This blog post series highlights the key announcements and major updates related to Azure Infrastructure as a Service (IaaS) and Azure Local, as officially released by Microsoft in the past two weeks.

Azure

General

Azure MCP Server 3.0

Azure MCP Server 3.0 is now Generally Available (GA), expanding the capabilities available to AI agents and developer tools through the open Model Context Protocol (MCP). The release introduces additional tools for infrastructure automation, protection and recovery, and operational optimization. New Azure Terraform integrations provide access to provider documentation, Azure Verified Modules, resource export, and policy validation, while Azure Backup and Azure Resilience Management tools support backup protection, recovery planning, readiness assessments, and recovery drills. Expanded Azure Advisor capabilities also help agents evaluate optimization recommendations, compare resource configurations, and analyze utilization.

Version 3.0 strengthens integration reliability through clearer tool contracts, stricter input and endpoint validation, and optional structured output. It also introduces more secure default configurations when creating Azure Storage accounts, Event Hubs namespaces, NFS file shares, and Recovery Services vaults. As the release includes breaking changes, organizations using existing MCP integrations or shared deployments should review Microsoft’s upgrade guidance before adopting the new version. These improvements provide a more comprehensive and predictable interface for integrating Azure management and operational capabilities into AI-assisted workflows.

Microsoft Marketplace private offer purchase enhancements

Microsoft Marketplace is simplifying the purchase experience for eligible private offers, reducing the number of steps required to acquire products with negotiated pricing and contractual terms. Previously, customers needed to accept a private offer before separately purchasing the individual products included in it. With the updated experience, eligible private offers allow customers to purchase all included products in a single step, streamlining procurement and reducing administrative effort. The enhancement preserves existing purchase governance through Azure role-based access control (RBAC) and the billing administrator role, ensuring that purchasing permissions remain aligned with organizational policies. The simplified experience is currently being enabled for Software as a Service (SaaS) and Professional Services offer types, making it easier for organizations to complete negotiated Marketplace transactions while maintaining established financial and governance controls.

Compute

Large OS Disk Encryption for Azure Confidential VM migrations

Large OS Disk Encryption (LOSDE) is now Generally Available (GA) for Azure Confidential VM migration scenarios, allowing organizations to migrate production-scale workloads with large operating system disks into confidential computing environments. During migration, the OS disk is protected using confidential disk encryption, covering all critical partitions and binding encryption keys to the VM’s virtual Trusted Platform Module (vTPM). Keys are released only after successful platform attestation, ensuring that encrypted disk content is accessible exclusively to the authorized VM rather than the host or hypervisor. By integrating encryption directly into the migration process, LOSDE eliminates the need to shrink, rebuild, or separately re-encrypt large system images and enables workloads to move into a hardware-enforced trusted execution environment without application code changes. Customers can use platform-managed keys or customer-managed keys backed by Azure Key Vault Premium or Azure Key Vault Managed HSM, maintaining flexibility over encryption key ownership and management.

Networking

HTTP DDoS ruleset for Azure Front Door Premium WAF

The HTTP DDoS ruleset for Azure Front Door Premium Web Application Firewall (WAF) is now Generally Available (GA), providing automated and adaptive Layer 7 DDoS protection against application-layer attacks. Unlike static IP filtering or fixed rate-limiting configurations, the ruleset continuously learns normal traffic patterns at both the Azure Front Door profile and individual client levels, identifying anomalous traffic surges and selectively mitigating suspicious requests. The GA release includes two protection rules: one targeting clients generating abnormally high request rates and another identifying suspected malicious bots using Microsoft Threat Intelligence. Each rule supports three sensitivity levels, allowing organizations to adjust detection behavior according to their traffic characteristics.

The ruleset also integrates with WAF exceptions, enabling trusted traffic such as monitoring probes and authorized load tests to bypass selected protections. Two additional geographic-based detection rules are available in Public Preview, dynamically establishing traffic thresholds for the countries and regions generating the highest request volumes, together with a combined threshold for other locations. All rules initially use the Log action, allowing administrators to review detection results before enabling active enforcement. This approach helps organizations strengthen application availability while reducing the operational effort associated with manually tuning DDoS protection policies.

