Archivi categoria: Azure Storage

Azure IaaS and Azure Stack: announcements and updates (July 2021 – Weeks: 27 and 28)

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.



Free Extended Security Updates only on Azure for Windows Server 2012/R2and SQL Server 2012

On-premises Windows Server and SQL Server customers looking to migrate and modernize can take advantage of the extension of free Extended Security Updates (ESUs) for Windows Server 2012/R2 and SQL Server 2012, as follows:

  • Windows Server 2012 and 2012 R2 Extended Support (ESU) will end on October 10, 2023. Extended Support for SQL Server 2012 ends July 12, 2022. Customers that cannot meet this deadline can protect their apps and data running on these releases for three additional years when they migrate to Windows Server and SQL Server on Azure and take advantage of free ESUs on Azure. Customers running Windows Server and SQL Server on these releases and on-premises will have the option to purchase ESUs.
  • Windows Server and SQL Server 2008 and 2008 R2 three-year ESUs are coming to an end on January 10, 2023, and July 12, 2022, respectively. Customers who need more time to migrate and modernize will be able to take advantage of a Windows Server and SQL Server 2008 and 2008 R2 on Azure, we will now provide one addiitonal year of extended security updates only on Azure.

Virtual Machine (VM) bursting is now generally available on more VM types

Virtual machine level disk bursting is a now enabled for our Dsv4, Dasv4, Ddsv4, Esv4, Easv4, Edsv4, Fsv2 and B-series VM families, which allows your virtual machine to burst its disk IO and MiB/s throughput performance for a short time daily. This enables your VMs to handle unforeseen spikey disk traffic smoothly and process batched jobs with speed. There is no additional cost associated with this new capability or adjustments on the VM pricing and it comes enabled by default.

HPC Cache on E-Series VMs Support of Blob NFS 3.0

The Azure Blob team recently announced that Blob NFS 3.0 protocol support is generally available and now, Azure HPC Cache will follow suit with general availability using E-Series VMs.


Azure File Sync agent v13

The Azure File Sync agent v13 release is being flighted to servers which are configured to automatically update when a new version becomes available.

Improvements and issues that are fixed in the v13 release:

  • Authoritative upload. Authoritative upload is a new mode available when creating the first server endpoint in a sync group. It is useful for the scenario where the cloud (Azure file share) has some/most of the data but is outdated and needs to be caught up with the more recent data on the new server endpoint. This is the case in offline migration scenarios like DataBox, for instance. When a DataBox is filled and sent to Azure, the users of the local server will keep changing / adding / deleting files on the local server. That makes the data in the DataBox and thus the Azure file share, slightly outdated. With Authoritative Upload, you can now tell the server and cloud, how to resolve this case and get the cloud seamlessly updated with the latest changes on the server. No matter how the data got to the cloud, this mode can update the Azure file share if the data stems from the matching location on the server. Be sure to avoid large directory restructures between the initial copy to the cloud and catching up with Authoritative Upload. This will ensure you are only transporting updates. Changes to directory names will cause all files in these renamed directories to be uploaded again. This functionality is comparable to semantics of RoboCopy /MIR = mirror source to target, including removing files on the target that no longer exist on the source. Authoritative Upload replaces the “Offline Data Transfer” feature for DataBox integration with Azure File Sync via a staging share. A staging share is no longer required to use DataBox. New Offline Data Transfer jobs can no longer be started with the AFS V13 agent. Existing jobs on a server will continue even with the upgrade to agent version 13.
  • Portal improvements to view cloud change enumeration and sync progress. When a new sync group is created, any connected server endpoint can only begin sync, when cloud change enumeration is complete. In case files already exist in the cloud endpoint (Azure file share) of this sync group, change enumeration of content in the cloud can take some time. The more items (files and folders) exist in the namespace, the longer this process can take. Admins will now be able to obtain cloud change enumeration progress in the Azure portal to estimate an eta for completion / sync to start with servers.
  • Support for server rename. If a registered server is renamed, Azure File Sync will now show the new server name in the portal. If the server was renamed prior to the v13 release, the server name in the portal will now be updated to show the correct server name.
  • Support for Windows Server 2022 Preview. The Azure File Sync agent is now supported on Windows Server 2022 Preview build 20348 or later. Note: Windows Server 2022 adds support for TLS 1.3 which is not currently supported by Azure File Sync. If the TLS settings are managed via group policy, the server must be configured to support TLS 1.2.
  • Miscellaneous improvements:
    • Reliability improvements for sync, cloud tiering and cloud change enumeration.
    • If a large number of files is changed on the server, sync upload is now performed from a VSS snapshot which reduces per-item errors and sync session failures.
    • The Invoke-StorageSyncFileRecall cmdlet will now recall all tiered files associated with a server endpoint, even if the file has moved outside the server endpoint location.
    • Explorer.exe is now excluded from cloud tiering last access time tracking.
    • New telemetry (Event ID 6664) to monitor the orphaned tiered files cleanup progress after removing a server endpoint with cloud tiering enabled.

To obtain and install this update, configure your Azure File Sync agent to automatically update when a new version becomes available or manually download the update from the Microsoft Update Catalog.

More information about this release:

  • This release is available for Windows Server 2012 R2, Windows Server 2016, Windows Server 2019 and Windows Server 2022 Preview installations.
  • A restart is required for servers that have an existing Azure File Sync agent installation if the agent version is less than version 12.0.
  • The agent version for this release is
  • Installation instructions are documented in KB4588753.

Azure Blob storage: container Soft Delete

Administrators can set a retention policy and recover data from a deletion of a blob container without contacting support.

HPC Cache for NVME-based Storage, Storage Target Management, and HIPAA Compliance

The latest release of HPC Cache adds support for high throughput VMs as well as enhancements to storage target operations.

