Archivi categoria: Microsoft Azure

Azure IaaS and Azure Local: announcements and updates (August 2025 – Weeks: 31 and 32)

This blog post series highlights the key announcements and major updates related to Azure Infrastructure as a Service (IaaS) and Azure Local, as officially released by Microsoft in the past two weeks.

Azure

Compute

Azure 128 & 192 vCPU sizes for the Esv6 and Edsv6 series VMs

Microsoft has introduced new VM sizes in the Esv6 and Edsv6 series, offering configurations with up to 192 vCPUs and 1832 GiB of RAM. These high-capacity virtual machines are designed for enterprise-scale workloads, including in-memory analytics, large relational databases, and in-memory cache scenarios. Equipped with Intel® Total Memory Encryption (Intel TME) and NVMe-enabled local and remote storage, these VMs deliver both robust performance and enhanced data security. Key advantages include up to 400K IOPS and 12 GB/s remote storage throughput with 200 Gbps network bandwidth, three times the local storage IOPS thanks to the NVMe interface, and strong memory protection capabilities provided by Intel TME.

Networking

Network Security Perimeter

Microsoft has introduced Network Security Perimeter, a feature that allows organizations to define a logical network isolation boundary for PaaS resources, such as Azure Storage accounts and SQL Database servers, deployed outside their virtual networks. This capability restricts public network access to PaaS resources within the perimeter, with exceptions managed through explicit inbound and outbound access rules. Key benefits include secure resource-to-resource communication within perimeter members to prevent data exfiltration, centralized management of external public access, detailed access logs for audit and compliance, and a unified experience across supported PaaS resources.

Customer-controlled maintenance

Microsoft has announced that customers can now define configurable maintenance windows for the Point-to-Site (P2S) VPN Gateway in the Virtual WAN service, which has reached general availability. This capability allows greater control over planned updates and enhances operational predictability. With this release, maintenance window configuration is now supported across multiple gateway resources in Azure networking services, including: Virtual Network Gateway in ExpressRoute, Virtual Network Gateway in VPN Gateway, Site-to-Site VPN Gateway in Virtual WAN, Point-to-Site VPN Gateway in Virtual WAN, and ExpressRoute Gateway in Virtual WAN. This improvement ensures that organizations can align gateway maintenance with their operational and compliance requirements.

Azure DNS Public Zones DNS Security Extensions (DNSSEC) in US Gov and China regions

Microsoft has announced the general availability of Domain Name System Security Extensions (DNSSEC) for Azure DNS Public Zones in US Gov and China regions. This enhancement enables cryptographic authentication of DNS data, providing protection against threats such as cache poisoning and man-in-the-middle attacks. Administrators can enable DNSSEC for both new and existing DNS zones via the Azure Portal, CLI, PowerShell, or API. Azure manages all key operations, simplifying deployment and maintenance while ensuring high availability and performance through its global infrastructure.

Azure Virtual Network Manager mesh now supports 5,000 virtual networks (preview)

Azure Virtual Network Manager now supports grouping up to 5,000 virtual networks in a mesh connectivity configuration, available in public preview for supported regions. A mesh topology establishes bi-directional connectivity between every virtual network in the group, removing the need for manual peerings, reducing network hops, and ensuring low-latency traffic flows under a unified control plane. This approach is particularly beneficial in hub-and-spoke environments, where spokes can communicate directly without routing through the hub, lowering latency while retaining security oversight via Azure Virtual Network Manager security admin rules, NSGs, and comprehensive traffic monitoring through flow logs.

Storage

Log or block shared access signature (SAS) tokens for Azure Storage based on expiration policy

Azure Storage now supports enhanced enforcement options for Shared Access Signature (SAS) token expiration policies. Administrators have long been able to define the validity interval for SAS tokens using a storage account’s expiration policy. However, it was previously possible to override this with a longer signed expiry date on the SAS token itself. With the new SAS expiration action capability, administrators can now choose to either log or block requests that violate the configured expiration policy. The ‘Log’ action provides visibility into out-of-policy usage without disrupting service, making it ideal for auditing and trend analysis. Conversely, the ‘Block’ action enforces strict compliance by denying access to expired tokens. Microsoft recommends beginning with the ‘Log’ action to monitor access patterns, followed by implementing ‘Block’ to secure environments against unauthorized or outdated token usage.

Azure Data Box Next Gen is now generally available in additional regions

Azure Data Box Next Gen is now generally available in new regions, including Australia, Japan, Singapore, Brazil, Hong Kong, UAE, Switzerland, and Norway. This expansion complements the existing availability of both the 120 TB and 525 TB models in the US, UK, Canada, EU, US Government, Australia, Japan, and Singapore. Additionally, the 120 TB model is now available in Brazil, UAE, Hong Kong, Switzerland, and Norway. These next-generation NVMe-based devices have already facilitated the ingestion of several petabytes of data across various industries, delivering up to 10× faster transfer speeds. Customers value their reliability and efficiency for large-scale migration projects, making them a preferred choice for secure and high-speed data movement.

Azure Storage Actions now in 22 more regions

Azure Storage Actions is now available in 22 additional Azure regions, expanding its global reach and providing customers with more options for data residency and compliance. This broader availability enhances the ability to automate data management tasks across a wider range of geographic locations, supporting diverse operational and regulatory requirements.

