This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Web Application Firewall (WAF) for Azure Front Door service is generally available

Customers can use WAF to define security policies that allow, block, forward or rate limit access to their web applications delivered through Azure Front Door.

• A WAF security policy may consist of an ordered list of custom rules and Azure managed pre-configured rulesets.
• Custom rules are based on a combination of client IP addresses, geolocation, http parameters, request methods and size constraints.
• The pre-configured default rule set can be enabled to protect your applications from OWASP top 10 threats.
• New or updated WAF configurations are deployed globally within minutes, letting you respond quickly to changing attack patterns.
• WAF for Azure Front Door is integrated with Azure Monitor and the logs can be accessed through an Azure storage account, Azure Event Hub or Azure Log Analytics.

DevTest Labs supports the Shared Image Gallery feature

It enables lab users to access images from a shared location while creating lab resources. It also helps you build structure and organization around your custom-managed VM images.

High-Performance Computing Virtual Machines are available in West US 2, East US

HC-series Virtual Machines, designed to provide supercomputer-grade performance and scalability with the best price-performance on the public cloud, are generally available in West US 2 and East US.

Azure File Sync is GA for Azure Government cloud

Azure File Sync is generally available for Azure Government cloud. Azure File Sync in Government Cloud can be used with the same v6 agent that a customer would use in public cloud. It is at feature parity with what’s available publicly.

Azure Shared Image Gallery are generally available

Shared Image Gallery provides a simple way to share your applications with others in your organization, within or across Azure Active Directory (AD) tenants and regions. This enables you to expedite regional expansion or DevOps processes and simplify your cross-region HA/DR setup.

Azure DevTest Labs: PowerShell module to simplify management of labs

You can now make use of Az.DevTestLabs, a PowerShell module to simplify the management of Azure DevTest Labs. It provides composable functions to create, query, update and delete labs, virtual machines, custom images and environments. 

Advanced data security for SQL servers on IaaS

Advanced data security is now available for SQL Server on Azure Virtual Machines. Advanced data security for SQL Server on Azure Virtual Machines currently includes functionality for surfacing and mitigating potential database vulnerabilities and detecting anomalous activities that could indicate a threat to your server.

Adaptive Network Hardening in Security Center id generally available

Security Center learns the network traffic and connectivity patterns of Azure workloads and provides NSG rule recommendations, for Internet facing virtual machines. This helps our customer better configure their network access policies and limit their exposure to attacks. 

Azure Application Gateway Web Application Firewall custom rules are Generally Available

Custom rules for WAF_v2 allow customers to create their own rules with IP/IP range or String based matching conditions. For example, customers will be able to create rules which block requests from a specific IP range, or those matching a specific regular expression in the request’s header/cookie/URI/queryString/form elements. Users can also join multiple matching conditions into a single custom rule. More details can be found here. 

Update rollup for Azure File Sync Agent

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Generation 2 virtual machines in Azure in Public Preview

Generation 2 virtual machines use the new UEFI-based boot architecture vs. the BIOS-based architecture used by Generation 1 VMs. The new architecture enables customers to:

• Build large virtual machines (up to 12TB)
• Provision OS disks sizes that exceed 2TB, and
• Leverage advanced security capabilities like SecureBoot and Virtual Trusted Platform Module (vTPM) to secure their Virtual Machines.

If you want to take advantage of these features, you can now create Generation 2 virtual machines in Azure. For a complete list of capabilities, limitations and details associated with the deployment of Generation 2 virtual machines on Azure, please refer to this documentation.

Azure DDoS Protection Standard introduces DDoS Alert integration with Azure Security Center

DDoS Protection Standard customers can view DDoS Alerts in Azure Security Center (ASC) and this capability is generally available for all ASC and DDoS Standard customers. These DDoS alerts will be available for review in the Security Center in near real-time without any setup or manual integrations required and will provide details on DDoS attacks detected and automatically mitigated by the service.

General availability of Azure NetApp Files

Azure NetApp Files, the industry’s first bare-metal cloud file storage and data management service, is general availability (GA). Azure NetApp Files is an Azure first-party service for migrating and running the most demanding enterprise file-workloads in the cloud including databases, SAP, and high-performance computing applications with no code changes. Azure NetApp Files is a fully managed cloud service with full Azure portal integration. It’s sold and supported exclusively by Microsoft. Customers can seamlessly migrate and run applications in the cloud without worrying about procuring or managing storage infrastructure. Additionally, customers can purchase Azure NetApp Files and get support through existing Azure agreements, with no up-front or separate term agreement.

