diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4f15b44925..7868a893a0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,101 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 
 > **Note:** Releases are sorted in reverse chronological order (newest first).
 
+## [Preview Release 7.1.0-preview3] - 2026-08-26
+
+This update brings the following changes since the [7.1.0-preview2](release-notes/7.1/7.1.0-preview2.md) release.
+See the [full release notes](release-notes/7.1/7.1.0-preview3.md) for detailed descriptions.
+
+> **Important — package version alignment:** Starting with the [7.0.2](release-notes/7.0/7.0.2.md) release, the `Microsoft.Data.SqlClient` driver and its companion packages share a single aligned version. Preview 3 of the `7.1` line continues this alignment; the following packages now ship together as `7.1.0-preview3`:
+>
+> - `Microsoft.Data.SqlClient`
+> - `Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider`
+> - `Microsoft.Data.SqlClient.Extensions.Azure`
+> - `Microsoft.Data.SqlClient.Extensions.Abstractions`
+> - `Microsoft.Data.SqlClient.Internal.Logging`
+>
+> (`Microsoft.SqlServer.Server` continues to version independently and remains at `1.0.0`.)
+>
+> Applications that reference `Microsoft.Data.SqlClient.Extensions.Azure` must upgrade it to `7.1.0-preview3` when upgrading `Microsoft.Data.SqlClient` to `7.1.0-preview3`.
+>
+> **Compatibility guarantee:** All aligned assemblies ship with `FileVersion 7.1.0.x` and `AssemblyVersion 7.0.0.0`. The `AssemblyVersion` is unchanged from [7.0.2](release-notes/7.0/7.0.2.md), so upgrading from `7.0.2` to `7.1.0-preview3` does **not** require any new .NET Framework strong-name binding redirects.
+
+### Added
+
+- Added four `virtual` asynchronous counterparts to the synchronous methods on `SqlColumnEncryptionKeyStoreProvider` — `DecryptColumnEncryptionKeyAsync`, `EncryptColumnEncryptionKeyAsync`, `SignColumnMasterKeyMetadataAsync`, and `VerifyColumnMasterKeyMetadataAsync` — each accepting an optional `CancellationToken`. The default implementations delegate to the existing synchronous methods, so existing custom providers are unaffected.
+  ([#3673](https://github.com/dotnet/SqlClient/pull/3673))
+
+- Implemented those four asynchronous APIs in `SqlColumnEncryptionAzureKeyVaultProvider`, calling the Azure SDK's own asynchronous methods and flowing the supplied `CancellationToken`. Concurrent cache misses for the same key are gated so a burst of callers issues a single Key Vault request. See the [AKV release notes](release-notes/add-ons/AzureKeyVaultProvider/7.1/7.1.0-preview3.md) for the `VerifyColumnMasterKeyMetadata` signature-validation behavior change and the 7.1 runtime requirement.
+  ([#4540](https://github.com/dotnet/SqlClient/pull/4540))
+
+- Substantially expanded `ChannelDbConnectionPool` (the opt-in pool behind `Switch.Microsoft.Data.SqlClient.UseConnectionPoolV2`) toward parity with the default pool: transaction support, broken-connection replacement, leaked-connection reclamation, background warmup and replenishment to `Min Pool Size`, idle pruning driven by `Connection Idle Timeout`, optional connection-creation rate limiting, and metrics/tracing parity. Default pooling behavior is unchanged.
+  ([#4395](https://github.com/dotnet/SqlClient/pull/4395),
+   [#4396](https://github.com/dotnet/SqlClient/pull/4396),
+   [#4429](https://github.com/dotnet/SqlClient/pull/4429),
+   [#4452](https://github.com/dotnet/SqlClient/pull/4452),
+   [#4463](https://github.com/dotnet/SqlClient/pull/4463),
+   [#4487](https://github.com/dotnet/SqlClient/pull/4487),
+   [#4504](https://github.com/dotnet/SqlClient/pull/4504),
+   [#4529](https://github.com/dotnet/SqlClient/pull/4529))
+
+### Changed
+
+- The driver now builds a single cross-platform assembly. Package structure and contents are unchanged, and Windows-only native SNI types now trim cleanly on Linux and macOS.
+  ([#4207](https://github.com/dotnet/SqlClient/pull/4207),
+   [#4465](https://github.com/dotnet/SqlClient/pull/4465),
+   [#4474](https://github.com/dotnet/SqlClient/pull/4474))
+
+- Reduced managed allocations in the async read path by restoring reuse of `PacketData` nodes via a bounded free list on `StateSnapshot`. This applies to the default async read path and is not gated behind any AppContext switch.
+  ([#4536](https://github.com/dotnet/SqlClient/pull/4536))
+
+- Operations no longer allocate a formatted trace string when `SqlClientEventSource` tracing is disabled, recovering a memory regression against the 6.1.6 baseline. Trace output with tracing enabled is unchanged.
+  ([#4528](https://github.com/dotnet/SqlClient/pull/4528))
+
+- Updated centrally managed dependency versions for the `net9.0` target framework to `9.0.18`, and added `System.Threading.RateLimiting` to the packaged dependency metadata. Non-`net9.0` targets keep their existing `8.0.x` pins.
