This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Compute

Azure HX series and HBv4 series virtual machines (preview)

The Azure HX series and HBv4 series virtual machines (VMs) are now in preview in the East US region. These VMs, powered by AMD 4th gen EPYCTM “Genoa” CPUs, improve the performance and cost-effectiveness of a variety of memory performance bound, compute bound, and massively parallel workloads. These new VMs deliver more performance, value-adding innovation, and cost-effectiveness to every Azure HPC customer.

Networking

Azure Bastion now support shareable links (preview)

With the new Azure Bastion shareable links feature in public preview and included in Standard SKU, you can now connect to a target resource (virtual machine or virtual machine scale set) using Azure Bastion without accessing the Azure portal.

This feature will solve two key pain points:

• Administrators will no longer have to provide full access to their Azure accounts to one-time VM users, helping to maintain their privacy and security.
• Users without Azure subscriptions can seamlessly connect to VMs without exposing RDP/SSH ports to the public internet.

Storage

Azure File Sync agent v15.2

Azure File Sync agent v15.2 is now on Microsoft Update and Microsoft Download Center.

Improvements and issues that are fixed:

• Fixed a cloud tiering issue in the v15.1 agent that caused the following symptoms:
  • Memory usage is higher after upgrading to v15.1
  • Storage Sync Agent (FileSyncSvc) service intermittently crashes
  • Files are failing to recall with error ERROR_INVALID_HANDLE (0x00000006)
• Fixed a health reporting issue with servers configured to use a non-Gregorian calendar

More information about this release:

• This release is available for Windows Server 2012 R2, Windows Server 2016, Windows Server 2019 and Windows Server 2022 installations
• The agent version for this release is 15.2.0.0
• Installation instructions are documented in KB5013875

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Compute

What’s new in Azure VMware Solution

Recent updates for Azure VMware Solution:

• Stretched Clusters for Azure VMware Solution, now in preview, provides 99.99 percent uptime for mission critical applications that require the highest availability. In times of availability zone failure, your virtual machines (VMs) and applications automatically failover to an unaffected availability zone with no application impact.
• Azure NetApp Files Datastores is now generally available to run your storage intensive workloads on Azure VMware Solution. This integration between Azure VMware Solution and Azure NetApp Files enables you to create datastores via the Azure VMware Solution resource provider with Azure NetApp Files NFS volumes and attach the datastores to your private cloud clusters of choice.
• Customer-managed keys for Azure VMware Solution is now in preview, both supporting higher security for customers’ mission-critical workloads and providing you with control over your encrypted vSAN data on Azure VMware Solution. With this feature, you can use Azure Key Vault to generate customer-managed keys as well as centralize and streamline the key management process.
• New node sizing for Azure VMware Solution. Start leveraging Azure VMware Solution across two new node sizes with the general availability of AV36P and AV52 in AVS. With these new node sizes organizations can optimize their workloads for memory and storage with AV36P and AV52.

Virtual Machine software reservations

The new Virtual Machine software reservations enable savings on your Virtual Machine software costs when you make a one- to three-year commitment for plans offered by third-party publishers such as Canonical, Citrix, and Red Hat.

Arm-based VMs now available in four additional Azure regions

The Dpsv5, Dplsv5, and Epsv5 VMs are available in the following additional four Azure regions: West US, North Central US, UK South, and France Central

Storage

Encrypt managed disks with cross-tenant customer-managed keys

Encrypting managed disks with cross-tenant customer-managed keys (CMK) enables you to encrypt managed disks with customer-managed keys using Azure Key Vault hosted in a different Azure Active Directory (AD) tenant.

Networking

New capabilities for Azure Firewall

Azure Firewall is a cloud-native firewall as a service offering that enables customers to centrally govern and log all their traffic flows using a DevOps approach.

Several key Azure Firewall capabilities are now generally available:

• New GA regions in Qatar central, China East, and China North: Azure Firewall Standard, Azure Firewall Premium, and Azure Firewall Manager are now generally available in three new regions: Qatar Central, China East, and China North
• IDPS Private IP ranges: in Azure Firewall Premium IDPS, Private IP address ranges are used to identify traffic direction (inbound, outbound, or internal) to allow accurate matches with IDPS signatures. By default, only ranges defined by Internet Assigned Numbers Authority (IANA) RFC 1918 are considered private IP addresses. To modify your private IP addresses, you can now easily edit, remove, or add ranges as needed.
• Single Click Upgrade/Downgrade (preview): With this new capability, customers can easily upgrade their existing Firewall Standard SKU to Premium SKU as well as downgrade from Premium to Standard SKU. The process is fully automated and has zero service downtime.
• Enhanced Threat Intelligence (preview): Threat Intelligence-based filtering can be enabled for your firewall to alert and deny traffic from/to known malicious IP addresses and FQDNs. With the new enhancement, Azure Firewall Threat Intelligence has more granularity for filtering based on malicious URLs. This means that customers may have access to a certain domain through a specific URL in this domain will be denied by Azure Firewall if identified as malicious.
• KeyVault with zero internet exposure (preview): in Azure Firewall Premium TLS inspection, customers are required to deploy their intermediate CA certificate in Azure KeyVault. Now that Azure firewall is listed as a trusted Azure KeyVault service, customers can eliminate any internet exposure of their Azure KeyVault.