OpenVPN support in Azure VPN gateways

Microsoft announced the General Availability (GA) of OpenVPN protocol in Azure VPN gateways for P2S connectivity. Form more details you can read this article.

Azure Mv2 Virtual Machines are generally available

Azure Mv2-series virtual machines are hyper-threaded and feature Intel® Xeon® Platinum 8180M 2.5GHz (Skylake) processor, offering up to 208 vCPU in 3TB and 6 TB memory configurations. Mv2 virtual machines provide unparalleled computational performance to support large in-memory databases and workloads such as SAP HANA and SQL Hekaton. Mv2-series VMs are certified by SAP for SAP HANA OLTP and OLAP production workloads. Mv2 VMs are available in US East and US East 2 regions. Mv2 VMs in U.S. West 2, Europe West, Europe North and Southeast Asia regions will become available in the coming months. 

Azure Stack

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Public IP Prefix

A Public IP prefix is a reserved range of static IP addresses that can be assigned to your subscription. You can use a prefix to simplify IP address management in Azure. Knowledge of the range ahead of time eliminates the need to change firewall rules as you assign IP addresses to new resources. This predictability significantly reduces management overhead when scaling in Azure. Public IP Prefix is available in all Azure public regions, Government cloud regions and China cloud regions.

Azure Premium Files preview

Azure Premium Files preview is available. Premium Files is a new performance tier for Azure Files, which is designed for IO intensive workloads with low latency and higher throughput requirements. Premium files storage provides consistent low latency and offers high throughput and IOPS that scales with your storage. Premium tier provides 20x capacity, 100x IOPS and 170x throughput as compared to the existing standard tier. For more details, see the Premium Files redefines limits for Azure Files blog.

Update rollup for Azure File Sync Agent: May 2019

An update rollup for the Azure File Sync agent was released today.

Improvements and issues that are fixed:

• Windows Admin Center fails to display the agent version and server endpoint configuration on servers which have Azure File Sync agent version 6.0 installed.

More information about this update rollup:

• This update is available for Windows Server 2012 R2, Windows Server 2016 and Windows Server 2019 installations that have Azure File Sync agent version 4.0.1.0 or later installed.
• The agent version of this update rollup is 6.1.0.0.
• A restart may be required if files are in use during the update rollup installation.
• Installation instructions are documented in KB4489737.

Azure File Sync is supported in West US 2 and West Central US

Azure File Sync is now supported in West US 2 and West Central US

Azure Cost Management multi-cloud for AWS is in preview

Azure Cost Management for AWS is now in public preview and you can manage your AWS spend along your Azure spend in Azure Cost Management. Features like cost analysis and budgets are availble as part of this feature as well, helping simplify your cost management practice on multi-cloud scenarios.

Advanced Threat Protection for Azure Storage is generally available

Advanced Threat Protection (ATP) for Azure Storage provides an additional layer of security intelligence that detects unusual and potentially harmful attempts to access or exploit storage accounts. This layer of protection allows you to protect and address concerns about potential threats to your storage accounts as they occur, without needing to be an expert in security. To learn more, see Advanced Threat Protection for Azure Storage  or read about the ATP for Storage price in Azure Security Center pricing page.

Ephemeral OS Disk in Public Preview

Ephemeral OS disks work well for stateless workloads, where applications are tolerant of individual VM failures and are more concerned about the time it takes to deploy at scale or to reimage the individual VMs. In addition, Ephemeral OS disk is free i.e., you incur no storage cost for the Ephemeral OS disk.

Azure Serial Console updated

The Azure Serial Console is an invaluable tool in troubleshooting scenarios where you may be unable to connect to your VM. In addition to VMs, you may now use the Serial Console to troubleshoot and diagnose connectivity issues with your Virtual Machine Scale Set (VMSS) instances. To use Serial Console on a VMSS instance, enable boot diagnostics on the VMSS model and ensure that your instances have been upgraded to the latest model. Use Serial Console just as you would with a VM to troubleshoot and diagnose connectivity issues. In addition, improved language support means that you can now troubleshoot your VMs and VMSS instances in a variety of languages.

Adaptive network hardening in public preview

One of the biggest attack surfaces for workloads running in the public cloud are connections to and from the public Internet. Our customers find it hard to know which Network Security Group (NSG) rules should be in place to make sure that Azure workloads are only available to required source ranges. With this feature, Security Center learns the network traffic and connectivity patterns of Azure workloads and provides NSG rule recommendations, for Internet facing virtual machines. This helps our customer better configure their network access policies and limit their exposure to attacks. 

