This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Compute

Azure VMware Solution on Azure Government

Azure VMware Solution will become generally available on May 17, 2023, to US Federal and State and Local Government (US) customers and their partners, in the regions of Arizona and Virgina. With this release, Microsoft is combining world-class Azure infrastructure together with VMware technologies by offering Azure VMware Solutions on Azure Government, which is designed, built, and supported by Microsoft.

Networking

Routing Intent and Virtual WAN Integrated Firewall NVAs

Routing intent allows you to set up simple and declarative routing policies to configure Virtual WAN to route traffic to bump-in-the-wire security solutions such as Azure Firewall, Integrated Firewall NVA and SaaS deployed in the Virtual WAN hub. This feature delivers two critical use cases: inter-region/inter-hub traffic inspection and branch-to-branch (on-premises to on-premises traffic inspection). With the General Availability of routing intent feature, the Virtual WAN team also extended routing intent capabilities to Next Generation Firewall NVA’s integrated within the Virtual WAN hub. As a result, the Virtual WAN team is also announcing the General Availability of the first two integrated Firewall NVA’s in Virtual WAN: Check Point CloudGuard Network Security and Fortinet NGFW.

Seamlessly upgrade your Application Gateway V2 WAF configuration to a policy

Azure’s regional Web Application Firewall (WAF) on Application Gateway now supports a fully automated experience when upgrading your WAF from a configuration to a policy. WAF policies offer you multiple benefits over WAF configurations including:

• richer feature set: Advanced features like newer managed rule sets, custom rules, per rule exclusions, bot protection rules, and more;
• higher scale and performance with our next generation WAF engine;
• simplified management experience: WAF policy allows you to define your WAF setup once, and share it across multiple gateways, listeners, and URL paths;
• latest features: you can keep up to date with the latest features and enhancements.

Policy analytics for Azure Firewall

As application migration to the cloud accelerates, it’s common to update Azure Firewall configuration daily (sometimes hourly) to meet the growing application needs and respond to a changing threat landscape. Frequently, changes are managed by multiple administrators spread across geographies. Over time, the firewall configuration can grow sub optimally impacting firewall performance and security. It’s a challenging task for any IT team to optimize firewall rules without impacting applications and causing serious downtime. Policy analytics help address these challenges faced by IT teams by providing visibility into traffic flowing through the firewall with features such as firewall flow logs, rule to flow match, rule hit rate, and single rule analysis. IT admins can refine Azure Firewall rules in a few simple steps through the Azure portal.

Inbound ICMPv4 pings are now supported on Azure Load Balancer

Standard Public Load Balancer now supports inbound ICMP pings on IPv4 frontends. Previously, to determine reachability of a Load Balancer’s frontend, a TCP-based ping tool like Psping would need to be used. This added complexity as external software was needed on each client machine. Now, you can ping the IPv4 frontend of a Standard Public Load Balancer like you natively would on an on-premises device without any external software needed. This enables you to troubleshoot network traffic between Azure Load Balancer and your client device.

Azure Bastion now support shareable links

With the Azure Bastion shareable links feature, you can now connect to a target resource (virtual machine or virtual machine scale set) using Azure Bastion without accessing the Azure portal.
This feature will solve two key pain points:

• administrators will no longer have to provide full access to their Azure accounts to one-time VM users—helping to maintain their privacy and security;
• users without Azure subscriptions can seamlessly connect to VMs without exposing RDP/SSH ports to the public internet.

Now generally available, the shareable links feature is supported for peered VNETs across subscriptions and across regions. It is also supported for national clouds.

Azure DNS Private Resolver is available in additional regions

Azure DNS Private Resolver is now available in West US, Canada East, Qatar Central, UAE North, Australia Southeast, Norway East, Norway East, and Poland Central.

Always Serve for Azure Traffic Manager (preview)

Always Serve for Azure Traffic Manager (ATM) is now available in public preview. You can disable endpoint health checks from an ATM profile and always serve traffic to that given endpoint. You can also now choose to use 3rd party health check tools to determine endpoint health, and ATM native health checks can be disabled, allowing flexible health check setups.

Storage

Azure Container Storage (preview)

Azure Container Storage, now in preview, is a unique volume management service built natively for containers. It provides a consistent experience across different types of storage offerings, including Managed option (backed by Azure Elastic SAN), Azure Disks, and ephemeral disk on container services. This simplifies the deployment of persistent volumes and offers a highly scalable, cost-effective, high-performance and resilient storage solution. With Azure Container Storage, you can easily create and manage block storage volumes for production-scale stateful container applications and run them on Kubernetes, ensuring consistent experiences across different environments. The solution is optimized to enhance the performance of stateful workloads on Azure Kubernetes Service (AKS) clusters by accelerating the deployment of stateful containers with persistent volumes and improving quality with reduced pod failover time through fast attach/detach. Additionally, by efficiently deploying and managing persistent volumes on backend storage options, you can reduce the total cost of ownership (TCO) associated with container storage.

