Azure Hybrid Management & Security: What’s New and Insights from the Field – October 2026

Once again this month, I’m back with my recurring series focused on the evolution of Azure management and security services, with a special focus on hybrid and multicloud scenarios enabled by Azure Arc and enhanced by the use of Artificial Intelligence.

This monthly series aims to:

• Provide an overview of the most relevant updates released by Microsoft;

• Share operational tips and field-proven best practices to help architects and IT leaders manage complex and distributed environments more effectively;

• Follow the evolution towards a centralized, proactive, and AI-driven management model, in line with Microsoft’s vision of AI-powered Management.

The main areas addressed in this series, together with the corresponding tools and services, are described in this article.

Hybrid and multicloud environment management

Azure Arc

Onboarding EKS and GKE clusters to Azure Arc via the Multicloud Connector (preview)

The Azure Arc Multicloud Connector introduces automatic onboarding of Amazon EKS and Google GKE clusters to Azure Arc-enabled Kubernetes, now in public preview.

The connector can discover clusters in connected AWS accounts and GCP projects, represent them as Azure resources, and automatically install the Azure Arc agents on the selected clusters. This removes the need for scripts or per-cluster onboarding procedures.

Once Arc-enabled, EKS and GKE clusters can be managed alongside AKS through Azure Policy for Kubernetes, Microsoft Defender for Cloud, Azure Monitor, GitOps with Flux v2, and Azure Resource Graph.

The preview also supports periodic synchronization, filtering by region and by tags or labels, proxy configurations, and the use of Azure Arc Gateway. This makes it easier to extend a consistent governance, security, and observability model to multicloud Kubernetes clusters.

Direct migration from Azure Arc to Azure SQL Database, including Hyperscale (preview)

Azure Arc now lets you select Azure SQL Database, including the Hyperscale tier, as a target directly from the database migration experience.

The workflow brings Azure Database Migration Service and the Self-hosted Integration Runtime configuration into a guided path in the portal. You can run assessments, choose the target, configure the migration, and track its progress without leaving the Azure Arc experience.

This means less switching between tools, and SQL Server assessment results can be turned into concrete modernization work toward Azure SQL Database more quickly.

Azure Arc-enabled SQL Server available in Italy North

Azure Arc-enabled SQL Server is now available in the Italy North region. You can connect SQL Server instances to Azure Arc and use centralized inventory, governance, security, assessment, and license management capabilities.

Regional availability allows Italian organizations to adopt these capabilities while keeping Italy North as the reference region for managing their Azure Arc-enabled resources.

AI and intelligent automation

Azure MCP Server 3.0: new AI-powered management and automation capabilities

Microsoft has made Azure MCP Server 3.0 generally available, expanding the functionality that AI agents and developer tools can reach through the open Model Context Protocol (MCP). The new version adds capabilities for infrastructure automation, data protection, resilience, and operational optimization.

Key additions include integrations with Azure Terraform, which provide access to provider documentation, Azure Verified Modules, and resource export and policy validation features. New tools are also available for Azure Backup and Azure Resilience Management, covering data protection, recovery planning, and resilience validation. The Azure Advisor integration expands resource analysis and optimization capabilities.

Version 3.0 also improves integration reliability, introduces stricter default security configurations for several Azure services, and supports structured output. Since the release includes breaking changes, Microsoft recommends checking that existing integrations are compatible before upgrading.

This evolution strengthens Azure MCP Server’s role as an interface for bringing Azure management and governance capabilities into AI-assisted operational workflows.

Security posture across hybrid and multicloud infrastructures

Microsoft Defender for Cloud

Posture Policy and exemption management in Microsoft Defender (preview)

Microsoft has introduced, in public preview, the ability to manage Posture Policies and recommendation exemptions directly in the Microsoft Defender portal for Azure environments. The new experience lets you assess the security posture of your resources against the Microsoft Defender for Cloud baseline. You can also define custom policies based on business, operational, and compliance requirements. Exemptions can be managed centrally, with their lifecycle tracked, which improves governance of accepted risks. This capability is a further step toward centralizing Cloud Security Posture Management in the Microsoft Defender portal.

