An Azure service for ingesting, preparing, and transforming data at scale.
We completed the investigation regarding the unexpected Self-Hosted Integration Runtime (ILIM-SHIR) upgrade that occurred on April 27, 2026 and impacted the overnight batch jobs.
Findings
During our troubleshooting session, we reviewed the Azure Activity Logs for the Data Factory and identified multiple "Create or Update Integration Runtime" operations that occurred around the same timeframe as the SHIR upgrade.
The Activity Logs provided visibility into:
- The exact time when the Integration Runtime configuration was updated.
- The identity that initiated the update operation.
- The correlation between the configuration update and the subsequent SHIR upgrade event.
Based on the evidence available in the Activity Logs, the SHIR upgrade was triggered as part of an Integration Runtime update operation.
Guidance
- Validated the relevant Activity Log entries and correlated them with the incident timeline.
- Reviewed how to identify the initiating identity responsible for Integration Runtime update operations.
- Discussed how Activity Logs can be used for future monitoring, auditing, and change tracking of Integration Runtime configuration changes.
As Azure Activity Logs retain the audit trail for management operations, they are the recommended source for determining when configuration changes occurred and which identity initiated them.
Please let us know if you have any additional questions or require further assistance.