Azure and AWS Retirement Tracker: Deadlines

Overview

The Spotto Retirement Tracker brings together Azure and AWS lifecycle deadlines and the resources Spotto has mapped as affected. Select Azure subscriptions and AWS accounts to review retirements, support changes, expiring credentials and certificates, and financial commitments.

Short walkthrough of reviewing Azure retirement notices and affected resources in Spotto.

Track more than just service retirements

• Azure service retirements, including feature and SKU retirements
• Virtual Machine size and SKU end-of-life
• Application (Service Principal) credential expiry
• Operating System and SQL version expiry
• Reserved Instances and Savings Plans retirement details
• AWS Health retirement and end-of-support notices, including notices whose affected resources have not yet been matched
• AWS ACM and IAM server certificates, with renewal context
• Expiring AWS service-specific API keys and imported KMS key material
• Secrets Manager rotation deadlines and IAM console-password expiry, where the source provides a date

It’s designed to make “we should deal with that before it breaks” a normal weekly workflow, not an emergency calendar invite.

Feature overview

Retirement Tracker lists upcoming and passed lifecycle deadlines, with triage signals like risk, effort, and confidence when available. Entries link to matched resources in your Spotto inventory so you can plan migrations, upgrades and credential changes. A notice can remain actionable while its affected-resource association is unresolved; the detail view makes that gap explicit.

Where to find it: In the Spotto Portal sidebar, go to Tasks -> Monitor -> Retirement Tracker.

What “affected resources” means

Spotto associates retirement notices to resources using the available metadata. Validate the scope and deadline against the linked provider announcement. An unresolved match or an empty resource list does not prove that no resources are affected.

Why use this? (Jobs, pains, gains)

Jobs to be done

• When a cloud provider announces a retirement, I want to see what it affects in my environment, so I can plan remediation before the deadline.
• When I’m prioritising work, I want to rank retirements by urgency and effort, so the right teams pick up the right migrations first.
• When someone asks “are we on supported services?”, I want a single list I can export and share, so I don’t rebuild the same spreadsheet every month.

Common pains

• Retirement notices exist, but mapping them to your actual resources is time-consuming.
• Deadlines creep up, then suddenly it’s “why is this feature gone?” day.
• The person who sees the notice (FinOps/Security/Platform) isn’t always the person who owns the remediation work.
• Provider-native pages tell you what’s retiring, but not always what you should do next.

What you gain

• A view across selected Azure subscriptions and AWS accounts that ties retirements to affected resources.
• Quick prioritisation using retirement date status, risk, and effort.
• A detail view that includes rationale (risk/effort/confidence) plus a link to the official provider announcement.
• A CSV export for planning, change requests, and “please don’t schedule this migration during month-end close” conversations.

Turn retirement evidence into a decision

Select Business Value beside Notes and the subscription selector. The brief combines live retirement counts, deadline pressure, affected resources, and risk or effort signals with a continuity decision.

Use it to agree the retirement work that needs funding before provider support or deployment paths disappear:

• Start with passed and near-term deadlines, then validate the official provider notice and latest safe completion date.
• Confirm which affected resources support customer-facing or business-critical services; technical risk does not prove business criticality.
• Approve the migration path, service owner, budget, milestones, change window, rollback, and validation evidence.

Delaying the work can reduce migration options and compress procurement, testing, and change approval. If an affected resource underpins an important service, decommissioning, support loss, or automatic provider change can also contribute to outage, degradation, or emergency work.

The live facts stay deterministic. Generate creates a tailored draft from authorized customer context and saves it to the exact scope. Clear removes that saved narrative and immediately restores the standard Business Value content without deleting Customer Context or changing live facts. Review freshness warnings and validate deadlines and service importance before presenting a tailored draft. Above 100 subscriptions, the curated live brief remains available without tailoring.

Key capabilities

Select subscriptions and accounts to scope the view

Use the selector at the top of the page to choose Azure subscriptions or AWS accounts. If nothing is selected, the page shows an empty state until you pick at least one.

Triage at a glance

The summary cards show:

• Total retirements
• Upcoming retirements (next 30 days)
• Effort distribution (High / Medium / Low, when available)

In the table, retirement dates are displayed with a status (for example “Expired X days ago”, “Expires today”, or “N days left”) to make urgency obvious without mental math.