Azure NetApp Files Standard Network Features – Edit Volumes (preview)

Standard Network Features provide you with an enhanced Virtual Networking experience for a seamless and consistent experience along with security posture for Azure NetApp Files. You are now able to edit existing ANF volumes and upgrading Basic network features to Standard network features.

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Compute

Microsoft Azure available from new cloud region in Poland

The newest cloud region in Poland is available with Azure Availability Zones and provides customers with the highest standards of security, privacy, and regulatory-compliant data storage in the country.

Ebsv5 and Ebdsv5 NVMe-enabled VM sizes

The Ebsv5 and Ebdsv5 VM series are the first Azure VM series to support NVMe storage protocol. NVMe support enables these series to achieve the highest Disk Storage IOPS and throughput of any Azure VMs to date. NVMe is a high-performance storage interface that is faster and more efficient compared to other traditional storage protocols like SCSI, which is the only other protocol that most Azure VMs use currently. With NVMe interface supported, customers can now use these VMs to achieve even higher VM-to-disk throughput and IOPS performance per core, with up to 8,000 MBps and 260,000 IOPS. This enables customers that process extremely data-intensive workloads to process more data on fewer core compute resources, potentially saving them money on infrastructure and commercial software licensing costs.

DCesv5 and ECesv5-series Confidential VMs with Intel TDX (preview)

There is an expansion of Confidential VM family with the launch of the DCesv5-series and ECesv5-series in preview. Featuring 4th Gen Intel® Xeon® Scalable processors, these VMs are backed by an all-new hardware-based Trusted Execution Environment called Intel® Trust Domain Extensions (TDX). Organizations can use these VMs to seamlessly bring confidential workloads to the cloud without any code changes to their applications.

Networking

Cloud Next-Generation Firewall (NGFW) Palo Alto Networks – an Azure Native ISV Service

Cloud NGFW Palo Alto Networks is the first ISV next-generation firewall service natively integrated in Azure. Developed through a collaboration between Microsoft and Palo Alto Networks, this service delivers the cutting-edge security features of Palo Alto Networks NGFW technology while also offering the simplicity and convenience of cloud-native scaling and management. NGFWs provide superior network security by offering enhanced capabilities compared to traditional firewalls. These include deep packet inspection, advanced visibility and control features, and the use of AI to improve threat detection and response.

Palo Alto Networks SaaS Cloud NGFW Integration with Virtual WAN (preview)

Palo Alto Networks Cloud NGFW is the first security software-as-a-service (SaaS) solution to be integrated in Azure Virtual WAN, allowing you to enjoy the simplicity of a SaaS security offering without the hassles of managing provisioning, scaling, resiliency, software updates, or routing.

Cloud NGFW SaaS integration with Virtual WAN provides you with the following benefits:

• protect workloads with a highly available NGFW powered by machine learning to
• detect and stop known, unknown and zero-day threats;
• fully managed infrastructure and software lifecycle under SaaS model;
  consumption-based pay-as-you-go billing;
• dedicated and streamlined support channel between Azure and Palo Alto Networks to provide a delightful customer support experience;
• simple one-click routing to inspect on-premises, Azure VNets and Internet traffic;
• deep and cohesive integration with Azure that provides a cloud-native experience.

Application Gateway V1 will be retired on 28 April 2026

Because Application Gateway V1 retires on 28 April 2026, please transition to Application Gateway V2 by that date.

Alongside the Application Gateway V1 features you already use, Application Gateway V2 provides:

• additional features – Autoscaling, zone redundancy, URL rewrite, mutual authentication mTLS , Azure Kubernetes Service Ingress Controller, Keyvault integration;
• increased performance – 5x Better TLS offload performance compared to V1;
• enhanced security – Faster update of security rules, WAF custom rules and policy associations, bot protection-

From now through 28 April 2026, you can continue using Application Gateway V1 but begin transitioning to Application Gateway V2.

New customers (customers who doesn’t not have Application Gateway V1 SKU in their subscriptions in the month of June 2023) won’t be able to create V1 gateways from 1st July 2023.

Existing customers with subscriptions containing V1 gateways, will no longer be able to create V1 gateways after 28th August 2024. However, they can manage V1 gateways until the retirement date of 28 April 2026. After 28 April 2026, Application Gateway V1 will not be supported.

Storage

Cross-region service endpoints for Azure Storage

Cross-region service endpoints is now generally available for Azure Blob and Data Lake Storage in all Azure regions. Virtual Network (VNet) service endpoints provide secure and direct connectivity to Azure services over an optimized route over the Azure backbone network. Service endpoints in Azure Storage already allow the ability to connect to a storage account to VNets in the same or paired region. With this release, cross-region service endpoints can be configured to allow access to an Azure Blob or Data Lake storage account from VNets in any region. This is valuable for customer scenarios such as global storage resource and access management.