Azure Front Door: new features in preview

New features are available for Azure Front Door (preview):

• Azure Front Door zero downtime migration. In March of this year, Microsoft announced the general availability of two new Azure Front Door tiers. Azure Front Door Standard and Premium are native, modern cloud content delivery network (CDN) catering to both dynamic and static content delivery acceleration with built-in turnkey security and a simple and predictable pricing model. The migration capability enables you to perform a zero-downtime migration from Azure Front Door (classic) to Azure Front Door Standard or Premium in just three simple steps or five simple steps if your Azure Front Door (classic) instance has custom domains with your own certificates. The migration will take a few minutes to complete depending on the complexity of your Azure Front Door (classic) instance, such as number of domains, backend pools, routes, and other configurations.
• Upgrade from Azure Front Door Standard to Premium tier: Azure Front Door supports upgrading from Standard to Premium tier without downtime. Azure Front Door Premium supports advanced security capabilities and has increased quota limit, such as managed Web Application Firewall rules and private connectivity to your origin using Private Link.
• Azure Front Door integration with managed identities. Azure Front Door now supports managed identities generated by Azure Active Directory to allow Front Door to easily and securely access other Azure AD-protected resources such as Azure Key Vault. This feature is in addition to the AAD Application access to Key Vault that is currently supported.

Default Rule Set 2.1 for Azure Web Application Firewall

Default Rule Set 2.1 (DRS 2.1) on Azure’s global Web Application Firewall (WAF) running on Azure Front Door is available. This rule set is available on the Azure Front Door Premium tier.
DRS 2.1 is baselined off the Open Web Application Security Project (OWASP) Core Rule Set (CRS) 3.3.2 and includes additional proprietary protections rules developed by Microsoft Threat Intelligence team. As with previous DRS releases, DRS 2.1 rules are also tailored by Microsoft Threat Intelligence Center (MSTIC). The MSTIC team analyzes Common Vulnerabilities and Exposures (CVEs) and adapts the CRS ruleset to address those issues while also reducing false positives to our customers.

Bot Manager Rule Set 1.0 on regional Web Application Firewall

A new bot protection rule set (Microsoft_BotManagerRuleSet_1.0) is now generally available for Azure Web Application Firewall (WAF) with Azure Application Gateway. Added to this updated rule set are three bot categories: good, bad, and unknown. Bot signatures are managed and dynamically updated by Azure WAF. The default action for bad bot groups is set to Block, for the verified search engine crawlers group it’s set to Allow, and for the unknown bot category it’s set to Log. You may overwrite the default action with Allow, Block, or Log for any type of bot rule

Per Rule Actions on regional Web Application Firewall

Azure’s regional Web Application Firewall (WAF) with Application Gateway running the Bot Protection rule set and Core Rule Set (CRS) 3.2 or higher now supports setting actions on a rule-by-rule basis. This gives you greater flexibility when deciding how the WAF handles a request that matches a rule’s conditions.

Azure Stack

Azure Stack HCI

Network HUD

Network HUD is a new feature, available with the November update on Azure Stack HCI that detects operational network issues causing stability issues or degrade performance. It distills the various indicators of problems generated by event logs, performance counters, the physical network and more, to proactively identify issues and alert you with contextual messages that you can act on. It also integrates with the existing alerting mechanisms you’re already used to and leverages Network ATC for intent-based analytics and remediation.

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Storage

Attribute-based access control for standard storage accounts

Attribute-based access control (ABAC) is an authorization strategy that defines access levels based on attributes associated with security principals, resources, and requests. Azure ABAC builds on role-based access control (RBAC) by adding conditions to Azure role assignments in the existing identity and access management (IAM) system. This release makes generally available role assignment conditions using request and resource attributes on Blobs, ADLS Gen2 and storage queues for standard storage accounts.

Premium SSD v2 disks available on Azure Disk CSI driver

Premium SSD v2 is the next-generation Azure Disk Storage optimized for performance-sensitive and general-purpose workloads that need consistent low average read and write latency combined with high IOPS and throughput. Premium SSD v2 is now available with the Azure Disk CSI driver to deploy stateful workloads in Kubernetes on Azure.

