Archivi categoria: Azure Local – 2025-2026

Azure IaaS and Azure Local: announcements and updates (April 2025 – Weeks: 15 and 16)

This blog post series highlights the key announcements and major updates related to Azure Infrastructure as a Service (IaaS) and Azure Local, as officially released by Microsoft in the past two weeks.

Azure

General

Microsoft Copilot in Azure is Now Generally Available

Microsoft Copilot in Azure has reached general availability, bringing AI-powered assistance to users across the Azure ecosystem. Designed to enhance productivity, Copilot in Azure leverages Large Language Models (LLMs), the Azure control plane, and real-time insights from the user’s environment to streamline tasks and uncover cloud benefits. With GA, users can now rely on Copilot in production scenarios, benefiting from improved performance, higher response accuracy, and full localization support across all Azure portal languages. Current capabilities are included at no additional cost, though future features may introduce pricing considerations. Microsoft has also implemented safeguards such as temporary throttling to manage excessive use of generative AI services.

Microsoft Azure Now Available from New Cloud Regions

Microsoft has announced the general availability of new Azure cloud regions, further expanding its global infrastructure. The Indonesia Central region is now live, marking Azure’s first presence in Indonesia. Equipped with Azure Availability Zones, this region offers scalable, resilient, and secure cloud services to support digital transformation and AI innovation across the country. In addition, a new Azure for U.S. Government Secret region is now generally available, providing increased capacity and flexibility for classified workloads. Designed to meet the strict requirements of the U.S. Department of Defense and other federal agencies, the new region offers geographically distributed data residency options, continuity of operations, and native connectivity to U.S. Government classified networks. Customers benefit from a consistent platform experience and can access foundational Azure services, including Azure ExpressRoute, to support mission-critical scenarios with private, high-bandwidth connectivity.

ExpressRoute Metro and Global Reach Available in Italy North

ExpressRoute Metro and Global Reach are now available in the Italy North region, expanding Azure’s private connectivity capabilities in the area. ExpressRoute Metro allows customers to connect to Microsoft’s global network from two different physical locations within a metro area for higher resiliency and performance. With Global Reach, users can connect their on-premises networks across different regions through the Microsoft backbone, improving global connectivity and optimizing traffic flow.

Compute

DCesv6 and ECesv6 Series Confidential VMs with Intel® TDX (private preview)

Azure has introduced the DCesv6 and ECesv6 series Confidential Virtual Machines in private preview, leveraging 5th Gen Intel® Xeon® processors with Intel® Trust Domain Extensions (TDX). These next-generation VMs are designed to support highly sensitive and confidential workloads in the cloud without requiring changes to application code. The new SKUs include the general-purpose DCesv6-series and the memory-optimized ECesv6-series. These VMs maintain data privacy by keeping it encrypted even during processing, and they offer in-guest attestation, enabling verification of VM integrity. This marks a significant advancement in Azure’s confidential computing offerings.

Networking

Azure Networking Capabilities for Microsoft Copilot in Azure

Azure networking capabilities for Microsoft Copilot in Azure are now generally available, enhancing the AI-powered assistant with deep, contextual insights into network design, operations, and security. Users can now query Copilot for information on Azure networking products, receive guidance on architecture planning, resilience strategies, and migration from on-premises environments. Copilot also supports detailed inventory and traffic path queries, providing topology maps and network connectivity graphs. For operational needs, it offers troubleshooting and diagnostic capabilities by analyzing network configurations, control plane data, and resource health. Additionally, Copilot now integrates with Security Copilot to enable attack investigation on malicious traffic intercepted by Azure Firewall’s IDPS feature—directly within the Azure portal.

Application Gateway as a Private Link Enabled Origin for Front Door Premium

Application Gateway resources can now be configured as Private Link enabled origins within Azure Front Door Premium profiles. This integration allows customers to deliver web content via public Front Door endpoints while keeping the origin infrastructure isolated from the public internet. The use of Private Link ensures that the communication between Front Door and the origin remains secure and private, enhancing the security posture of internet-facing applications. This feature is particularly valuable for scenarios requiring strict network isolation without compromising performance or global reach.