Azure ExpressRoute is generally available in additional locations

Azure ExpressRoute lets you extend your on-premises networks into the Microsoft cloud over a private connection facilitated by a connectivity provider. The ExpressRoute footprint is expanding to eight new locations:

• Amsterdam2
• Frankfurt
• London2
• Perth
• Silicon Valley2
• Taipei
• Washington DC2
• Zurich

Red Hat Enterprise Linux BYOS images now available

Red Hat Enterprise Linux images are now available as both BYOS and PAYG offers.

Azure Lab Services update: Address range feature available

In Azure Lab Services was added the ability to provide address range of virtual machines for the labs. This is useful for scenarios where licensing servers for an application on the lab virtual machines only accept a specific range of IP addresses.

Azure Virtual Machine PowerOff available with fast shutdown

The Azure Compute Virtual Machines API has now been updated to allow users to forcefully skip the graceful shutdown period when executing a power off command. This may be useful in situations where a VM may need to be quickly powered off and the risk for data loss or corruption can be ignored. To use this feature, ensure the skipShutdown flag is added to your API or SDK calls.

High-Performance Computing Virtual Machines in new regions

HB-series, designed to provide supercomputer-grade performance and scalability with the best price-performance on the public cloud, are Generally Available in South Central US and Western Europe.

Reserved instance pricing in the Dev/Test Offer

Reserved instances discounts are available for VMs and Azure SQL Database instances created in Dev/Test offer subscriptions. Dev/Test offer provides you a cost-effective way to run your development and testing workloads and with the support of Reserved instances, you can enjoy additional savings and have more purchase controls for your development and test workloads.

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Azure VMware Solutions

Microsoft Corp.  and Dell Technologies announced they are expanding their partnership to address a wider range of customer needs and help accelerate digital transformations. Through this collaboration, the companies will deliver a fully native, supported, and certified VMware cloud infrastructure on Microsoft Azure.

Azure VMware Solutions are built on VMware Cloud Foundation, a comprehensive offering of software defined compute, storage, networking and management, deployed in Azure. With these solutions, customers can capitalize on VMware’s broadly deployed and trusted cloud infrastructure while experiencing the power of Microsoft Azure.

Azure VMware Solutions give customers the power to seamlessly migrate, extend and run existing VMware workloads from on-premises environments to Azure without the need to re-architect applications or retool operations. Customers will be able to build, run, manage, and secure new and existing applications across VMware environments and Microsoft Azure while extending a single model for operations based on established tools, skills and processes as part of a hybrid cloud strategy.  Some of the more popular customer scenarios Azure VMware Solutions will support are app migration and datacenter expansion, disaster recovery, and business continuity and modern application development.

Azure Firewall – Price Reduction

Azure Firewall pricing includes a fixed hourly cost ($1.25/firewall/hour) and a variable per GB processed cost to support auto scaling. Microsoft are announcing a price reduction, effective 01/05/2019, for the firewall per GB cost to $0.016/GB (-46.6%) to ensure that high throughput customers maintain cost effectiveness. There is no change to the fixed hourly cost.

Azure Application Gateway Standard v2 and WAF v2 SKUs

Application Gateway is Azure’s Application Delivery Controller as-a-service offering which provides customers with layer 7 load balancing, security and WAF functionality.

Azure Application Gateway Standard v2 and WAF v2 SKUs are generally available and fully supported with a 99.95 SLA. The v2 SKUs also offer the following additional capabilities to Application Gateway and WAF:

• Faster provisioning and configuration update time.
• Static VIPs ensure that the Application Gateway VIP will not change over its lifecycle.
• Autoscaling allows elasticity to your application enabling it to scale up or down based on application traffic pattern. This also eliminates the need to run Application Gateway at peak provisioned capacity, thus significantly saving cost.
• Improved performance offers better application performance and also helps reduce overall cost.
• Zone redundancy enables your Application Gateway to survive zonal failures, thereby offering better resilience to your applications.
• Header Rewrite allows you to add, remove, or update HTTP request and response headers allowing applications to enable various scenarios like HSTS support, securing cookies, changing cache controls, etc. without changing application code.

For more information about the capabilities available, please visit the Application Gateway documentation webpage.

Azure File Sync v6 

Azure File Sync Agent v6 is available.