Azure Blob Storage adds a new online access: Cold Storage (preview)

Azure Blob Storage is optimized for storing massive amounts of unstructured data. With blob access tiers, you can store your blob data in the most cost-effective manner based on how frequently it will be accessed and how long it will be retained. Now Azure Blob Storage adds a new online access tier, cold, in addition to hot, cool and archive.

Cold tier pricing is positioned between cool and archive, with 90-day early deletion policy. See the prices in Azure Blob Storage pricing. You can seamlessly use the cold tier the way you use hot and cool, through REST API, SDK, tools, and lifecycle management policy. Cold public preview is now available in Canada Central, Canada East, France Central and Korea Central.

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Compute

Hotpatch for Windows Server VMs on Azure with desktop experience

Hotpatch is now available for Windows Server Azure edition VMs running the desktop experience. Hotpatch is a feature that allows you to patch and install updates to Windows Server Azure Edition virtual machines on Azure without requiring a reboot. It was previously available for the server core installation mode, but now, Windows Server Azure edition VMs installed with the desktop experience mode (the Windows Explorer shell, Start Menu, etc.) will no longer reboot every month for security updates, providing:

• lower workload impact with less reboots;
• faster deployment of updates as the packages are smaller, install faster, and have easier patch orchestration with Azure Update Manager;
• better protection, as the hotpatch update packages are scoped to Windows security updates that install faster without rebooting.

Trusted launch on existing Azure Gen2 VMs (preview)

Trusted launch provides a seamless way to improve the security of Azure Generation 2 VMs. It protects against advanced and persistent attack techniques by combining technologies which can be independently enabled like secure boot and virtualized version of trusted platform module (vTPM). The preview is available to support to enable Trusted launch on existing Gen2 VMs by upgrading the security type of the Gen2 VM to Trusted launch. This will help improve the foundational security of existing Gen2 VMs.

Networking

Azure CNI overlay in generally available

Azure CNI overlay addresses performance, scalability and IP exhaustion challenges while using traditional Azure Container Networking Interface (CNI). With Azure CNI overlay AKS clusters can be scaled to very large sizes by assigning pod IP addresses from user defined overlay address space which are logically different from VNet IP address space hosting the cluster nodes. Additionally, user defined private CIDR can be reused in different AKS clusters, truly extending the IP space available for containerized applications in AKS. Pod and node traffic within the cluster use an overlay network via Azure Software Defined Network (SDN) without any additional encapsulation. Network Address Translation (using the node’s IP address) is used to reach resources outside the cluster.

Storage

Azure Storage Mover is now Generally Available

Azure Storage Mover is a new, fully managed migration service that enables you to migrate your files and folders to Azure Storage while minimizing downtime for your workload. You can use Storage Mover for different migration scenarios such as lift-and-shift, and for cloud migrations that you have to repeat occasionally. Azure Storage Mover also helps maintain oversight and manage the migration of all your globally distributed file shares from a single storage mover resource.

Support for Linux clients to use identity-based access to Azure file shares over SMB

Azure Files now supports Linux clients to use identity-based authentication over Server Message Block (SMB). Previously only Windows clients were supported by Azure Files.

In order to leverage identity based authentication and authorization, the clients need to be domain joined to one of the following Domain Services:

• On-premises Active Directory Domain Services (AD DS)
• Azure Active Directory Domain Services (Azure AD DS)

Azure Active Directory (Azure AD) Kerberos for hybrid identities is NOT supported yet for Linux clients. This capability will enable customers who are moving a mix of Windows and Linux environments to cloud to have a consistent identity system across both Windows and Linux workstations.

Azure Elastic SAN Public Preview is now available in more regions

Azure Elastic SAN, which is currently in preview, is available with locally redundant storage (LRS) in several regions, including Australia East, Southeast Asia, France Central (including ZRS), North Europe (including ZRS), Sweden Central, UK South, West Europe (including ZRS), East US, East US 2, South Central US, West US 2 (including ZRS), and West US 3. By combining SAN-like capabilities with the advantages of being a cloud-native service, Azure Elastic SAN provides a storage solution that is highly scalable, cost-effective, high-performing, and resilient. It caters to various storage needs, whether you’re migrating your on-premises SAN to the cloud or creating your application directly in the cloud.

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Compute

New General-Purpose VMs: Dlsv5 and Dldsv5

The Dlsv5 and Dldsv5 VM series are ideal for workloads that require less RAM per vCPU than standard general purpose VM sizes. Target workloads include web servers, gaming, video encoding, AI/ML, batch processing and more. These VM series can potentially improve price-performance and reduce the cost of running workloads that do not require more memory per vCPU. The new VMs feature sizes with and without local temporary storage.

