## Migrate to Self-Deployed Runtime

URL: https://docs.atlan.com/secure-agent/concepts/understand-migrating-to-sdr

> Overview of migrating from Atlan Secure Agent to Self-Deployed Runtime before the June 2026 deprecation deadline.

:::danger **Deprecated**
Secure Agent was deprecated on **June 30, 2026** and is no longer supported or maintained, including bug fixes. Migrate to [Self-Deployed Runtime](https://docs.atlan.com/llms/platform/self-deployed-runtime/llms.txt) to maintain uninterrupted metadata extraction. Existing workflows may break/be disabled without warning.
:::

Self-Deployed Runtime (SDR) is the successor to Secure Agent. It provides the same core capability—secure metadata extraction from your infrastructure—with significant improvements in security, performance, and operational flexibility.

## Why migrate to SDR

- Run new connectors built on the Atlan Application SDK

- Access the latest connector functionality and updates as they ship

- Future connector development is exclusively on the Application SDK

- All application logic is baked into the container image—no more split between Argo templates and app code

- Each connector is a self-contained, independently versioned image

- Easier rollback, testing, and version pinning per connector

- Popular container runtimes - Docker, Podman

- Managed Kubernetes Cloud Clusters - EKS, AKS, GKE

- RedHat OpenShift

- Automated app lifecycle management (Orchestrator mode)

- Centralized monitoring from Atlan UI

For a detailed architecture, security, and deployment comparison, see [Secure Agent vs SDR](https://docs.atlan.com/llms/platform/secure-agent/secure-agent-vs-sdr/llms.txt).

## What carries over and what changes

Most of your existing setup transfers directly. The migration work is concentrated in deployment infrastructure and authentication—not in reconfiguring your data sources or workflows.

**Carries over unchanged:**

- Firewall rules to your source systems (outbound rules to databases, warehouses, and other sources don't change)
- Object storage bucket or container (same bucket, just different config key names in SDR)
- Secret store references (vault paths and key names stay the same)
- Source system credentials (credentials remain in your secret store, SDR retrieves them the same way)

**What changes:**

- **Authentication**: shared API key replaced by per-app OAuth credentials with 15-minute short-lived JWTs that refresh automatically
- **One new firewall rule**: outbound gRPC/TLS to `<tenant>-temporal.atlan.com:443` (in addition to the existing HTTPS rule)
- **Config key names**: setting names change in the new `.env` and `config.yaml`. See [Configuration mapping](https://docs.atlan.com/llms/platform/secure-agent/secure-agent-config-mapping/llms.txt)

## Get started

---