This blog post series highlights the key announcements and major updates related to Azure Infrastructure as a Service (IaaS) and Azure Local, as officially released by Microsoft in the past two weeks.

Azure

Networking

Azure Route Server dual-stack IPv4/IPv6 support (preview)

Azure Route Server now supports IPv4 and IPv6 dual-stack routing in Public Preview, extending its dynamic routing capabilities to environments adopting IPv6 alongside existing IPv4 network architectures. The enhancement enables Azure Route Server to exchange routes for both IP address families across supported hybrid networking connections, helping organizations progressively introduce IPv6 without disrupting established IPv4 connectivity. In dual-stack configurations, administrators can also apply Azure Route Server route maps to connections involving Azure ExpressRoute, VPN Gateway, and network virtual appliances (NVAs) deployed in hub or spoke virtual networks. This provides additional control over route exchange and routing policies across hybrid and cloud networking environments. Existing IPv4 connections remain unchanged, allowing organizations to adopt dual-stack routing incrementally. The capability is particularly relevant for large enterprise networks, hybrid connectivity architectures, and network modernization initiatives where consistent dynamic routing and centralized control are required across IPv4 and IPv6 infrastructures.

WAF Insights for Azure Application Gateway

WAF Insights for Azure Application Gateway is now Generally Available (GA), providing an integrated monitoring and investigation experience that brings Web Application Firewall (WAF) logs and metrics together in interactive dashboards. Built into the WAF policy management experience and based on Azure Monitor workbooks, WAF Insights helps security and operations teams identify suspicious traffic patterns, investigate blocked requests, validate WAF policy effectiveness, and identify potential false positives or configuration issues.

The capability provides two complementary views: Monitor, which offers visibility into request volumes, managed and custom rule matches, blocked traffic, and JavaScript challenge activity; and Triage, which enables detailed investigations by WAF rule or URL. Administrators can drill down into affected hosts, request paths, client IP addresses, and individual transactions to understand why traffic was blocked and determine whether policy adjustments are needed. By correlating aggregated metrics with detailed diagnostic logs, WAF Insights simplifies security investigations and supports more effective WAF policy tuning. Diagnostic logging to Azure Log Analytics must be configured to populate the relevant dashboards.

Azure Front Door TLS key exchange policy with post-quantum support

Azure Front Door TLS key exchange policies with post-quantum support are now Generally Available (GA) across all public Azure regions, introducing configurable TLS key exchange policies that help organizations prepare for emerging quantum computing threats while maintaining compatibility with existing clients. Azure Front Door now supports hybrid post-quantum key establishment for TLS 1.3, combining traditional elliptic-curve cryptography with the NIST-standardized Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM). Supported hybrid groups include X25519MLKEM768 and SecP256r1MLKEM768, providing additional protection against harvest-now, decrypt-later attacks, where encrypted traffic captured today could potentially be decrypted using future quantum computing capabilities.

Hybrid post-quantum key exchange is enabled by default for compatible clients, with classical cryptographic fallback preserving interoperability. Administrators can also select managed TLS policies or configure custom policies to control supported protocol versions, key exchange groups, and cipher suites according to security and compatibility requirements. The current post-quantum protection applies to client-to-Azure Front Door TLS connections, while connections between Azure Front Door and backend services remain a separate encryption segment. This allows organizations to begin adopting post-quantum cryptography at the application edge without immediately modifying their backend infrastructure.

JWT validation for Application Gateway for Containers (preview)

Azure Application Gateway for Containers now supports centralized JSON Web Token (JWT) validation in Public Preview, enabling organizations to enforce authentication requirements directly at the application gateway rather than relying exclusively on backend applications. The capability uses the new AuthPolicy Kubernetes custom resource to validate token signatures, issuers, expiration and validity periods, and configured audiences, retrieving signing keys from trusted HTTPS JSON Web Key Set (JWKS) endpoints. Requests with missing or invalid credentials are rejected before reaching the backend, providing a consistent authentication enforcement point for containerized applications and APIs. AuthPolicy can be associated with ApplicationLoadBalancer, Gateway, HTTPRoute, GRPCRoute, and MCPRoute resources, supporting hierarchical policy inheritance while allowing more specific route-level policies to override inherited configurations or explicitly opt out. The integration supports Microsoft Entra ID and third-party identity providers that publish trusted JWKS signing keys. It can also work alongside Web Application Firewall (WAF) protections, allowing malicious requests to be inspected before authentication. Optional OAuth Protected Resource Metadata enables compatible clients to discover authorization servers and supported scopes, making the capability particularly relevant for securing HTTP, gRPC, and AI agent communication through a centralized gateway.