+  ([#4507](https://github.com/dotnet/SqlClient/pull/4507))
+
+- Updated the `Microsoft.Data.SqlClient.SNI` and `Microsoft.Data.SqlClient.SNI.runtime` dependencies to `7.1.0-preview3.26226.3`.
+  ([#4564](https://github.com/dotnet/SqlClient/pull/4564))
+
+- Bypassed SQL Graph column alias mapping in `SqlBulkCopy` when neither the source nor destination table contains graph pseudo-columns, recovering a bulk copy performance regression. Graph table bulk copy behavior is unchanged.
+  ([#4535](https://github.com/dotnet/SqlClient/pull/4535))
+
+- Re-shipped `Microsoft.Data.SqlClient.Extensions.Azure` as `7.1.0-preview3`, fixing Entra ID tenant parsing for multi-segment authorities. See [release notes](release-notes/Extensions/Azure/7.1/7.1.0-preview3.md).
+
+- Re-shipped `Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider` as `7.1.0-preview3` with new asynchronous key store provider APIs, and `Microsoft.Data.SqlClient.Extensions.Abstractions` and `Microsoft.Data.SqlClient.Internal.Logging` as `7.1.0-preview3` (version alignment only, no functional changes). See release notes for [AKV](release-notes/add-ons/AzureKeyVaultProvider/7.1/7.1.0-preview3.md), [Abstractions](release-notes/Extensions/Abstractions/7.1/7.1.0-preview3.md), and [Logging](release-notes/Internal/Logging/7.1/7.1.0-preview3.md).
+
+### Fixed
+
+- Fixed Always Encrypted VSM/HGS enclave attestation not verifying that the enclave public key used to establish the session matches the key committed to by the signed attestation report.
+  ([#4532](https://github.com/dotnet/SqlClient/pull/4532))
+
+- Fixed a `SqlConnectionFactory` timer that woke the process every 30 seconds for the lifetime of the application even when no connection pools existed, including with `Pooling=False` and after `ClearAllPools()`.
+  ([#4479](https://github.com/dotnet/SqlClient/pull/4479))
+
+- Fixed connection pool performance counter defects affecting the default pool as well as pool V2. `active-soft-connects` and `number-of-active-connections` could go negative after a failed connection activation, and several gauges drifted upward permanently after a broken connection was replaced.
+  ([#4504](https://github.com/dotnet/SqlClient/pull/4504))
+
+- Fixed `OverflowException` when sending large `decimal` values as a parameter with explicit `Precision` and `Scale`, which primarily affected Always Encrypted scenarios.
+  ([#4443](https://github.com/dotnet/SqlClient/pull/4443))
+
+- Fixed a TDS stream error when passing a `DateOnly` value as a parameter with `SqlDbType.Variant`.
+  ([#4294](https://github.com/dotnet/SqlClient/pull/4294))
+
+- Fixed `DateOnly` values written to a `sql_variant` column of a table-valued parameter being sent as `datetime` instead of `date`, which also caused an overflow for values out of `datetime` range.
+  ([#4439](https://github.com/dotnet/SqlClient/pull/4439))
+
+- Fixed the `ServerCertificate` connection-string keyword not being honored when the platform reported no TLS policy errors, and made an unloadable certificate file fail closed instead of silently falling back to host-name validation.
+  ([#4445](https://github.com/dotnet/SqlClient/pull/4445))
+
+- Fixed `SqlConnection.AccessTokenCallback` not disabling Transparent Network IP Resolution by default, unlike `SqlConnection.AccessToken`, along with a related connection pool key defect.
+  ([#4520](https://github.com/dotnet/SqlClient/pull/4520))
+
+- Fixed several async entry points in `SqlBulkCopy`, `SqlDataReader`, and `SqlCommand` that captured fatal exceptions such as `OutOfMemoryException` into faulted `Task`s instead of letting them propagate.
+  ([#4437](https://github.com/dotnet/SqlClient/pull/4437))
+
+- Fixed `Authentication=Active Directory Service Principal` (and the other Entra ID flows) failing against endpoints that return a multi-segment authority such as the Dataverse / Dynamics 365 TDS endpoint; the tenant id is now taken from the first path segment of the STSURL authority instead of the last. Ships in `Microsoft.Data.SqlClient.Extensions.Azure`.
+  ([#4521](https://github.com/dotnet/SqlClient/pull/4521))
+
 ## [Preview Release 7.1.0-preview2] - 2026-07-09
 
 This update brings the following changes since the [7.1.0-preview1](release-notes/7.1/7.1.0-preview1.md) release.
diff --git a/release-notes/7.1/7.1.0-preview3.md b/release-notes/7.1/7.1.0-preview3.md
new file mode 100644
index 0000000000..5ce782c7a7
--- /dev/null
+++ b/release-notes/7.1/7.1.0-preview3.md
@@ -0,0 +1,160 @@
+# Release Notes
+
+## Preview Release 7.1.0-preview3 - 2026-08-26
+
+This update brings the following changes since the [7.1.0-preview2](7.1.0-preview2.md) release:
+
+> **Important — package version alignment:** Starting with the [7.0.2](../7.0/7.0.2.md) release, the `Microsoft.Data.SqlClient` driver and its companion packages share a single aligned version. Preview 3 of the `7.1` line continues this alignment; the following packages ship together as `7.1.0-preview3`:
+>
+> - `Microsoft.Data.SqlClient`
+> - `Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider`
+> - `Microsoft.Data.SqlClient.Extensions.Azure`
+> - `Microsoft.Data.SqlClient.Extensions.Abstractions`
+> - `Microsoft.Data.SqlClient.Internal.Logging`
+>
+> (`Microsoft.SqlServer.Server` continues to version independently and remains at `1.0.0`.)