Ephemeral OS disk support for confidential virtual machines

The support to create confidential VMs using Ephemeral OS disks is available. This enables customers using stateless workloads to benefit from the trusted execution environments (TEEs). Trusted execution environments protect data being processed from access outside the trusted execution environments.

Encrypt storage account with cross-tenant customer-managed keys

The ability to encrypt storage account with customer-managed keys (CMK) using an Azure Key Vault hosted on a different Azure Active Directory tenant is available. You can use this solution to encrypt your customers’ data using an encryption key managed by your customers.

Availability zone volume placement for Azure NetApp Files (preview)

Azure NetApp Files availability zone volume placement feature lets you deploy new volumes in the logical availability zone of your choice to support enterprise, mission-critical high availability (HA) deployments across multiple availability zones.

Networking

Azure Virtual WAN announcements 

Multiple areas of Azure Virtual WAN (vWAN) have key announcements:

• Remote user connectivity (also known as point-to-site VPN)

  • Multipool user group support preview

• Routing

  • Secure hub routing intent preview

  • Hub routing preference (HRP) is generally available

  • Bypass next hop IP for workloads within a spoke VNet connected to the virtual WAN hub generally available

  • Border Gateway Protocol (BGP) Peering with a virtual hub is generally available

• Branch connectivity (also known as site-to-site VPN)

  • BGP dashboard is now generally available

  • Virtual Network Gateway VPN over ExpressRoute private peering (AZ and non-AZ regions) is generally available

  • Custom traffic selectors (portal)

  • High availability for Azure VPN client using secondary profile is generally available

• Private connectivity (also known as ExpressRoute)

  • ExpressRoute circuit with visibility of Virtual WAN connection

• Third-Party Network Virtual Appliance Integrations

  • Fortinet SDWAN is generally available

  • Aruba EdgeConnect Enterprise SDWAN preview

  • Checkpoint NG Firewall preview

Custom IP Prefixes (BYOIP) available in US Government regions

The ability to bring your own public IP ranges is now available in all US Government regions.

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

In this dedicated post you can find the most important announcements and major updates officialized last week during Microsoft Ignite (October 2022) conference.

Azure

Compute

Azure savings plan for compute

Azure savings plan for compute is an easy and flexible way to save significantly on compute services, compared to pay-as-you-go prices. The savings plan unlocks lower prices on select compute services when customers commit to spend a fixed hourly amount for one or three years. Choose whether to pay all upfront or monthly at no extra cost. As you use select compute services across the world, your usage is covered by the plan at reduced prices, helping you get more value from your cloud budget. During the times when your usage is above your hourly commitment, you’ll be billed at your regular pay-as-you-go prices. With savings automatically applying across compute usage globally, you’ll continue saving even as your usage needs change over time.

Storage

SFTP support for Azure Blob Storage

SSH File Transfer Protocol (SFTP) support for Azure Blob Storage is now generally available. Azure Blob Storage now supports SFTP, enabling you to leverage object storage economics and features for your SFTP workloads. With just one click, you can provision a fully managed, highly scalable SFTP endpoint for your storage account. This expands Blob Storage’s multi-protocol access capabilities and eliminates data silos, meaning you can run different applications, requiring different protocols, on a single storage platform with no code changes.

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Storage

Azure NetApp Files new regions and cross-region replication

Azure NetApp Files is now available in the following additional regions:

• Korea South,
• Sweden Central.

Additionally, Azure NetApp Files cross-region replication has been enabled between following regions:

• Korea Central and Korea South,
• North Central US and East US 2,
• France Central and West Europe.

Networking

ExpressRoute FastPath support for Vnet peering and UDRs

FastPath now supports virtual network peering and user defined routing (UDR). FastPath will send traffic directly to any VM deployed in a spoke virtual network peered to the virtual network where the ExpressRoute virtual network gateway is deployed. Additionally, FastPath will now honor UDRs configured on the GatewaySubnet and send traffic directly to an Azure Firewall or third-party Network Virtual Appliance (NVA).

Azure Firewall Basic (preview)

Azure Firewall Basic is a new SKU for Azure Firewall designed for small and medium-sized businesses. 

Comprehensive, cloud-native network firewall security:

• Network and application traffic filtering
• Threat intelligence to alert on malicious traffic
• Built-in high availability
• Seamless integration with other Azure security services

Simple setup and easy-to-use:

• Setup in just a few minutes
• Automate deployment (deploy as code)
• Zero maintenance with automatic updates
• Central management via Azure Firewall Manager

Cost-effective:

• Designed to deliver essential, cost-effective protection of your resources within your virtual network

Policy analytics for Azure Firewall (preview)

Policy analytics for Azure Firewall, now in public preview, provides enhanced visibility into traffic flowing through Azure Firewall, enabling the optimization of your firewall configuration without impacting your application performance.  