JWT validation with Azure Front Door Auth Policy (preview)

Azure Front Door Premium now supports JSON Web Token (JWT) validation through Auth Policy in Public Preview, enabling organizations to validate Microsoft Entra ID-issued bearer tokens directly at the Azure edge before requests reach backend applications and APIs. Administrators can associate an authentication policy with an Azure Front Door profile, domain, or route, specifying the expected token issuer and audience to enforce consistent authentication requirements across different application endpoints. The capability supports two operational modes: Block, which rejects requests containing missing or invalid tokens with an HTTP 401 Unauthorized response, and Log, which evaluates token validity without blocking traffic, allowing organizations to assess policy behavior before enforcement. By centralizing JWT validation at the edge, Azure Front Door can reduce unnecessary requests to backend services and simplify authentication controls across distributed applications. The preview focuses on validating existing bearer tokens rather than performing user authentication or application-specific authorization, which remains the responsibility of the backend application. Organizations should also restrict direct access to their origins to prevent clients from bypassing Azure Front Door authentication policies.

Azure Front Door mutual TLS authentication

Mutual TLS (mTLS) authentication for Azure Front Door Premium is now Generally Available (GA), enabling organizations to authenticate clients using X.509 certificates and strengthen protection for sensitive applications and APIs. The capability supports four authentication modes: require and validate, which makes client certificates mandatory and validates them at the Azure Front Door edge; require without validation, which requires a certificate but delegates validation to the origin; validate when presented, which validates optional client certificates; and pass through to origin, which delegates certificate validation to the backend application. Client certificates can be forwarded to the origin through the X-Azure-ClientCertificate request header, allowing backend services to apply additional identity and authorization controls. With General Availability, trusted Certificate Authority (CA) configuration has also been simplified: administrators can upload only the trusted root CA certificate to Azure Key Vault and associate it with an Azure Front Door custom domain. Clients must provide the necessary intermediate certificates during the TLS handshake, allowing Azure Front Door to construct and validate the complete certificate chain dynamically. This capability is particularly relevant for business-to-business integrations, IoT applications, financial services, and enterprise APIs that require certificate-based client authentication.

Rate limit grouping for Azure Front Door Premium WAF (preview)

Azure Front Door Premium Web Application Firewall (WAF) now supports rate limit grouping in Public Preview, introducing more advanced traffic aggregation capabilities to strengthen protection against distributed application-layer attacks. Traditional WAF rate-limiting rules count requests independently for each client IP address, making them less effective when malicious traffic is distributed across large numbers of IP addresses. With rate limit grouping, administrators can define alternative aggregation criteria, including JA4 fingerprints, Autonomous System (AS) numbers, and countries or regions, allowing traffic from multiple clients sharing the same characteristics to contribute toward a common rate-limit threshold. JA4-based grouping is particularly useful for detecting automated clients that rotate IP addresses while retaining similar TLS client fingerprints, while AS-based and geographic grouping help control traffic originating from specific networks or locations. Administrators can also select a None grouping option to apply a single rate limit across all requests matching a rule, such as requests targeting a sensitive authentication endpoint. Existing rules continue to use per-IP rate limiting unless explicitly reconfigured, and grouped rules can coexist with traditional per-IP rules. The capability can be managed through the Azure portal, ARM templates, Bicep, REST API, and Azure PowerShell, providing greater flexibility for implementing application-aware and distributed attack mitigation policies.

Native gRPC support in Azure Front Door (preview)

Azure Front Door Standard and Premium now provide native gRPC support in Public Preview, allowing organizations to securely expose and distribute gRPC-based applications and APIs through Azure’s global application delivery network. The capability supports gRPC over HTTP/2 and HTTPS throughout the communication path, from clients through Azure Front Door to backend origins, including both unary and streaming Remote Procedure Calls (RPCs). Administrators can configure routing based on specific gRPC services and methods, enabling more granular traffic distribution across backend applications while taking advantage of supported Azure Front Door routing and security capabilities. The preview also introduces gRPC health probes, allowing Azure Front Door to monitor backend service availability and distribute requests only to healthy origins. Native gRPC support is particularly relevant for microservices architectures, Kubernetes-based applications, and distributed backend services that rely on high-performance, strongly typed communication protocols. By extending its application delivery capabilities beyond traditional HTTP workloads, Azure Front Door provides a more consistent entry point for modern applications that combine REST APIs, web traffic, and gRPC services.