+>
+> Applications must reference the same versions of `Microsoft.Data.SqlClient` and its extensions for best compatibility. In particular, applications that reference `Microsoft.Data.SqlClient.Extensions.Azure` must upgrade it to `7.1.0-preview3` when upgrading `Microsoft.Data.SqlClient` to `7.1.0-preview3`.
+>
+> **Compatibility guarantee:** All aligned assemblies ship with `FileVersion 7.1.0.x` and `AssemblyVersion 7.0.0.0`. The `AssemblyVersion` is unchanged from [7.0.2](../7.0/7.0.2.md), so upgrading from `7.0.2` to `7.1.0-preview3` does **not** require any new .NET Framework strong-name binding redirects.
+
+### Added
+
+#### Asynchronous Key Store Provider APIs for Always Encrypted
+
+*What Changed:*
+
+- Added four `virtual` asynchronous counterparts to the existing synchronous methods on the `SqlColumnEncryptionKeyStoreProvider` abstract base class: `DecryptColumnEncryptionKeyAsync`, `EncryptColumnEncryptionKeyAsync`, `SignColumnMasterKeyMetadataAsync`, and `VerifyColumnMasterKeyMetadataAsync`. Each takes an optional `CancellationToken`. The default implementations delegate to the existing synchronous methods, so providers that do not override them continue to work unchanged.
+  ([#3672](https://github.com/dotnet/SqlClient/issues/3672), [#3673](https://github.com/dotnet/SqlClient/pull/3673))
+
+*Who Benefits:*
+
+- Authors of custom column encryption key store providers — particularly those backed by network-bound key stores such as HSMs or cloud key vaults — can now implement genuinely asynchronous key operations instead of blocking a thread on synchronous I/O during query execution.
+
+*Impact:*
+
+- Purely additive. Because the new methods are `virtual` with a synchronous fallback, existing providers compile and run without modification.
+- The in-box `SqlColumnEncryptionAzureKeyVaultProvider` overrides all four methods in this release. See the [AzureKeyVaultProvider 7.1.0-preview3](../add-ons/AzureKeyVaultProvider/7.1/7.1.0-preview3.md) release notes. ([#4540](https://github.com/dotnet/SqlClient/pull/4540))
+
+#### Connection Pool V2 Feature Completeness
+
+*What Changed:*
+
+- Substantially expanded `ChannelDbConnectionPool`, the opt-in pool implementation gated behind the `Switch.Microsoft.Data.SqlClient.UseConnectionPoolV2` AppContext switch, bringing it closer to parity with the default `WaitHandleDbConnectionPool`:
+  - **Transaction support** — implemented `PutObjectFromTransactedPool` and `TransactionEnded` (previously `NotImplementedException`), and reworked connection return to mirror the reference pool's deactivate-then-route behavior. ([#4487](https://github.com/dotnet/SqlClient/pull/4487))
+  - **Connection replacement** — implemented replacement of broken connections during command execution, with atomic slot replacement in `ConnectionPoolSlots`. ([#4429](https://github.com/dotnet/SqlClient/pull/4429))
+  - **Background warmup and replenishment** — the pool now pre-creates connections up to `Min Pool Size` on startup and replenishes automatically whenever it drops below the minimum. ([#4452](https://github.com/dotnet/SqlClient/pull/4452))
+  - **Idle pruning** — the pruning window is now derived from the `Connection Idle Timeout` value rather than a hard-coded interval. Defaults are unchanged. ([#4463](https://github.com/dotnet/SqlClient/pull/4463))
+  - **Connection-creation rate limiting** — an optional `ConcurrencyLimiter` can throttle new physical connection creation; when a permit is denied the caller waits for an existing connection instead of forcing another open. ([#4395](https://github.com/dotnet/SqlClient/pull/4395), [#4396](https://github.com/dotnet/SqlClient/pull/4396))
+  - **Leaked connection reclamation** — the pool now reclaims emancipated connections (connections whose owning `SqlConnection` was garbage collected without being closed) both inline on the requesting thread and, while callers are waiting, from a demand-driven `PoolReclaimer` timer. The `number-of-reclaimed-connections` counter, which previously always read zero under pool V2, is now emitted. ([#4529](https://github.com/dotnet/SqlClient/pull/4529))
+  - **Metrics and tracing parity** — the pool now emits the same pooled/free connection and soft/hard connect/disconnect counters as the default pool, and traces at comparable fidelity. ([#4504](https://github.com/dotnet/SqlClient/pull/4504))
+
+*Who Benefits:*
+
+- Applications evaluating the V2 connection pool can now exercise transaction-enlisted workloads, broken-connection recovery, leaked-connection reclamation, and pool warmup, and can observe the pool through the existing performance counters and EventSource traces.
+
+*Impact:*
+
+- No change to default behavior. `ChannelDbConnectionPool` is used only when `Switch.Microsoft.Data.SqlClient.UseConnectionPoolV2` is enabled; the default pool remains `WaitHandleDbConnectionPool`.