Azure Front Door: Enhanced Server Variable Support

Azure Front Door has expanded its server variable capabilities by enabling the capture of request header, response header, and request query string values. This builds on the previously released feature to capture URL path segments. With these new enhancements, server variables can now be used in the rules engine to enable more dynamic and flexible HTTP request manipulation and routing at the edge. Scenarios enabled by this feature include modifying a response header based on a request header value, renaming cloud provider-generated headers to branded ones, and redirecting based on query string values. These capabilities unlock new customization opportunities for developers aiming to fine-tune edge routing behavior.

Azure Front Door: Custom Cipher Suite Support

Custom cipher suite support for Azure Front Door is now generally available across both Standard and Premium tiers. Azure Front Door provides several predefined TLS policies based on Microsoft Security best practices to ensure strong encryption and protocol support. With this update, customers can also define custom TLS policies to meet specific business and compliance requirements. This includes setting the minimum supported TLS version and selecting allowed cipher suites, offering granular control over security settings and enabling organizations to tailor their Front Door configuration to their unique security posture.

Azure Bastion Developer Now Available in 36 Regions

Azure Bastion Developer, previously limited to six regions, is now generally available in 36 public regions worldwide. Designed for Dev/Test scenarios, this version of Azure Bastion provides secure-by-default RDP and SSH access to virtual machines without the need for a public IP address. It allows users to connect to one VM at a time through the virtual machine’s connect blade—all at no cost. While it lacks the advanced features and scalability options of the standard Bastion offering, Bastion Developer is ideal for users seeking a streamlined and secure connection method for development and testing environments.

Expanded Availability of ExpressRoute Metro, Peering Locations, and Global Reach

Azure continues to expand its networking footprint with broader availability of ExpressRoute Metro and Global Reach. ExpressRoute Metro is now accessible in four new locations—Atlanta (USA), Jakarta (Indonesia), Madrid (Spain), and Milan (Italy)—providing increased resiliency for organizations requiring high-performance, private connectivity to Azure. Additionally, two new ExpressRoute Peering locations, Brussels and Brussels2 in Belgium, have been introduced, further enhancing secure access across Europe. ExpressRoute Direct is now available in all these new regions. Furthermore, ExpressRoute Global Reach has expanded to include Belgium, Italy, and Spain, enabling private site-to-site connectivity through Microsoft’s global network infrastructure.

Route-Maps for Azure Virtual WAN

Azure Virtual WAN now includes support for route-maps, empowering users with enhanced control over routing behavior within Virtual WAN virtual hubs. This feature enables fine-grained management of route advertisements and route selection for various connection types, including site-to-site VPN, point-to-site VPN, ExpressRoute, and virtual network (VNet) links. Route-maps allow for advanced routing scenarios, such as filtering or modifying route advertisements, offering greater flexibility in managing complex network topologies and optimizing traffic flows.

Storage

ACLs for Local Users in Azure Blob Storage SFTP

Access Control Lists (ACLs) for Azure Blob Storage SFTP local users are now generally available. This capability provides administrators with an intuitive way to implement fine-grained access control over blobs and directories for users configured for SFTP access. With ACLs, organizations can enforce security and access policies more precisely, simplifying the management of user-level permissions while enhancing data protection within Azure Blob Storage environments.

Performance Plus for Azure Disk Storage

Azure Disk Storage has introduced the Performance Plus feature in general availability, bringing enhanced performance to Premium SSD, Standard SSD, and Standard HDD disks of 513 GB or larger. With Performance Plus, users benefit from increased IOPS and throughput at no additional cost. This feature is accessible via Azure CLI, PowerShell, and the Azure Portal, enabling customers to optimize their disk performance with minimal effort and without changing disk SKUs. Performance Plus helps meet demanding workload requirements by improving disk responsiveness and efficiency.