Azure Storage Discovery (preview)

Microsoft has announced the public preview of Azure Storage Discovery, a fully managed service providing enterprise-wide visibility into Azure Blob Storage estates. This solution offers deep insights into capacity usage, activity trends, cost optimization opportunities, and security enhancements, all accessible directly within the Azure Portal. Azure Storage Discovery integrates with Azure Copilot, enabling users to obtain actionable insights through natural language queries without needing to learn a query language or write code.
Organizations can analyze trends over time, drill down into top storage accounts, and filter reports by configuration details such as region, redundancy, performance type, and encryption. The service supports analysis of up to one million storage accounts across multiple subscriptions and resource groups in a single workspace. Key benefits include automated aggregation of metrics, interactive reporting, 30 days of historical data upon deployment, and retention of insights for up to 18 months. The Standard tier is free to use until September 30, after which charges will apply, while the Free tier offers basic insights at no cost.

Conclusion

Over the past two weeks, Microsoft has introduced a slew of updates and announcements pertaining to Azure Infrastructure as a Service (IaaS) and Azure Local. These developments underscore the tech giant’s unwavering commitment to enhancing its cloud offerings and adapting to the ever-evolving needs of businesses and developers. Users of Azure can anticipate improved functionalities, streamlined services, and enriched features as a result of these changes. Stay tuned for more insights as I continue to monitor and report on Azure’s progression in the cloud sphere.

Azure Hybrid Management & Security: What’s New and Insights from the Field – July 2025

Once again this month, I’m back with my recurring series focused on the evolution of Azure management and security services, with a special focus on hybrid and multicloud scenarios enabled by Azure Arc and enhanced by the use of Artificial Intelligence.

This monthly series aims to:

  • Provide an overview of the most relevant updates released by Microsoft;

  • Share operational tips and field-proven best practices to help architects and IT leaders manage complex and distributed environments more effectively;

  • Follow the evolution towards a centralized, proactive, and AI-driven management model, in line with Microsoft’s vision of AI-powered Management.

The key areas we will cover in this series, along with the corresponding tools and services, include:

🔹 Hybrid and multicloud environment management – with Azure Arc, which extends policy, security, management, and automation capabilities to on-premises and multicloud resources.

🔹 AI and intelligent automation – enabled by Microsoft Copilot in Azure, AIOps capabilities, and predictive tools to streamline operations and support smarter decision-making.

🔹 Security posture across hybrid and multicloud infrastructures – using Microsoft Defender for Cloud and other native services for vulnerability management and advanced threat protection.

🔹 Governance and policy management – leveraging tools such as Azure Policy, Azure Cost Management, and Resource Graph to ensure control, standardization, and cost/resource optimization.

🔹 Update & Patching – through Azure Update Management, Azure Automation, and native patching capabilities across Azure Arc-enabled environments.

🔹 Backup & Resilience – using Azure Backup and Azure Site Recovery to ensure business continuity, data protection, and disaster recovery.

🔹 Monitoring – with tools like Azure Monitor, Log Analytics, and Application Insights for comprehensive visibility and effective troubleshooting.

Hybrid and multicloud environment management

Azure Arc

Azure File Sync Extension for Azure Arc

The Azure File Sync Arc extension is now generally available, enabling simplified deployment and management of Azure File Sync on Azure Arc–enabled Windows Servers. With this extension, you can install the Azure File Sync agent directly from the Azure portal, via PowerShell, or CLI—supporting Windows Server starting from version 2012 R2. The extension is available in all Azure File Sync–supported regions at no additional cost, marking a significant step forward in the unified management of distributed environments.

New SQL Server Database Migration Experience in Azure Arc (Preview)

A new integrated migration experience for SQL Server databases in Azure Arc environments is now available in public preview, designed to streamline the entire migration journey to Azure SQL Managed Instance. Integrated with Azure Database Migration Service, the process is now fully manageable from a single interface within the Azure portal. This centralized, automated approach offers ongoing database assessments with cost insights, simplified target provisioning, and near real-time replication support, minimizing downtime. You can also validate migration readiness through read-only replicas and client connection reports. Microsoft Copilot is embedded at key stages of the workflow, providing AI-powered decision support that makes the entire transition faster, more informed, and more reliable.

Security posture across hybrid and multicloud infrastructures

Microsoft Defender for Cloud

New features, bug fixes, and deprecated features of Microsoft Defender for Cloud

The development of Microsoft Defender for Cloud is constantly evolving, with continuous improvements being introduced. To stay updated on the latest developments, Microsoft updates this page, which provides information on new features, bug fixes, and deprecated features. Specifically, this month’s main news includes:

  • Four New Regulatory Compliance Standards (Preview): Microsoft Defender for Cloud is expanding its compliance support with the introduction of four new regulatory frameworks, now available in public preview for Azure, AWS, and GCP environments. The newly added standards include the Digital Operational Resilience Act (DORA), the European Union Artificial Intelligence Act (EU AI Act), the Korean Information Security Management System for Public Cloud (k-ISMS-P), and the CIS Microsoft Azure Foundations Benchmark v3.0. These frameworks can be enabled directly from the Regulatory Compliance dashboard in Microsoft Defender for Cloud, offering increasingly comprehensive coverage for multicloud scenarios. Their integration allows security and compliance teams to continuously monitor and align cloud environments with the most current and globally relevant regulations.
  • Container Image Scanning Support for Chainguard and Wolfi: Microsoft Defender for Cloud’s vulnerability scanning engine—powered by Microsoft Defender Vulnerability Management—now extends its coverage to Chainguard container images and the Wolfi distribution. This new capability enables the detection of vulnerabilities within these container images, helping to validate the security of builds before they are deployed to production. The goal is to ensure that the images in use meet the highest security standards while supporting the adoption of modern, secure containerized environments. Note that expanding scan coverage to new image types may lead to increased costs, depending on the number and frequency of scans performed.