Azure Basic Load Balancer will be retired

On 30 September 2025, Azure Basic Load Balancer will be retired. You can continue to use your existing Basic Load Balancers until then, but you’ll no longer be able to deploy new ones after 31 March 2025.

To keep your workloads appropriately distributed, you’ll need to upgrade to Standard Load Balancer, which provides significant improvements including:

• High performance, ultra-low latency, and superior resilient load-balancing.
• Security by default: closed to inbound flows unless allowed by a network security group.
• Diagnostics such as multi-dimensional metrics and alerts, resource health, and monitoring.
• SLA of 99.99 percent availability.

Basic SKU public IP addresses will be retired

On 30 September 2025, Basic SKU public IP addresses will be retired in Azure. You can continue to use your existing Basic SKU public IP addresses until then, however, you’ll no longer be able to create new ones after 31 March 2025.

Standard SKU public IP addresses offer significant improvements, including:

• Access to a variety of other Azure products, including Standard Load Balancer, Azure Firewall, and NAT Gateway.
• Security by default—closed to inbound flows unless allowed by a network security group.
• Zone-redundant and zonal front ends for inbound and outbound traffic.

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Storage

Azure File Sync agent v15.1

Improvements and issues that are fixed:

• Low disk space mode to prevent running out of disk space when using cloud tiering. Low disk space mode is designed to handle volumes with low free space more effectively. On a server endpoint with cloud tiering enabled, if the free space on the volume reaches below a threshold, Azure File Sync considers the volume to be in Low disk space mode. In this mode, files are tiered to the Azure file share more proactively and tiered files accessed by the user will not be persisted to the disk. To learn more, see the low disk space mode section in the Cloud tiering overview documentation.
• Fixed a cloud tiering issue that caused high CPU usage after v15.0 agent is installed.
• Miscellaneous reliability and telemetry improvements.

To obtain and install this update, configure your Azure File Sync agent to automatically update when a new version becomes available or manually download the update from the Microsoft Update Catalog.

More information about this release:

• This release is available for Windows Server 2012 R2, Windows Server 2016, Windows Server 2019 and Windows Server 2022 installations.
• The agent version for this release is 15.1.0.0.
• Installation instructions are documented in KB5003883.

Standard network features for Azure NetApp Files

Standard network features for Azure NetApp Files volumes are available. Standard network features provide you with an enhanced, and consistent virtual networking experience along with security posture for Azure NetApp Files.

You are now able to choose between standard or basic network features while creating a new Azure NetApp Files volume:

• Basic provide the current functionality, limited scale, and features.
• Standard provides the following new features for Azure NetApp Files volumes or delegated subnets:
  – Increased IP limits for Vnets with Azure NetApp Files volumes. This is at par with VMs to enable you to provision Azure NetApp File volumes in your existing topologies or architectures. This eliminates the need to rearchitect network topologies to use Azure NetApp Files for workloads like VDI, AVD, or AKS.
  – Enhanced network security with support for network security groups (NSG) on the Azure NetApp Files delegated subnet.
  – Enhanced network control with support for user-defined routes (UDR) to and from Azure NetApp Files delegated subnets. You can now direct traffic to and from Azure NetApp Files via your choice of network virtual appliances for traffic inspection.
  – Connectivity over active or active VPN gateway setup for highly available connectivity to Azure NetApp Files from on-premises network.
  – ExpressRoute FastPath connectivity to Azure NetApp Files. FastPath improves the data path performance between on-premises network and Azure Virtual Network.

Immutable storage for Azure Data Lake Storage

Immutable storage for Azure Data Lake Storage is now generally available. Immutable storage provides the capability to store data in a write once, read many (WORM) state. Once data is written, the data becomes non-erasable and non-modifiable and you can set a retention period so that files can’t be deleted until after that period has elapsed. Additionally, legal holds can be placed on data to make that data non-erasable and non-modifiable until the hold is removed.

Improved Append Capability on Immutable Storage for Blob Storage

Immutable storage for Blob Storage on containers (which has been generally available since September 2018) now includes a new append capability. This capability, titled “Allow Protected Appends for Block and Append Blobs”, allows you to set up immutable policies for block and append blobs to keep already written data in a WORM state and continue to add new data. This capability is available for both legal holds and time-based retention policies.

Encrypt managed disks with cross-tenant customer-managed keys

Many service providers building Software as a Service (SaaS) offerings on Azure want to give their customers the option of managing their own encryption keys. Customers of service providers can now use cross-tenant customer-managed keys to manage encryption keys in their own Azure AD tenant and subscription using Azure Key Vault. As a result, they will have complete control of their customer-managed keys and their data.