Disk pool for Azure VMware Solution (preview)

With disk pool, Azure VMware Solution customers can now access Azure Disk Storage for high-performance, durable block storage. Customer can scale their storage independent of compute and handle their growing data needs more cost-effectively.


Azure Bastion Standard SKU public (preview)

With the new Azure Bastion Standard SKU, you can now perform/configure the following: 

  • Manually scale Bastion host Virtual Machine instances: Azure Bastion supports manual scaling of the Virtual Machine (VM) instances facilitating Bastion connectivity. You can configure 2-50 instances to manage the number of concurrent SSH and RDP sessions Azure Bastion can support. 

  • Azure Bastion admin panel: Azure Bastion supports enabling/disabling features accessed by the Bastion host. 

Azure Web Application Firewall: OWASP ModSecurity Core Rule Set 3.2 (preview)

Open Web Application Security Project (OWASP) ModSecurity Core Rule Set 3.2 (CRS 3.2) for Azure Web Application Firewall (WAF) deployments running on Application Gateway is in preview. This release offers improved security from web vulnerabilities, reduced false positives, and improvements to performance. Microsoft is also announcing an increase in the file upload limit and request body size limit to 4GB and 2MB respectively.

Azure IaaS and Azure Stack: announcements and updates (July 2021 – Weeks: 25 and 26)

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.



Azure VM Image Builder service: custom image building process

Azure VM Image Builder service is a managed service to build custom Linux or Windows virtual machine (VM) images with ease, and be compliant with your company’s security policy across Azure and Azure Stack. With Azure VM Image Builder, the Microsoft managed service built on HashiCorp Packer, you can describe custom images in a template using new or existing configurations and enables VM image building immediately without setting up and managing your own image building pipeline.

New Azure VMs for confidential workloads (Limited Preview)

Microsoft is announcing the limited preview go-live of the DCsv3-series and DCdsv3-series Azure Virtual Machines, starting in the East US 2 region. Leveraging Intel Software Guard Extensions (SGX), you can allocate private regions of memory, called enclaves, giving you more granular protection against processes or administrators with higher privilege levels. These new VMs enable you to protect the confidentiality and integrity your code and data while in use.


Azure Blob storage: NFS 3.0 protocol support

Network File System (NFS) 3.0 protocol support for Azure Blob Storage is generally available. Azure Blob Storage is the only storage platform that supports NFS 3.0 protocol over object storage natively (no gateway or data copying required), with object storage economics. The data stored in your storage account with NFS support is billed at the same rate as blob storage capacity charges with no minimal provisioned capacity required.

Azure NetApp Files: regional Capacity Quota

The default capacity quota for each subscription will be changed from no quota to a quota of 25 TiB, per region, across all service levels. This capacity change will not have any impact on your current service but will ensure (new) capacity pool creation or capacity pool size increases will succeed based on available regional capacity. Any regional capacity quota increase does not incur a billing increase, as billing will still be based on the provisioned capacity pools.

Expansion of credit-based disk bursting to Azure Standard SSDs E30 and smaller

Credit-based disk bursting is now available on Azure Standard SSDs E30 and smaller (less than or equal to 1TiB). With credit-based bursting, your disks can burst IOPS and throughput for a short-time (up to 30 minutes) to handle unexpected disk traffic and process batch jobs with speed. Now you can deploy your disks for their average performance needs instead of for peak performance, enabling you to achieve cost savings. All your existing or new Standard SSD disks (less than or equal to 1TiB) will have credit-based bursting enabled by default with no user action or addition costs.

Expansion of on-demand disk bursting for Premium SSD to more regions (preview)

Microsoft has now expanded the preview of on-demand disk bursting to all production regions. You can enable on-demand bursting on existing or new disks following instructions here.


VPN NAT (preview)

Azure VPN NAT (Network Address Translation) supports overlapping address spaces between customers on-premises branch networks and their Azure Virtual Networks. NAT can also enable business-to-business connectivity where address spaces are managed by different organizations and re-numbering networks is not possible. VPN NAT preview provides support for 1:1 Static NAT.

Azure IaaS and Azure Stack: announcements and updates (June2021 – Weeks: 23 and 24)

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.



Confidential Computing price reduction on DCsv2 virtual machines

DCsv2-series protects the confidentiality and integrity of your data and code while it’s processed in the public cloud. Microsoft is announcing a price reduction on DCsv2-series Azure Virtual Machines by 37%. The new pricing is effective June 1st, 2021, and applies to all the regions where DCsv2-series is available.

New datacenter region in Arizona

Microsoft is launching a new sustainable datacenter region in Arizona, known as “West US 3.” For more details you can read “Expanding cloud services: Microsoft launches its sustainable datacenter region in Arizona“.

Azure Virtual Machines DCsv2-series are available in Australia

Confidential computing DCsv2-series virtual machines (VMs) are now available in Australia East, Austria Southeast will launch in the coming weeks to provide disaster recovery capabilities. 


Azure Blob index tags 

Prior to index tags, solutions that required the ability to quickly find specific objects in a blob container would need to keep a secondary catalog.  Blob index tags provides a built in capability to add tags and then quickly query for or filter using this information.  This provides a simpler solution without requiring a separate query system. This includes the ability to set index tags both upon upload or after upload.  You can utilize these indexes as part of lifecycle management that automates deletion and movement between tiers.


New Azure private MEC solution announced

An evolution of Private Edge Zones, Azure private multi-access edge compute (MEC) expands the scope of possibilities from a single platform and service to a combination of edge compute, multi-access networking stacks, and the application services that run together at the edge. These capabilities help simplify integration complexity and securely manage services from the cloud for high-performance networking and applications.