Retirement date status (how Spotto labels urgency)

• Expired: the retirement date has passed (shown as “Expired X days ago”).
• About to expire: due today, tomorrow, or within the next week (shown as “Expires today” / “N days left”).
• Near future: due within the next 30 days (still shown as “N days left”, and counted in “Upcoming (next 30 days)”).
• Later: due in months (shown as “N months away”; long-dated items may appear visually de-emphasised so the urgent ones don’t get buried).

Search, sort, and export

• Search across service name, retiring feature, date, effort, and affected resources.
• Sort by retirement date (default), risk, or effort.
• Export the current results to CSV (useful for backlog creation and reporting).

Drill into the details (and affected resources)

Click a row to open the detail view with:

• Retirement date, risk, effort (with hour estimates when available), and confidence
• Risk/effort/confidence rationale and key considerations
• A direct link to Microsoft’s retirement notice
• A list of affected resources that link to the corresponding Spotto resource detail pages

Workflow status and collaboration

Retirement Tracker supports the same triage workflow as recommendations:

• Active: Default status for items that still need review or action.
• Prioritized: Marked as high-priority work so it stays visible and easy to sort to the top.
• Dismissed: Hide items you’ve decided not to act on (for example, a Reserved Instance you won’t renew). Dismissals can be permanent or until a date. If a dismissal end date passes, the item automatically returns to Active and appears again. You can toggle “Show dismissed” to review these later.

Each retirement also supports:

• Comments to capture context and decisions.
• Pinned comment to highlight the most important note.
• History of actions (dismiss, restore, prioritize, unprioritize, pin/unpin, comment) with optional reasons.

Technical reference (what the Retirement Tracker uses)

Component	Details
Inputs	Retirement notices for each selected subscription, plus Spotto’s resource inventory. Additional signals include VM size and SKU lifecycle data, Service Principal credential metadata from Microsoft Graph Application.Read.All, OS and SQL version signals, and Reserved Instances/Savings Plans retirement data when the required provider-scope reader roles are granted.
Outputs	Summary cards, a searchable/sortable retirement table, a retirement detail view, and CSV export across service retirements, VM size/SKU end-of-life, credential expiry, OS/SQL expiry, and Reserved Instances/Savings Plans retirements.
Defaults	Sorts by retirement date. “Upcoming” means within the next 30 days. Duplicate retirement notices across subscriptions are de-duplicated and their affected resources are merged.

How it differs from Azure-native retirement views

Azure Service Health and Azure Updates are the source of truth for retirement announcements, but they’re not always optimized for answering the operational question: “what do we need to change in our environment?”

Spotto’s Retirement Tracker focuses on:

• Surfacing retirements in the same place you already triage resources and recommendations.
• Connecting retirement notices to affected resources in your inventory.
• Providing structured triage hints (risk/effort/confidence) alongside the official announcement link.

How it works (high level)

• You select one or more subscriptions.
• Spotto fetches the retirement notices for those subscriptions and shows them in a single combined list.
• Retirements that appear across multiple subscriptions are de-duplicated; affected resources are merged into the same entry.
• The detail view includes supporting fields (risk/effort/confidence and considerations) when they’re available.

Coverage and limitations

Collection coverage and freshness

The source-coverage panel distinguishes current, partial, stale, unavailable and unknown evidence for each selected subscription or account. Missing coverage is unknown. A failed collection can retain earlier evidence with stale freshness; an empty tracker table alone does not establish a successful scan.

AWS Health API collection depends on the account's support-plan entitlement. Delivered Health events can also contribute through a configured EventBridge integration. That stream is partial event evidence and does not establish a complete historical inventory. A failed API pull remains visible in coverage.

Coverage summaries group each source across regions. Expand a source to review regional results, collection times and lookahead windows. Coverage unknown means the available evidence cannot establish how much was checked; collection failed means a retrieval attempt failed. Stale evidence means the accepted snapshot exceeded the source's freshness policy at assessment time. These states remain visible even when other regions were collected successfully.