Disable VNet peering route (preview)

Disable VNet peering route (DPR) is now available in Public Preview, introducing a new route-table capability that provides greater control over traffic between peered Azure virtual networks. When enabled, DPR suppresses the system-generated routes normally created by VNet peering on subnets associated with the route table, while leaving the underlying peering connection intact. In large hub-and-spoke architectures, this can be combined with summarized user-defined routes (UDRs) to steer traffic through a network virtual appliance such as Azure Firewall, avoiding the need to maintain individual route overrides for every spoke. DPR can be configured directly through route tables or centrally through Azure Virtual Network Manager routing rule collections. Customers remain responsible for defining the replacement UDRs and inspection paths, as DPR only suppresses the automatically generated peering routes.

Service tag match condition for Azure Front Door Premium WAF

The service tag match condition for Azure Web Application Firewall (WAF) custom rules on Azure Front Door Premium is now Generally Available (GA). Azure service tags represent groups of IP address prefixes associated with specific Azure services and are automatically maintained by Microsoft as those addresses change. WAF custom rules can now evaluate the source IP address of an HTTP request against these service tags, reducing the need to manually maintain large IP allowlists or blocklists. Organizations can use this capability to allow traffic from trusted Azure services such as monitoring or health-check systems, block requests originating from unexpected Azure services, restrict sensitive application paths by combining service tags with URI, host, or HTTP method conditions, or apply rate limiting to traffic from selected Azure services.

Keyless TLS on Azure Application Gateway with Azure Key Vault Managed HSM

Azure Application Gateway now supports keyless TLS termination with Azure Key Vault Managed HSM, allowing TLS certificates to be used while their private keys remain protected inside the Managed HSM boundary. During each TLS handshake, cryptographic signing operations are performed directly within the HSM and the private key is never exported to Application Gateway. This architecture enables organizations to maintain stronger control over private-key custody while using managed identities and role-based access control (RBAC) for key access. Signing operations can also be monitored through Managed HSM diagnostic logs, while organizations can obtain cryptographic evidence that the TLS key was generated and remains stored within a FIPS 140-3 Level 3 validated HSM. The capability is particularly relevant for environments requiring centralized key management, separation of duties, and stringent cryptographic compliance controls.

Azure DNS Traffic Manager linked records

Azure DNS now integrates directly with Azure Traffic Manager through linked record sets, enabling DNS-based load balancing without requiring a CNAME record that points to the traditional trafficmanager.net domain. Customers can directly associate an Azure DNS record set with a Traffic Manager profile, simplifying DNS configuration and eliminating an additional CNAME lookup from the resolution path. This can reduce DNS lookup latency and also improves compatibility with DNSSEC-protected load-balanced records, because the unsigned trafficmanager.net domain no longer needs to appear in the DNS resolution chain.

Azure Local

Azure Local: Features and improvements in 2610

Microsoft has released the October 2026 update for Azure Local, version 12.2610.1004.41, with OS build 26100.33650. The release also updates the platform to .NET 8.0.32, .NET 10.0.13, and PowerShell 7.6.6, while requiring drivers compatible with the new OS build or Windows Server 2025. For Integrated System and Premier solution hardware, customers should work with their OEM to obtain validated OS images and compatible drivers.

A major focus of 2610 is the continued evolution of disaggregated and SAN-based Azure Local architectures. Rack-aware clusters with SAN are now available in preview, enabling workload protection across two rooms with synchronized storage replication while keeping compute and storage independently managed. The Azure portal deployment wizard also adds support for configuring a disk witness for SAN deployments and defining iSCSI settings on a per-node basis, reducing the amount of manual configuration required for SAN-based environments. Microsoft is also moving composed ISO releases to a semiannual cadence, aligned with OEM validation and release cycles.

The release introduces several improvements to connectivity and lifecycle management. Existing Azure Local deployments can now update proxy settings, enable the Azure Arc gateway after deployment, or move from public outbound connectivity to the Azure Local private path architecture, all currently in preview. Azure Local also starts automatically creating a Provisioned Machine resource for each Arc-enabled server in a cluster, providing a corresponding Azure resource that is created and maintained by the platform without requiring administrator action.