+- This work also surfaced connection pool performance counter defects that affect the **default** pool, which are listed under *Fixed* below.
+
+### Changed
+
+- Windows-only native SNI types are now removed cleanly by the IL trimmer on Linux and macOS, and `LocalAppContextSwitches.UseManagedNetworking` is now substituted for a constant (an `ILLink.Substitutions.xml` naming defect previously prevented this). The driver now builds a single OS-agnostic assembly for all platforms; the structure and contents of the NuGet package are unchanged. ([#4207](https://github.com/dotnet/SqlClient/pull/4207), [#4239](https://github.com/dotnet/SqlClient/issues/4239), [#4465](https://github.com/dotnet/SqlClient/pull/4465), [#4474](https://github.com/dotnet/SqlClient/pull/4474))
+- Reduced managed allocations in the async read path by restoring reuse of `PacketData` linked-list nodes via a bounded free list on `StateSnapshot`, recovering an allocation regression against the 6.1.6 baseline. This applies to the default async read path and is not gated behind any AppContext switch; `SqlCommand/ExecuteReaderAsync` returns from +120.9% allocated against the 6.1.6 baseline to +0.1%. ([#4536](https://github.com/dotnet/SqlClient/pull/4536))
+- `SqlBulkCopy` no longer builds SQL Graph column alias mapping tables when the source and destination tables contain no graph pseudo-columns (`$edge_id`, `$to_id`, `$from_id`, `$node_id`), recovering a bulk copy performance regression introduced with graph column alias support in [#3677](https://github.com/dotnet/SqlClient/pull/3677). Graph table bulk copy behavior is unchanged. ([#4535](https://github.com/dotnet/SqlClient/pull/4535))
+- Operations no longer allocate a formatted trace string when `SqlClientEventSource` tracing is disabled, recovering a memory regression against the 6.1.6 baseline. Trace output with tracing enabled is unchanged. ([#4528](https://github.com/dotnet/SqlClient/pull/4528))
+- Updated centrally managed dependency versions for the `net9.0` target framework to `9.0.18`, and added `System.Threading.RateLimiting` to the packaged dependency metadata. Non-`net9.0` targets keep their existing `8.0.x` pins. ([#4507](https://github.com/dotnet/SqlClient/pull/4507))
+- Updated the `Microsoft.Data.SqlClient.SNI` and `Microsoft.Data.SqlClient.SNI.runtime` dependencies to `7.1.0-preview3.26226.3`. ([#4564](https://github.com/dotnet/SqlClient/pull/4564))
+
+### Fixed
+
+- Fixed Always Encrypted VSM/HGS enclave attestation not verifying that the enclave public key used to establish the session matches the key committed to by the signed attestation report. The provider now compares `SHA-256(enclave public key)` against the report's `EnclaveData` using a fixed-time comparison, and rejects attestation when the data is missing, malformed, or mismatched. ([#4532](https://github.com/dotnet/SqlClient/pull/4532))
+- Fixed a `SqlConnectionFactory` timer that woke the process every 30 seconds for the lifetime of the application even when no connection pools existed — including with `Pooling=False` and after `ClearAllPools()`. The pruning timer is now armed on demand and disarmed once there is nothing left to prune. A missing .NET Framework unload hook was also added. ([#1881](https://github.com/dotnet/SqlClient/issues/1881), [#4479](https://github.com/dotnet/SqlClient/pull/4479))
+- Fixed connection pool performance counter defects affecting the **default** pool as well as pool V2. `active-soft-connects` and `number-of-active-connections` could go negative after a failed connection activation, and `active-soft-connects`, `active-hard-connections`, and `number-of-pooled-connections` drifted upward permanently after a broken connection was replaced. Because these are gauges, an unmatched increment or decrement never recovered for the lifetime of the process. ([#4504](https://github.com/dotnet/SqlClient/pull/4504))
+- Fixed `OverflowException` when sending large `decimal` values (for example `decimal.MaxValue`) as a parameter with explicit `Precision` and `Scale`, which primarily affected Always Encrypted scenarios where both must always be set. ([#1655](https://github.com/dotnet/SqlClient/issues/1655), [#4443](https://github.com/dotnet/SqlClient/pull/4443))
+- Fixed a TDS stream error when passing a `DateOnly` value as a parameter with `SqlDbType.Variant`; the required `sql_variant` write paths were missing. (net8.0/net9.0 only) ([#3953](https://github.com/dotnet/SqlClient/issues/3953), [#4294](https://github.com/dotnet/SqlClient/pull/4294))