Improvements and issues that are fixed

• Agent auto-update support
• Support for Azure file share ACLs
• Parallel upload and download sync sessions for a server endpoint
• New Cloud Tiering cmdlets to get volume and tiering status
• Support for FIPS mode
• Miscellaneous reliability improvements for cloud tiering and sync

For more details, see KB4489736.

Agent installation notes

• This update is available for Windows Server 2012 R2, Windows Server 2016 and Windows Server 2019 installations.
• Azure File Sync agent version 4.0.1.0 or a later version is required to upgrade existing agent installations.
• A restart may be required if files are in use during the update rollup installation.
• The agent version for the v6 release is 6.0.0.0.
• Installation instructions are documented in KB4489736.

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Gateway Transit support for Global VNet Peering

Global VNet Peering seamlessly connects Azure virtual networks across regions. After virtual networks are peered, they appear as one for connectivity purposes. Traffic between resources in the peered virtual networks is completely private and stays on the Microsoft Backbone. Gateway Transit is a VNet Peering property that enables one virtual network to use the VPN gateway in the peered virtual network for cross-premises connectivity. Previously, support for Gateway Transit was limited to peering within the same region. Now, Gateway Transit is supported for Global VNet Peering in all Azure public regions, Azure China regions, and Azure Government regions. Gateway Transit enables you to use a peered virtual network’s gateway instead of creating a new gateway for connectivity. As you increase your workloads in Azure, you need to scale your networks across regions and virtual networks to keep up with the growth. VNet peering’s Gateway Transit can help simplify your network architecture.

Full IPv6 support for Azure Virtual Networks

Dual Stack IPv4/IPv6 connectivity with full IPv6 support for Virtual Networks is now available. This lets you bring your private IPv6 space into Azure and enables connectivity over IPv6 within your Virtual Networks. With this, you’re able to address IPv4 depletion, meet regulatory requirements, and expand into the growing mobile and IoT markets with your Azure-based applications.

Azure Cost Management generally available for Pay-As-You-Go customers

The general availability of Azure Cost Management features for all Pay-As-You-Go and Azure Government customers will greatly enhance the ability to analyze and proactively manage  cloud costs. These features will allow you to analyze your cost data, configure budgets to drive accountability for cloud costs, and export pre-configured reports on a schedule to support deeper data analysis within your own systems. This release for Pay-As-You-Go customers also provides invoice reconciliation support in the Azure portal via a usage csv download of all charges applicable to your invoices.

New experience and APIs for purchasing Azure reservations

The new user experience also shows purchase recommendations for VM size that have consistent usage over the last 30 days, to help you select the right VM size. You can now add multiple products to your cart and purchase them together from the Azure portal, or use the reservation APIs to purchase individual products.

Rewrite HTTP headers with Azure Application Gateway

Rewriting HTTP headers in Azure Application Gateway is now supported. You can add, remove, or update HTTP request and response headers while the request and response packets move between the client and backend application. You can also add conditions to ensure that the headers you specify are rewritten only when the conditions are met. Rewriting headers helps you accomplish several important scenarios such as removing port information from X-Forwarded-For headers, adding security-related header fields like HSTS/ X-XSS-Protection, removing response header fields which may reveal sensitive information, etc.

Azure Backup support to move Recovery Services vaults across subscriptions and resource groups

Azure Backup support for move functionality for recovery services vaults where you can migrate a vault between subscriptions and resource groups with a few steps, in minimal downtime and without any data-loss of old backups. You can move the vault across resource groups and subscriptions. This is very helpful in scenarios like expiry of old subscription, moving from EA to CSP type subscription, organizational and departmental changes or separation between QA environment and production environment.  Post migration, all the settings, backup policies and configurations in the vault are retained, including all backup and recovery points created in the past inside the vault. You can restore from retained backup history in the vault regardless of whether the VM is moved with the vault or not to the target subscription.

Azure Availability Zones in UK South and in Japan East

Azure Availability Zones, a high-availability solution for mission-critical applications, is generally available in UK South and in Japan East. Availability Zones are physically separate locations within an Azure region. Each Availability Zone consists of one or more datacenters equipped with independent power, cooling, and networking. With the introduction of Availability Zones, Microsoft offers a service-level agreement (SLA) of 99.99% for uptime of virtual machines. Availability Zones are generally available in select regions.

Azure virtual network service endpoint policies expanded

Public preview for virtual network service endpoint policies for Azure Storage was expanded to four new US regions on March 25. Azure virtual network service endpoint policies enable you to prevent unauthorized access to Azure service resources from your virtual network. You can now allow access to only specific Azure service resources (for example, storage accounts) by using endpoint policies over service endpoints. For details about supported capabilities and limitations, and for configuration guidance, see Virtual network service endpoint policies (preview).