In addition to the Azure private MEC solution, we are announcing the following Microsoft and partner services and solutions:

  • New Azure Network Function Manager (public preview) service
  • Metaswitch Fusion Core third-party services on Azure Stack Edge
  • Affirmed Private Network Service third-party service on Azure Stage Edge
  • New Azure Marketplace solutions from our partners’

Default Rule Set 2.0 for Azure Web Application Firewall (preview)

The Default Rule Set 2.0 (DRS 2.0) for Azure Web Application Firewall (WAF) deployments running on Azure Front Door is in preview. This rule set is only available on the Azure Front Door Premium SKU. DRS 2.0 includes the latest changes to our rule set, including the addition of anomaly scoring. With anomaly scoring, incoming requests are assigned an anomaly score when they violate WAF rules and an action is taken only when they breach an anomaly threshold. This helps drastically reduce false positives for customer applications. Also included in DRS2.0 are rules powered by Microsoft Threat Intelligence which offer increased coverage and patches for specific vulnerabilities.

Azure IaaS and Azure Stack: announcements and updates (June 2021 – Weeks: 21 and 22)

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.



Azure Storage Blob inventory is now available in all public regions (preview)

Azure blob storage inventory provides you the ability to understand the total number of objects, their size, tier, and other information to gain insight into your object storage estate. Inventory can be used with Azure Synapse to calculate summaries by container. Microsoft has expanded preview to all public regions for blob inventory.

Key Rotation and Expiration Policies

Key rotation is one of the best security practices to reduce the risk of secret leakage for enterprise customers. Customers using Azure Storage account access keys can rotate their keys on demand, in the absence of key expiry dates and policies customers find it difficult to enforce and manage this key rotation automatically.  The new feature will allow you to not only set key expiration duration but also add policies that can mandate anyone deploying storage endpoints to specify key rotation duration. Furthermore, you would be able to monitor key expiration and set alerts if a key is about to expire. For accounts that are nearing key expiry, you can rotate the keys using APIs, CLI, Powershell, or Azure Portal.


ExpressRoute Global Reach Pricing Reduction

Microsoft is annoucing a 50% decrease in the data transfer price for ExpressRoute Global Reach.  This pricing change will go into effect as of June 1, 2021. For more information about ExpressRoute Global Reach pricing, visit the ExpressRoute Pricing webpage.

Azure Stack

Azure Stack HCI

Azure Kubernetes Service (AKS) on Azure Stack HCI

Azure Kubernetes Services (AKS) on Azure Stack HCI simplifies the Kubernetes cluster deployment on Azure Stack HCI. It offers hybrid capabilities and consistency with Azure Kubernetes Service for ease of app portability and management. You can take advantage of familiar tools and capabilities to modernize both Linux and Windows .NET apps on-premises. Furthermore, its built-in security enables you to deploy your modern applications anywhere: cloud, on-premises, and edge.

Free Trial Now Available

The Azure Stack HCI team has extended the built-in free software trial from 30 days to 60 days giving more time for customers and partners to evaluate their virtual workloads on Azure Stack HCI in planning their purchase decision.  There’s nothing you need to do to enable the trial duration, it’s been automatically extended.

Available in China

Azure Stack HCI is now available in the China cloud – making it very easy to get all the benefits of Azure Stack HCI. 

New feature called Network ATC

The next update available to Azure Stack HCI subscribers will be 21H2 which is in preview right now. With this update comes a new feature called Network ATC, which simplifies the deployment and management of networking on your HCI hosts.

If you’ve deployed Azure Stack HCI previously, you know that network deployment can pose a significant challenge. You might be asking yourself:

  • How do I configure or optimize my adapter?
  • Did I configure the virtual switch, VMMQ, RDMA, etc. correctly?
  • Are all nodes in the cluster the same?
  • Are we following the best practice deployment models?
  • (And if something goes wrong) What changed!?

So, what does Network ATC actually set out to solve? Network ATC can help:

  • Reduce host networking deployment time, complexity, and errors
  • Deploy the latest Microsoft validated and supported best practices
  • Ensure configuration consistency across the cluster
  • Eliminate configuration drift

Network ATC does this through some new concepts, namely “intent-based” deployment. If you tell Network ATC how you want to use an adapter, it will translate, deploy, and manage the needed configuration across all nodes in the cluster. 

Azure IaaS and Azure Stack: announcements and updates (May 2021 – Weeks: 19 and 20)

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.



Zone redundant storage (ZRS) option for Azure managed disks (preview)

Zone redundant storage (ZRS) option for Azure managed disks is now available on Premium SSDs and Standard SSDs in public preview in: West Europe, North Europe, West US 2 and France Central regions. Disks with ZRS provide synchronous replication of data across the zones in a region, enabling disks to tolerate zonal failures which may occur due to natural disasters or hardware issues. Disks with ZRS maintain three consistent copies of the data in distinct Availability Zones in a region, making them tolerant to outages. They also allow you to maximize your virtual machine availability without the need for application-level replication of data across zones, which is not supported by many legacy applications such as old versions of SQL or industry-specific proprietary software. This means that, if a virtual machine becomes unavailable in an affected Zone, you can continue to work with the disk by mounting it to a virtual machine in a different zone. You can also use the ZRS option with shared disks to provide improved availability for clustered or distributed applications like SQL FCI, SAP ASCS/SCS or GFS2.

Lower pricing for provisioned throughput on Azure Ultra Disks

Microsoft is announcing a price reduction on provisioned throughput for Azure Ultra Disks by 65%. The new pricing is effective May 1st, 2021, and applies to all the regions where Ultra Disks are available. Azure Ultra Disks offer high throughput, high IOPS, and consistent low latency disk storage for Azure Virtual Machines (VMs).