Networking

Azure Firewall enhancements for troubleshooting network performance and traffic visibility (preview)

Microsoft Azure Firewall now offers new logging and metric enhancements designed to increase visibility and provide more insights into traffic processed by the firewall. IT security administrators may use (in preview) a combination of the following to root cause application performance issues:

o    Latency Probe metric
o    Flow Trace Log
o    Top Flows Log

Private Application Gateway v2 (preview)

Application Gateway v2 is introducing a collection of new capabilities to further enable you to control network exposure using Application Gateway v2 skus:

• private IP only frontend configuration (elimination of Public IP);
• enhanced control over Network Securtiy Groups:
  • eliminate GatewayManager service tag requirement;
  • enable definition of Deny All Outbound rule;
• enhanced control over Route Table rules:
  • forced Tunelling Support (learning of 0.0.0.0/0 route via BGP);
  • route Table rule of 0.0.0.0/0 next hop Virtual Appliance.

Storage

Azure File Sync agent v16

The Azure File Sync agent v16 release has finished flighting and is now available on both Microsoft Update and the Microsoft Download Center.

Improvements and issues that are fixed:

• improved Azure File Sync service availability:
  • Azure File Sync is now a zone-redundant service which means an outage in a zone has limited impact while improving the service resiliency to minimize customer impact. To fully leverage this improvement, configure your storage accounts to use zone-redundant storage (ZRS) or Geo-zone redundant storage (GZRS) replication. To learn more about different redundancy options for your storage accounts, see: Azure Storage redundancy
• immediately run server change enumeration to detect files changes that were missed on the server:
  • Azure File Sync uses the Windows USN journal feature on Windows Server to immediately detect files that were changed and upload them to the Azure file share. If files changed are missed due to journal wrap or other issues, the files will not sync to the Azure file share until the changes are detected. Azure File Sync has a server change enumeration job that runs every 24 hours on the server endpoint path to detect changes that were missed by the USN journal. If you don’t want to wait until the next server change enumeration job runs, you can now use the Invoke-StorageSyncServerChangeDetection PowerShell cmdlet to immediately run server change enumeration on a server endpoint path;
• bug fix for the PowerShell script FileSyncErrorsReport.ps1;
• miscellaneous reliability and telemetry improvements for cloud tiering and sync.

More information about this release:

• this release is available for Windows Server 2012 R2, Windows Server 2016, Windows Server 2019 and Windows Server 2022 installations;
• the agent version for this release is 16.0.0.0;
• installation instructions are documented in KB5013877.

Azure Files NFS: nconnect support

Azure Files NFS v4.1 share now support nconnect option. Nconnect is a client-side Linux mount option that increases performance at scale. With nconnect, the NFS mount uses more TCP connections between the client and the Azure Files service for NFSv4.1. Using Nconnect can improve a client’s throughput/IOPS upto 4X and reduce TCO by upto 70%. There is no additional billing cost associated to using this feature. This feature is available to all existing and new shares.

Azure Premium SSD v2 Disk Storage in new regions

Azure Premium SSD v2 Disk Storage is now available in East US 2, North Europe, and West US 2 regions. This next-generation storage solution offers advanced general-purpose block storage with the best price performance, delivering sub-millisecond disk latencies for demanding IO-intensive workloads at a low cost. It is well-suited for a wide range of enterprise production workloads, including SQL Server, Oracle, MariaDB, SAP, Cassandra, MongoDB, big data analytics, gaming on virtual machines, and stateful containers.

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Compute

Azure VMware Solution: Azure Hybrid Benefit for SQL Server

Azure Hybrid Benefit (AHB) for SQL Server is now available in Azure VMware Solution (AVS). With AHB for SQL Server on Azure VMware Solution, you can take advantage of the unlimited virtualization licensing capability included with the SQL Server Software Assurance. To this end, you can configure and enable VM-Host placement policies via the Azure portal and apply Azure Hybrid Benefit. 

Networking

Azure Firewall Basic

Azure Firewall Basic is a new SKU for Azure Firewall designed for small and medium-sized businesses. Azure Firewall Basic can be deployed inside a virtual network or a virtual hub. This gives businesses the flexibility to choose the deployment option that best meets their needs. 

The main benefits are: 

• Comprehensive, cloud-native network firewall security
  • Network and application traffic filtering 
  • Threat intelligence to alert on malicious traffic 
  • Built-in high availability 
  • Seamless integration with other Azure security services 
• Simple setup and easy-to-use
  • Setup in just a few minutes 
  • Automate deployment (deploy as code) 
  • Zero maintenance with automatic updates 
  • Central management via Azure Firewall Manager
• Cost-effective
  • Designed to deliver essential, cost-effective protection of your resources within your virtual network

Pricing and billing for Azure Firewall Basic with secured virtual hub will be effective starting May 1, 2023.