+- Fixed `DateOnly` values written to a `sql_variant` column of a table-valued parameter being sent as `datetime` instead of `date`. Besides being incorrect, this caused an overflow for `DateOnly` values that are valid for `date` but out of range for `datetime`. Reading continues to return `DateTime` instances by default, for backwards compatibility. (net8.0/net9.0 only — .NET Framework has no `DateOnly` type) ([#3934](https://github.com/dotnet/SqlClient/issues/3934), [#4439](https://github.com/dotnet/SqlClient/pull/4439))
+- Fixed the `ServerCertificate` connection-string keyword not being honored when the platform reported no TLS policy errors. The configured certificate is now always compared against the certificate presented by the server, matching the documented exact-match semantic. If the configured file cannot be loaded or parsed, the connection now fails closed with an `SSLCertificateAuthenticationException` naming the path, rather than silently falling back to host-name validation. A null server certificate now throws `AuthenticationException` instead of `NullReferenceException`. Connections that do not set `ServerCertificate`, and those whose configured certificate matches, are unaffected. ([#4445](https://github.com/dotnet/SqlClient/pull/4445))
+- Fixed `SqlConnection.AccessTokenCallback` not disabling Transparent Network IP Resolution by default, unlike `SqlConnection.AccessToken`. Also fixed a related defect in how the authentication setters build the connection pool key, and made `SspiContextProvider` mutually exclusive with token-based authentication. (net462 only for the TNIR behavior) ([#4520](https://github.com/dotnet/SqlClient/pull/4520))
+- Fixed several async entry points in `SqlBulkCopy`, `SqlDataReader.InvokeAsyncCall`, `SqlCommand.Reader`, and `SqlCommand.Xml` that captured fatal exceptions such as `OutOfMemoryException` into faulted `Task`s instead of letting them propagate. ([#4437](https://github.com/dotnet/SqlClient/pull/4437))
+- Fixed `Authentication=Active Directory Service Principal` (and the interactive, password, integrated, and device-code flows) failing against endpoints such as the Dataverse / Dynamics 365 TDS endpoint, which return a multi-segment Entra ID authority (`https://login.microsoftonline.com/{tenantId}/oauth2/authorize`) in the TDS `FEDAUTHINFO` token. The tenant id is now taken from the first path segment of the authority instead of the last. This fix ships in `Microsoft.Data.SqlClient.Extensions.Azure`; see its [7.1.0-preview3](../Extensions/Azure/7.1/7.1.0-preview3.md) release notes. ([#4496](https://github.com/dotnet/SqlClient/issues/4496), [#4521](https://github.com/dotnet/SqlClient/pull/4521))
+### Companion package release notes
+
+- [Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider 7.1.0-preview3](../add-ons/AzureKeyVaultProvider/7.1/7.1.0-preview3.md)
+- [Microsoft.Data.SqlClient.Extensions.Azure 7.1.0-preview3](../Extensions/Azure/7.1/7.1.0-preview3.md)
+- [Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.0-preview3](../Extensions/Abstractions/7.1/7.1.0-preview3.md)
+- [Microsoft.Data.SqlClient.Internal.Logging 7.1.0-preview3](../Internal/Logging/7.1/7.1.0-preview3.md)
+
+## Target Platform Support
+
+- .NET Framework 4.6.2+ (Windows x86, Windows x64, Windows ARM64)
+- .NET 8.0+ (Windows x86, Windows x64, Windows ARM, Windows ARM64, Linux, macOS)
+
+### Dependencies
+
+#### .NET 9.0
+
+- Microsoft.Bcl.Cryptography 9.0.18
+- Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.0-preview3
+- Microsoft.Data.SqlClient.Internal.Logging 7.1.0-preview3
+- Microsoft.Data.SqlClient.SNI.runtime 7.1.0-preview3.26226.3
+- Microsoft.Extensions.Caching.Memory 9.0.18
+- Microsoft.IdentityModel.JsonWebTokens 8.16.0
+- Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
+- Microsoft.SqlServer.Server 1.0.0
+- System.Configuration.ConfigurationManager 9.0.18
+- System.Security.Cryptography.Pkcs 9.0.18
+- System.Threading.RateLimiting 9.0.18
+
+#### .NET 8.0
+
+- Microsoft.Bcl.Cryptography 8.0.0
+- Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.0-preview3
+- Microsoft.Data.SqlClient.Internal.Logging 7.1.0-preview3
+- Microsoft.Data.SqlClient.SNI.runtime 7.1.0-preview3.26226.3
+- Microsoft.Extensions.Caching.Memory 8.0.1
+- Microsoft.IdentityModel.JsonWebTokens 8.16.0
+- Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
+- Microsoft.SqlServer.Server 1.0.0
+- System.Configuration.ConfigurationManager 8.0.1
+- System.Security.Cryptography.Pkcs 8.0.1
+- System.Threading.RateLimiting 8.0.0
+
+#### .NET Standard 2.0
+
+- Microsoft.Bcl.Cryptography 8.0.0
+- Microsoft.Bcl.TimeProvider 8.0.1
+- Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.0-preview3
+- Microsoft.Data.SqlClient.Internal.Logging 7.1.0-preview3
+- Microsoft.Data.SqlClient.SNI.runtime 7.1.0-preview3.26226.3
+- Microsoft.Extensions.Caching.Memory 8.0.1