Azure NetApp Files: Application Consistent Snapshot tool (AzAcSnap)

The Azure Application Consistent Snapshot tool (AzAcSnap) is a command-line tool enables you to simplify data protection for third-party databases (SAP HANA) in Linux environments (for example, SUSE and RHEL). Since the January 2021 preview announcement, AzAcSnap has seen wide adoption among enterprise customers for fast backup of Azure NetApp Files volumes including multi-TB databases and scale-out scenarios for SAP HANA. Now it is available.

Azure File Sync agent v12.1

The v12.0 agent release had two bugs which are fixed in this release:

  • Agent auto-update fails to update the agent to a later version.
  • FileSyncErrorsReport.ps1 script does not provide the list of per-item errors.

If agent version 12.0 is installed on your servers, you will need to update to v12.1 using Microsoft Update or Microsoft Update Catalog (see installation instructions in KB4588751).

More information about this release:

  • This update is available for Windows Server 2012 R2, Windows Server 2016 and Windows Server 2019 installations.
  • The agent version for this release is
  • A restart may be required if files are in use during the installation.
  • Installation instructions are documented in KB4588751.


Virtual Network peering support for Azure Bastion

Azure Bastion and VNet peering can be used together. When VNet peering is configured, you don’t have to deploy Azure Bastion in each peered VNet. This means if you have an Azure Bastion host configured in one virtual network (VNet), it can be used to connect to VMs deployed in a peered VNet without deploying an additional Bastion host.

Azure VPN Client for macOS (preview)

Azure VPN Client for macOS, with support for native Azure AD, certificate-based, and RADIUS authentication for OpenVPN protocol is in public preview. Native Azure AD authentication support is highly desired by organizations as it enables user-based policies, conditional access, and multi-factor authentication (MFA) for P2S VPN. Native Azure AD authentication requires both Azure VPN gateway integration and the Azure VPN Client to obtain and validate Azure AD tokens. With the Azure VPN Client for macOS, customers can use user-based policies, Conditional Access, as well as Multi-factor Authentication (MFA) for their Mac devices.

Application Gateway Mutual Authentication (preview)

Azure Application Gateway now supports the ability to perform frontend mutual authentication. In addition to the client authenticating Application Gateway in a request, Application Gateway can now also authenticate the client. You can upload multiple client Certificate Authority (CA) certificate chains for Application Gateway to use for client authentication. Additionally, Application Gateway also allows you to configure listener specific SSL policies. You can choose to enable mutual authentication at a per listener level on your gateway, as well as choose to pass client authentication information to the backends through server variables. This feature enables scenarios where Application Gateway needs to authenticate the client in addition to the client authenticating Application Gateway.

Azure ExpressRoute: 5 New Peering Locations Available

 New peering locations are now available for ExpressRoute:

  • Bogota
  • Madrid
  • Sao Paulo
  • Rio de Janeiro
  • Toronto2

With this announcement, ExpressRoute is now available across 75 global commercial Azure peering locations. 

Azure IaaS and Azure Stack: announcements and updates (May 2021 – Weeks: 17 and 18)

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.



Azure Hybrid Benefit for Linux with RI and VMSS Support

Azure Hybrid Benefit is available for Linux, extending the ability to easily migrate RHEL and SLES servers to Azure beyond existing pay-as-you-go instances to include support for Azure Reserved Instance (RI) and virtual machine scale set (VMSS). 

While previous Bring-Your-Own-Subscription cloud migration options available to Red Hat and SUSE customers allowed them to use their pre-existing RHEL and SLES subscriptions in the cloud, Azure Hybrid Benefit for Linux improves upon this with several capabilities unique to Azure making enterprise Linux cloud migration even easier than before:

  • Applies to all Red Hat Enterprise Linux and SUSE Linux Enterprise Server pay-as-you-go images available in the Azure Marketplace or Azure Portal. No need to provide your own image.
  • Save time with seamless post-deployment conversions—production redeployment is unnecessary. Simply convert the pay-as-you-go images used during your proof-of-concept testing to bring-your-own-subscription billing.
  • Lower ongoing operational costs with automatic image maintenance, updates, and patches: Microsoft maintains the converted RHEL and SLES images for you.
  • Enjoy the convenience of unified user interface integration with the Azure CLI, providing the same UI as other Azure virtual machines, as well as scalable batch conversions.
  • Get co-located technical support from Azure, Red Hat, and SUSE with just one ticket.
  • Combine with recently announced Red Hat and SUSE support for Azure shared disks to lift-and-shift failover clusters and parallel file systems, like Global File System.
  • Fully compatible with Azure Arc, providing end-to-end hybrid cloud operations management for Windows, RHEL, and SLES servers in one solution.

New Azure VMs for general purpose and memory intensive workloads (preview) 

The new Dv5, Dsv5, Ddv5, Ddsv5, and Ev5, Edv5 series Azure Virtual Machines, now in preview, are based on the 3rd Generation Intel® Xeon® Platinum 8370C (Ice Lake) processor in a hyper-threaded configuration. This custom processor can reach an all-core Turbo clock speed of up to 3.5GHz and features Intel® Turbo Boost Technology 2.0, Intel® Advanced Vector Extensions 512 (Intel® AVX-512) and Intel® Deep Learning Boost. These new offerings deliver a better value proposition for general-purpose, and memory intensive workloads compared to the prior generation (e.g., increased scalability and an upgraded CPU class) including better price to performance.

The Dv5, Dsv5, Ddv5, Ddsv5 VM sizes offer a combination of vCPUs and memory able to meet the requirements associated with most general-purpose workloads and can scale up to 96 vCPUs. The Ddv5 and Ddsv5 VM sizes feature high performance, large local SSD storage (up to 2,400 GiB).  The Dv5 and Dsv5 VM series offer a lower price of entry since they do not feature any local temporary storage. If you require temporary storage select the latest Ddv5 or Ddsv5 Azure virtual machines, which are also in Preview.