Azure Virtual Network Manager

Azure Virtual Network Manager (AVNM) is now generally available. AVNM is a highly scalable and available network management solution that allows you to simplify network management across subscriptions globally. Using its centralized network management capabilities, you can manage your network resources at scale from a single plane of glass.

Key features of Azure Virtual Network Manager include:

• global management of virtual network resources across regions, subscriptions, and tenants;
• automated management and deployment of virtual network topology to create hub and spoke*;
• high-priority security rule enforcement at scale to protect your network resources*;
• safe deployment of network configurations across desired regions.

*The mesh topology and security admin rule features remain in public preview and will become generally available soon

Azure Traffic Manager: reserved namespaces for subdomains

Azure Traffic Manager has added functionality for reserving domain labels for traffic manager profiles. Any customer requesting a traffic manger profile of the form label1.trafficmanager.net will have “label1” label reserved for the tenant and another user will not be able to create a new traffic manager profile with this name or subdomains below it. For example if a user creates a profile names label1.trafficmanager.net then “label1” and all labels of form “<labelN>….<lable2>.<label1>.trafficmanager.net” will be reserved for the subscription. With these enhancements, once a namespace is created by a customer under trafficmanager.net domain, it will not be available for any other tenant. This enhancement ensures that customers have full control over the labels tree used in their traffic manager profiles and enables customers better manage their namespace without having to worry about a specific name/label being in use by other tenants.

Illumio for Azure Firewall (preview)

Microsoft partnered with Illumio, the leader in Zero Trust Segmentation, to build Illumio for Azure Firewall, an integrated solution that brings the benefits of Zero Trust Segmentation to Azure Firewall.

Illumio for Azure Firewall uses the Azure platform to protect your resources across your Azure virtual networks and at your Azure perimeter. It enables organizations to understand application traffic and dependencies and apply consistent protection across your environment – limiting exposure, containing breaches, and improving efficiency. Illumio for Azure Firewall also helps simplify Zero Trust Segmentation by enhancing visibility, streamlining policy management, and providing scalable security.

 Key benefits:

• Reduce security risks with a single view of your east-west and north-south traffic based on Azure Firewall flow data within your Azure subscriptions.
• Gain a holistic view of your application traffic with real-time visibility of interactions and dependencies across your environment.
• Easily deploy and configure Azure application-based polices within the Illumio platform.
• Deploy Azure Firewall policies confidently with policies that automatically scale along with your applications.
• Avoid application downtime by understanding the impact of Azure Firewall policies before they are enforced.
• Works with all 3 SKUs of Azure Firewall – Basic, Standard, and Premium – to meet the needs of any organization.

Accelerated Connections for Network Virtual Appliances now in Azure Marketplace (preview)

Accelerated Connections is a new product that enhances Accelerated Networking enabled vNICs, enabling customer flexibility in selecting the best option of CPS capabilities suited to match their Azure implementation.  This offering will enable you to achieve the first bare-metal-like performance levels for connections per second (CPS) in Azure.

Storage

Ephemeral OS disks supports encryption at host using customer managed keys

Ephemeral OS disks can be encrypted at host using platform managed keys or customer managed keys. The default is platform managed keys. This feature would enable our customers to meet your organization’s compliance needs.

Azure Ultra Disk Storage in Brazil Southeast, South Africa North and UAE North

Azure Ultra Disk Storage is now available in one zone in Brazil Southeast, South Africa North and UAE North region. Azure Ultra Disk Storage offers high throughput, high IOPS and consistent low latency disk storage for Azure Virtual Machines (VMs). Ultra Disk Storage is well suited for data-intensive workloads such as SAP HANA, top-tier databases and transaction-heavy workloads.

Encryption scopes on hierarchical namespace enabled storage accounts

Encryption scopes introduce the option to provision multiple encryption keys in a storage account with hierarchical namespace. Using encryption scopes, you now can provision multiple encryption keys and choose to apply the encryption scope either at the container level (as the default scope for blobs in that container) or at the blob level. The capability is available for REST, HDFS, NFSv3 and SFTP protocols in an Azure Blob / Data Lake Gen2 storage account. The key that protects an encryption scope may be either a Microsoft-managed key or a customer-managed key in Azure Key Vault. You can choose to enable automatic rotation of a customer-managed key that protects an encryption scope. When you generate a new version of the key in your Key Vault, Azure Storage will automatically update the version of the key that is protecting the encryption scope, within a day.

Performance Plus for Azure Disk Storage (preview)

Azure Disk Storage now offers a new feature called Performance Plus, which enhances the IOPS and throughput performance of Standard HDD, Standard SSD, and Standard HDD disks that are sized 1TB or larger. Performance Plus is offered for free and is available to use through deployments on Azure Command-Line Interface (CLI) and PowerShell.

