This blog post series highlights the key announcements and major updates related to Azure Infrastructure as a Service (IaaS) and Azure Local, as officially released by Microsoft in the past two weeks.
Azure
General
Two-Way Forest Trusts for Microsoft Entra Domain Services
Microsoft has announced the general availability of Two-Way Forest Trusts for Microsoft Entra Domain Services. This enhancement enables organizations to establish bi-directional forest trusts between Microsoft Entra Domain Services and on-premises Active Directory Domain Services (AD DS). Previously, only one-way outbound trusts were supported, which allowed users in the on-premises environment to access resources in the managed domain. Now, administrators can configure one-way inbound, one-way outbound, or two-way forest trusts, granting users from either domain reciprocal access to resources. This added flexibility allows enterprises to better align their hybrid identity strategies, with support for more granular control over trust relationships. An Enterprise or Premium SKU license is required to configure these trusts.
Compute
Enable Trusted Launch on Existing Virtual Machine Uniform Scale Set
Microsoft has announced the general availability of the ability to enable Trusted Launch on existing Virtual Machine Uniform Scale Sets by upgrading these resources to Gen2-Trusted Launch. This enhancement allows organizations to bolster the foundational security of their existing infrastructure without needing to redeploy. Trusted Launch VMs support Secure Boot and virtual Trusted Platform Module (vTPM), protecting the guest operating system from bootkits, rootkits, and other low-level threats. Additionally, attestation capabilities measure the integrity of the VM’s boot process, further strengthening security posture.
Trusted Launch Default for New Gen2 VMs & Scale Sets (preview)
A new public preview introduces Trusted Launch as default (TLaD) for newly deployed Generation 2 Virtual Machines, Virtual Machine Scale Sets, and Azure Compute Gallery resources. This default behavior enables foundational security features, including Secure Boot and vTPM, without requiring any changes to deployment templates or automation scripts (e.g., SDKs, Bicep, ARM templates, Terraform). With Trusted Launch enabled by default, new deployments gain enhanced protection against rootkits and bootkits, while also enabling attestation to verify the VM’s boot process integrity, simplifying secure adoption of Generation 2 resources.
Networking
Azure DNS Security Policy
Azure DNS Security Policy is now generally available, offering comprehensive control and visibility over DNS traffic at the virtual network level. This new capability allows administrators to filter DNS queries by allowing, alerting, or blocking name resolutions based on domain lists, helping to protect against access to known malicious or undesired domains. Security policies can be applied to virtual networks within the same region and can be linked to multiple VNets. Organizations can gain deep visibility into DNS traffic by sending detailed logs to a storage account, Log Analytics workspace, or Event Hubs. The feature also supports granular DNS traffic rules and location-based domain lists, providing a powerful mechanism to enhance DNS security and compliance across Azure environments.
FQDN Filtering in DNAT Rules in Azure Firewall
Azure Firewall now supports Fully Qualified Domain Name (FQDN) filtering in Destination Network Address Translation (DNAT) rules, which is now generally available. This feature allows administrators to define backend resources using domain names instead of static IP addresses for inbound traffic routing. It is particularly beneficial in environments where backend IPs are dynamic or managed via DNS. With FQDN-based targeting, organizations gain improved flexibility and easier backend management. Additionally, administrators can monitor DNAT activity through AZFWNatRule logs to ensure proper policy enforcement and troubleshooting.
Customer Controlled Maintenance for Azure Firewall
Azure Firewall now supports customer-controlled maintenance windows, offering greater flexibility and operational control. With this update, users can define a recurring daily maintenance window of at least five hours during which updates and upgrades to the firewall will be applied. Firewalls that are configured with such a maintenance policy will not undergo upgrades outside the specified window, reducing the likelihood of unexpected downtime and allowing organizations to align updates with their internal change management processes. This enhancement helps ensure service continuity and better aligns with enterprise maintenance practices.
Storage
Granular Role-Based Access Control (RBAC) for Azure File Sync
Azure File Sync now includes two new built-in RBAC roles: Azure File Sync Administrator and Azure File Sync Reader. These roles are designed to improve security and streamline operations by offering more granular access control than traditional roles such as Owner or Contributor. With these purpose-built roles, organizations can better enforce the principle of least privilege when assigning permissions related to Azure File Sync. Users can create and manage essential components such as Storage Sync Services, Sync Groups, Server Endpoints, and Cloud Endpoints, as well as register servers, all while avoiding broader permissions like VM management. This update removes the need to define custom roles for common administrative tasks, supporting compliance and operational efficiency by limiting access only to what is required.
Encryption in Transit for Azure Files NFS Shares
Encryption in Transit (EiT) for Azure Files NFS shares is now generally available, providing secure data transmission over the network by using TLS 1.3. This enhancement ensures the confidentiality, integrity, and authenticity of all NFS traffic. It supports a wide range of environments, including all major Linux distributions, Azure Linux virtual machines, and on-premises Linux servers. To simplify deployment, Microsoft offers the open-source AZNFS mount helper, which automates the TLS tunneling and volume mount process. This added security layer helps organizations meet compliance requirements while preserving performance and usability in enterprise-scale file sharing scenarios.
Azure Storage Mover Adds Free, Direct AWS S3-to-Azure Blob Migration (preview)
Azure Storage Mover has introduced a new public preview feature that enables free, direct migration of data from Amazon S3 to Azure Blob Storage. Designed for organizations with multi-cloud strategies or planning a complete transition to Azure, this Cloud-to-Cloud migration capability supports secure, petabyte-scale data transfers without disrupting ongoing operations. In addition to this new path, Azure Storage Mover already supports migrating on-premises SMB shares to Azure File and transferring both SMB and NFS data to Azure Blob Storage. The integration of Azure Arc streamlines authentication when connecting to AWS, ensuring secure and seamless operations. As a fully managed and cost-free service, Azure Storage Mover helps businesses modernize their storage architectures more efficiently and with minimal complexity.
Azure Local
Updates in the 2506 Release
The 2506 release of Azure Local delivers a comprehensive set of updates across operating system support, security, networking, and deployment processes. New deployments now use OS version 26100.4349, with driver compatibility required for this version or Windows Server 2025. Existing deployments remain on version 25398.1665. The release also integrates improved deployment validation through updated environment checkers for Microsoft On-premises Cloud and Azure Resource Bridge. On the security front, a new baseline expands to 407 evaluated rules, improving alignment with CIS and DISA STIG standards, and introduces enhanced Microsoft Defender Antivirus configurations. Administrators can now fine-tune drift control settings instead of disabling them globally, and the minimum password length has been raised to 14 characters to meet NIST 2 compliance. In preview, Software-Defined Networking (SDN) enabled by Azure Arc allows the creation and assignment of Network Security Groups (NSGs) and security rules for a consistent cloud-to-edge networking model. Additional features include an overprovisioning alert to warn of insufficient compute capacity before updates, .NET 8.0.17 runtime support, and the archival of Azure Local version 22H2 documentation. Notably, this release is not supported for Azure Local instances deployed in Azure Government cloud.
Conclusion
Over the past two weeks, Microsoft has introduced a slew of updates and announcements pertaining to Azure Infrastructure as a Service (IaaS) and Azure Local. These developments underscore the tech giant’s unwavering commitment to enhancing its cloud offerings and adapting to the ever-evolving needs of businesses and developers. Users of Azure can anticipate improved functionalities, streamlined services, and enriched features as a result of these changes. Stay tuned for more insights as I continue to monitor and report on Azure’s progression in the cloud sphere.