The Ev5 and Edv5 VM sizes feature up to 672 GiB of RAM and are ideal for memory-intensive enterprise applications. You can attach Standard SSDs and Standard HDDs disk storage to these VMs. If you prefer to use Premium SSD or Ultra Disk storage, please select the Esv5 and Edsv5 VM series, which will be in preview in the near future. The Ev5 and Esv5 VMs offer a lower price of entry since they do not feature any local temporary storage. If you require temporary storage select the latest Edv5 VM series which are also in preview, or the Edsv5 VM series, which will be in preview in the near future.

New NPv1 virtual machines

NPv1 series virtual machines are a new addition to the Azure product offering. These instances are powered by Xilinx Alveo U250 FPGAS. These highly-programmable accelerators benefit a variety of computationally intensive workloads such as genomics, image-processing, security, data analysis and more. The NP series offering is based upon the commercially available U250 from Xilinx and uses a standard shell easing the difficulties of migrating existing FPGA workloads & solutions to the cloud. New Xilinx Alveo U250 FPGA NPv1 VMs are now generally available in West US 2, East US, West Europe, and Southeast Asia.

Microsoft acquires Kinvolk to accelerate container-optimized innovation

Microsoft is excited to bring the expertise of the Kinvolk team to Azure and having them become key contributors to the engineering development of Azure Kubernetes Service (AKS)Azure Arc, and future projects that will expand Azure’s hybrid container platform capabilities and increase Microsoft’s upstream open source contributions in the Kubernetes and container space. Microsoft is also committed to maintaining and building upon Kinvolk’s open source culture. The Kinvolk team will continue to remain active in their existing open source projects and will be essential to driving further collaboration between Azure engineering teams and the larger open source container community.


Azure Blob storage: NFS 3.0 protocol support public preview now expands to all regions

Azure Blob storage is the only public cloud storage platform that supports NFS 3.0 protocol over object storage natively (no gateway or data copying required), with object storage economics. This new level of support is optimized for high-throughput, read-heavy workloads where data will be ingested once and minimally modified further, such as large-scale analytic data, backup and archive, media processing, genomic sequencing, and line-of-business applications.  Azure Blob Storage NFS 3.0 preview supports general purpose v2 (GPV2) storage accounts with standard tier performance in all publicly available regions. Further, Microsoft is enabling a set of Azure blob storage features in premium blockblob accounts with NFS 3.0 feature enabled such as blob service REST API and lifecycle management.  

Attribute-based Access Control (ABAC) in preview

Attribute-based access control (ABAC) is an authorization strategy that defines access levels based on attributes associated with security principals, resources, requests, and the environment. Azure ABAC builds on role-based access control (RBAC) by adding conditions to Azure role assignments in the existing identity and access management (IAM) system. This preview includes support for role assignment conditions on Blobs and ADLS Gen2, and enables you to author conditions based on resource and request attributes.

Prevent Shared Key authorization for an Azure Storage account

Every secure request to an Azure Storage account must be authorized. By default, requests can be authorized with either Azure Active Directory (Azure AD) credentials, or by using the account access key for Shared Key authorization. Of these two types of authorization, Azure AD provides superior security and ease of use over Shared Key and is recommended by Microsoft. To require clients to use Azure AD to authorize requests, you can disallow requests to the storage account that are authorized with Shared Key. Microsoft is announcing the general availability of the ability to disable Shared Key authorization for Azure Storage. 

Append blob support in Azure Data Lake Storage 

Append blobs provide a simple and effective way of adding new content to the end of a file or blob when the existing content does not need to be modified. This makes append blobs great for applications such as logging that need to add information to existing files efficiently and continuously.  Until now, only block blobs were supported in Azure Data Lake Storage accounts. Applications can now also create append blobs in these accounts and write to them using Append Block operations. These append blobs can be read using existing Blob APIs and Azure Data Lake Storage APIs.


Multiple features for Azure VPN Gateway

The following features for Azure VPN Gateway are general available:

  • Multiple authentication types for point-to-site VPN – You can now enable multiple authentication types on a single gateway for OpenVPN tunnel type. Azure AD, certificate-based and RADIUS can all be enabled on a single gateway.
  • BGP diagnostics – You can now see the Border Gateway Protocol session status, route advertised and routes learnt by the VPN Gateway.
  • VPN packet capture in Azure portal – Support for packet capture on the VPN Gateway is now availbe in the Azure portal.
  • VPN connection management – With new enhancements in VPN connection management capabilities, you can now reset an individual connection instead of resseting the whole gateway. You can also set the Internet Key Exchange (IKE) mode of the gateway to responder-only, initiator-only or both and view the Security Association (SA) of a connection.

Azure IaaS and Azure Stack: announcements and updates (April 2021 – Weeks: 15 and 16)

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.



New M-series Msv2/Mdsv2 Medium Memory VMs for memory-optimized workloads

Azure Msv2/Mdsv2 Medium Memory Series offering up to 192vCPU and 4TB memory configurations and running on Cascade Lake processor are now generally available. Msv2/Mdsv2 medium memory VM sizes providing a 20% increase in CPU performance, increased flexibility with local disks, and a new intermediate scale up-option. These virtual machines provide unparalleled computational performance to support large in-memory databases and workloads such as SAP HANA and SQL Hekaton. 

Azure Virtual Machines DCsv2-series in Azure Government (public preview)

Azure Government customers can build secure, enclave-based applications to protect code and data while it’s in use, in a dedicated cloud that meets stringent government security and compliance requirements.  Confidential computing DCsv2-series virtual machines are now in preview for Azure Government customers (federal, state, local governments, and their partners) in US Government Virginia and Arizona regions. These VMs are backed by Intel XEON E-2288G processors with Intel Software Guard Extensions (SGX) technology.