Backup & Resilience

Azure Backup

Standard Backup Policy Support for Trusted Launch Virtual Machines

Standard backup policy support for Trusted Launch–enabled virtual machines is now generally available. Trusted Launch is a key security feature for enhancing VM protection in Azure, and this update simplifies backup configuration for VMs using it—now the default setting in major VM creation flows. It ensures full operational continuity for automated processes via PowerShell, CLI, or REST API. Existing scripts require no policy changes, reducing potential errors and enhancing the resilience of backup workflows. This marks a significant step toward a secure, automated approach to backup management across cloud and hybrid environments.

Migration of Azure VM Backups from Standard to Enhanced Policy

Azure Backup now allows the migration of virtual machine backups from standard policies to enhanced policies, offering more advanced and flexible data protection. With this capability, you can schedule backups up to every 4 hours and retain snapshot-based recovery points for longer periods. Recovery points created with the enhanced policy reside in the snapshot tier and are zone-resilient, increasing reliability. Additionally, multi-disk crash consistency is supported. Migrating to an enhanced policy also enables VMs to be upgraded to Trusted Launch and to adopt Premium SSD v2 or Ultra Disk storage—without disrupting or compromising existing protection. This evolution supports a modern, scalable, and mission-critical–ready data protection strategy.

Agentless Crash-Consistent Backup for Multi-Disk Azure VMs

Azure Backup now supports agentless crash-consistent backups for multi-disk Azure virtual machines. This feature enables backups without the need to install additional software such as the VM agent or snapshot extension inside the VM. It is particularly beneficial for performance-sensitive workloads that can tolerate crash-consistent backups, minimizing downtime during backup operations. It’s also useful for systems with OS versions that do not support application-consistent or file-system–consistent backups. You can enable this functionality by specifying the desired consistency type within the backup policy.

Azure Backup: Advanced Protection for VMs with Premium SSD v2 Now Available in Norway and Japan

Azure Backup continues to enhance protection for critical workloads in hybrid cloud environments with the general availability of Geo-Redundant Storage (GRS) and Cross-Region Restore (CRR) for virtual machines using Premium SSD v2. These features provide geographically redundant backups and on-demand restores in secondary regions, ideal for audit scenarios or disaster recovery plans. Availability has now been extended to Norway West, Norway East, Japan West, and Japan East, enabling even greater resilience for performance-sensitive, distributed architectures.

Monitoring

Azure Monitor

Log Analytics Summary Rules: Efficient Analysis for High-Volume Data Streams

Microsoft has announced the general availability of Summary Rules in Log Analytics—a powerful tool designed to optimize the management of high-ingestion data streams. Summary Rules enable aggregation and summarization of data from Analytics, Basic, or Auxiliary plans, allowing for robust analysis, high-performance dashboard creation, and long-term reporting based on summarized Analytics tables. With the GA release, Microsoft has also increased the configurable rule limit per workspace to 100, a key improvement for teams managing complex and distributed environments.

Log Analytics: Enhanced Search Jobs for More Flexible Data Management

Several major enhancements to Search Jobs in Log Analytics are now generally available. Search Jobs allow asynchronous queries across all data within a workspace, including data stored in long-term retention. New improvements include a more intuitive and streamlined user interface, cost estimation prior to execution, and increased concurrency—enabling multiple jobs to run simultaneously without additional limits. Support for up to 100 million results is also coming soon, along with expanded KQL capabilities and other anticipated enhancements.

Conclusions

Once again this month, the evolution of Azure services in the areas of management and security confirms the ongoing shift toward increasingly integrated, intelligent, and proactive management of hybrid and multicloud IT environments. The latest updates—from the enhancement of Azure Arc to the increased resilience provided by Azure Backup, the continuous enrichment of Microsoft Defender for Cloud, and the new advanced monitoring capabilities—demonstrate Microsoft’s commitment to delivering practical tools to address the challenges of complexity and security. In a context where the adoption of AI and automation is becoming ever more strategic, it is essential for architects and IT leaders to stay informed and ready to seize the opportunities these innovations offer. Stay tuned for next month’s updates, as we continue to explore the developments shaping the future of IT management.

Microsoft Strengthens Digital Sovereignty in Europe: A Balance Between Regulation and Innovation

The growing focus on digital sovereignty in Europe has prompted major cloud service providers, including Microsoft, to develop solutions specifically designed to meet the regulatory and operational needs of European organizations. U.S. regulations such as the CLOUD Act and FISA 702 pose significant risks to the confidentiality of data handled by American companies, even when that data is physically stored within the European Union.

Microsoft has responded with a comprehensive strategy that combines compliance with European laws and advanced technical tools for data control and protection. The Microsoft Sovereign Cloud initiative is structured around three models — Public, Private, and National Partner Cloud — to ensure maximum flexibility and security.