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Compute

Azure VMware Solution in Microsoft Azure Government (preview)

Azure VMware Solution is a fully managed service in Azure that customers can use to extend their on-premises VMware workloads more seamlessly to the cloud, while maintaining their existing skills and operational processes. Azure VMware Solution is already available in Azure commercial for any customer, including public sector organizations. With this launch, Microsoft is extending the same benefits of Azure VMware Solution to Azure Government, where US Government customers and their partners can meet their security and compliance needs.

Spot Priority Mix

Spot Priority Mix is a new feature for Virtual Machine Scale Sets (VMSS) with Flexible Orchestration Mode enabled. With Spot Priority Mix, customers can now mix spot and standard virtual machines in their Flexible scale set, providing the high availability of standard virtual machines and the cost savings of Spot virtual machines. This feature also allows customers to autoscale their scale set with a percentage split of Spot and standard virtual machines, providing even more flexibility and cost optimization. With Spot Priority Mix, customers can specify a base number of standard virtual machines and a percentage split of spot and standard virtual machines to be used when the scale set capacity is above the base number of standard virtual machines. This allows customers to ensure that their critical workloads are always running on standard virtual machines, while taking advantage of the cost savings offered by spot virtual machines for non-critical, interruptible workloads.

Networking

Azure Network Watcher: new enhanced connection troubleshoot

As customers bring sophisticated, high-performance workloads into Azure, there is a critical need for increased visibility and control over the operational state of complex networks running these workloads. One such day-to-day common occurring scenario is connectivity.

Although Microsoft Azure Network Watcher provides numerous specialized standalone tools to diagnose and troubleshoot connectivity cases. These tools include:

• IP Flow Verify – helping detect blocked traffic due to network security group (NSG) rules restriction
• Next Hop – determine intended traffic as per the rules of the effective route
• Port Scanner – helping determine any port blocking traffic.

With a one-stop solution to all disjointed operations and actionable insights at the fingertips, the new comprehensive and improved Network Watcher connection troubleshoot aims to reduce mean time to resolution and improve your experience.

New features:

• Unified solution for troubleshooting all NSG, user defined routes, and blocked ports
• Actionable insights with step-by-step guide to resolve issues
• Identifying configuration issues impacting connectivity
• NSG rules that are blocking traffic
• Inability to open a socket at the specified source port
• No servers listening on designated destination ports
• Misconfigured or missing routes

Scale improvements and metrics enhancements on Azure’s regional WAF

You can now do more with less using the increased scale limits for Azure’s regional Web Application Firewall (WAF) running on Application Gateway. These increased scale limits allow you greater flexibility, and scale, when configuring your WAF to meet the needs of your applications and network. Application Gateway v2 WAF enabled SKUs running Core Rule Set (CRS) 3.2 or higher now supports a higher number of frontend ports, HTTP load-balancing rules, backend HTTP settings, SSL certificates, number of sites, and redirect configurations. The regional WAF also increased the number of HTTP listeners from 40 to 200. You can leverage the new metrics for Azure’s regional v2 WAF when you use CRS 3.2 or higher, or if your WAF has bot protection and geo-filtering enabled. The regional WAF now allows you to filter the metrics total requests, managed rule matches, custom rule matches, and bot protection matches by the dimensions policy name, policy scope and ruleset name, in addition to the already existing dimensions that the WAF supports.

Azure Virtual Network Manager Event Logging (preview)

Azure Virtual Network Manager (AVNM) event logging is now available for public preview. AVNM is a highly scalable and available network management solution that allows you to simplify network management across subscriptions globally. With this new feature, you can monitor changes in network group membership by accessing event logs. Whenever a virtual network is added to or removed from a network group, a corresponding log is emitted for that specific addition or removal. You can view and interact with these logs using Azure Monitor’s Log Analytics tool in the Azure Portal, or you can store them in your storage account, or send them to an event hub or partner solution.

Storage

More transactions at no additional cost for Azure Standard SSD

Microsoft has made changes to the billable transaction costs per hour that can result in additional cost savings. The total cost of Azure Standard SSD storage depends on the size, number of disks, and the number of transactions. Any transactions that exceed the maximum hourly limit will not incur additional charges. New prices took effect on March 6th, 2023.

Customer Initiated Storage Account Conversion

Microsoft is now supporting the self-service ability to convert storage accounts from non-zonal redundancy (LRS/GRS) to zonal redundancy (ZRS/GZRS). You can now save time by initiating a storage account conversion directly through Azure Portal rather than creating a support ticket. Converting your storage account to zonal redundancy allows you to increase your intra-regional resiliency and availability.

Online live resize of persistent volumes

Live resizing capability allows you to dynamically scale up your persistent volumes without application downtime. Previously, in order to resize the disk, you had to scale down your deployment to zero pods, wait several minutes for the disk to detach, update your persistent volume claim, and then scale back up the deployment. With Live resize of persistent volumes, you can just modify your persistent volume claim directly, avoiding any application downtime.