Azure NetApp Files: File Access Logs (preview)

Azure NetApp Files now supports file access logs in public preview, offering organizations enhanced visibility into file activity for improved security and operational monitoring. This new feature captures detailed information about file access, including user identity, operation type, and timestamps. It supports SMB, NFSv4.1, and dual-protocol volumes, allowing organizations to detect unauthorized access, ensure compliance, resolve operational incidents, and analyze usage patterns. By incorporating file access logs, enterprises can strengthen data protection, meet compliance requirements, and align with the Well-Architected Framework’s security best practices.

Conclusion

Over the past two weeks, Microsoft has introduced a slew of updates and announcements pertaining to Azure Infrastructure as a Service (IaaS) and Azure Local. These developments underscore the tech giant’s unwavering commitment to enhancing its cloud offerings and adapting to the ever-evolving needs of businesses and developers. Users of Azure can anticipate improved functionalities, streamlined services, and enriched features as a result of these changes. Stay tuned for more insights as I continue to monitor and report on Azure’s progression in the cloud sphere.

Azure IaaS and Azure Local: announcements and updates (April 2025 – Weeks: 13 and 14)

This blog post series highlights the key announcements and major updates related to Azure Infrastructure as a Service (IaaS) and Azure Local, as officially released by Microsoft in the past two weeks.

Azure

Compute

Retirement of D, Ds, Dv2, Dsv2, and Ls Series Virtual Machines

Microsoft has announced the retirement of the D, Ds, Dv2, Dsv2, and Ls series virtual machines, effective May 1, 2028. After this date, these VM series will no longer be available for use or purchase. Customers currently utilizing these VM types are advised to begin planning their migration strategies toward newer VM generations to ensure ongoing compatibility and support for their applications. As part of the phased retirement process, three-year reserved instances for these VMs will no longer be available for purchase or renewal starting May 1, 2025. One-year reservations will continue to be offered until 2027. For those with active three-year reservation contracts, the benefits will remain valid until contract expiration. Beyond that point, instances will revert to pay-as-you-go pricing. To avoid billing surprises and ensure continuity, customers should review their reservations and take action to transition affected workloads.

Networking

Azure Firewall Updates – Parallel IP Group Updates

Azure Firewall now supports Parallel IP Group Updates, enabling administrators to update multiple IP Groups simultaneously as part of their firewall or firewall policy changes.

Key Benefits

  • Faster & Scalable Updates: Update up to 20 IP Groups in parallel, achieving up to 2x faster update times compared to sequential updates.
  • Improved Visibility: Enhanced error messaging allows administrators to quickly identify and resolve issues. Even if one IP Group fails, other updates continue uninterrupted, preserving overall system integrity.

This update significantly improves management efficiency and scalability for large-scale or dynamic firewall policy environments.

New Regions for Azure Front Door Premium with Private Link-Enabled Origins

Azure Front Door Premium now supports Private Link-enabled origins in West US 2 and Southeast Asia regions. This feature allows content to be delivered through public Front Door endpoints while keeping backend origins inaccessible from the public internet, enhancing security and privacy. With the addition of these new regions, organizations can now deploy Private Link-enabled architectures in more geographies, improving network performance and meeting regional compliance requirements.

Network isolated cluster in AKS

Azure Kubernetes Service (AKS) now offers network isolated clusters, enabling a simplified approach to securing network access to Kubernetes workloads. While customers have traditionally relied on Azure Firewall to control egress traffic and enforce isolation, this approach often introduces added complexity and cost. With network isolated clusters, organizations can reduce the risk of unintentional exposure of public endpoints and strengthen the security posture of their AKS deployments. This built-in feature helps minimize attack surfaces by ensuring tighter control over how clusters connect to external networks, supporting compliance and data protection goals with greater ease.