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Azure Front Door Service is generally available

Azure Front Door Service (AFD) is a scalable and secure entry point for fast delivery of your global applications. AFD is a solution for your global website/application and provides:

• Application and API acceleration with anycast and using Microsoft’s massive private global network to directly connect to your Azure deployed backends means your app runs with lower latency and higher throughput to your end users.
• Global HTTP load balancing enables you to build your application resiliently across regions, fail-over instantly and offer your users an “always-on” web site availability experience either at a domain or microservice (URL path) level. 
• SSL offload at a massive scale enables you to maintain security and scale to a rapidly growing or expanding user base, all while reducing latency.
• WAF @ Edge offering application security against DDoS attacks or malicious users at the edge providing protection at scale without sacrificing on performance.

ExpressRoute Direct is generally available 

ExpressRoute Direct provides 100 Gbps connectivity. It is the first service of its scale in public cloud and focuses on core scenarios around large data-ingestion, R&D, media services, graphics and the like.

ExpressRoute Global Reach is generally available

ExpressRoute Global Reach extends the use of ExpressRoute from on-premises or from your corporate datacenter to Azure, to now also provide connectivity between on-premises sites, using the Microsoft Global network.

Azure Premium Block Blob Storage is generally available

Premium Blob Storage is a new performance tier in Azure Blob Storage for block blobs and append blobs, complimenting the existing Hot, Cool, and Archive access tiers. Premium Blob Storage provides lower and more consistent storage latency, providing low and consistent storage response times for both read and write operations across a range of object sizes, and is especially good at handling smaller blob sizes. Premium Blob Storage is ideal for workloads that require very fast response times and/or high transactions rates, such as IoT, Telemetry, AI, and scenarios with humans in the loop such as interactive video editing, web content, online transactions, and more.

New Azure Disks SKU

All existing Azure Managed Disk offerings (Premium SSD, Standard SSD and Standard HDD) will now feature 8, 16 and 32 TiB disk sizes. In addition, are supported disk sizes up to 64 TiB on Ultra Disks in preview. The performance scale targets for Premium SSD are increased to 20,000 IOPS and 900 MB/sec. Also, Standard SSD performance will now reach up to 6,000 IOPS and 750MBps and Standard HDD to 2000 IOPS and 500MBps .

Advanced Threat Protection for Azure Storage
Advanced Threat Protection for Azure Storage is available. It provides an additional layer of security intelligence that detects unusual and potentially harmful attempts to access or exploit storage accounts.

Azure Blob Storage lifecycle management

General availability of Blob Storage lifecycle management so that you can automate blob tiering and retention with custom defined rules. Azure Blob Storage lifecycle management offers a rich, rule-based policy which you can use to transition your data to the best access tier and to expire data at the end of its lifecycle. This feature is available in all Azure public regions.

Azure Firewall in Government Cloud

Azure Firewall Service is now generally available in Government Cloud. Specific regions and limitations can be found here.

New B-series VM size

A new B-series VM size, B1ls, which has the smallest memory and lowest cost among Azure VM instances is available. B1ls has 512 MiB of memory and 1 vCPU.  This offering is in response to customers who were looking for entry-level offerings. B1ls is available only on Linux for the best customer experience. Windows is not supported because the minimum recommended memory for the Windows OS is larger than what B1ls offers. B1ls is best for small web servers, small databases, and development and test environments. It offers a cost-effective way to deploy workloads that don’t need the full performance of the CPU continuously and burst in their performance.

New capabilities in Azure Security Center

Microsoft Azure Security Center has released new capabilities:

• Advanced Threat Protection for Azure Storage. Layer of protection that helps customers detect and respond to potential threats on their storage account as they occur—without having to be an expert in security.
• Regulatory compliance dashboard. Helps Security Center customers streamline their compliance process by providing insight into their compliance posture for a set of supported standards and regulations.
• Support for Virtual Machine Scale Sets (VMSS). Easily monitor the security posture of your VMSS with security recommendations.
• Dedicated Hardware Security Module (HSM) service, now available in U.K., Canada, and Australia. Provides cryptographic key storage in Azure and meets the most stringent customer security and compliance requirements.
• Azure disk encryption support for VMSS. Now Azure disk encryption can be enabled for Windows and Linux VMSS in Azure public regions—enabling customers to help protect and safeguard the VMSS data at rest using industry standard encryption technology.