Azure Ultra Disk Storage in the China North 3 Azure region

Azure Ultra Disk Storage is now available in the China North 3 Azure region. Azure Ultra Disk Storage offers high throughput, high input/output operations per second (IOPS), and consistent low latency disk storage for Azure Virtual Machines. Ultra Disk Storage is well-suited for data-intensive workloads such as SAP HANA, top-tier databases, and transaction-heavy workloads.

Azure Archive Storage now available in West US 3

Azure Archive Storage provides a secure, low-cost means for retaining rarely accessed data including backup and archival storage. Now, Azure Archive Storage is available in West US 3.

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Storage

Create disks from CMK-encrypted snapshots across subscriptions and in the same tenant

To ease manageability, Microsoft makes disks encrypted with customer-managed keys (CMK) more flexible by allowing creation of disks and snapshots from CMK-encrypted source across subscriptions.

Incremental snapshots for Premium SSD v2 Disk Storage (preview)

Incremental snapshots for Premium SSD v2 Disk Storage in the US East and West Europe Azure region are available. This new capability is particularly important to customers who want to create a backup copy of their data stored on disks to recover from accidental deletes, or to have a last line of defense against ransomware attacks, or to ensure business continuity. You can now create incremental snapshots for Premium SSD v2 Disk Storage on Standard HDD. Additionally, snapshot resources can be used to store incremental backups of your disk, create or recover to new disks, or download snapshots to on-premises locations. This new feature adds an extra layer of data protection and flexibility for users.

Azure Managed Lustre (preview)

Azure Managed Lustre is a managed, pay-as-you-go file system purpose-built for high-performance computing (HPC) and AI workloads. This high-performance distributed parallel file system delivers hundreds of GBps storage bandwidth and solid-state disk latency and integrates fully with Azure services such as Azure HPC Compute, Azure Kubernetes Service, and Azure Machine Learning.

Use this system to:

• Simplify operations
• Reduce setup costs
• Eliminate complex maintenance

Azure NetApp Files updates (preview)

• Azure NetApp Files volume user and group quotas: in some scenarios you may want to limit this storage consumption of users and groups within the volume. With Azure NetApp Files volume and group quotas you can now do so. User and/or group quotas enable you to restrict the storage space that a user or group can use within a specific Azure NetApp Files volume. You can choose to set default (same for all users) or individual user quotas on all NFS, SMB, and dual protocol-enabled volumes. On all NFS-enabled volumes, you can set default (same for all users) or individual group quotas.
• You can now create Azure NetApp Files large volumes between 100TiB to 500TiB in size.
• Azure NetApp Files now supports smaller 2TiB capacity pool sizes, lowered from 4TiB, when used with volumes using standard network features.
• Azure NetApp Files volumes now support encryption with customer-managed keys (CMK), using Azure Key Vault for key storage, to enable an extra layer of security for data at rest.

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Compute

New planned datacenter region in Saudi Arabia (Saudi Arabia Central)

Microsoft will establish a new datacenter region in the country, offering organizations in Saudi Arabia local data residency and faster access to the cloud, delivering advanced data security and cloud solutions. The new datacenter region will also include Availability Zones, providing customers with high availability and additional tolerance to datacenter failures.

Azure Kubernetes Service introduces two pricing tiers: Free and Standard

To better communicate the benefits and use cases for the two control plane management options, today, Azure Kubernetes Service (AKS) is introducing two pricing tiers: Free tier and Standard tier. Previously, few customers were aware of the uptime SLA support, and many did not have the uptime SLA feature enabled for critical production workload. With the Standard tier, Microsoft hopes to help increase customer awareness and allow customers to gain the full benefits of the Standard tier for production workload to minimize disruption.

AKS’s unique Free tier allows you to only pay for the virtual machines, and associated storage and networking resources consumed, and you get the managed Kubernetes control plane for free. This allows you to deploy unlimited free test clusters to decide if AKS is right for your needs and allows you to configure and test your infrastructure set-up before running critical production workloads. The Free tier is recommended for clusters with less than 10 nodes and for experimenting, learning, and simple testing.

The new Standard tier is the recommended control plane management pricing option which comes with greater control plane resources, scalability and the existing uptime SLA support. Customers currently signed up for the uptime SLA support will automatically be moved to the Standard tier with no change in cost or action needed. Standard tier not only includes the uptime SLA, but it will also include additional features such as support for up to 5000 nodes per cluster and API server autoscaling.

Microsoft Azure Load Testing is now Generally Available

Azure Load Testing is a fully managed load-testing service that enables you to generate high-scale load, gain actionable insights, and ensure the resiliency of your applications and services. The service simulates traffic for your applications, regardless of where they’re hosted. Developers, testers, and quality assurance (QA) engineers can use it to optimize application performance, scalability, or capacity.