Expanded server onboarding capabilities in Microsoft Defender

Microsoft has expanded the new server security experience in the Defender portal by adding onboarding procedures for Azure virtual machines and on-premises servers. Azure VMs and Azure Arc-enabled servers can be onboarded automatically through Defender for Servers. Windows and Linux systems can also be onboarded manually through Defender for Endpoint. On-premises servers can be onboarded through Azure Arc or Direct Onboarding. The new experience also lets you check onboarding status and review the available offboarding options. Servers already protected by Defender for Endpoint require no reinstallation or migration.

Cloud security plan management in the Microsoft Defender portal (preview)

Microsoft has announced the public preview of cloud security plan management directly in the Microsoft Defender portal for commercial Azure environments. The new experience lets you connect subscriptions and management groups, centrally enable and configure protection plans, and monitor their costs. It also introduces a new billing model based on Defender Workload Units (DWUs), with dedicated cost estimation tools and 30-day free trials for eligible plans. Once you migrate to the new experience, plans are configured from the Defender portal, while the Azure portal keeps a read-only view.

New server security experience in Microsoft Defender

Microsoft has introduced a new unified server security experience that brings together information from Defender for Endpoint and Defender for Servers in the Microsoft Defender portal. The new asset page combines cloud and endpoint data, so you can analyze servers, alerts, incidents, and relationships in the attack graph. The Go hunt feature also lets you take investigations further through threat hunting. Access management is centralized through RBAC, device groups, and cloud scopes, giving a more complete and consistent view of server security across hybrid environments.

KSPM recommendations at the workload controller level

Microsoft Defender for Cloud has updated its Kubernetes Security Posture Management (KSPM) misconfiguration recommendations. Their scope has moved from individual container instances to higher-level Kubernetes controllers such as Deployments and StatefulSets. Recommendations are now tied directly to the resources that manage the workload lifecycle, making it easier to identify the configurations that need fixing. As a result, you may see changes in the number of recommendations displayed and in their impact on Secure Score.

Selective on-demand malware scanning in Microsoft Defender for Storage

Microsoft Defender for Storage now supports on-demand malware scanning of specific items, without having to scan the entire storage account. Scans can be limited to individual blobs or files, containers, file shares, or objects identified by a path prefix. Items are selected through filters defined in REST API requests; if no filters are specified, the entire storage account is scanned. This finer granularity makes targeted checks simpler and makes it easier to build scanning into automated security and incident response processes.

Governance and policy management

Azure Policy

Azure Policy Linter goes open source

Microsoft has open-sourced Azure Policy Linter, a command-line tool that detects errors, known issues, and deviations from best practices when authoring Azure Policy definitions.

The linter brings checks forward into the development phase, before a policy is assigned to Azure environments, and can be integrated into CI/CD pipelines. It can analyze individual definitions or entire libraries, produces JSON output for automated processes, and offers multiple configurable rule sets.

Being open source, the linter encourages a shift-left approach to governance. It reduces the risk of incorrect policies blocking legitimate deployments or producing misleading compliance results.

Backup & Resilience

Azure Backup

Cross-Tenant Restore with Azure Backup (preview)

Azure Backup introduces Cross-Tenant Restore (CTR), now in public preview, which allows Azure virtual machine backups to be restored to a tenant other than the source one. This makes it possible to set up an independent recovery path, strengthening resilience against cyberattacks and scenarios where the primary tenant is compromised. Restores use existing backup copies, so there is no need to create and manage duplicate data. This capability broadens the design options for Disaster Recovery and Cyber Recovery strategies, adding a further layer of isolation between the production and recovery environments.

Item-Level Recovery for VMs with Premium SSD v2 and Ultra Disk

Azure Backup now supports Item-Level Recovery for Azure virtual machines using Premium SSD v2 and Ultra Disk, with 512-byte or 4 KB logical sector sizes.

You can therefore recover individual files and folders from a recovery point without performing a full disk or VM restore. Using the Azure portal, CLI, or PowerShell, you can generate the file recovery executable or script, access the recovery point, and selectively copy the data you need.

Azure Backup for PostgreSQL Flexible Server and Elastic Cluster v2 (preview)

Azure Backup introduces, in preview, a new version of its protection for PostgreSQL Flexible Server and Elastic Cluster. It is based on physical backups taken via managed disk snapshots and stored in an Azure Backup vault.