This article explores the regulatory landscape, the associated risks, the solutions offered by Microsoft, and provides practical scenarios to better understand the real-world implications for European businesses.

Introducing the Current Landscape

In recent years, digital sovereignty has become a critical issue for businesses, public institutions, and European citizens alike. Rising geopolitical tensions, the rapid expansion of global cloud platforms, and increasing awareness around personal data processing have fueled the need for trustworthy, compliant, and transparent solutions. Regulatory authorities across Europe, guided by increasingly stringent frameworks such as the GDPR, are demanding stronger guarantees from digital service providers in terms of data traceability, localization, and protection.

In parallel, governments and civil society organizations are applying growing pressure to ensure that the data of European citizens is genuinely safeguarded against unauthorized access — even when managed by cloud providers headquartered outside the European Union.

This is not merely a technical matter; it is deeply political and economic. Controlling data now means controlling value, innovation, and critical infrastructure. Digital sovereignty is therefore no longer seen as a luxury or an option, but as a strategic necessity to secure Europe’s safety, competitiveness, and self-determination in the digital age.

This complex and evolving challenge has brought increased scrutiny on the role of major U.S.-based cloud providers — such as Microsoft, Amazon, and Google — which dominate the European market but remain subject to extraterritorial regulations like the CLOUD Act and FISA 702.

In response, Microsoft has launched a new strategy focused on European digital sovereignty, introducing a comprehensive portfolio of sovereign cloud solutions. These offerings not only address regulatory demands but also support the operational needs of customers, delivering a blend of security, compliance, and flexibility.

Designed to give European customers greater control over their data, transparency around access, operational autonomy, and strong alignment with EU laws and values, Microsoft’s objective is twofold: to empower digital innovation in Europe, while ensuring that such innovation respects the principles of sovereignty, accountability, and the protection of fundamental rights.

The Regulatory Framework: CLOUD Act, FISA, and the Conflict with the GDPR

The CLOUD Act is a U.S. law enacted in 2018 that requires American companies to provide data to U.S. authorities upon request — even if that data is stored in datacenters located outside the United States. This principle of “extended jurisdiction” conflicts with European regulations, which condition international data transfers on strict requirements of legality, transparency, and proportionality.

In parallel, Section 702 of the Foreign Intelligence Surveillance Act (FISA) authorizes U.S. intelligence agencies to surveil foreign individuals using digital services operated by American companies, even without a traditional judicial warrant. As a result, data stored and processed within the EU can still be subject to extra-European access, often without the data subject’s knowledge or consent.

The Court of Justice of the European Union acknowledged these risks in the landmark “Schrems II” ruling, which in 2020 invalidated the Privacy Shield agreement, concluding that U.S. safeguards were insufficient to protect the fundamental rights of EU citizens.

Aspect GDPR (EU) CLOUD Act (US) FISA 702 (US)
Jurisdiction European Union United States – applies to U.S. companies worldwide United States – applies to global communications involving non-U.S. persons
Scope Personal data protection Access to data held by U.S.-based companies Intelligence data collection
Authorization Requires consent or valid legal basis U.S. legal orders (e.g., subpoena, warrant) Authorized by secret court (FISC), no traditional warrant
Extraterritorial Reach No Yes – includes data stored in the EU Yes – interception on global networks
GDPR Compatibility Potentially conflicting due to extraterritorial access Deemed non-compliant by EU Court (Schrems II ruling)

Table 1 – Comparison of GDPR, CLOUD Act, and FISA 702

The legal conflict is more relevant than ever and calls for concrete technical and organizational solutions.

Known Cases Involving the CLOUD Act or FISA Applied to EU Citizens or Companies

To date, there are no publicly confirmed cases where the CLOUD Act or Section 702 of FISA has been directly applied to data physically stored in EU datacenters. However, there are indirect signals, legal precedents, and official positions that clearly highlight the real possibility of such scenarios:

  • Microsoft Ireland (2013–2018): The U.S. government requested that Microsoft hand over emails stored in Ireland. Microsoft contested the order, but the case was rendered moot by the enactment of the CLOUD Act, which made such cross-border data requests legally valid.

  • Schrems II and European DPAs: In its landmark ruling, the Court of Justice of the European Union explicitly cited FISA 702 as a reason for invalidating the Privacy Shield agreement. Several European data protection authorities (including those in France, Germany, and the Netherlands) have reiterated that U.S. surveillance laws are incompatible with the GDPR’s protections.

  • Transparency Reports: Microsoft reports receiving over 10,000 data requests annually from U.S. authorities. While the company does not specify whether these requests include data stored in the EU, the sheer volume illustrates the frequency of governmental access attempts.

  • Snowden Revelations (2013): Documents leaked by Edward Snowden revealed that the NSA had systematic access to data hosted outside the United States, enabled through cooperation with major U.S. technology firms.

Although the lack of specific public cases limits direct evidence, these examples clearly underscore the regulatory tension and the need for European organizations to adopt robust technical and legal safeguards.

Microsoft’s Strategy: Where and Why It Is Evolving

In light of this context, Microsoft has introduced a comprehensive strategy to strengthen European digital sovereignty through three main models:

  • Sovereign Public Cloud: Available across all Azure regions in Europe, this model ensures that data remains within the EU, is subject exclusively to European law, and that access is limited to Microsoft personnel who are EU residents.