On the security side, Confidential VMs powered by AMD SEV-SNP on AMD Genoa platforms are now Generally Available, providing workload attestation and memory encryption for sensitive virtual machines. The 2610 release also expands the Azure Local security baseline from 408 to 429 evaluated settings, increasing alignment with CIS and DISA STIG recommendations. Administrators can now customize supported baseline settings while retaining drift control, with guardrails preventing changes that could compromise platform integrity. Microsoft has also aligned Azure Local terminology and PowerShell cmdlets with the new App Control for Business naming, while maintaining compatibility with existing scripts.

Update management also receives an important improvement with combined OS and Solution Builder Extension (SBE) Cluster-Aware Updating, allowing the operating system, OEM firmware, and drivers to be updated within a single coordinated CAU run. Starting in November 2026, OS cumulative security updates and .NET updates will also be released in the same week as Patch Tuesday, allowing Azure Local customers to address vulnerabilities earlier without waiting for a broader cumulative or feature release.

Additional operational enhancements include new built-in Azure RBAC roles for Azure Local infrastructure management in preview, initially focused on GPU infrastructure, a new SANDiagnostics Get-SolutionHealthSummary log collection role for Fibre Channel, iSCSI, MPIO, disks, volumes, and related SAN components, and the new  PowerShell command, which provides a concise view of the most recent solution health checks and highlights critical issues requiring immediate attention.

Azure Migrate for Azure Local also continues to evolve independently of the Azure Local release cadence. A notable new capability allows migrations from VMware and Hyper-V to reuse existing Azure Arc-enabled server resources, preserving tags, RBAC assignments, Azure Policy settings, monitoring configuration, and VM extensions when workloads are migrated to Azure Local. The release also adds US Gov Arizona as an Azure Local deployment region in preview, extending Azure Government support beyond US Gov Virginia with support up to Impact Level 5 (IL5).

Azure Copilot for Azure Local

Microsoft has announced Azure Copilot for Azure Local, an AI-powered, agentic operations experience designed to simplify management and troubleshooting across distributed Azure Local environments. Operators will be able to start investigations using natural-language questions such as why a cluster is disconnected, whether a node is healthy, why a deployment failed, or whether an environment is ready for an update. Azure Copilot translates the operator’s intent into a guided troubleshooting workflow that brings together infrastructure context, health information, diagnostics, logs, and relevant troubleshooting knowledge.

For supported scenarios, the experience goes beyond answering questions by orchestrating multi-step investigations: gathering context, running diagnostics, analysing findings, and recommending possible next actions while keeping the operator in control. Initial scenarios include infrastructure health, connectivity troubleshooting, network configuration, deployment failures, update readiness, and diagnostic and log collection. The objective is to reduce the effort required to correlate information across multiple tools and make complex infrastructure investigations easier to understand and act on. Azure Copilot for Azure Local is planned to enter Public Preview in early 2027.

Scheduled backups for Azure Local with disconnected operations

With the Azure Local 2609 release, Microsoft has introduced scheduled backups for Azure Local with disconnected operations, extending the existing on-demand backup capability for the local control plane. The feature is designed to improve recovery readiness in sovereign, regulated, and isolated environments by reducing dependence on manually triggered backups and allowing organizations to maintain recovery points according to a defined operational cadence.

Administrators can configure automated backups to run twice daily, daily, weekly, or monthly, with each schedule referencing a backup configuration that defines the target SMB share and encryption certificate. Both a default configuration and additional named configurations can be used, allowing scheduled backups to target different protected destinations where required. The schedule can also be paused, resumed, or removed, and Azure Local exposes the next planned execution time together with backup status and provenance information.

The capability protects the Azure Local disconnected operations control plane, including the authoritative platform state and metadata required to operate the environment, such as subscriptions, resource groups, policies, and connected Azure Local resources. It is important to note that these backups do not protect workload virtual machines or configured workload clusters, which continue to require their own application and infrastructure backup strategy. By automating protection of the local control plane, scheduled backups strengthen the resilience model for Azure Local deployments that must continue operating without dependence on public Azure connectivity.

Conclusion

Over the past two weeks, Microsoft has introduced a slew of updates and announcements pertaining to Azure Infrastructure as a Service (IaaS) and Azure Local. These developments underscore the tech giant’s unwavering commitment to enhancing its cloud offerings and adapting to the ever-evolving needs of businesses and developers. Users of Azure can anticipate improved functionalities, streamlined services, and enriched features as a result of these changes. Stay tuned for more insights as I continue to monitor and report on Azure’s progression in the cloud sphere.