This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.
Azure
Compute
Azure VMware Solution Stretched Clusters with Customer-Managed Keys
Stretched clusters for Azure VMware Solution (AVS) is now Generally Available, providing 99.99% uptime for mission critical applications that require the highest availability. With this release, customers can use Customer-Managed Keys to encrypt the stretched vSAN. By default, virtual machines within vSAN datastore are protected with data-at-rest encryption using FIPS 140-2 compliant Data Encryption Key (DEK) generated for each local disk on ESXi hosts. These DEKs are encrypted by VMware vSAN Key Encryption Key (service-managed key) provided by Microsoft.
Stretched Cluster Benefits:
- improved application availability;
- provide a zero-recovery point objective (RPO) capability for enterprise applications without needing to redesign them or deploy expensive disaster recovery solutions;
- A private cloud with stretched clusters is designed to provide 99.99% availability due to its resilience to AZ failures.
Azure VMware Solution customer-managed encryption is supported through integration with Azure Key Vault. You can create your own encryption keys and store them in a Key Vault, or you can use Azure Key Vault API to generate encryption keys.
Mv2 Virtual Machine: 8TB memory
Mv2 High Memory virtual machines serve largest in-memory workloads providing infrastructure for 6 and 12TB memory needs. Based on customer demand, an 8TB memory virtual machine (VM) Standard_M416ms_8_v2 is now available, that offers an intermediate size to scale between 6TB and 12TB.
NGads V620-series VMs optimized for cloud gaming
NGads V620-series virtual machines (VMs), powered by AMD RadeonTM PRO V620 GPUs and AMD EPYCTM 7763 CPUs, are purpose-built for generating and streaming high quality graphics for an interactive gaming experience hosted on Azure. Featuring GPU partitioning with options for ¼, ½, or 1 full GPU, they allow customers to right-size their choice for the performance and cost of the business need. These VMs also feature the AMD Adrenaline Gaming Driver Cloud Edition that targets the same optimizations available in the consumer gaming version of the Adrenaline driver but is further optimized for the cloud environment.In addition, the NGads V620-series VMs also support graphics-accelerated virtual desktop infrastructure (VDI) and visualization rendering, using the AMD Pro Workstation Driver, Cloud Edition.
Azure VMware Solution now available in North Switzerland
With the introduction of AV36 in North Switzerland, customers will receive access to 36 cores, 2.3 GHz clock speed, 576GB of RAM, and 15.36TB of SSD storage.
Confidential Virtual Machines (VM) support in Azure Virtual Desktop (preview)
Azure Confidential Virtual Machines (VMs) support in Azure Virtual Desktop is in public preview. Confidential Virtual Machines increase data privacy and security by protecting data in use. The Azure DCasv5 and ECasv5 confidential VM series provide a hardware-based Trusted Execution Environment (TEE) that features AMD SEV-SNP security capabilities, which harden guest protections to deny the hypervisor and other host management code access to VM memory and state, and that is designed to protect against operator access and encrypts data in use. With this preview, support for Windows 11 22H2 has been added to Confidential Virtual Machines.
Networking
Private Link support for Application Gateway
Private link configuration for Application Gateway enables incoming traffic to an Azure Application Gateway frontend and can be secured to clients running in another Azure Virtual Network, Azure subscription, or Azure subscription linked to a different Azure Active Directory tenant through Azure Private Link.
Azure Load Balancer per VM limit removal
The “Load balancer per VM” limit is now removed for customers using Standard Load Balancer. Previously this limit was 2 load balancers per VM (1 public and 1 internal). Now with this limit removed, you can associate as many load balancers per VM with either types (public or internal) up to the Azure Load Balancer’s limits.
Azure Load Balancer: inbound ICMPv6 pings and traceroute are now supported
Standard Public Load Balancer now supports inbound ICMP pings on IPv6 frontends as well as inbound tracerouting support to both IPv4 and IPv6 frontends. This is an addition to previous announcement of ICMPv4 pings support on Azure Load Balancer. Now, you can ping and traceroute to both IPv4 and IPv6 frontend of a Standard Public Load Balancer like you natively would on an on-premises device without any external software needed. This enables you to troubleshoot network issues, identify network bottlenecks, verify network paths, and monitor network performance between Azure Load Balancer and your client device. This functionality is generally available in all public regions, Azure China cloud regions, and Azure Government cloud regions.