Azure Dedicated Host support for Ultra Disk Storage

Virtual machines (VMs) running on Azure Dedicated Host support the use of standard and premium disks as data disks, and now there is also the support for ultra disks on dedicated host.

Azure unmanaged disks will be retired on 30 September 2025

Azure Managed Disks now have full capabilities of unmanaged disks and other advancements. Microsoft will begin deprecating unmanaged disks on September 30, 2022, and this functionality will be completely retired on September 30, 2025. 

Encryption scopes on hierarchical namespace enabled storage accounts (preview)

Encryption scopes introduce the option to provision multiple encryption keys in a storage account with hierarchical namespace. Using encryption scopes, you now can provision multiple encryption keys and choose to apply the encryption scope either at the container level (as the default scope for blobs in that container) or at the blob level. The preview is available for REST, HDFS, NFSv3, and SFTP protocols in an Azure Blob / Data Lake Gen2 storage account. The key that protects an encryption scope may be either a Microsoft-managed key or a customer-managed key in Azure Key Vault. You can choose to enable automatic rotation of a customer-managed key that protects an encryption scope. When you generate a new version of the key in your Key Vault, Azure Storage will automatically update the version of the key that is protecting the encryption scope, within a day.

Customer initiated storage account conversion (preview)

The self-service option to convert storage accounts from non-zonal redundancy (LRS/GRS) to zonal redundancy (ZRS/GZRS) is available. This allows you to initiate the conversion of storage accounts via the Azure portal without the necessity of creating a support ticket.

Networking

Resizing of peered virtual networks

Updating the address space for peered virtual networks now is now generally available. This feature allows you to update the address space or resize for a peered virtual network without removing the peering.

Improvements to Azure Web Application Firewall (WAF) custom rules

• There are two improvements for WAF custom rules:
  Azure regional Web Application Firewall (WAF) with Application Gateway now supports creating custom rules using the operators “Any” and “GreaterThanOrEqual”. Custom rules allow you to create your own rules to customize how each request is evaluatedas it passes through the WAF engine.
• Azure global Web Application Firewall (WAF) with Azure Front Door now supports custom geo-match filtering rules using socket addresses. Filtering by socket address allows you to restrict access to your web application by country/region using the source IP that the WAF sees.

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Compute

Azure Virtual Machines with Ampere Altra Arm–based processors

Microsoft is announcing the general availability of the latest Azure Virtual Machines featuring the Ampere Altra Arm–based processor. The new virtual machines will be generally available on September 1, and customers can now launch them in 10 Azure regions and multiple availability zones around the world. In addition, the Arm-based virtual machines can be included in Kubernetes clusters managed using Azure Kubernetes Service (AKS). This ability has been in preview and will be generally available over the coming weeks in all the regions that offer the new virtual machines.

Storage

Prevent a lifecycle management policy from archiving recently rehydrated blobs

Azure Storage lifecycle management offers a rule-based policy that you can use to transition blob data to the appropriate access tiers or to expire data at the end of the data lifecycle. You can configure rules to move a blob to archive tier based on last modified condition. If you rehydrate a blob by changing its tier, this rule may move the blob back to the archive tier. This can happen if the last modified time is beyond the threshold set for the policy. Now you can add a new condition, daysAfterLastTierChangeGreaterThan, in your rules, to skip the archiving action if the blobs are newly rehydrated.

Encrypt storage account with cross-tenant customer-managed keys (preview)

The ability to encrypt storage account with customer-managed keys (CMK) using an Azure Key Vault hosted on a different Azure Active Directory tenant is available in preview. You can use this solution to encrypt your customers’ data using an encryption key managed by your customers.

Ephemeral OS disks supports host-based encryption using customer managed key

Ephemeral OS disk customers can choose encryption type between platform managed keys or customer managed keys for host-based encryption. The default is platform managed keys. This feature would enable our customers to meet organization’s compliance needs.

Resource instance rules for access to Azure Storage

Resource instance rules enable secure connectivity to a storage account by restricting access to specific resources of select Azure services.
Azure Storage provides a layered security model that enables you to secure and control access to your storage account. You can configure network access rules to limit access to your storage account from select virtual networks or IP address ranges. Some Azure services operate on multi-tenant infrastructure, so resources of these services cannot be isolated to a specific virtual network.
With resource instance rules, you can now configure your storage account to only allow access from specific resource instances of such Azure services. For example, Azure Synapse offers analytic capabilities that cannot be deployed into a virtual network. If your Synapse workspace uses such capabilities, you can configure a resource instance rule on a secured storage account to only allow traffic from that Synapse workspace.
Resource instances must be in the same tenant as your storage account, but they may belong to any resource group or subscription in the tenant.