+- Microsoft.IdentityModel.JsonWebTokens 8.16.0
+- Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
+- Microsoft.SqlServer.Server 1.0.0
+- System.Configuration.ConfigurationManager 8.0.1
+- System.Security.Cryptography.Pkcs 8.0.1
+- System.Text.Json 10.0.3
+- System.Threading.Channels 10.0.3
+- System.Threading.RateLimiting 8.0.0
+
+#### .NET Framework 4.6.2+
+
+- Microsoft.Bcl.Cryptography 8.0.0
+- Microsoft.Bcl.TimeProvider 8.0.1
+- Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.0-preview3
+- Microsoft.Data.SqlClient.Internal.Logging 7.1.0-preview3
+- Microsoft.Data.SqlClient.SNI 7.1.0-preview3.26226.3
+- Microsoft.Extensions.Caching.Memory 8.0.1
+- Microsoft.IdentityModel.JsonWebTokens 8.16.0
+- Microsoft.IdentityModel.Protocols.OpenIdConnect 8.16.0
+- System.Buffers 4.6.1
+- System.Data.Common 4.3.0
+- System.Diagnostics.DiagnosticSource 10.0.3
+- System.Memory 4.6.3
+- System.Runtime.InteropServices.RuntimeInformation 4.3.0
+- System.Security.Cryptography.Pkcs 8.0.1
+- System.Text.Json 10.0.3
+- System.Threading.Channels 10.0.3
+- System.Threading.RateLimiting 8.0.0
+- System.ValueTuple 4.6.2
diff --git a/release-notes/7.1/README.md b/release-notes/7.1/README.md
index 843ba62b36..0b7de8156d 100644
--- a/release-notes/7.1/README.md
+++ b/release-notes/7.1/README.md
@@ -6,3 +6,4 @@ The following Microsoft.Data.SqlClient 7.1 releases have been shipped:
 |:-------------|:---------------|:----------------------------------:|
 | 2026-04-29   | 7.1.0-preview1 | [Release Notes](7.1.0-preview1.md) |
 | 2026-07-09   | 7.1.0-preview2 | [Release Notes](7.1.0-preview2.md) |
+| 2026-08-26   | 7.1.0-preview3 | [Release Notes](7.1.0-preview3.md) |
diff --git a/release-notes/Extensions/Abstractions/7.1/7.1.0-preview3.md b/release-notes/Extensions/Abstractions/7.1/7.1.0-preview3.md
new file mode 100644
index 0000000000..c76a2af5f7
--- /dev/null
+++ b/release-notes/Extensions/Abstractions/7.1/7.1.0-preview3.md
@@ -0,0 +1,19 @@
+# Release Notes
+
+## Preview Release 7.1.0-preview3 - 2026-08-26
+
+This release continues version-alignment of `Microsoft.Data.SqlClient.Extensions.Abstractions` with the core `Microsoft.Data.SqlClient` driver version (`7.1.0-preview3`). The previous release of this package was [7.1.0-preview2](7.1.0-preview2.md).
+
+There are no functional or API changes in this release. See the core [Microsoft.Data.SqlClient 7.1.0-preview3](../../../7.1/7.1.0-preview3.md) release notes for the driver-family changes shipped alongside this version.
+
+> **Version alignment:** This package's version continues to track the core `Microsoft.Data.SqlClient` driver version. See the [7.0.2 release notes](../../../7.0/7.0.2.md) for the initial alignment announcement. This assembly ships with `FileVersion 7.1.0.x`. The `AssemblyVersion 7.0.0.0` remains unchanged from the `7.0.2` release.
+
+## Target Platform Support
+
+- .NET Standard 2.0
+
+### Dependencies
+
+#### .NET Standard 2.0
+
+- Microsoft.Data.SqlClient.Internal.Logging 7.1.0-preview3
diff --git a/release-notes/Extensions/Abstractions/7.1/README.md b/release-notes/Extensions/Abstractions/7.1/README.md
index 133eb71b32..9d1374bdb6 100644
--- a/release-notes/Extensions/Abstractions/7.1/README.md
+++ b/release-notes/Extensions/Abstractions/7.1/README.md
@@ -6,3 +6,4 @@ The following `Microsoft.Data.SqlClient.Extensions.Abstractions`
 | Release Date | Description | Notes |
 | :-- | :-- | :--: |
 | 2026-07-09 | 7.1.0-preview2 | [Release Notes](7.1.0-preview2.md) |
+| 2026-08-26 | 7.1.0-preview3 | [Release Notes](7.1.0-preview3.md) |
diff --git a/release-notes/Extensions/Azure/7.1/7.1.0-preview3.md b/release-notes/Extensions/Azure/7.1/7.1.0-preview3.md
new file mode 100644
index 0000000000..c7fb0b952f
--- /dev/null
+++ b/release-notes/Extensions/Azure/7.1/7.1.0-preview3.md
@@ -0,0 +1,39 @@
+# Release Notes
+
+## Preview Release 7.1.0-preview3 - 2026-08-26
+
+This release fixes Entra ID tenant parsing for multi-segment authorities, and continues version-alignment of `Microsoft.Data.SqlClient.Extensions.Azure` with the core `Microsoft.Data.SqlClient` driver version (`7.1.0-preview3`). The previous release of this package was [7.1.0-preview2](7.1.0-preview2.md). See the core [Microsoft.Data.SqlClient 7.1.0-preview3](../../../7.1/7.1.0-preview3.md) release notes for the driver-family changes shipped alongside this version.
+
+> **Version alignment:** This package's version continues to track the core `Microsoft.Data.SqlClient` driver version. See the [7.0.2 release notes](../../../7.0/7.0.2.md) for the initial alignment announcement. This assembly ships with `FileVersion 7.1.0.x`. The `AssemblyVersion 7.0.0.0` remains unchanged from the `7.0.2` release.