Microsoft announces plans to establish first datacenter region in Malaysia

The new datacenter region is part of the “Bersama Malaysia” initiative to support inclusive economic growth in Malaysia.


Azure Blob storage supports objects up to 200 TB in size

Workloads that utilize larger file sizes such as backups, media, and seismic analysis can now utilize Azure Blob storage and ADLS Gen2 without breaking these large files into separate blobs. Each blob is made up of up to 50,000 blocks.  Each block can now be 4GB in size for a total of 200 TB per blob or ADLS Gen2 file.

Lustre HSM tools to import from or export to Azure Storage

Lustre HSM (Hierarchical Storage Management) provides the capability to associate a Lustre file system with an external storage system and migrate file data between them.

Now available are the File System Hydrator and Copy Tool, which enables integrating a Lustre file system with an Azure storage account: 

  • The File System Hydrator is used to import a file system namespace from an Azure storage account into a Lustre file system with the imported files left in the ‘released’/’exist’ state.
  • The Copy Tool is used to hydrate the content of the files in the storage account into the Lustre file system on-demand. The copy tool can also be used to archive content of files back into the storage account, including changed or added files.


Application Gateway URL Rewrite

Azure Application Gateway now supports the ability to rewrite host name, path and query string of the request URL. In addition to header rewrites, you can now also rewrite URL of all or some of the client requests based on matching one or more conditions as required. You can choose to route the request based on the original URL or the rewritten URL. This feature enables several important scenarios such as allowing path based routing for query string values and support for hosting friendly URLs.

Azure IaaS and Azure Stack: announcements and updates (April 2021 – Weeks: 13 and 14)

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.



Virtual machine (VM) level disk bursting available on all Dsv3 and Esv3 families

Virtual machine level disk bursting allows your virtual machine to burst its disk IO and MiB/s throughput performance for a short time daily. This feature is now enabled on all our Dsv3-series and Esv3-series virtual machines, with more virtual machine types and families support soon to come. There is no additional cost associated with this new capability or adjustments on the VM pricing and it comes enabled by default.

Cloud Services (extended support) is generally available

Cloud Services (extended support), which is a new Azure Resource Manager (ARM)-based deployment model for Azure Cloud Services, is generally available. Cloud Services (extended support) has the primary benefit of providing regional resiliency along with feature parity with Azure Cloud Services deployed using Azure Service Manager (ASM). It also offers some ARM capabilities such as role-based access and control (RBAC), tags, policy, private link support, and use of deployment templates. The ASM-based deployment model for Cloud Services has been renamed Cloud Services (classic). Customers retain the ability to build and rapidly deploy web and cloud applications and services. Customers will be able to scale cloud services infrastructure based on current demand and ensure that the performance of applications can keep up while simultaneously reducing costs. The platform-supported tool for migrating existing cloud services to Cloud Services (extended support) also goes into preview. Migrating to ARM will allow customers to set up a robust infrastructure platform for their applications. 


Azure File Sync agent v12 

Improvements and issues that are fixed in the v12 release:

  • New portal experience to configure network access policy and private endpoint connections
    • You can now use the portal to disable access to the Storage Sync Service public endpoint and to approve, reject and remove private endpoint connections. To configure the network access policy and private endpoint connections, open the Storage Sync Service portal, go to the Settings section and click Network.
  • Cloud Tiering support for volume cluster sizes larger than 64KiB
  • Measure bandwidth and latency to Azure File Sync service and storage account
    • The Test-StorageSyncNetworkConnectivity cmdlet can now be used to measure latency and bandwidth to the Azure File Sync service and storage account. Latency to the Azure File Sync service and storage account is measured by default when running the cmdlet. Upload and download bandwidth to the storage account is measured when using the “-MeasureBandwidth” parameter. To learn more, see the release notes.
  • Improved error messages in the portal when server endpoint creation fails
    • We heard your feedback and have improved the error messages and guidance when server endpoint creation fails.
  • Miscellaneous performance and reliability improvements
    • Improved change detection performance to detect files that have changed in the Azure file share.
    • Performance improvements for reconciliation sync sessions.
    • Files may fail to tier on Server 2019 if Data Deduplication is enabled on the volume.
    • AFSDiag fails to compress files if a file is larger than 2GiB.

To obtain and install this update, configure your Azure File Sync agent to automatically update when a new version becomes available or manually download the update from the Microsoft Update Catalog.

More information about this release:

  • This release is available for Windows Server 2012 R2, Windows Server 2016 and Windows Server 2019 installations.
  • A restart is required for servers that have an existing Azure File Sync agent installation.
  • The agent version for this release is
  • Installation instructions are documented in KB4568585.

Encryption scopes in Azure Storage

Encryption scopes introduce the option to provision multiple encryption keys in a storage account for blobs. Previously, customers using a single storage account for multi-tenancy scenarios were limited to using a single account-scoped encryption key for all the data in the account. With encryption scopes, you now can provision multiple encryption keys and choose to apply the encryption scope either at the container level (as the default scope for blobs in that container) or at the blob level. 

Azure Data Explorer external tables

An external table is a schema entity that references data stored outside the Azure Data Explorer database. Azure Data Explorer Web UI can create external tables by taking sample files from a storage container and creating schema based on these samples. You can then analyze and query data in external tables without ingestion into Azure Data Explorer.

Azure Security Center: la protezione di Azure Storage

Azure Security Center, la soluzione cloud che consente di prevenire, rilevare e rispondere alle minacce di sicurezza che interessano architetture ibride, permette di avere un livello di protezione avanzato anche per le risorse storage presenti in Azure. La soluzione consente di rilevare tentativi insoliti e potenzialmente dannosi di accedere oppure di utilizzare Azure Storage. In questo articolo viene riportato come proteggere in modo efficace lo storage in Azure con questa soluzione, esaminando le novità recentemente annunciate in questo ambito.