Networking

ExpressRoute IPv6 Support for Global Reach

IPv6 support for Global Reach unlocks connectivity between on-premise networks, via the Microsoft backbone, for customers with dual-stack workloads. Establish Global Reach connections between ExpressRoute circuits using IPv4 subnets, IPv6 subnets, or both. This configuration can be done using Azure Portal, PowerShell, or CLI.

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Compute

Azure VMware Solution now in Sweden Central

Azure VMware Solution empowers you to seamlessly extend or migrate your existing on-premises VMware workloads to Azure without the cost, effort, or risk of re-architecting applications or retooling operations. With this update Azure VMware Solution has now expanded availability to the Sweden Central Azure region.

Azure VMware Solution: public IP capability

Most customer applications running on Azure VMware Solution require internet access. These applications require both outbound and inbound internet connectivity. Azure VMware Solution Public IP is a simplified and scalable solution for running these applications. With this capability, Microsoft enables the following:

• Direct inbound and outbound internet access for AVS to the NSX-T Edge.
• The ability to receive up to 1000 or more Public IPs.
• DDoS Security protection against network traffic in and out of the internet.
• Enable support for VMware HCX (migration tool for VMwre VMs) over the public internet.

UAE North Availability Zones

Availability Zones in UAE North are made up of three unique physically separated locations or “zones” within a single region to bring higher availability and asynchronous replication across Azure regions for disaster recovery protection.

Networking

Private endpoint network security group support

Private endpoint support for network security groups (NSGs) is now generally available. This feature enhancement provides you with the ability to enable advanced security controls on traffic destined to a private endpoint. In order to leverage this feature, you will need to set a specific subnet level property, called PrivateEndpointNetworkPolicies, to enabled.

Private endpoint user-defined routes support

Private endpoint support for user-defined routes (UDRs) is now generally available. This feature enhancement will remove the need to create a /32 address prefix when defining custom routes. You will now have the ability to use a wider address prefix in the user defined route tables for traffic destined to a private endpoint (PE) by way of a network virtual appliance (NVA). In order to leverage this feature, you will need to set a specific subnet level property, called PrivateEndpointNetworkPolicies, to enabled on the subnet containing private endpoint resources.

Azure Stack

Azure Stack HCI

Azure Stack HCI 22H2: Network ATC improvements

Network ATC can simplify the deployment and on-going management of host networking in Azure Stack HCI. In this article are described all improvements to this component, released with Azure Stack HCI 22H2 update.

Software Defined Networking (SDN) extensions reach General Availability for WAC

SDN Infrastructure, Network Security Groups (NSGs), Logical networks, Virtual Networks, Load Balancers, and Gateways reach General Availability for Windows Admin Center (WAC). SDN Infrastructure’s “Network Controller” tab in WAC now displays information about cluster, server, and node certificates, complete with UI indications that certificate will expire soon. 

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Compute

Azure Dedicated Host restart (preview)

Azure Dedicated Host gives you more control over the hosts you deployed by giving you the option to restart any host. When undergoing a restart, the host and its associated VMs will restart while staying on the same underlying physical hardware. With this new capability, now in preview, you can take troubleshooting steps at the host level.

Azure Dedicated Host support for Ultra SSD (preview)

Currently, VMs running on Azure Dedicated Host support the use of Standard and Premium Azure disks as data disks. With this preview, Microsoft is introducing support for Azure Ultra Disks on Azure Dedicated Host. Azure Ultra disks are highly performant disks on Azure that offer high throughput (maximum of 4000 MBps per disk) and high IOPS (maximum of 160,00 IOPS per disk) depending on the disk size.
If you are running IaaS workloads that are data intensive and latency sensitive, such as Oracle DB, MySQL DB, other critical databases, and gaming applications, you will benefit from using Ultra disks as data disks on VMs hosted on Azure Dedicated Host.

Microsoft Azure available from new cloud region in Qatar

Microsoft is launching a new datacenter region in Qatar. The new datacenter region includes Azure Availability Zones, which offer you additional resiliency for your applications by designing the region with unique physical datacenter locations with independent power, network, and cooling for additional tolerance to datacenter failures.