An EventBridge stream with no received evidence is shown as a supplemental source; successful AWS Health API collection remains independent. EC2 OS and RDS support coverage depends on both current inventory and resolved lifecycle metadata. An empty deadline list alone does not establish that all resources were assessed. IAM console-password deadline evidence uses a 24-hour report-age window aligned with the scan cadence, while governance applies its separate freshness policy.

Read the deadline meaning

• Expiry means the provider supplied a credential, certificate or key-material expiration date.
• Rotation due/overdue means a secret rotation deadline has arrived or passed; it does not prove that the credential has stopped working.
• End of support means the platform or version has reached its support deadline.
• Ordinary IAM access-key age remains governance evidence; it does not supply a hard expiry date.

ACM certificate rows focus on renewal work requiring attention. Imported certificates and renewal failures need review; normal managed renewal can keep a certificate out of the actionable list. Source coverage reports any configured lookahead window, so the tracker is not a complete list of every future deadline.

• OS expiry and SQL version end-of-life signals do not cover every scenario (for example, custom images or some SQL support paths). Treat these as early indicators, not a full compliance audit.
• Retirement Tracker maps several data sources. Validate scope and deadlines against the linked provider announcement when available.

Permissions and access

To see Application (Service Principal) credential expiry, Reserved Instances, and Savings Plans retirement details, Spotto needs more than subscription Reader access:

• Microsoft Graph Application.Read.All with admin consent to read applications and service principals for credential expiry posture.
• Reservations Reader at /providers/Microsoft.Capacity for Reserved Instances retirement details.
• Savings plan Reader at /providers/Microsoft.BillingBenefits for Savings Plans retirement details.

Without those permissions, those sections will be absent or incomplete even if the cloud account validates successfully.

AWS lifecycle collection needs access to the corresponding IAM, ACM, KMS, Secrets Manager and commitment metadata APIs in each selected account and Region. Spotto collects lifecycle metadata without reading secret values. Review the source-coverage panel after a scan to identify permission or collection gaps. AWS Health EventBridge forwarding must be configured separately; delivery of an event does not establish complete collection.

Troubleshooting

The page is empty / I don’t see any retirements

What you’re seeing: No rows, or an empty state prompt. Likely causes:

• No subscriptions selected.
• The subscriptions aren’t fully synced/ready yet. How to fix:

1. Select at least one subscription in the subscription picker.
2. If the subscription is still onboarding, wait for ingestion to complete and refresh.

“No service retirements match your current filters.”

What you’re seeing: The table shows the message No service retirements match your current filters. Likely causes:

• Your search term is too specific (or you’re filtering by a field that isn’t present for every retirement).
• You’ve selected subscriptions that currently have no matching retirement entries. How to fix:

1. Clear the search box and try again.
2. Select additional subscriptions (or use “Select all”) to broaden the scope.

Risk/Effort/Confidence shows “-” or looks incomplete

What you’re seeing: Some retirements have missing triage fields. Likely causes: Not every retirement notice has enough context to populate every field, or enrichment hasn’t run yet. How to fix: Use the Microsoft “Learn more” link in the detail view for the authoritative guidance, and treat missing fields as “unknown”, not “safe”.

Application credentials, Reserved Instances, or Savings Plans don’t show up

What you’re seeing: Those categories are missing from the table or detail view. Likely causes:

• Microsoft Graph Application.Read.All is missing or admin consent was not granted.
• Reservations Reader is missing at /providers/Microsoft.Capacity.
• Savings plan Reader is missing at /providers/Microsoft.BillingBenefits.
• Access was granted only at the subscription level. How to fix:

1. Grant Microsoft Graph Application.Read.All to the Spotto app registration and apply admin consent.
2. Grant Reservations Reader from the Reservations blade.
3. Grant Savings plan Reader from the Savings plans blade.
4. Refresh the page after ingestion completes.

Resource links don’t open in a new tab

What you’re seeing: Clicking an affected resource doesn’t open the resource page. Likely causes: Browser pop-up blocking. How to fix: Allow pop-ups for the Spotto portal, or copy the resource link and open it manually.

Optimize Your Azure Environment

Looking to enhance your cloud setup for cost efficiency, performance, reliability, or security?

Talk to a cloud specialist. Email us or schedule a 30-minute consultation and let's optimize your cloud environment together.

Book a Free Consultation