  • Sovereign Private Cloud: Designed for highly regulated scenarios, it enables the execution of critical workloads in fully isolated environments (on-premises, air-gapped, or hybrid), providing full operational continuity and maximum data protection.

  • National Partner Clouds: Delivered in partnership with local providers (such as Bleu in France and Delos Cloud in Germany), these infrastructures are entirely managed under national control and aligned with local standards like SecNumCloud and specific government requirements in countries like Germany.

Feature Sovereign Public Cloud Sovereign Private Cloud National Partner Clouds
Data Location Within the EU, in existing Azure regions At local or on-premises facilities Local infrastructure managed by partners (e.g., Bleu, Delos Cloud)
Operational Access Controlled by Microsoft staff residing in the EU Managed by the customer or a trusted partner Operated by an independent legal entity within the target country
Included Services Azure, Microsoft 365, Power Platform Azure Local, Microsoft 365 Local Azure + Microsoft 365 in compliance with national regulatory standards
Ideal For Public and private organizations requiring compliance Private entities with physical isolation or high resilience needs Governments, healthcare, defense, and critical infrastructure sectors ⚠️
Main Benefit No migration required, full compliance Full operational control and local management Guarantees independence from Microsoft and full national sovereignty

This structured approach enables Microsoft to address a wide range of needs — from private enterprises to public institutions — by offering flexible models tailored to different levels of data sensitivity.

Sovereignty and Compliance Tools Introduced

To enable these solutions, Microsoft has introduced a suite of tools specifically designed for governance, transparency, and encryption:

  • Data Guardian: Ensures that every remote access to data is monitored, supervised by EU-based personnel, and logged in a tamper-proof system. All support interventions are subject to real-time controls.

  • External Key Management: Allows organizations to use encryption keys hosted in external HSMs (Hardware Security Modules), either owned by the organization or provided by trusted European third parties (e.g., Thales, Futurex, Utimaco), following a HYOK (Hold Your Own Key) model.

  • Regulated Environment Management: A centralized platform for configuring, monitoring, and governing cloud environments in line with regulatory policies, featuring auditable access and granular control capabilities.

  • Microsoft 365 Local: Enables services like Exchange, SharePoint, and Teams to run within customer-controlled or on-premises environments, while maintaining full functionality equivalent to public cloud versions.

Together, these tools enhance the ability of organizations to meet sovereignty and compliance requirements — even in the most sensitive sectors.

How Microsoft’s Approach Addresses Legal Risks

Microsoft’s strategy responds to the complex regulatory landscape through a multi-layered model:

  • Legal Isolation: Access and operations are restricted to personnel and infrastructure under European jurisdiction.

  • Advanced Encryption: The use of HYOK and external HSMs prevents forced access, even in the event of legal orders from non-EU authorities.

  • Audit and Oversight: Tools like Data Guardian ensure full visibility and traceability of remote access operations.

  • GDPR Alignment: Architectures and processes are designed to meet key principles of accountability and risk minimization required by the GDPR.

However, only the adoption of HYOK models and HSMs that are fully located and managed within Europe — and outside the control of entities subject to U.S. jurisdiction — can truly eliminate the risk of access by foreign governments.

Practical Use Case: Private Entity with Continuity and Sovereignty Requirements

Imagine a private organization aiming to digitize its processes while maintaining full control over its data. Subject to strict regulations such as the GDPR and operational constraints regarding data availability and localization, this organization may soon adopt the Sovereign Private Cloud solution based on Azure Local and Microsoft 365 Local.

With Azure Local, the organization can host cloud infrastructure directly within its own datacenter, leveraging Azure’s compute, storage, and networking capabilities under complete local control. By integrating Microsoft 365 Local, it can run productivity applications such as Exchange, SharePoint, and Teams in an isolated environment, ensuring that no data leaves its jurisdiction and that every access is auditable.

This approach allows the organization to combine operational efficiency, service continuity, and compliance with European regulations, while providing a tangible response to the risks posed by extraterritorial U.S. legislation.

Conclusion

Data protection has become a cornerstone of European digital sovereignty. It is no longer merely a technical concern, but a strategic challenge tied to national security, economic competitiveness, and the protection of citizens’ rights. In this complex landscape, Microsoft offers Sovereign Cloud as a concrete, flexible, and regulation-compliant response tailored to the needs of the European Union.

Through its three-model framework — Public Cloud, Private Cloud, and National Partner Cloud — and tools like Data Guardian, External Key Management, and Microsoft 365 Local, Microsoft empowers European organizations to adopt modern, secure, and locally controlled cloud infrastructures. These solutions not only mitigate risks posed by extraterritorial U.S. laws, but also actively support Europe’s digital autonomy.

In a global context where control over information equates to power, one essential question must be asked: are European enterprises truly ready to embrace technologies that protect their digital sovereignty — or will they continue to rely on infrastructures that may expose their data to foreign jurisdictions? Now is the time for a paradigm shift. Both private companies and public administrations in Europe must begin to strategically assess where and how their data is managed.