Azure Front Door edge actions

Azure Front Door edge actions are now Generally Available (GA), introducing serverless compute capabilities that allow organizations to execute lightweight JavaScript functions directly at Azure’s global edge locations during client request and response processing. Rather than forwarding every decision to backend services, edge actions enable application logic to execute closer to users, reducing unnecessary origin processing and supporting more responsive, flexible application delivery architectures. Common scenarios include A/B testing, canary deployments, HTTP header manipulation, request filtering, dynamic origin selection, advanced routing, and authentication or authorization logic at the edge. Edge actions integrate with existing Azure Front Door capabilities, including the rules engine, caching, routing, and Web Application Firewall (WAF), allowing developers to extend application delivery behavior without introducing additional infrastructure at the origin. The underlying execution environment is built on Hyperlight, Microsoft’s lightweight micro-VM technology, which provides hardware-backed isolation for customer code execution. With General Availability, Azure Front Door expands beyond content delivery and traffic management into programmable edge computing, enabling organizations to implement application-specific logic while maintaining centralized management and security controls.

MCP gateway for Application Gateway for Containers (preview)

Azure Application Gateway for Containers now supports Model Context Protocol (MCP) gateway capabilities in Public Preview, introducing the new MCPRoute Kubernetes custom resource for managing connectivity between AI agents and MCP servers running in Kubernetes environments. The capability allows platform teams to expose MCP services through stable hostnames and paths while centralizing TLS termination, JWT validation, Web Application Firewall (WAF) protection, backend health monitoring, and routing policies at the gateway. MCPRoute supports both direct routing to individual MCP servers and the aggregation of multiple independent servers behind a single logical endpoint. In aggregated configurations, the gateway combines tool, resource, and prompt discovery responses from different MCP servers, namespaces capability names to prevent conflicts, and automatically directs subsequent invocations to the appropriate backend. The capability also provides best-effort session affinity for MCP servers that maintain session state, together with backend TLS, health checks, and cross-namespace routing support. By providing a centralized and governed entry point for MCP traffic, Application Gateway for Containers helps organizations simplify the exposure, security, and operation of AI agent integrations while allowing individual teams to manage their own MCP services independently.

Private ingress for Application Gateway for Containers (preview)

Azure Application Gateway for Containers now supports private ingress in Public Preview, enabling Kubernetes applications and services to be exposed through private frontends accessible exclusively through approved Azure Private Link private endpoints. This capability allows organizations to eliminate public IP exposure and direct internet connectivity for internal applications while retaining the gateway’s existing Layer 7 routing, TLS, health probing, and Web Application Firewall (WAF) capabilities. Private ingress supports connectivity across virtual networks, subscriptions, Microsoft Entra tenants, and Azure regions, without requiring VNet peering, including scenarios where connected environments use overlapping IP address ranges. A single Application Gateway for Containers resource can host both public and private frontends, allowing organizations to apply different exposure models and security controls to individual workloads. Private endpoints must be explicitly provisioned and approved, providing additional control over which networks and consumers can access protected applications. The capability also supports architectures where Azure Firewall, network virtual appliances, or other upstream security services are positioned in front of Kubernetes workloads. This makes private ingress particularly valuable for enterprise applications, shared internal services, cross-cluster communication, and environments requiring strict network isolation and controlled application access.

Azure Firewall IPv6 application rules (preview)

Azure Firewall now supports application rules for IPv6 traffic in Public Preview, extending its Layer 7 filtering capabilities to HTTP and HTTPS connections over IPv6. Previously, IPv6 support focused on network-level filtering, limiting the ability to apply application-aware security controls consistently across dual-stack environments. With this enhancement, organizations can define application rules for IPv6 traffic and extend their existing firewall security policies to applications communicating over either IPv4 or IPv6.

The capability is particularly relevant for organizations modernizing their network infrastructure and adopting dual-stack architectures, where consistent security enforcement is essential across different IP protocols. By enabling application-level inspection and filtering for IPv6 HTTP and HTTPS traffic, Azure Firewall provides greater flexibility in controlling application connectivity while helping maintain a unified security posture as IPv6 adoption increases.

Storage

On-premises NAS share discovery and assessment with Azure Migrate (preview)

Azure Migrate now supports on-premises Network-Attached Storage (NAS) discovery and assessment in Public Preview, extending its migration planning capabilities to enterprise file storage environments. The Azure Migrate appliance can connect directly to Dell PowerScale (Isilon/OneFS) and NetApp ONTAP/FAS clusters using read-only credentials, automatically discovering and inventorying SMB, NFS, and S3 shares. Discovered shares can be grouped, tagged, and filtered alongside existing server, application, and database inventories, providing a more comprehensive view of the infrastructure being considered for migration. Azure Migrate can assess individual shares for migration readiness, recommend appropriately sized target configurations across Azure Files, Azure Blob Storage, and Azure NetApp Files, and estimate monthly Azure storage costs. The capability also integrates storage assessments into the broader Azure Migrate business case, allowing organizations to compare Azure storage options with on-premises costs and organize migration activities into phased migration waves. By bringing NAS discovery and assessment into the same workflow used for application and infrastructure migration planning, Microsoft aims to reduce manual analysis, improve cost transparency, and help organizations make more informed storage modernization decisions.

