---
slug: "azure-container-registry-docker-content-trust-retirement"
title: "Azure Container Registry: Docker Content Trust retirement"
summary: "Retirement date for Docker Content Trust in Azure Container Registry: 31 Mar 2028. On that date the function is removed and the data stored for signing and verifying signatures with it is permanently deleted."
cloud: "azure"
service: "Azure Container Registry"
service_slug: "container-registry"
category: "feature"
type: "retirement"
announced_date: "2025-03-26"
effective_date: "2028-03-31"
effective_precision: "day"
replacement: "Notary Project (Notation) with Azure Key Vault"
affected_versions: []
source_url: "https://azure.microsoft.com/updates?id=485241"
extra_source_urls: ["https://learn.microsoft.com/en-us/azure/container-registry/container-registry-tutorial-sign-build-push#create-a-self-signed-certificate-azure-cli","https://learn.microsoft.com/en-us/azure/container-registry/container-registry-tutorial-sign-trusted-ca","https://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/notation-ado-task-sign","https://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/notation-sign-gha","https://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/verify-gha","https://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/validating-image-signatures-using-ratify-aks"]
vendor_ref: "485241"
last_checked_at: "2026-11-12T09:55:19.345Z"
created_at: "2026-11-13T13:36:44.208Z"
updated_at: "2026-11-13T13:36:44.208Z"
url: "https://eolwatch.dev/items/azure-container-registry-docker-content-trust-retirement"
short_url: "https://eolwatch.dev/i/9e"
markdown_url: "https://eolwatch.dev/items/azure-container-registry-docker-content-trust-retirement.md"
json_url: "https://eolwatch.dev/items/azure-container-registry-docker-content-trust-retirement.json"
source_note: null
---

# Azure Container Registry: Docker Content Trust retirement

Retirement date for Docker Content Trust in Azure Container Registry: 31 Mar 2028. On that date the function is removed and the data stored for signing and verifying signatures with it is permanently deleted.

- Effective date: 31 Mar 2028
- Cloud: [Azure](https://eolwatch.dev/cloud/azure.md)
- Service: [Azure Container Registry](https://eolwatch.dev/services/azure/container-registry.md)
- Type: Retirement
- Category: [Feature](https://eolwatch.dev/categories/features.md)
- Replacement: Notary Project (Notation) with Azure Key Vault
- Announced: 26 Mar 2025
- Official source: [azure.microsoft.com](https://azure.microsoft.com/updates?id=485241)
- Last checked: 12 Nov 2026

## What breaks

Docker Content Trust is completely removed from Azure Container Registry on 31 Mar 2028. Data stored in the registry for signing and verifying signatures with Docker Content Trust is permanently deleted on the same date. Since September 30, 2025, customers have not been able to enable Docker Content Trust on Azure Container Registry. Registries that currently use Docker Content Trust to sign images or verify signatures are affected.

## What to do

1. Move from Docker Content Trust to the [Notary Project](https://notaryproject.dev/) ecosystem, including its open-source tool [Notation](https://github.com/notaryproject/notation).
2. For signing, use Azure Key Vault with [self-signed certificates](https://learn.microsoft.com/en-us/azure/container-registry/container-registry-tutorial-sign-build-push#create-a-self-signed-certificate-azure-cli) or [CA-issued certificates](https://learn.microsoft.com/en-us/azure/container-registry/container-registry-tutorial-sign-trusted-ca).
3. To sign in pipelines, see [Sign in ADO pipelines](https://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/notation-ado-task-sign) and [Sign in GitHub workflows](https://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/notation-sign-gha).
4. For verification, see [Verify in ADO pipelines](https://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/notation-ado-task-sign), [Verify in GitHub workflows](https://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/verify-gha) and [Verify on AKS](https://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/validating-image-signatures-using-ratify-aks).

## Replacement

Notary Project (Notation) with Azure Key Vault

## Sources

- [Official source](https://azure.microsoft.com/updates?id=485241) (azure.microsoft.com, Official)
- [Additional source](https://learn.microsoft.com/en-us/azure/container-registry/container-registry-tutorial-sign-build-push#create-a-self-signed-certificate-azure-cli) (learn.microsoft.com, Official)
- [Additional source](https://learn.microsoft.com/en-us/azure/container-registry/container-registry-tutorial-sign-trusted-ca) (learn.microsoft.com, Official)
- [Additional source](https://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/notation-ado-task-sign) (learn.microsoft.com, Official)
- [Additional source](https://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/notation-sign-gha) (learn.microsoft.com, Official)
- [Additional source](https://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/verify-gha) (learn.microsoft.com, Official)
- [Additional source](https://learn.microsoft.com/en-us/azure/security/container-secure-supply-chain/articles/validating-image-signatures-using-ratify-aks) (learn.microsoft.com, Official)

Last checked against the first source in this list on 12 Nov 2026.

Page: https://eolwatch.dev/items/azure-container-registry-docker-content-trust-retirement | JSON: https://eolwatch.dev/items/azure-container-registry-docker-content-trust-retirement.json

The text on this page is drafted with AI assistance from the vendor's text, checked against the official source and approved by a person before it is published.