This is not solely about regulatory compliance — it is about ensuring that strategic data remains inaccessible to foreign powers, that technology choices do not compromise the confidentiality of sensitive information, and that decision-making authority stays within Europe’s legal boundaries. In this light, solutions such as Azure Local and Microsoft 365 Local, even when hosted within private European datacenters, represent a balanced path forward — combining innovation, performance, and true sovereignty.

Azure IaaS and Azure Local: announcements and updates (July 2025 – Weeks: 29 and 30)

This blog post series highlights the key announcements and major updates related to Azure Infrastructure as a Service (IaaS) and Azure Local, as officially released by Microsoft in the past two weeks.

Azure

General

CISPE Secures Landmark Licensing Reform in Agreement with Microsoft

CISPE (Cloud Infrastructure Services Providers in Europe) has reached a landmark agreement with Microsoft that introduces significant licensing reforms for Microsoft software running on CISPE member infrastructure. As part of this agreement, Microsoft will allow qualified CISPE members to offer Microsoft software—such as Windows Server and SQL Server—on a pay-as-you-go basis through the CSP-Hoster (CSP-H) program, aligning pricing more closely with that of Microsoft Azure.

This agreement delivers multiple benefits. CISPE members gain access to competitive Pay-As-You-Go licensing models, enhancing flexibility and cost-effectiveness for customers. It also supports digital sovereignty by enabling deployment of Microsoft 365 Local on European cloud infrastructure—pending general availability within Microsoft’s Cloud Solution Program. A major privacy improvement allows CISPE members to host Microsoft workloads without disclosing customer data to Microsoft, addressing long-standing concerns about data sovereignty and vendor neutrality.

The agreement applies to current CISPE members and is also open to eligible European cloud providers that join CISPE in the near future. Microsoft has committed to reviewing the program after one year, with a view to expanding access further—excluding hyperscale cloud providers designated as “Listed Providers” in order to protect competition and support innovation in the European cloud ecosystem.

Microsoft Azure Cloud HSM

Azure Cloud HSM is now generally available, offering a FIPS 140-3 Level 3 certified, highly available, single-tenant Hardware Security Module (HSM) service. Designed to meet the highest security and compliance standards, Azure Cloud HSM gives customers full administrative control over their HSMs, enabling secure cryptographic key management and operations within dedicated Cloud HSM clusters. It supports key cryptographic libraries such as PKCS#11, OpenSSL, and JCE, making it ideal for workloads like Apache/Nginx SSL offload, SQL Server or Oracle TDE, and ADCS hosted on Azure VMs. The solution also supports certificate storage with private keys via PKCS#11 and allows for secure document and code signing. As the successor to Azure Dedicated HSM, this new service provides improved support for general-purpose scenarios requiring isolated and secure key management. Microsoft plans to expand availability across Public, US Gov, and Sovereign Clouds.

Modernizing Azure Resource Manager Throttling for Sovereign Clouds (preview)

Microsoft has announced the public preview of its updated throttling model for Azure Resource Manager (ARM) in sovereign clouds. This update is part of a broader modernization effort aimed at achieving parity between public and sovereign cloud environments by the end of 2026. The revised throttling model brings consistent limits and architecture across all Azure deployments, enhancing operational reliability and simplifying cross-environment workloads. As previously communicated in 2024, the new throttling configuration delivers substantial improvements, including a 30x increase in write limits, a 2.4x increase for deletes, and a 7.5x increase in read operations, greatly improving performance and scalability for ARM users.

Networking

Azure Firewall now supports ingestion-time transformation in Log Analytics

Azure Firewall has introduced support for ingestion-time transformation in Log Analytics, a feature now generally available. This capability allows organizations to filter and transform logs before they are ingested into Log Analytics, offering a flexible and cost-effective logging strategy. The benefits are substantial: security teams can log only suspicious or critical traffic for more effective threat detection; storage costs are reduced by avoiding unnecessary log ingestion; compliance requirements can be met by routing logs through Data Collection Rules (DCRs); and incident response is accelerated through streamlined access to relevant logs. Additionally, users can create customized dashboards and alerts in Azure Monitor, enhancing visibility and control over network activity.

ExpressRoute – Auto-assigned Public IP for ExpressRoute Gateways

Microsoft has introduced a simplification in the deployment of ExpressRoute Virtual Network Gateways: all newly created gateways will now use auto-assigned Public IP addresses. This change eliminates the need for customers to manually assign Public IPs during configuration, streamlining the setup process and reducing operational overhead. The new model enhances deployment consistency across different gateway types. It’s important to note that existing ExpressRoute gateways will remain unaffected by this update.

Web Application Firewall on Application Gateway for Containers (preview)

Azure has introduced Web Application Firewall (WAF) support for Application Gateway for Containers in public preview. Application Gateway for Containers is the next-generation layer 7 load balancing solution for workloads running in Kubernetes clusters, combining the capabilities of Application Gateway and Application Gateway Ingress Controller. With WAF integration, users can now protect their containerized applications from common web vulnerabilities such as SQL injection, cross-site scripting, and protocol anomalies. The solution includes Azure-managed Default Rulesets (DRS), offering protection based on OWASP standards and Microsoft’s Threat Intelligence Center (MSTIC). Additional features include bot protection through bot manager rulesets and rate-limiting custom rules to mitigate DDoS attacks, delivering enterprise-grade security for modern containerized environments.