Enforcement mode of machine configuration (previously guest configuration)

The enforcement mode of machine configuration (previously guest configuration) is now generally available. This represents the ApplyAndMonitor and ApplyAndAutocorrect auditing modes. The customer experience within Azure has not changed as a result of the renaming. Machine configuration continues to provide a native capability to audit or configure operating system settings as code, both for machines running in Azure and hybrid Azure Arc-enabled servers, directly per-machine or at-scale orchestrated through Azure Automanage, Microsoft Defender for Cloud, or Azure Policy.
You will now be able to:

• Apply and monitor configurations: set the required configuration on your machines and remediate on demand.
• Apply and autocorrect configurations: set the required configuration at scale and autoremediate in the event of a configuration drift.
• Apply configurations to machines at management group level.
• Set TLS 1.2 to machines through our newly released built-in policy.
• Create, delete, and monitor the compliance of your configurations through the Azure portal.

Storage

Azure StorSimple 8000/1200 series will no longer be supported starting 31st December 2022

Support for the following StorSimple versions will end 31st December 2022:
• StorSimple 8000 series – 8100, 8600, 8010, 8020
• StorSimple 1200 Series
• StorSimple Data Manager
• StorSimple Snapshot Manager

The StorSimple service will reach end of life which means the following will no longer be available:
• All cloud management capability (e.g. viewing or updating settings related to volumes, shares, backups, backup policies or installing updates, etc.)
• Access to live data and backups.
• Access to customer support resources (phone, email, web)
• Hardware replacement parts and repair services for StorSimple 8000 series devices
• Software updates for StorSimple 8000 series and 1200 series devices

Microsoft has been expanding the portfolio of Azure Hybrid storage capabilities with new services for data tiering and cloud ingestion, providing more options to customers for storing data in Azure in native formats.

Networking

Azure Firewall Premium is now ICSA labs certified

Azure Firewall Premium SKU is a managed, cloud-based network security service that protects your Azure Virtual Network resources. It provides advanced threat protection that meets the needs of highly sensitive and regulated environments and includes Intrusion Prevention System (IPS) and TLS inspection capabilities.
The new Intrusion Prevention System (IPS) certification from ICSA Labs is an important IPS certification, is an addition to existing Firewall certification, from ICSA Labs.
ICSA Labs provides credible third-party testing and certification of security and health IT products, as well as network-connected devices. This includes certification of network intrusion prevention systems.
ICSA Labs Network Intrusion Prevention System (IPS) security certification test cycle includes Azure Firewall protection against exploits aimed at approximately 100 high severity vulnerabilities in enterprise software. Because real world attacks do not happen on a quiescent network, ICSA Labs tests with an appropriate level of background traffic using various mixes of enterprise network traffic. The test included evasion techniques, platform security of the product itself, logging, secure administration, and administrative functions.
Azure Firewall is the first cloud firewall service to attain the ICSA Labs Corporate Certification for both Firewall and IPS services.

Next hop IP support for Route Server

With next hop IP support, you can deploy network virtual appliances (NVAs) behind an Azure Internal Load Balancer (ILB) to acheive key active-passive connectivity scenarios and improve connectivity performance.

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Compute

Virtual machine restore points

VM restore points provides you with a point in time snapshot of all the managed disks attached to your Virtual Machine. Customers and Azure partners who are looking to build business continuity and disaster recovery solutions can use VM restore points to capture app consistent and crash consistent backups natively on the Azure platform. This can then be used to restore disks and VMs during scenarios such as data loss, data corruption, or disaster recovery. 

NVads A10 v5 Virtual Machines

NVads A10 v5 virtual machines (VMs) are now generally available in West Europe, South Central US, and West US3 regions. The NVads A10 v5 VM series enables a wide variety of graphics, video, and AI workloads, including virtual production and visual effects, engineering design and simulation, game development and streaming, virtual desktops/workstations and more. They feature NVIDIA A10 Tensor Core GPUs, up to 72 AMD EPYC™ 74F3-series vCPUs, and are designed to offer the right choice for any workload with optimum configurations for both single user and multi-session environments. 

Azure confidential VMs (DCasv5/ECasv5-series VMs)

Azure confidential VMs are designed to offer a new, hardware-based TEE leveraging SEV-SNP, which hardens guest protections to deny the hypervisor and other host management code access to VM memory and state, protecting against operator access. Azure DCasv5/ECasv5 confidential VMs, utilizing 3rd Gen AMD EPYC processors with Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) security features, are available. 

Trusted Launch support for DCsv3 and DCdsv3 series Virtual Machines

Trusted Launch support for DCsv3 and DCdsv3 virtual machines is available. DCsv3 and DCdsv3 series virtual machines provides support for Intel® SGX. With all new hardware-based security paradigm is now just a few clicks away in Azure to deploy DCsv3 virtual machines with trusted launch feature.