Azure Storage Actions adds automatic task updates, execution controls, and case-sensitive matching

Azure Storage Actions introduces three new capabilities, now Generally Available (GA), that improve automation management and operational control across Azure Blob Storage and Azure Data Lake Storage. First, changes made to a storage task definition are now automatically propagated to existing task assignments, ensuring that subsequent scheduled executions use the updated logic without requiring administrators to modify each assignment individually. Second, administrators can now request the termination of in-progress task assignment runs, either for a specific assignment or across all assignments associated with a storage task. Stop requests are processed asynchronously, providing additional flexibility when automated operations need to be interrupted. Finally, Azure Storage Actions introduces case-sensitive string comparison operators, including equals, contains, startsWith, endsWith, and matches, allowing tasks to identify and process objects more precisely when capitalization matters. Existing operators retain their case-insensitive behavior. Together, these improvements simplify the management of automated storage operations, reduce configuration overhead, and provide greater control over large-scale data management workflows.

Advanced capacity insights in Azure Storage Discovery (preview)

Azure Storage Discovery now provides advanced capacity insights in Public Preview, expanding its ability to analyze storage utilization and support data management decisions across large Azure Storage environments. The new capabilities provide more detailed visibility into data access patterns, data age, storage tiers, object size distribution, retention states, and versioning, helping organizations understand how storage capacity is consumed and identify the factors contributing to data growth.

These insights allow storage administrators and FinOps teams to identify opportunities for storage optimization, lifecycle management, and cost reduction by examining how data is distributed, accessed, retained, and protected. For example, access patterns and data age can help identify candidates for lower-cost storage tiers, while retention and versioning insights provide additional context for understanding capacity consumption and potential storage overhead. By bringing these dimensions into a centralized discovery experience, Azure Storage Discovery helps organizations move beyond basic capacity reporting toward more informed, evidence-based storage governance and optimization at scale.

Modernize Arc-enabled Windows Servers with Azure File Sync (preview)

Azure File Sync now provides a guided onboarding experience for Azure Arc-enabled Windows Servers in Public Preview, simplifying the integration of existing Windows file servers with Azure Files. The new Azure portal workflow brings together the main deployment steps, including Azure File Sync agent installation, server registration, and synchronization configuration with an Azure file share, reducing the operational effort previously required to configure these components separately. Azure File Sync enables organizations to maintain a complete copy of their file data in Azure Files while continuing to provide local access through existing Windows Servers, preserving the familiar file server experience for users and applications. The solution also supports cloud tiering, allowing frequently accessed files to remain available locally while less frequently used content is tiered to Azure, helping optimize on-premises storage consumption. By combining Azure Arc-based server management with a streamlined Azure File Sync deployment experience, Microsoft provides a more accessible path for organizations seeking to modernize traditional file services, implement hybrid file storage architectures, or progressively migrate file data to Azure without immediately replacing their existing Windows Server infrastructure.

Multi-disk crash-consistent VM restore points for Premium SSD v2 and Ultra Disks (preview)

Multi-disk crash-consistent restore points for Azure Virtual Machines using Premium SSD v2 and Ultra Disks are now available in Public Preview for VMs configured with SCSI disk controllers. This capability extends existing multi-disk crash-consistent restore point support beyond Standard HDD, Standard SSD, and Premium SSD disks, allowing organizations to capture an agentless, crash-consistent recovery point across multiple attached disks. This helps preserve a consistent point-in-time state for workloads spanning multiple disks without requiring in-guest agents or application-level integration.

The preview also introduces Instant Access support for multi-disk crash-consistent restore points involving Premium SSD v2 and Ultra data disks. With Instant Access, administrators can begin restoring a disk immediately after the restore point is created, without waiting for the background data copy to complete, potentially reducing Recovery Time Objectives (RTOs). The capability can be enabled by setting the consistencyMode parameter to CrashConsistent when creating a restore point within a restore point collection. Support is currently limited to VMs using SCSI disk controllers, and multi-disk crash-consistent restore points remain unsupported on VMs with NVMe controllers or Azure Boost hardware. The feature is particularly relevant for high-performance workloads that require coordinated disk recovery and faster restoration.

Conclusion

Over the past two weeks, Microsoft has introduced a slew of updates and announcements pertaining to Azure Infrastructure as a Service (IaaS) and Azure Local. These developments underscore the tech giant’s unwavering commitment to enhancing its cloud offerings and adapting to the ever-evolving needs of businesses and developers. Users of Azure can anticipate improved functionalities, streamlined services, and enriched features as a result of these changes. Stay tuned for more insights as I continue to monitor and report on Azure’s progression in the cloud sphere.