New Regions for Azure File Sync

Azure File Sync is available in Korea Central and Korea South. To get the latest list of supported regions, see this document.

New Regions for Traffic Analytics

Traffic Analytics is now available in East Asia, Japan West, France Central and Korea Central.

Update rollup for Azure File Sync Agent: April 2019

An update rollup for the Azure File Sync agent was released.

Improvements and issues that are fixed:

• Reliability improvements for offline data transfer and data transfer resume features.
• Sync telemetry improvements.

More information about this update rollup:

• This update is available for Windows Server 2012 R2, Windows Server 2016 and Windows Server 2019 installations that have Azure File Sync agent version 4.0.1.0 or later installed.
• The agent version of this update rollup is 5.2.0.0.
• A restart may be required if files are in use during the update rollup installation.
• Installation instructions are documented in KB4481061.

Azure Stack

Azure Stack HCI

Microsoft announced Azure Stack HCI solutions for customers who want to run virtualized applications on modern hyperconverged infrastructure (HCI) to lower costs and improve performance. Azure Stack HCI solutions feature the same software-defined compute, storage, and networking software as Azure Stack, and can integrate with Azure for hybrid capabilities such as cloud-based backup, site recovery, monitoring, and more.

With Azure Stack, you can run Azure IaaS and PaaS services on-premises to consistently build and run cloud applications anywhere.

Azure Stack HCI is a better solution to run virtualized workloads in a familiar way – but with hyperconverged efficiency – and connect to Azure for hybrid scenarios such as cloud backup, cloud-based monitoring, etc.

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

AzCopy support in Azure Storage Explorer

Azure Storage Explorer provides the UI interface for various storage tasks, and now it supports using AzCopy as a transfer engine to provide the highest throughput for transferring your files for Azure Storage.

Service Map is available in Central Canada and UK South

The Service Map feature of Azure Monitor is now available in Central Canada and UK South. Across the world, it’s available in six public regions. Service Map automatically discovers application components on Windows and Linux systems and maps the communication between services. With Service Map, you can view your servers in the way that you think of them: as interconnected systems that deliver critical services. Service Map shows connections between servers, processes, inbound and outbound connection latency, and ports across any TCP-connected architecture, with no configuration required other than the installation of an agent.

Azure premium blob storage is generally available

Azure premium blob storage is generally available. Premium block blob is a new performance tier in Blob storage, complementing the existing hot, cool, and archive tiers. Premium blob storage is ideal for workloads with high transaction rates or that require very fast access times, such as IoT, telemetry, AI, and scenarios with humans in the loop such as interactive video editing, web content, and online transactions. 

Support for virtual network peering in Azure Security Center

The network map in Azure Security Center now supports virtual network peering. Directly from the network map, you can view allowed traffic flows between peered virtual networks and deep dive into the connections and entities.

Adaptive network hardening in Azure Security Center (Public preview)

Azure Security Center can now learn the network traffic and connectivity patterns of your Azure workload and provide you with network security group (NSG) rule recommendations for your internet-facing virtual machines. This is called adaptive network hardening, and it’s in public preview. It helps you secure connections to and from the public internet (made by workloads running in the public cloud), which are one of the most common attack surfaces.

Windows Virtual Desktop in public preview on Azure

Now available in public preview, Windows Virtual Desktop is the service that delivers simplified management, a multi-session Windows 10 experience, optimizations for Office 365 ProPlus, and support for Windows Server Remote Desktop Services (RDS) desktops and apps. With Windows Virtual Desktop, you can deploy and scale your Windows desktops and apps on Azure in minutes and enjoy built-in security.

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Azure South Africa regions are available

Azure services are now available from new cloud regions in Johannesburg (South Africa North) and Cape Town (South Africa West), South Africa. The launch of these regions marks a major milestone for Microsoft as they open their first enterprise-grade datacenters in Africa, becoming the first global provider to deliver cloud services from datacenters on the continent. With 54 regions announced worldwide, the Microsoft global cloud infrastructure will connect the new regions in South Africa with greater business opportunity, help accelerate new global investment, and improve access to cloud and internet services across Africa. The new cloud regions in Africa are connected with Microsoft’s other regions via their global network, which spans more than 100,000 miles (161,000 kilometers) of terrestrial fiber and subsea cable systems to deliver services to customers.