ExpressRoute Resiliency Enhancements (preview)

Microsoft has introduced new resiliency validation and insight capabilities for ExpressRoute, now available in public preview. These enhancements aim to improve the assessment and monitoring of ExpressRoute-enabled workloads, offering more robust and transparent insights into network reliability. The resiliency validation feature allows customers to simulate site failovers on their Virtual Network Gateways, enabling proactive testing during planned migrations or outage scenarios. This helps verify failover mechanisms and ensures continued connectivity to Azure services. In addition, the new resiliency insights capability introduces a resiliency index — a percentage-based score that evaluates ExpressRoute reliability based on criteria such as route resilience, use of zone-redundant gateways, advisory feedback, and test results from resiliency validation. These metrics allow organizations to identify weak points in their network architecture and make informed improvements to enhance the robustness of their connectivity.

Increased VNet limits for Private Endpoints (preview)

Microsoft has introduced High Scale Private Endpoints, now in public preview, enabling significantly increased limits for deploying Azure Private Endpoints within Virtual Networks (VNets) and across peered VNets. Previously, customers could only create up to 1,000 private endpoints within a single VNet, and exceeding this limit required a support request. Additionally, Microsoft recommended a soft limit of 4,000 private endpoints across peered VNets to avoid connectivity issues. With the introduction of High Scale Private Endpoints, these limits are substantially raised—allowing up to 5,000 private endpoints within a single VNet and 20,000 across peered VNets. This capability is especially beneficial for large-scale, service-rich environments where extensive use of private connectivity is essential. Customers seeking greater scalability for their private networking configurations are encouraged to adopt High Scale Private Endpoints to support growing infrastructure needs without the complexity of manual quota increases.

Storage

Vaulted Backup for Azure Files

Azure Backup has announced the general availability of Vaulted Backup support for Azure Files – Standard tier, providing a robust, enterprise-grade solution to protect data and applications hosted on Azure SMB file shares.

Key Features & Benefits

  • Integrated Protection Policy: Combine snapshot and vaulted backup in a single policy to protect data in a secure Recovery Services vault.

  • Regional Recovery: Ensure data resilience with support for cross-region restore.

  • Advanced Protection Capabilities:

    • Ransomware protection and immutability

    • Restore capability even if the file share is deleted

  • Azure File Sync Integration: Seamlessly protect cloud-tiered data from Azure File Sync, enabling long-term retention in a cost-effective way.

With this release, customers can meet compliance, security, and business continuity requirements while simplifying backup management and reducing data protection costs.

Azure File Sync support for managed identities

Azure File Sync now supports managed identities, a feature that has reached general availability. This enhancement replaces the need for shared keys with a more secure and streamlined authentication mechanism through system-assigned managed identities provided by Microsoft Entra ID. By configuring managed identities within an Azure File Sync deployment, these identities will handle authentication in several key scenarios: the Storage Sync Service authenticating to the Azure file share, registered servers authenticating to the Azure file share, and registered servers authenticating to the Storage Sync Service. To further simplify the setup and improve security, managed identities are now enabled by default for all new Storage Sync Services. Configuration can be completed directly through the Azure portal, eliminating the previous dependency on PowerShell. This updated experience is being gradually rolled out across all Azure regions. The feature is available at no additional cost in all Azure Public and Government cloud regions, making it a recommended approach for customers seeking enhanced security and simplified identity management.

Azure NetApp Files Flexible Service Level (Preview)

Azure has introduced a Flexible Service Level for Azure NetApp Files, now in public preview, allowing customers to independently configure storage capacity and throughput for greater cost and performance optimization.

Key Features & Benefits

  • Customizable Throughput: Scale throughput independently from capacity, up to 640 MiB/s per provisioned TiB, which is up to 5x higher than the Ultra tier.

  • Manual QoS Pools: Supported with manual QoS capacity pools, offering a baseline throughput of 128 MiB/s at no additional cost.

