer machines, build agents, service accounts, VPN and non-corporate paths, and automation runners.
How to spot NTLM dependency
A successful Git operation doesn’t show which protocol it used, so check deliberately:
- Look for NTLM warnings from Git for Windows or Git Credential Manager.
- Check Kerberos tickets after a Git operation; a service ticket such as
HTTP/tfs.contoso.commeans Kerberos was used for that endpoint. - Inspect Git HTTP traces in a safe test; NTLM and Kerberos Negotiate tokens look different, as Microsoft’s post shows.
- Test build agents separately, since service accounts and network contexts differ from an admin workstation.
Common Kerberos fixes involve SPNs, DNS aliases, delegation, load balancer configuration and client reachability to domain controllers. Where Kerberos isn’t feasible, Microsoft suggests evaluating SSH for Git if it’s supported and enabled in your deployment. Test that with real repositories, agents and users before relying on it.
Who should care
| Team | Why it matters | First action |
|---|---|---|
| Azure DevOps Server admins | Patch installation, identity validation, TFVC policy retirement. | Schedule the patch and verify with CheckInstall. |
| Security teams | NTLM retirement and trusted-domain validation reduce legacy auth risk. | Confirm Kerberos and document exceptions. |
| Build and release teams | Agents may fail Git fetch or clone if they depend on NTLM. | Test representative pipeline agents. |
| TFVC-heavy projects | Legacy check-in policy saving is disabled by default and being retired. | Inventory policy usage and alternatives. |
Install the right patch, verify it, inventory TFVC policy dependencies and prove Kerberos works. For Azure DevOps Services, where Entra ID replaces NTLM entirely, see Azure DevOps service connection.
Last reviewed: October 2026
Sources
- July Patches for Azure DevOps Server (Microsoft DevBlogs)
- Azure DevOps Server Patch 6 release notes (Microsoft Learn)
- Azure DevOps Server 2022 Update 2 Patch 11 release notes (Microsoft Learn)
- NTLM removal in Git/libcurl: impact to Azure DevOps Server customers (Microsoft DevBlogs)
- Azure DevOps Server downloads (Microsoft Learn)
Discover more from Cloud Osprey
Subscribe to get the latest posts sent to your email.