Microsoft Azure Sentinel: intelligent security analytics for the entire enterprise

Security can be a never-ending saga, a chronicle of increasingly sophisticated attacks, volumes of alerts, and long resolution timeframes where today’s Security Information and Event Management (SIEM) products can’t keep pace. Microsoft rethinks the SIEM tool as a new cloud-native solution called Microsoft Azure Sentinel. Azure Sentinel provides intelligent security analytics at cloud scale for your entire enterprise. Azure Sentinel makes it easy to collect security data across your entire hybrid organization from devices, to users, to apps, to servers on any cloud.  It uses the power of artificial intelligence to ensure you are identifying real threats quickly and unleashes you from the burden of traditional SIEMs by eliminating the need to spend time on setting up, maintaining, and scaling infrastructure. Since it is built on Azure, it offers nearly limitless cloud scale and speed to address your security needs. Traditional SIEMs have also proven to be expensive to own and operate, often requiring you to commit upfront and incur high cost for infrastructure maintenance and data ingestion. With Azure Sentinel there are no upfront costs, you pay for what you use.

Virtual network service endpoints for Azure Database for MariaDB are available

virtual network service endpoints for Azure Database for MariaDB are accessible in all available regions. Virtual network service endpoints allow you to isolate connectivity to your logical server from only a given subnet or set of subnets within your virtual network. Traffic to Azure Database for MariaDB from the virtual network service endpoints stays within the Azure network, preferring this direct route over any specific routes that take internet traffic through virtual appliances or on-premises.

M-series virtual machines (VMs) are available in the Korea South region and in the China North 2 region

Azure M-series VMs are now available in the Korea South region and in the China North 2 region. M-series VMs offer configurations with memory from 192 GB to 3.8 TiB (4 TB) RAM and are certified for SAP HANA.

Azure Policy root cause analysis and change tracking features

New functionalities have been added to Azure Policy, including root cause analysis and change tracking features. This means that you’ll be able to see why a resource evaluated as non-complaint and what changes were implemented directly by a policy.

Azure Container Registry firewall rules and Virtual Network

Firewall rules and Virtual Network support in Azure Container Registry are available in preview.  Limit registry access to your resources in Azure, or specific on-premises resources, including Express Route connected devices. Virtual Network access is provided through the Azure Container Registry premium tier. General availability pricing will be announced at a later date. 

Azure Lab Services

Azure Lab Services is generally available. With Azure Lab Services, you can easily set up and provide on-demand access to preconfigured virtual machines (VMs) to teach a class, train professionals, run hackathons or hands-on labs, and more. Simply input what you need in a lab and let the service roll it out to your audience. Your users go to a single place to access all their VMs across multiple labs, and connect from there to learn, explore, and innovate.

Azure Availability Zones in East US

Azure Availability Zones, a high-availability solution for mission-critical applications, is now generally available in East US.

Global VNet Peering in Azure Government regions

Global VNet Peering is generally available in all Azure Government cloud regions. This means you can peer virtual networks across the Azure Government cloud regions. You cannot peer across Azure Government cloud and Azure public cloud regions.

Global VNet Peering supports Standard Load Balancer

Previously, resources in one virtual network could not communicate with the front-end IP address of an internal load balancer over a globally peered connection. The virtual networks needed to be in the same region. This is no longer the case. You can communicate with the internal IP address of a Standard Load Balancer instance across regions from resources deployed in a globally peered virtual network. This support is in all Azure regions, including Azure China and Azure Government regions.

New capabilities in Azure Firewall

Two new key capabilities in Azure Firewall:

• Threat intelligence based filtering: Azure Firewall can now be configured to alert and deny traffic to and from known malicious IP addresses and domains in near real-time. The IP addresses and domains are sourced from the Microsoft Threat Intelligence feed. Threat intelligence-based filtering is default-enabled in alert mode for all Azure Firewall deployments, providing logging of all matching indicators. Customers can adjust behavior to alert and deny.
• Service tags filtering: a service tag represents a group of IP address prefixes for specific Microsoft services such as SQL Azure, Azure Key Vault, and Azure Service Bus, to simplify network rule creation. Microsoft today supports service tagging for a rich set of Azure services which includes managing the address prefixes encompassed by the service tag, and automatically updating the service tag as addresses change. Azure Firewall service tags can be used in the network rules destination field.

Azure File Sync is now supported in Japan East, Japan West, and Brazil South regions.