Storage

AZNFS (3.0) for BlobNFS with FUSE for superior performance (preview)

Microsoft has released the public preview of AZNFS (3.0) for BlobNFS, offering a major upgrade for customers utilizing Azure Blob Storage with native NFSv3 access. The new version leverages the libfuse3 library—also used by BlobFuse—to bring substantial performance and scalability improvements. With this update, users benefit from higher throughput, support for larger files, enhanced metadata performance, and the removal of user group limits. These enhancements make AZNFS (3.0) particularly well-suited for performance-intensive, POSIX-compliant workloads on Linux systems that require consistent and reliable access to Blob Storage using the NFS protocol.

Azure Local

Version 2507 Release: Security Updates and Fixes

Microsoft has released version 2507 of Azure Local, delivering two targeted security updates tied to specific OS builds. The release also addresses several key issues reported in earlier builds. Fixes include resolution of a solution update failure caused by an exception in the ComposedImageUpdate role, and clarification for Azure Government cloud users where the upgrade banner is shown but the environment checker incorrectly flags lack of support. Another critical fix resolves an issue where, during VM deployment, the absence of a specified storage path would cause all resources to be placed on the first available path—potentially leading to disk space exhaustion and deployment failures over time.

End of Support Reminder: Azure Stack HCI Version 23H2

Microsoft has announced that Azure Stack HCI version 23H2 will reach end of support on October 31, 2025. Currently, Azure Local supports two active OS versions: 25398.xxx and 26100.xxx. With update 2510, systems running the 25398.x OS will automatically be upgraded to the latest 26100.x build. For deployments already based on 26100.x, the update will be applied as a feature upgrade. Organizations using Azure Local should plan accordingly to ensure ongoing support, security, and access to new features beyond the 23H2 lifecycle.

Software Defined Networking (SDN) enabled by Azure Arc on Azure Local (preview)

Microsoft has announced the public preview of Software Defined Networking (SDN) enabled by Azure Arc, now available starting with Azure Local version 2506. This release brings native Azure-style network security and control to on-premises infrastructure through Azure Arc integration. Customers can now define and manage Logical Networks, Network Interfaces, and Network Security Groups (NSGs) from the Azure control plane using the Azure Portal, CLI, or ARM templates.

Key capabilities include the ability to deploy VLAN-backed logical networks, assign static or dynamic IP addresses to virtual machines, and enforce granular traffic control policies via NSGs. NSGs can be applied both at the VLAN level and directly to VM network interfaces, using complete 5-tuple rules (source/destination IP, port, and protocol). Default network policies can also be applied during VM creation to secure workloads with predefined rules for inbound and outbound traffic.

This SDN solution is powered by the Network Controller running on Azure Local infrastructure and eliminates the need for dedicated SDN controller VMs by running as a Failover Cluster service. While advanced features such as virtual networks (vNETs), Software Load Balancers (SLBs), and Gateways are not yet supported in this preview, customers can continue to rely on traditional SDN management tools—like SDN Express and Windows Admin Center—if they require those functionalities. Notably, only one SDN management model (Azure Arc or on-premises tools) can be used per environment.

Microsoft 365 Local: New Sovereign Offering with Azure Local Foundation

Microsoft has unveiled a new sovereign solution for regulated and high-compliance environments: Microsoft 365 Local, a “Private Cloud” variant built on Azure Local infrastructure. This solution enables customers to deploy Microsoft productivity workloads such as Exchange Server and SharePoint Server directly in their own datacenters or sovereign cloud regions. With full control over security, compliance, and governance, Microsoft 365 Local extends trusted productivity experiences to environments where data residency and isolation are essential. While specific technical details are still forthcoming, this initiative marks a significant step forward in supporting sovereign cloud strategies globally.

Conclusion

Over the past two weeks, Microsoft has introduced a slew of updates and announcements pertaining to Azure Infrastructure as a Service (IaaS) and Azure Local. These developments underscore the tech giant’s unwavering commitment to enhancing its cloud offerings and adapting to the ever-evolving needs of businesses and developers. Users of Azure can anticipate improved functionalities, streamlined services, and enriched features as a result of these changes. Stay tuned for more insights as I continue to monitor and report on Azure’s progression in the cloud sphere.

Azure IaaS and Azure Local: announcements and updates (July 2025 – Weeks: 27 and 28)

This blog post series highlights the key announcements and major updates related to Azure Infrastructure as a Service (IaaS) and Azure Local, as officially released by Microsoft in the past two weeks.

Azure

General

Two-Way Forest Trusts for Microsoft Entra Domain Services

Microsoft has announced the general availability of Two-Way Forest Trusts for Microsoft Entra Domain Services. This enhancement enables organizations to establish bi-directional forest trusts between Microsoft Entra Domain Services and on-premises Active Directory Domain Services (AD DS). Previously, only one-way outbound trusts were supported, which allowed users in the on-premises environment to access resources in the managed domain. Now, administrators can configure one-way inbound, one-way outbound, or two-way forest trusts, granting users from either domain reciprocal access to resources. This added flexibility allows enterprises to better align their hybrid identity strategies, with support for more granular control over trust relationships. An Enterprise or Premium SKU license is required to configure these trusts.