+
+### Fixed
+
+- Fixed Entra ID tenant parsing for multi-segment STSURL authorities. Endpoints such as the Dataverse / Dynamics 365 TDS endpoint return an OAuth v1 style authority (`https://login.microsoftonline.com/{tenantId}/oauth2/authorize`) in the TDS `FEDAUTHINFO` token. `ActiveDirectoryAuthenticationProvider.AcquireTokenAsync` split that authority at the **last** `/`, so the credential received the literal string `"authorize"` as its tenant id and connections failed with `ClientSecretCredential authentication failed`. The tenant is now taken from the **first** path segment, so trailing endpoint suffixes (`/oauth2/authorize`, `/oauth2/v2.0/token`, ...) are ignored, and the normalized authority is used for the MSAL-based interactive, password, integrated, and device-code flows as well. An unparseable authority now raises a clear `AuthenticationException` naming the offending value, and provider-raised authentication errors are no longer re-wrapped as "Unexpected error". Behavior is unchanged for the bare `https://login.microsoftonline.com/{tenantId}` authority sent by Azure SQL, Fabric, and Synapse. There are no public API changes.
+  ([#4496](https://github.com/dotnet/SqlClient/issues/4496), [#4521](https://github.com/dotnet/SqlClient/pull/4521))
+
+## Target Platform Support
+
+- .NET Standard 2.0
+- .NET Framework 4.6.2+
+
+### Dependencies
+
+#### .NET Standard 2.0
+
+- Azure.Core 1.51.1
+- Azure.Identity 1.18.0
+- Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.0-preview3
+- Microsoft.Data.SqlClient.Internal.Logging 7.1.0-preview3
+- Microsoft.Extensions.Caching.Memory 8.0.1
+- Microsoft.Identity.Client 4.84.2
+- Microsoft.Identity.Client.Broker 4.84.2
+
+#### .NET Framework 4.6.2+
+
+- Azure.Core 1.51.1
+- Azure.Identity 1.18.0
+- Microsoft.Data.SqlClient.Extensions.Abstractions 7.1.0-preview3
+- Microsoft.Data.SqlClient.Internal.Logging 7.1.0-preview3
+- Microsoft.Extensions.Caching.Memory 8.0.1
+- Microsoft.Identity.Client 4.84.2
+- Microsoft.Identity.Client.Broker 4.84.2
diff --git a/release-notes/Extensions/Azure/7.1/README.md b/release-notes/Extensions/Azure/7.1/README.md
index 3acdf3d45c..b3f93b7931 100644
--- a/release-notes/Extensions/Azure/7.1/README.md
+++ b/release-notes/Extensions/Azure/7.1/README.md
@@ -6,3 +6,4 @@ The following `Microsoft.Data.SqlClient.Extensions.Azure`
 | Release Date | Description | Notes |
 | :-- | :-- | :--: |
 | 2026-07-09 | 7.1.0-preview2 | [Release Notes](7.1.0-preview2.md) |
+| 2026-08-26 | 7.1.0-preview3 | [Release Notes](7.1.0-preview3.md) |
diff --git a/release-notes/Internal/Logging/7.1/7.1.0-preview3.md b/release-notes/Internal/Logging/7.1/7.1.0-preview3.md
new file mode 100644
index 0000000000..0c434cb632
--- /dev/null
+++ b/release-notes/Internal/Logging/7.1/7.1.0-preview3.md
@@ -0,0 +1,22 @@
+# Release Notes
+
+## Preview Release 7.1.0-preview3 - 2026-08-26
+
+> **Note:** This package is for internal use by other Microsoft.Data.SqlClient packages only
+> and should not be referenced directly by application code.
+
+This release continues version-alignment of `Microsoft.Data.SqlClient.Internal.Logging` with the core `Microsoft.Data.SqlClient` driver version (`7.1.0-preview3`). The previous release of this package was [7.1.0-preview2](7.1.0-preview2.md).
+
+There are no functional or API changes in this release. See the core [Microsoft.Data.SqlClient 7.1.0-preview3](../../../7.1/7.1.0-preview3.md) release notes for the driver-family changes shipped alongside this version.
+
+> **Version alignment:** This package's version continues to track the core `Microsoft.Data.SqlClient` driver version. See the [7.0.2 release notes](../../../7.0/7.0.2.md) for the initial alignment announcement. This assembly ships with `FileVersion 7.1.0.x`. The `AssemblyVersion 7.0.0.0` remains unchanged from the `7.0.2` release.