Azure Front Door integration with managed identities
Azure Front Door now supports managed identities generated by Azure Active Directory to allow Front Door to easily and securely access other Azure AD-protected resources such as Azure Key Vault. This feature is in addition to the AAD Application access to Key Vault that is currently supported.
Azure Front Door upgrade from standard to premium
Azure Front Door supports upgrading from Standard to Premium tier without downtime. Azure Front Door Premium supports advanced security capabilities and has increased quota limits, such as managed Web Application Firewall rules and private connectivity to your origin using Private Link.
Azure Front Door Migration from classic to standard/premium
In March 2022, Microsoft announced the general availability of two new Azure Front Door tiers. Azure Front Door Standard and Premium are native, modern cloud content delivery network (CDN) catering to both dynamic and static content delivery acceleration with built-in turnkey security and a simple and predictable pricing model. The migration capability enables you to perform a zero-downtime migration from Azure Front Door (classic) to Azure Front Door Standard or Premium in just three simple steps or five simple steps if your Azure Front Door (classic) instance has custom domains with your own certificates. The migration will take a few minutes to complete depending on the complexity of your Azure Front Door (classic) instance, such as number of domains, backend pools, routes, and other configurations.
Azure Front Door Standard/Premium in Azure Government (preview)
Azure Front Door (AFD) Standard and Premium tier is now available in Azure Government in public preview, in the regions of Arizona and Texas. After this release, Local Government (US) customers and their partners can benefit from the new and enhanced capabilities on standard and premium. The new and enhanced capabilities include, but are not limited to, better reporting and diagnostic capabilities, expanded rules engine with server variables, enhanced Web Application Firewall (latest DRS rule set, Bot protection, Web Application Firewall Notebook using Sentinel for security investigation and monitoring, Microsoft Sentinel Analytics) and security capabilities (Private Link connectivity to your origin, subdomain takeover prevention) and many upcoming new features.
Storage
Zone Redundant Storage for Azure Disks is now available in more regions
Zone Redundant Storage (ZRS) for Azure Disk Storage is now generally available on Azure Premium SSDs and Standard SSDs in Brazil South, UK South, East US, East US 2, and South-Central US regions. Disks with ZRS provide synchronous replication of data across three availability zones in a region, enabling disks to tolerate zonal failures without causing disruptions to your application. This feature enables disks to tolerate zonal failures without causing disruptions to your application. Additionally, it allows you to maximize virtual machine availability without the need for application-level replication of data across zones. You can also use ZRS with shared disks to provide higher availability for clustered or distributed applications like SQL FCI, SAP ASCS/SCS, or GFS2.
Azure Files scalability improvement for Azure Virtual Desktop and other workloads that open root directory handles
Azure Files has increased the root directory handle limit per share from 2,000 to 10,000 for standard and premium file shares. This improvement benefits applications that keep an open handle on the root directory. For example, Azure Virtual Desktop with FSLogix profile containers now supports 10,000 active users per share.
Zone Redundant Storage for Azure Disks is now available in Japan East and Korea Central
Zone Redundant Storage (ZRS) for Azure Disk Storage is now generally available on Azure Premium SSDs and Standard SSDs in Japan East and Korea Central regions.
Azure NetApp Files Availability zone volume placement enhancement: populate existing volume (preview)
Azure NetApp Files availability zone volume placement feature lets you deploy new volumes in the availability zone of your choice, in alignment with Azure compute and other services in the same zone. With this ‘Populate existing volume’ enhancement you can now obtain and, if desired, populate previously deployed, existing volumes with the logical availability zone information. It will automatically map the physical zone the volumes were deployed in and map it to the logical zone for your subscription. This feature will not move any volumes between zones. With this capability you can enhance workloads that were previously deployed regionally and align them with VMs in the same failure domain, for example to enable HA architectures across availability zones.
Azure AD Support for Azure Files SMB shares REST API (preview)
The public preview of Azure Active Directory (Azure AD) for Azure SMB Shares enables share-level read and write access for users, groups, and managed identities (MI) when accessing through the REST API. With Azure AD support, applications can now access Azure file shares securely, without storing or managing any credentials. Applications can leverage managed identities to securely access the customer-owned file shares. Azure Portal also now supports using Azure AD to authenticate requests to Azure Files. Users can choose Azure AD identity-based authentication method for the actions they take through portal such as browsing their file share contents.
