Azure IaaS and Azure Local: announcements and updates (October 2026 – Weeks: 41 and 42)
This blog post series highlights the key announcements and major updates related to Azure Infrastructure as a Service (IaaS) and Azure Local, as officially released by Microsoft in the past two weeks.
Azure
Compute
Automatic zone balance for Virtual Machine Scale Sets
Automatic zone balance for Azure Virtual Machine Scale Sets is now Generally Available (GA), helping maintain a more even distribution of VM instances across availability zones. The capability continuously monitors zonal distribution and automatically rebalances instances when an imbalance occurs, reducing the risk that a single-zone failure disproportionately affects the application.
Azure uses a create-before-delete approach during rebalancing: a replacement VM is first created in an under-provisioned zone and its health is validated before an instance is removed from the over-provisioned zone. Built-in safeguards respect instance protection policies, coordinate with Azure Autoscale, avoid interference with active or recently completed scale-set operations, enforce cooldown periods, and replace only one VM at a time. Automatic zone balance is primarily intended for stateless workloads and requires at least two availability zones, zonal VM instances, and application health monitoring. It can be configured through the Azure portal, Azure CLI, PowerShell, or REST API.
Networking
Standard service endpoint
Standard service endpoint introduces a new connectivity model within the Azure Private Link family for scalable and secure communication between Azure IaaS workloads and supported Azure PaaS services. Unlike traditional service endpoints, the capability uses Public IP addresses as network identifiers and integrates with Network Security Perimeter (NSP), helping address manageability and scale limitations in large environments. A Public IP instance can be associated with multiple subnets and virtual networks across subscriptions within the same tenant and Azure region, providing a reusable identity for IaaS-to-PaaS connectivity.
When combined with Network Security Perimeter, organizations can establish a logical security boundary around supported services including Azure Storage, Azure SQL Database, Azure Cosmos DB, and Azure Key Vault, restricting access to approved networks and workloads while simplifying connectivity management. Standard service endpoint is a paid Azure feature, billed at a fixed rate per virtual network per hour.
Exceptions in WAF for Azure Application Gateway and Azure Front Door
Web Application Firewall (WAF) exceptions for Azure Application Gateway and Azure Front Door are now Generally Available (GA), providing more granular control over how trusted application traffic is evaluated. Existing WAF exclusions allow specific request attributes—such as headers, cookies, query string arguments, or body fields—to be omitted from inspection while the rest of the request continues to be analyzed. Exceptions extend this model by allowing matching requests to bypass WAF inspection at the individual rule, rule group, or managed ruleset level. Exceptions can be defined using criteria such as request URI, remote IP address, or request header name and value, helping organizations reduce false positives and tune policies more precisely while keeping the remaining WAF protections active.
IPv6 support for Azure Application Gateway WAF (preview)
Azure Application Gateway Web Application Firewall (WAF) now supports IPv6 traffic inspection and enforcement in Public Preview, extending WAF protection to dual-stack application environments. Managed rule sets, custom rules, and diagnostics can now be applied to IPv6 traffic, allowing customers to maintain consistent application security controls across both IPv4 and IPv6 connections. This capability is particularly relevant as organizations expand IPv6 adoption while preserving the same WAF security posture used for existing IPv4 workloads. During the preview, IPv6 geo-based custom rules are also available through AFEC enrollment, providing additional location-based traffic governance for IPv6 requests.
Storage
Azure Files cross-region data copy and synchronization with Azure Storage Mover (preview)
Azure Storage Mover now supports Azure Files cross-region data copy and synchronization in Public Preview, allowing customers to copy and synchronize file share data across storage accounts, Azure regions, and subscriptions within the same Microsoft Entra tenant. Incremental transfers can be scheduled to maintain secondary copies for business continuity scenarios, consolidate file shares, move data between regions, or place datasets closer to applications and analytics workloads. The service provides centralized scheduling, monitoring, auditing, and metadata preservation, offering a managed approach to recurring Azure Files replication and synchronization operations without requiring customers to build and operate their own copy workflows.
Azure Local
Azure Site Recovery for Azure Local
Azure Site Recovery (ASR) for Azure Local is now Generally Available (GA), providing a fully supported disaster recovery solution for production workloads running on Azure Local and replicating them to Azure. The service is available across all Azure Local-supported regions and provides an integrated disaster recovery experience directly from the Azure Local resource in the Azure portal.
A major improvement introduced with GA is a new single-page deployment wizard that significantly simplifies infrastructure preparation. From the Azure Local Disaster Recovery experience, administrators can create or select a Recovery Services vault, configure a Hyper-V site and replication policy, optionally define proxy settings, and prepare the entire cluster in a single operation. Azure automatically downloads and installs the ASR agent on every cluster node, registers the hosts with Azure Site Recovery, and associates them with the selected replication policy, eliminating the need to repeat configuration steps for individual nodes. Once preparation is complete, administrators can select the virtual machines to protect and enable replication directly from the same experience.
The GA release also removes two important limitations present during the preview. Azure Site Recovery now supports Windows Defender Application Control (WDAC) in enforcement mode, allowing organizations to deploy the ASR agent without temporarily relaxing application-control policies. This is particularly relevant for regulated and security-sensitive environments. In addition, proxy configuration is now integrated directly into the deployment wizard, including proxy host, port, and credentials, ensuring consistent outbound connectivity settings across all Azure Local nodes without separate configuration files or post-installation steps.
Azure Site Recovery for Azure Local supports the complete disaster recovery lifecycle. VM disks are continuously replicated to Azure Storage, customers can perform non-disruptive test failovers in isolated Azure networks, and both planned and unplanned failovers are supported for Windows and Linux, Generation 1 and Generation 2 virtual machines. Recovery Plans can orchestrate multi-VM application recovery with sequencing, dependencies, and automation, while failback enables workloads to return to the original Azure Local environment once the primary site has been restored. Reverse replication can then re-establish ongoing protection.
The solution is particularly relevant for organizations that want to use Azure as a disaster recovery extension of their Azure Local environment, including regulated industries where business continuity requirements, restricted outbound connectivity, and WDAC enforcement are common. Internet connectivity to Azure, either directly or through the newly integrated proxy configuration, remains required for replication traffic. Trusted Launch VM support and the ability to fail back to an alternate on-premises location are planned for future releases.
Conclusion
Over the past two weeks, Microsoft has introduced a slew of updates and announcements pertaining to Azure Infrastructure as a Service (IaaS) and Azure Local. These developments underscore the tech giant’s unwavering commitment to enhancing its cloud offerings and adapting to the ever-evolving needs of businesses and developers. Users of Azure can anticipate improved functionalities, streamlined services, and enriched features as a result of these changes. Stay tuned for more insights as I continue to monitor and report on Azure’s progression in the cloud sphere.