Azure Security Center (ASC) è possibile attivarlo in due tiers differenti:

  • Free tier. In questo tier ASC è totalmente gratuito ed effettua un assessment continuo, fornendo delle raccomandazioni relative alla sicurezza dell’ambiente Azure.
  • Standard tier. Rispetto al tier free aggiunge funzionalità avanzate di rilevamento delle minacce, utilizzando l’analisi comportamentale e l’apprendimento automatico per identificare attacchi ed exploit zero-day. Attraverso tecniche di machine learning e tramite la creazione di whitelist è possibile controllare l’esecuzione delle applicazioni per ridurre l’esposizione agli attacchi di rete e ai malware. Inoltre, il livello standard aggiunge la possibilità di effettuare in modo integrato un Vulnerability Assessment per le macchine virtuali in Azure. Lo standard Security Center Standard supporta diverse risorse Azure tra cui: VMs, Virtual machine scale sets, App Service, SQL servers, e Storage accounts.

Advanced Threat Protection (ATP) per Azure Storage rientra quindi tra le varie funzionalità di Azure Security Center Standard.

Figura 1 – Confronto tra le funzionalità dei differenti tiers di ASC

Per migliorare le security posture del proprio ambiente Azure è fortemente consigliata l’abilitazione del tier Standard di Security Center.

La funzionalità di Advanced Threat Protection (ATP) per Azure Storage è stata annunciata lo scorso anno, permettendo di rilevare minacce comuni come malware, accesso da fonti sospette (inclusi nodi TOR), attività di esfiltrazione dei dati e altro ancora, ma il tutto limitatamente ai blob containers. Recentemente è stata incluso il supporto anche per Azure Files e Azure Data Lake Storage Gen2. Questo permette ai clienti di proteggere anche i dati archiviati in file shares e gli archivi di dati progettati per l’analisi dei big data aziendali.

L’attivazione di questa funzionalità dal portale Azure è molto semplice ed è possibile farla a livello di subscription protetta da Security Center oppure in modo selettivo sui singoli storage account.

Per abilitare questa protezione su tutti gli storage account della subscription è necessario accedere alla sezione “Pricing & Settings” di Security Center e attivare la protezione degli Storage Accounts.

Figura 2 – Attivazione ATP per Azure Storage a livello di subscription

Se si preferisce abilitarla solo su determinati storage account è necessario attivarla nelle rispettive impostazioni di Advanced security.

Figura 3 – Attivazione ATP sul singolo storage account

Quando si verificano anomalie su uno storage account gli avvisi di sicurezza vengono inviati tramite posta elettronica agli amministratori delle subscription Azure, con i dettagli sulle attività sospette rilevate e i relativi consigli su come indagare e risolvere le minacce.

I dettagli inclusi nella notifica dell’evento includono:

  • La natura dell’anomalia
  • Il nome dello storage account
  • L’ora dell’evento
  • La tipologia dello storage
  • Le potenziali cause
  • I passi consigliati per indagare quanto riscontrato
  • Le azioni da intraprendere per rimediare da quanto accaduto

Figura 4 – Esempio di avviso di sicurezza inviato a fronte di una rilevazione di una minaccia

Per validare il corretto funzionamento della soluzione è stato in questo esempio utilizzato il test file EICAR. Si tratta di un file sviluppato dall’European Institute for Computer Anti-Virus Research (EICAR) che serve per validare in sicurezza le soluzioni di protezione.

Gli avvisi di sicurezza è possibile consultarli e gestirli direttamente da Azure Security Center, dove vengono visualizzati i relativi dettagli e le azioni per indagare le minacce attuali ed affrontare quelle future.

Figura 5 – Esempio di avviso di sicurezza presente nel Security alerts tile di ASC

Per ottenere la lista completa dei possibili avvisi generati da tentativi insoliti e potenzialmente dannosi di accedere oppure utilizzare gli storage account è possibile accedere alla sezione Threat protection for data services in Azure Security Center.

Questa protezione risulta molto utile anche in presenza di architettura che prevedono l’utilizzo del servizio Azure File Sync (AFS), che permette di centralizzare le cartelle di rete della propria infrastruttura in Azure Files.


Sempre più frequentemente le realtà aziendali trasferiscono i loro dati nel cloud, alla ricerca di architettura distribuite, elevate prestazioni e una ottimizzazione dei costi. Tutte le funzionalità offerte dal cloud pubblico richiedono di rafforzare la sicurezza informatica, in particolare vista la crescente complessità e sofisticatezza degli attacchi informatici. Grazie all’adozione di Advanced Threat Protection (ATP) per Azure Storage è possibile aumentare il livello di sicurezza dello storage utilizzato in ambiente Azure in modo semplice ed efficace.

La protezione di Azure File Sync tramite Azure Backup

Il servizio Azure File Sync permette di centralizzare le cartelle di rete della propria infrastruttura in Azure Files, consentendo di mantenere le caratteristiche tipiche di un file server on-premises, in termini di performance, compatibilità e flessibilità e allo stesso tempo di beneficiare delle potenzialità offerte dal cloud. Azure File Sync si integra con Azure Backup rendendo possibile la gestione delle politiche di protezione nel cloud in modo centralizzato. In questo articolo viene riportato come si integrano queste due soluzioni e quali aspetti è necessario tenere in considerazione per attivare una protezione efficace.

Le caratteristiche principali di Azure File Sync sono le seguenti:

  • Cloud tiering: vengono mantenuti localmente solo i dati acceduti di recente.
  • Multi-site sync: si ha la possibilità di effettuare la sincronizzazione tra differenti site, consentendo di accedere in scrittura agli stessi dati tra differenti Windows Servers ed Azure Files.
  • Integrazione con Azure backup: possibilità di attivare la protezione dei contenuti tramite Azure Backup.
  • Disaster recovery: si ha la possibilità di effettuare in modo immediato il ripristino dei metadata dei file e di richiamare solamente i dati necessari, per velocizzare le operazioni di riattivazione del servizio in scenari di Disaster Recovery.
  • Accesso diretto all’ambiente cloud: è consentito accedere direttamente ai contenuti presenti sulla File share da altre risorse Azure (IaaS e PaaS).

