Cloudflare Sets a September 14 Deadline for Its Legacy Microsoft Sentinel Connector

Cloudflare announced on August 26, 2026 that Enterprise customers using its Azure Functions-based Microsoft Sentinel connector must migrate to the Cloudflare for Microsoft Sentinel Codeless Connector Framework connector by September 14, 2026. The reason is upstream: Microsoft is ending support for the legacy Azure Monitor HTTP Data Collector API on the same date. Cloudflare says it will no longer maintain the Azure Functions-based connector after that deadline.

For proxy operations, ad verification, market research and authorized data-collection teams, this is not merely a connector replacement. Edge and proxy investigations rely on a continuous chain of evidence: client attempt, proxy session, exit behavior, edge request, security decision and application outcome. A migration that silently drops fields, shifts timestamps or changes parsing can make a healthy route look broken—or hide a real failure.

What is changing—and what is not

The old path uses an Azure Functions-based connector built around the legacy Data Collector API. The replacement uses Microsoft's Codeless Connector Framework. The transport and ingestion architecture changes, but the operational question remains the same: can an analyst reconstruct one authorized request from the client through the proxy and edge controls to its final outcome?

Do not define success as “the connector is connected.” Define it as evidence continuity across four dimensions:

• Coverage: all required Cloudflare datasets still arrive;
• Shape: fields, types and table mappings remain usable;
• Time: event timestamps and ingestion timestamps are interpreted correctly;
• Correlation: request identifiers and approved proxy session references still join across systems.

Why proxy teams should care

Proxy troubleshooting is especially vulnerable to incomplete logs. A 403 may come from an application policy, an edge rule, account state or route characteristics. A timeout may occur before the request reaches the edge. Without intact timestamps and correlation keys, investigators may blame the exit IP simply because it is the only visible variable.

The migration should therefore preserve three evidence layers:

1. Client and proxy layer: test ID, proxy session reference, gateway result, address family, DNS mode, exit region and measured timings.
2. Edge layer: request or ray identifier, host, method, response status, security action and edge timestamp.
3. Application layer: approved workflow step, sanitized outcome and application-side correlation identifier.

Keep these layers separate in storage. Join them during analysis using pseudonymous identifiers and narrow time windows. Never put proxy credentials, cookies, authorization headers or one-time codes into SIEM records.

A safe migration sequence

1. Inventory the current contract

Before changing anything, export a configuration inventory—not production secrets. Record connector name, enabled datasets, destination tables, transformation rules, retention policy, alert dependencies, dashboards, service ownership and the expected event rate by dataset.

Capture a small set of sanitized reference events. Include at least one successful authorized request, one edge rejection and one client-side failure that never reached the edge. These become your validation fixtures.

2. Map fields before mapping dashboards

Create a field contract for every event family used in proxy investigations. Mark each field as required, optional or intentionally removed. Pay special attention to:

• event time versus ingestion time;
• numeric values that may arrive as strings;
• nested objects and arrays;
• null and missing-field behavior;
• request identifiers, hostnames and response codes;
• country, ASN and address-family fields;
• any transformation that hashes or truncates an identifier.

Dashboards can be rebuilt. Missing raw evidence cannot.

3. Run old and new paths in parallel

Where licensing, capacity and platform rules allow, operate a short dual-run. Send the same approved dataset through both connectors long enough to cover normal volume, quiet periods and at least one controlled test window. Avoid generating artificial traffic merely to inflate counts.

Compare event totals in fixed windows, then compare by dataset, host and outcome. A matching grand total can conceal a missing low-volume security dataset.

4. Validate content, not just volume

For each fixture, answer these questions:

• Did the event arrive in the expected table?
• Is the original event timestamp preserved?
• Are request identifiers unchanged and searchable?
• Do status and action fields retain their meaning?
• Are country and ASN values present when expected?
• Can the analyst join the edge event to the approved proxy test record?
• Are duplicate events introduced during retries or dual delivery?

Record every difference as expected, acceptable with remediation, or blocking.

5. Rehearse failure and rollback

Test what happens when the destination throttles, credentials expire, storage is unavailable or a transformation rejects a record. Confirm that health monitoring exposes drops, retries and delays. Set a rollback decision time before the deadline; do not wait for the legacy API's final day to discover an unrecoverable mapping problem.

6. Cut over with a bounded observation window

Freeze unrelated parsing changes, switch primary ingestion, and monitor dataset-level freshness and counts. Keep the legacy path only for the pre-approved overlap period. Once validation passes, retire old functions, credentials and alert routes through the organization's change process.

Acceptance criteria for the new connector

Use a percentage comparison and an absolute count. A 100% increase from one event to two may be harmless; a 1% drop in a high-volume request dataset may be material.

Cutover checklist

• Connector owners and incident contacts are named.
• Current datasets, tables, transformations and alerts are inventoried.
• A required-field contract exists for proxy and edge investigations.
• Sanitized success, rejection and pre-edge failure fixtures are saved.
• Old and new connectors have completed an approved dual-run.
• Counts are compared per dataset and fixed time window.
• Timestamps, identifiers, status fields and data types are verified.
• Duplicate and late-arriving event behavior is understood.
• Destination throttling and retry visibility have been tested.
• Privacy, access control and retention settings are reviewed.
• Rollback criteria and the final legacy shutdown time are documented.
• Old functions and credentials are retired only after acceptance passes.

For related operational checks, use 98IP's guides to trace proxy failures across layers, test residential proxy session stickiness, and detect proxy route leaks.

FAQ

Is a successful connector health status enough?

No. It proves a connection state, not dataset completeness, field semantics or cross-system correlation. Validate representative events end to end.

Should we migrate on September 14?

No. September 14 is the support deadline. Complete dual-run validation and cutover before it, leaving time for rollback and remediation.

Can we compare only total event volume?

No. Compare by dataset, time window, host and outcome. Low-volume security or error events are often the most important evidence.

Does this migration require changing proxy behavior?

Normally no. The connector migration concerns log delivery. Keep proxy routing, retry policy and client configuration stable during validation so connector differences are easier to isolate.

Compliance note

Collect and correlate logs only for systems, accounts and workflows you own or are explicitly authorized to operate. Minimize personal data, restrict raw-event access, apply documented retention, and never export credentials, cookies, session tokens or message bodies unless a lawful, approved requirement explicitly demands them. Do not use proxies to bypass access controls or evade security decisions.

Source note: Cloudflare, “Azure Functions-based Microsoft Sentinel connector deprecation,” published August 26, 2026; Microsoft, “Send log data to Azure Monitor by using the HTTP Data Collector API (deprecated),” support deadline September 14, 2026. Source URLs are retained only in 98IP's internal operations record under the website's zero-external-link policy.