Storage

Live resize for Premium SSD and Standard SSD Disk Storage

Resizing a disk on Azure can provide increased storage capacity and better performance for your applications. As part of our commitment to continuously add new capabilities to our Azure Disk Storage portfolio, live resize for Premium SSD and Standard SSD Disk Storage is now generally available. With live resize, you can dynamically increase the storage capacity of your Premium SSD and Standard SSD disks without causing any disruption to your applications. To reduce costs, you can start with smaller disks and gradually increase their storage capacity without experiencing any downtime.

Azure Premium SSD v2 Disk Storage (preview)

The next generation of Microsoft Azure Premium SSD Disk Storage is available in preview. This new disk offering provides the most advanced block storage solution designed for a broad range of input/output (IO)-intensive enterprise production workloads that require sub-millisecond disk latencies as well as high input/output operations per second (IOPS) and throughput at a low cost. With Premium SSD v2, you can now provision up to 64TiBs of storage capacity, 80,000 IOPS, and 1,200 MBPS throughput on a single disk. With best-in-class IOPS and bandwidth, Premium SSD v2 provides the most flexible and scalable general-purpose block storage in the cloud, enabling you to meet the ever-growing demands of your production workloads such as SQL Server, Oracle, MariaDB, SAP, Cassandra, Mongo DB, big data, analytics, gaming, on virtual machines, or stateful containers. Moreover, with Premium SSD v2, you can provision granular disk sizes, IOPS, and throughput independently based on your workload needs, providing you more flexibility in managing performance and costs.

Networking

TLS 1.3 support on Application Gateway (preview)

The new Predefined and CustomV2 policies on Application Gateway come with TLS v1.3 support. They provide improved security and performance benefits, fulfilling the needs of your enterprise security policies. You may use out-of-the-box predefined policies or configure a preferred cipher-suite list by using the CustomV2 policy.

Azure Stack

Azure Stack HCI

Azure Marketplace for Arc-enabled Azure Stack HCI (preview)

Azure Marketplace for Arc-enabled Azure Stack HCI makes it easy and convenient to download the latest fully patched image to your cluster with just a few clicks in the Azure Portal. This preview focuses on Windows 11 Enterprise multi-session, the image used by Azure Virtual Desktop, and Windows Server 2022 Datacenter Azure Edition, which enables hot-patching (reboot-less patching) for on-premises VMs. More images will follow in the coming months. This preview is available for all in-market Azure Stack HCI.

Remote support for Arc-enabled Azure Stack HCI (preview)

When opening a case, you can now grant Microsoft support engineers remote access to your cluster to gather logs of perform remediation steps themselves. This reduces the back-and-forth that’s typical with on-premises support. New PowerShell cmdlets and Windows Admin Center tools let you precisely control and audit the access that support engineers get, including time limits, allow-listing cmdlets, and comprehensive auditing that’s always on.

Arc-enabled guest VMs with extensions for Azure Stack HCI (preview)

When you deploy a new virtual machine through Azure Arc onto Azure Stack HCI, the guest operating system is now automatically enrolled as an Arc-enabled server instance. This means you can use popular VM extensions like Custom Script to perform configuration inside the VM (like installing an application) as part of VM deployment. To illustrate the usefulness of this capability, Microsoft is providing a sample custom script extension that enrolls a VM into an Azure Virtual Desktop session host pool, eliminating manual configuration of the guest agent as its own step. This preview is available for all in-market Arc-enabled Azure Stack HCI.

Azure Stack HCI version 22H2 (preview)

The operating system at the heart of Azure Stack HCI gets a major update with new features and enhancements every year. Next month, the first significant preview of version 22H2 will become available to clusters enrolled in the public Preview channel. Like version 21H2, the new version 22H2 will be available as a free, non-disruptive, over-the-air update for all subscribers when it reaches general availability later this year. Content-wise, the update is focused on fundamental improvements to the core hypervisor, storage, and networking.

Storage replication in stretch clusters is faster, and you can convert existing volumes from fixed provisioning to thin provisioning.

Network ATC has gained new abilities, including automatic IP addressing for storage networks, support for stretch clusters, and better network proxy support.

Hyper-V live migration is faster and more reliable for switchless 2-node and 3-node clusters.

And for new installations, version 22H2 starts with a stronger default security posture, including a stronger set of protocols and cipher suites, Secured-Core Server, Windows Defender application control, and other well-known security features enabled by default right from the start.

Azure Stack Hub

Azure Well-Architected Framework Assessments (preview)

Two pillars of the Well-Architected Framework are available in Preview for Azure Stack Hub on the Microsoft Assessment Platform: Reliability and Operational Excellence. If you are using Azure Stack Hub to deploy and operate workloads for key business systems, it is now possible to answers questions for these pillars within the assessments platform. After completing the assessments, you will be provided with a maturity or risk score, together with prescriptive guidance and knowledge links that suggest possible improvements you could make to your architecture design and score.