Azure File Sync è in grado di trasformare Windows Server in una “cache” per accedere rapidamente ai contenuti presenti su una determinata Azure File share. L’accesso locale ai propri dati può avvenire con qualsiasi protocollo disponibile in Windows Server. Si ha la possibilità inoltre di disporre di più server “cache” dislocati in location geografiche differenti.

La possibilità di attivare la funzionalità di Cloud Tiering rende Azure File Sync una soluzione sempre più diffusa, ma questo aspetto in particolare impone di fare le dovute considerazioni nella strategia da adottare per la protezione dei dati. Così come per le soluzioni antivirus, le soluzioni di backup potrebbero causare il richiamo di file archiviati nel cloud tramite la funzionalità di Cloud Tiering. Microsoft consiglia di adottare una soluzione di backup cloud per eseguire il backup di Azure File share anziché una soluzione di backup locale. Se si utilizza una soluzione di backup locale, i backup devono essere eseguiti su un server appartenente a un gruppo di sincronizzazione in cui il cloud tiering è disabilitato.

Funzionamento del processo di backup

La protezione delle Azure File share avviene secondo la seguente architettura:

Figura 1 – Architettura per la protezione delle Azure File share

Il processo di protezione di Azure File share prevede i seguenti step:

  1. La presenza di un Recovery Service Vault è necessaria per poter configurare i backup. Quindi è opportuno procedere con la relativa creazione nel caso non sia disponibile.
  2. Azure Backup effettuerà un discovery necessario per portare a termine il processo di registrazione dello storage account che ospita le Azure File share da proteggere.
  3. Completato il processo di registrazione, Azure Backup memorizzerà la lista delle File share presenti sullo storage account in un suo catalog.
  4. Sarà possibile selezionare l’Azure File share da proteggere e associarle alle relative backup policy, che prevedono una specifica schedulazione e le politiche di mantenimento dei dati.
  5. Sulla base delle policy configurate Azure Backup effettua i backup. Un aspetto fondamentale da valutare è che attualmente il backup avviene generando uno snapshot dell’Azure File share. I dati presenti nelle Azure File share non vengono mai trasferiti nel Recovery Service Vault, ma Azure Backup si limita a creare e gestire gli snapshots che fanno parte dello storage account.
  1. In caso di ripristino saranno utilizzati gli snapshots ed, il relativo URL dei backup, viene ripreso dallo store dei metadati presente nel Recovery Service Vault.
  2. Il monitor dei processi di backup e di ripristino vengono inviati al servizio di Azure Backup Monitoring. Questo consente di avere una visione complessiva di tutti i backup, compresi quelli relativi alle Azure File Share. Inoltre, è anche possibile configurare alerts oppure notifiche via e-mail in caso di problemi sull’esecuzione dei backup.


Vantaggi nell’adottare questa strategia di protezione

  • Zero infrastructure: non è necessaria alcuna infrastruttura per attivare la protezione dell’ambiente.
  • Personalizzazione delle retention policy: è possibile configurare i backup con politiche di conservazione dei dati giornaliere, settimanali, mensili ed annuali, in base alle proprie esigenze. I backup annuali è possibile ora mantenerli fino a 10 anni.
  • Funzionalità di gestione integrate: è possibile pianificare i backup e specificare il periodo di retention desiderato in modo totalmente integrato nella piattaforma.
  • Ripristino istantaneo: il backup delle Azure File share usa gli snapshots, questo consente di selezionare solo i file che si desidera ripristinare istantaneamente.
  • Alert e report: è possibile configurare alert a fronte di operazioni di backup e ripristino che presentano errori. Si può inoltre utilizzare la soluzione di reportistica fornita da Azure Backup per ottenere informazioni dettagliate sui processi di backup.

Protezione dalla cancellazione accidentale delle Azure File shares

Per fornire una maggiore protezione contro gli attacchi informatici e per la cancellazione accidentale, Azure Backup ha recentemente aggiunto un ulteriore livello di sicurezza alla soluzione di gestione degli snapshots di Azure File shares. Nel caso vengano eliminate le File share, i contenuti e i relativi punti di ripristino (snapshots) vengono conservati per un periodo di tempo configurabile, consentendone il ripristino completo senza perdita di dati. Quando si configura la protezione per una File share, Azure Backup abilita la funzionalità di soft-delete a livello di storage account con un periodo di conservazione di 14 giorni, il quale è configurabile in base alle proprie esigenze. Questa impostazione determina la finestra temporale in cui è possibile ripristinare i contenuti e gli snapshots delle File share dopo qualsiasi operazione di eliminazione accidentale. Una volta ripristinata la File share, i backup riprendono a funzionare senza la necessità di effettuare ulteriori configurazioni.


Questa soluzione consente in molto semplice, affidabile e sicuro di configurare la protezione per le Azure File share e di ripristinare facilmente i dati in caso di necessità. L’integrazione tra Azure File Sync ed Azure Backup vedrà sicuramente nei prossimi mesi il rilascio di diverse nuove funzionalità, tra le quali, molto sentita, la possibilità di configurare il trasferimento dei dati verso il Recovery Service Vault anziché mantenere gli snapshots nello stesso storage account dove risiedono i dati. Per conoscere tutti gli ambiti di supporto ed i limiti nell’utilizzo del servizio di Azure Backup per la protezione delle Azure File share è possibile consultare questo articolo Microsoft.