  • Right-Sized Performance:

    • High throughput for smaller pools – Ideal for SAP HANA, Oracle, and other demanding workloads.

    • Cost savings for high-capacity/low-throughput workloads – Reduce cost without compromising storage footprint.

  • No Volume Moves Required: Avoid service disruptions or reconfigurations when scaling performance or storage.

This new service level offers unprecedented flexibility, allowing customers to fine-tune Azure NetApp Files performance and cost based on exact workload requirements.

Azure Local

Azure Local – 2503 Update Released

The 2503 update for Azure Local has been officially released as of March 31st, introducing a set of baseline enhancements focused on improving registration, deployment, and overall management experience. This update reflects ongoing efforts to simplify operations and bolster security within Azure Local environments.

Key changes include a shift in the extension installation process: extensions are no longer installed during the registration phase but are now deployed during machine validation. Additionally, the local UI used for bootstrapping has been deprecated in favor of the Configurator app, providing a more modern and flexible onboarding experience. The Arc registration flow has also been streamlined—Service Principal Name (SPN) is deprecated, and a simplified Arc installer script now relies solely on the Start-ArcBootstrap command.

The update also supports composed images for OEMs and enables deployment of both current and previous versions of Azure Local. While the Azure portal supports the latest version, prior versions must be deployed using dedicated Azure Resource Manager templates.

Other notable improvements include enhanced security for the Bootstrap service, integrated environment checks for connectivity and validation, improved update applicability logic, and support for downloading platform update packages via URLs. Finally, users can now connect to Azure Local VMs over SSH or RDP from within the host network, removing the requirement for line-of-sight access.

Azure Local Performance Metrics Dashboard

Microsoft has introduced the Azure Local Performance Metrics Dashboard, a powerful new tool designed to provide comprehensive visibility into the health and performance of Azure Local systems. With over 60 metrics collected by default—at no additional cost—this out-of-the-box solution delivers actionable insights across storage, network, and compute resources.

Metrics are automatically gathered by the TelemetryAndDiagnostics agent, which is configured during deployment, enabling seamless access to system telemetry without requiring manual setup. The dashboard offers deep visibility into several critical performance areas:

  • Storage Performance: Includes disk read/write operations and throughput, volume latency, and insights into VHD and physical disk activity to help optimize storage usage.

  • Network Performance: Monitors data transmission metrics such as Netadapter Bytes Sent/Received, RDMA traffic, and VM-level network activity for early detection of bottlenecks or connectivity issues.

  • Compute Metrics: Tracks memory usage (available, assigned, used, pressure) across host and guest environments, along with CPU utilization metrics for both host and virtual machines.

This centralized performance dashboard empowers administrators to proactively manage their Azure Local environments, facilitating data-driven decisions to maintain system efficiency and reliability.

Support for 4-node switchless configuration

Microsoft has introduced official documentation to support 4-node switchless configurations, expanding the deployment options for Azure Stack HCI and other Azure-integrated infrastructure solutions.

This update provides organizations with the flexibility to deploy smaller, cost-effective clusters without the need for dedicated network switches between nodes. The switchless architecture simplifies the physical setup and reduces hardware requirements while maintaining essential performance and connectivity capabilities for supported scenarios.

By adding support for this topology, Microsoft continues to enhance deployment versatility, especially for edge and branch environments where simplicity and space efficiency are crucial.

Conclusion

Over the past two weeks, Microsoft has introduced a slew of updates and announcements pertaining to Azure Infrastructure as a Service (IaaS) and Azure Local. These developments underscore the tech giant’s unwavering commitment to enhancing its cloud offerings and adapting to the ever-evolving needs of businesses and developers. Users of Azure can anticipate improved functionalities, streamlined services, and enriched features as a result of these changes. Stay tuned for more insights as I continue to monitor and report on Azure’s progression in the cloud sphere.