+
+## Target Platform Support
+
+- .NET Standard 2.0
+
+### Dependencies
+
+#### .NET Standard 2.0
+
+- None
diff --git a/release-notes/Internal/Logging/7.1/README.md b/release-notes/Internal/Logging/7.1/README.md
index f0c0f8c274..25caeccaba 100644
--- a/release-notes/Internal/Logging/7.1/README.md
+++ b/release-notes/Internal/Logging/7.1/README.md
@@ -9,3 +9,4 @@ The following `Microsoft.Data.SqlClient.Internal.Logging`
 | Release Date | Description | Notes |
 | :-- | :-- | :--: |
 | 2026-07-09 | 7.1.0-preview2 | [Release Notes](7.1.0-preview2.md) |
+| 2026-08-26 | 7.1.0-preview3 | [Release Notes](7.1.0-preview3.md) |
diff --git a/release-notes/add-ons/AzureKeyVaultProvider/7.1/7.1.0-preview3.md b/release-notes/add-ons/AzureKeyVaultProvider/7.1/7.1.0-preview3.md
new file mode 100644
index 0000000000..d27c19a432
--- /dev/null
+++ b/release-notes/add-ons/AzureKeyVaultProvider/7.1/7.1.0-preview3.md
@@ -0,0 +1,48 @@
+# Release Notes
+
+## Preview Release 7.1.0-preview3 - 2026-08-26
+
+This release adds asynchronous key store provider APIs and continues version-alignment of `Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider` with the core `Microsoft.Data.SqlClient` driver version (`7.1.0-preview3`). The previous release of this package was [7.1.0-preview2](7.1.0-preview2.md).
+
+See the core [Microsoft.Data.SqlClient 7.1.0-preview3](../../../7.1/7.1.0-preview3.md) release notes for the driver-family changes shipped alongside this version.
+
+> **Version alignment:** This package's version continues to track the core `Microsoft.Data.SqlClient` driver version. See the [7.0.2 release notes](../../../7.0/7.0.2.md) for the initial alignment announcement. This assembly ships with `FileVersion 7.1.0.x`. The `AssemblyVersion 7.0.0.0` remains unchanged from the `7.0.2` release.
+
+### Added
+
+#### Asynchronous key store provider APIs
+
+*What Changed:*
+
+- `SqlColumnEncryptionAzureKeyVaultProvider` now overrides the four asynchronous key store provider methods introduced on the base class in [#3673](https://github.com/dotnet/SqlClient/pull/3673): `EncryptColumnEncryptionKeyAsync`, `DecryptColumnEncryptionKeyAsync`, `SignColumnMasterKeyMetadataAsync`, and `VerifyColumnMasterKeyMetadataAsync`. These call the Azure SDK's own asynchronous methods and flow the supplied `CancellationToken` to them, rather than completing synchronous work on a returned task.
+- Concurrent cache misses for the same key are gated so a burst of callers issues a single Key Vault request. The gate is only ever awaited, so no thread blocks, and misses for different keys still proceed in parallel.
+  ([#4540](https://github.com/dotnet/SqlClient/pull/4540))
+
+*Who Benefits:*
+
+- Applications using Always Encrypted with Azure Key Vault can now perform column encryption key operations without blocking a thread pool thread on network-bound key vault I/O.
+
+*Impact:*
+
+- No public API was removed or changed. The column encryption key and signature caches are shared between the synchronous and asynchronous paths, so a key resolved by one is visible to the other.
+- **Behavior change:** `VerifyColumnMasterKeyMetadata` and `VerifyColumnMasterKeyMetadataAsync` now reject a null or empty `signature` with `ArgumentNullException` / `ArgumentException` instead of passing it through to the Azure SDK. In-product callers are unaffected because `SqlSecurityUtility.VerifyColumnMasterKeySignature` already rejects those values upstream.
+- **Runtime requirement:** this version requires `Microsoft.Data.SqlClient` 7.1.0-preview3 or later at runtime, because the overridden methods only exist on the 7.1 base class. The NuGet dependency floor covers restore, but downgrading the driver below 7.1 at runtime produces a `TypeLoadException`, since assembly versions unify at `major.0.0.0`.
+
+### Fixed
+
+- Fixed the 2000-entry column master key signature cache being able to stop compacting and grow unbounded. `LocalCache.GetOrCreate` compacted only when `Count == maxSize`, and under concurrency that equality test could be stepped past, permanently disabling compaction. It now compacts on `Count >= maxSize`. ([#4540](https://github.com/dotnet/SqlClient/pull/4540))
+- Fixed concurrent callers ending up with different `CryptographyClient` instances for the same key, which produced redundant clients and duplicated Key Vault handshakes. `GetCryptographyClient` now uses `GetOrAdd` instead of `TryGetValue` followed by `TryAdd`. ([#4540](https://github.com/dotnet/SqlClient/pull/4540))
+
+## Target Platform Support
+
+- .NET Standard 2.0
+
+### Dependencies
+
+#### .NET Standard 2.0
+
+- Azure.Core 1.51.1
+- Azure.Security.KeyVault.Keys 4.9.0
+- Microsoft.Data.SqlClient 7.1.0-preview3
+- Microsoft.Data.SqlClient.Internal.Logging 7.1.0-preview3
+- Microsoft.Extensions.Caching.Memory 8.0.1
diff --git a/release-notes/add-ons/AzureKeyVaultProvider/7.1/README.md b/release-notes/add-ons/AzureKeyVaultProvider/7.1/README.md
index 9fda87ae8f..07fffc069b 100644
--- a/release-notes/add-ons/AzureKeyVaultProvider/7.1/README.md
+++ b/release-notes/add-ons/AzureKeyVaultProvider/7.1/README.md
@@ -6,3 +6,4 @@ The following `Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider`
 | Release Date | Description | Notes |
 | :-- | :-- | :--: |
 | 2026-07-09 | 7.1.0-preview2 | [Release Notes](7.1.0-preview2.md) |
+| 2026-08-26 | 7.1.0-preview3 | [Release Notes](7.1.0-preview3.md) |