Trusted launch for Azure VMs in Azure for US Government regions

Trusted launch for Azure virtual machines is available in all Azure for US Government regions: US Gov Virginia, US Gov Arizona US Gov Texas, US DoD East, US DoD Central. Trusted launch for Azure VMs allows you to bolster the security posture of an Azure Virtual Machine.

Storage

Azure File Sync agent v16

The Azure File Sync agent v16 release is being flighted to servers which are configured to automatically update when a new version becomes available.

Improvements and issues that are fixed:

• Improved Azure File Sync service availability: Azure File Sync is now a zone-redundant service which means an outage in a zone has limited impact while improving the service resiliency to minimize customer impact. To fully leverage this improvement, configure your storage accounts to use zone-redundant storage (ZRS) or Geo-zone redundant storage (GZRS) replication.
• Sync upload performance improvements: this improvement will mainly benefit file share migrations (initial upload) and high churn events on the server in which a large number of files need to be uploaded.
• Immediately run server change enumeration to detect files changes that were missed on the server.
• Miscellaneous reliability and telemetry improvements for cloud tiering and sync.

To obtain and install this update, configure your Azure File Sync agent to automatically update when a new version becomes available or manually download the update from the Microsoft Update Catalog.

More information about this release:

• This release is available for Windows Server 2012 R2, Windows Server 2016, Windows Server 2019 and Windows Server 2022 installations.
• The agent version for this release is 16.0.0.0.
• Installation instructions are documented in KB5013877.

Azure storage access tiers to append blobs and page blobs with blob type conversion

Azure Storage offers different access tiers so that you can store your blob data in the most cost-effective manner based on how it’s being used. Azure Storage access tiers include hot tier, cool tier, and archive tier. Azure Storage access tiers support only block blobs natively. When you need to save cost of storing append blobs or page blobs, you can convert them to block blobs then move them into the most cost-efficient tiers based on your access patterns. Blob type conversion along with tiering is now supported by PowerShell, CLI and AzCopy.

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Compute

Classic VM retirement: extending retirement date to September 1st 2023

Microsoft is providing an extended migration period for IaaS VMs from Azure Service Manager to Azure Resource Manager. To avoid service disruption, plan and migrate IaaS VMs from Azure Service Manager to Resource Manager 1 September 2023. There are multiple steps to this transition, so we recommend that you plan your migration promptly to avoid potential system interruption.

Networking

Application security groups support for private endpoints

Private endpoint support for application security groups (ASGs) is now available. This feature enhancement will allow you to add granular controls on top of existing network security group (NSG) rules by attaching an ASG to the private endpoint network interface. This will increase segregation within your subnets without losing security rules. In order to leverage this feature, you will need to set a specific subnet level property, called PrivateEndpointNetworkPolicies, to enabled on the subnet containing private endpoint resources.

Storage

5 GB Put Blob

Azure Storage is announcing the general availability of 5 GB Put Blob. This allows you to upload nearly 20x the previous limit of Put Blob uploads while increasing the maximum size of Put Blob from 256 MiB to 5000 MiB.

Mount Azure Storage as a local share in App Service Windows Code

Mounting Azure Storage File share as a network share in Windows code (non-container) in App Service is now available.

Incremental snapshots for Ultra Disk Storage (preview)

The preview of incremental snapshots for Ultra Disk in the Sweden Central and US West 3 Azure region is available. This new capability is particularly important to customers who want to create a backup copy of their data stored on disks to recover from accidental deletes, or to have a last line of defense against ransomware attacks, or to ensure business continuity. You can now create incremental snapshots for Ultra Disk on Standard HDD. Additionally, snapshot resources can be used to store incremental backups of your disk, create or recover to new disks, or download snapshots to on-premises locations.

Azure Stack

Azure Stack HCI

Software Defined Networking (SDN) with WAC v2211

In this article there are all new features and improvements for SDN in Windows Admin Center 2211 (WAC) for Azure Stack HCI.

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Storage

Azure Ultra Disk Storage in Switzerland North and Korea South

Azure Ultra Disk Storage is now available in one zone in Switzerland North and with Regional VMs in Korea South. Azure Ultra Disk Storage offers high throughput, high IOPS, and consistent low latency disk storage for Azure Virtual Machines (VMs). Ultra Disk Storage is well-suited for data-intensive workloads such as SAP HANA, top-tier databases, and transaction-heavy workloads.

Azure Active Directory authentication for exporting and importing Managed Disks

Azure already supports disk import and export locking only from a trusted Azure Virtual Network (VNET) using Azure Private Link. For greater security, the integration with Azure Active Directory (AD) to export and import data to Azure Managed Disks is available. This feature enables the system to validate the identity of the requesting user in Azure AD and verify that the user has the required permissions to export and import that disk.