The solution supports servers up to 32 TB on Premium SSD v1 and up to 64 TB on Premium SSD v2. After the first full backup, subsequent backups are incremental, with daily or weekly schedules, on-demand backups, and configurable retention from 7 days up to 10 years.

Compared to the previous version, the new model removes the 1 TB limit and introduces Restore as Server. You can restore directly to a pre-created Flexible Server or Elastic Cluster without intermediate storage or manual imports. Soft delete, immutability, Multi-user Authorization, Customer-Managed Key encryption, and WORM backups are also supported.

Azure Site Recovery

Azure Site Recovery for Azure Arc-enabled VMware and physical Windows servers

Azure Site Recovery now supports Disaster Recovery for Azure Arc-enabled on-premises Windows servers running on VMware or on physical hardware.

Organizations can therefore use ASR to protect machines already managed through Azure Arc, while continuing to use Arc for inventory, governance, monitoring, and centralized management.

This integration simplifies the management of hybrid environments by adding Disaster Recovery through Azure Site Recovery to Azure Arc’s management capabilities.

Monitoring

Azure Monitor

Network Security Perimeter metrics

Network Security Perimeter metrics are now available, so you can monitor traffic associated with perimeter-protected resources through Azure Monitor.

The metrics let you analyze allowed and denied requests, inbound and outbound traffic, access patterns, and unexpected access attempts. You can also check the impact of rule changes. They can also be used to establish a baseline before moving a perimeter from Transition mode to Enforced mode.

Because the metrics are integrated into Azure Monitor, you can use them to build dashboards, workbooks, trend analyses, and operational alerts.

Advanced Platform Metrics for Azure Monitor

Azure Monitor Advanced Platform Metrics are now available. They introduce more granular signals that help you spot changes, trends, and anomalies in monitored resources more quickly.

The feature can be enabled directly from the Azure portal and is now also available in the Fairfax and Mooncake environments, extending coverage beyond the public cloud.

Metrics Usage Insights for Azure Monitor Workspace

Metrics Usage Insights is now available, helping you better understand how metrics are used within an Azure Monitor Workspace. It lets you monitor overall usage, identify unused metrics, analyze trends, and investigate changes in ingestion volumes. These insights support both cost optimization and workspace capacity planning.

Microsoft-managed SQL performance monitoring (preview)

Microsoft has extended platform-managed SQL performance monitoring, in public preview, to SQL Server on Azure Virtual Machines, Azure SQL Database, and Azure Arc-enabled SQL Server. Telemetry is collected and managed directly by Microsoft, so there is no need to build custom pipelines or scripts.

Per-resource and estate-wide dashboards help identify trends, anomalies, and bottlenecks. Integration with Fabric Database Hub provides a unified view. For advanced analysis, the data can be queried using Kusto Query Language through RBAC-protected endpoints. Azure Arc-enabled SQL Server also gets built-in Grafana dashboards, and you can connect existing Grafana environments to the same telemetry endpoint.

Hardware Audit Logging for Azure Cloud HSM

Azure Cloud HSM introduces Hardware Audit Logging, which generates audit records directly from the HSM for supported management operations.

The logs include human-readable information, HSM-signed binary data, signatures, and certificates, so organizations can independently verify their authenticity and integrity. Events are sent to Azure Monitor Log Analytics and can therefore be integrated into existing monitoring, compliance, and forensic analysis processes.

This capability strengthens the traceability of critical operations and supports scenarios with stringent governance and control requirements.

Conclusions

The October 2026 updates continue to bring together management, security, and resilience across hybrid and multicloud environments. Azure Arc further strengthens its role as the bridge between infrastructure and services. At the same time, the evolution of Microsoft Defender and Azure Monitor provides a more consistent view of resources, risks, and performance. New automation capabilities, including AI-driven ones, make it even more important to keep inventories up to date, validate policies, and clearly define operational responsibilities.

For those managing these environments, my advice is to adopt these capabilities gradually, based on real needs. Test preview features in controlled settings, check that integrations are compatible, and assess the impact on costs and existing processes. New backup and Disaster Recovery options should also come with regular restore tests to confirm they meet recovery objectives. The value of these developments is measured by the ability to turn them into reliable, sustainable processes, with verifiable results in protection, efficiency, and operational continuity.