Azure Premium Blob Storage public preview

Premium Blob Storage is a new performance tier in Azure Blob Storage, complimenting the existing Hot, Cool, and Archive tiers. Premium Blob Storage is ideal for workloads with high transactions rates or requires very fast access times, such as IoT, Telemetry, AI and scenarios with humans in the loop such as interactive video editing, web content, online transactions, and more. Premium Blob Storage has higher data storage cost, but lower transaction cost compared to data stored in the regular Hot tier. This makes it cost effective and can be less expensive for workloads with very high transaction rates.

Update rollup for Azure File Sync Agent: March 2019

An update rollup for the Azure File Sync agent was released today which addresses the following issues:

• Files may fail to sync with error 0x80c8031d (ECS_E_CONCURRENCY_CHECK_FAILED) if change enumeration is failing on the server
• If a sync session or file receives an error 0x80072f78 (WININET_E_INVALID_SERVER_RESPONSE), sync will now retry the operation
• Files may fail to sync with error 0x80c80203 (ECS_E_SYNC_INVALID_STAGED_FILE)
• High memory usage may occur when recalling files
• Cloud tiering telemetry improvements

More information about this update rollup:

• This update is available for Windows Server 2012 R2, Windows Server 2016 and Windows Server 2019 installations that have Azure File Sync agent version 4.0.1.0 or later installed.
• The agent version of this update rollup is 5.1.0.0.
• A restart may be required if files are in use during the update rollup installation.
• Installation instructions are documented in KB4481060.

Azure Stack

Azure App Service on Azure Stack 1.5 (Update 5) Released

This release updates the resource provider and brings the following key capabilities and fixes:

• Updates to **App Service Tenant, Admin, Functions portals and Kudu tools**. Consistent with Azure Stack Portal SDK version.
• Updates to **Kudu** tools to resolve issues with styling and functionality for customers operating **disconnected** Azure Stack.
• Updates to core service to improve reliability and error messaging enabling easier diagnosis of common issues.

All other fixes and updates are detailed in the App Service on Azure Stack Update Five Release Notes.

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Serial console for Azure Virtual Machines (feature update)

The serial console for Azure Virtual Machines enables you to reboot your VM from within the console experience. This ability will help you if you want to reboot a stuck VM or enter the boot menu of your VM.

Azure File Sync v5 release

Improvements and issues that are fixed:

• Support for Azure Government cloud
  • Added preview support for the Azure Government cloud. This requires a white-listed subscription and a special agent download from Microsoft.
• Support for Data Deduplication
  • Data Deduplication is now fully supported with cloud tiering enabled on Windows Server 2016 and Windows Server 2019. Enabling deduplication on a volume with cloud tiering enabled lets you cache more files on-premises without provisioning more storage.
• Support for offline data transfer (e.g. via Data Box)
  • Easily migrate large amounts of data into Azure File Sync via any means you choose. You can choose Azure Data Box, AzCopy and even third party migration services. No need to use massive amounts of bandwidth to get your data into Azure, in the case of Data Box.
• Improved sync performance
  • Customers with multiple server endpoints on the same volume may have experienced slow sync performance prior to this release. Azure File Sync creates a temporary VSS snapshot once a day on the server to sync files that have open handles. Sync now supports multiple server endpoints syncing on a volume when a VSS sync session is active. No more waiting for a VSS sync session to complete so sync can resume on other server endpoints on the volume.
• Improved monitoring in the portal
  • Charts have been added in the Storage Sync Service portal to view:
    • Number of files synced
    • Size of data transferred
    • Number of files not syncing
    • Size of data recalled
    • Agent connectivity status
• Improved scalability and reliability
  • Maximum number of file system objects (directories and files) in a directory has increased to 1,000,000. Previous limit was 200,000.
  • Sync will try to resume data transfer rather than retransmitting when a transfer is interrupted for large files

Agent installation notes:

• The Azure File Sync agent is supported on Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019.
• Azure File Sync agent version 4.0.1.0 or a later version is required to upgrade existing agent installations.
• A restart may be required if files are in use during the installation.
• The agent version for the v5 release is 5.0.2.0.

Installation instructions are documented in KB4459989.

Service tags are available in Azure Firewall network rules

A service tag represents a group of IP address prefixes to help minimize complexity for security rule creation. You cannot create your own service tag, nor specify which IP addresses are included within a tag. Microsoft manages the address prefixes encompassed by the service tag, and automatically updates the service tag as addresses change. Azure Firewall service tags can be used in the network rules destination field. You can use them in place of specific IP addresses. Service tags are fully supported in all public regions using PowerShell/REST/CLI by simply including the tag string in a network rule destination field. Portal support is being rolled out and will incrementally be available in all public regions in the near future.