Compute

Enable Trusted Launch on Existing Virtual Machine Uniform Scale Set

Microsoft has announced the general availability of the ability to enable Trusted Launch on existing Virtual Machine Uniform Scale Sets by upgrading these resources to Gen2-Trusted Launch. This enhancement allows organizations to bolster the foundational security of their existing infrastructure without needing to redeploy. Trusted Launch VMs support Secure Boot and virtual Trusted Platform Module (vTPM), protecting the guest operating system from bootkits, rootkits, and other low-level threats. Additionally, attestation capabilities measure the integrity of the VM’s boot process, further strengthening security posture.

Trusted Launch Default for New Gen2 VMs & Scale Sets (preview)

A new public preview introduces Trusted Launch as default (TLaD) for newly deployed Generation 2 Virtual Machines, Virtual Machine Scale Sets, and Azure Compute Gallery resources. This default behavior enables foundational security features, including Secure Boot and vTPM, without requiring any changes to deployment templates or automation scripts (e.g., SDKs, Bicep, ARM templates, Terraform). With Trusted Launch enabled by default, new deployments gain enhanced protection against rootkits and bootkits, while also enabling attestation to verify the VM’s boot process integrity, simplifying secure adoption of Generation 2 resources.

Networking

Azure DNS Security Policy

Azure DNS Security Policy is now generally available, offering comprehensive control and visibility over DNS traffic at the virtual network level. This new capability allows administrators to filter DNS queries by allowing, alerting, or blocking name resolutions based on domain lists, helping to protect against access to known malicious or undesired domains. Security policies can be applied to virtual networks within the same region and can be linked to multiple VNets. Organizations can gain deep visibility into DNS traffic by sending detailed logs to a storage account, Log Analytics workspace, or Event Hubs. The feature also supports granular DNS traffic rules and location-based domain lists, providing a powerful mechanism to enhance DNS security and compliance across Azure environments.

FQDN Filtering in DNAT Rules in Azure Firewall

Azure Firewall now supports Fully Qualified Domain Name (FQDN) filtering in Destination Network Address Translation (DNAT) rules, which is now generally available. This feature allows administrators to define backend resources using domain names instead of static IP addresses for inbound traffic routing. It is particularly beneficial in environments where backend IPs are dynamic or managed via DNS. With FQDN-based targeting, organizations gain improved flexibility and easier backend management. Additionally, administrators can monitor DNAT activity through AZFWNatRule logs to ensure proper policy enforcement and troubleshooting.

Customer Controlled Maintenance for Azure Firewall

Azure Firewall now supports customer-controlled maintenance windows, offering greater flexibility and operational control. With this update, users can define a recurring daily maintenance window of at least five hours during which updates and upgrades to the firewall will be applied. Firewalls that are configured with such a maintenance policy will not undergo upgrades outside the specified window, reducing the likelihood of unexpected downtime and allowing organizations to align updates with their internal change management processes. This enhancement helps ensure service continuity and better aligns with enterprise maintenance practices.

Storage

Granular Role-Based Access Control (RBAC) for Azure File Sync

Azure File Sync now includes two new built-in RBAC roles: Azure File Sync Administrator and Azure File Sync Reader. These roles are designed to improve security and streamline operations by offering more granular access control than traditional roles such as Owner or Contributor. With these purpose-built roles, organizations can better enforce the principle of least privilege when assigning permissions related to Azure File Sync. Users can create and manage essential components such as Storage Sync Services, Sync Groups, Server Endpoints, and Cloud Endpoints, as well as register servers, all while avoiding broader permissions like VM management. This update removes the need to define custom roles for common administrative tasks, supporting compliance and operational efficiency by limiting access only to what is required.

Encryption in Transit for Azure Files NFS Shares

Encryption in Transit (EiT) for Azure Files NFS shares is now generally available, providing secure data transmission over the network by using TLS 1.3. This enhancement ensures the confidentiality, integrity, and authenticity of all NFS traffic. It supports a wide range of environments, including all major Linux distributions, Azure Linux virtual machines, and on-premises Linux servers. To simplify deployment, Microsoft offers the open-source AZNFS mount helper, which automates the TLS tunneling and volume mount process. This added security layer helps organizations meet compliance requirements while preserving performance and usability in enterprise-scale file sharing scenarios.

Azure Storage Mover Adds Free, Direct AWS S3-to-Azure Blob Migration (preview)

Azure Storage Mover has introduced a new public preview feature that enables free, direct migration of data from Amazon S3 to Azure Blob Storage. Designed for organizations with multi-cloud strategies or planning a complete transition to Azure, this Cloud-to-Cloud migration capability supports secure, petabyte-scale data transfers without disrupting ongoing operations. In addition to this new path, Azure Storage Mover already supports migrating on-premises SMB shares to Azure File and transferring both SMB and NFS data to Azure Blob Storage. The integration of Azure Arc streamlines authentication when connecting to AWS, ensuring secure and seamless operations. As a fully managed and cost-free service, Azure Storage Mover helps businesses modernize their storage architectures more efficiently and with minimal complexity.

Azure Local

Updates in the 2506 Release

The 2506 release of Azure Local delivers a comprehensive set of updates across operating system support, security, networking, and deployment processes. New deployments now use OS version 26100.4349, with driver compatibility required for this version or Windows Server 2025. Existing deployments remain on version 25398.1665. The release also integrates improved deployment validation through updated environment checkers for Microsoft On-premises Cloud and Azure Resource Bridge. On the security front, a new baseline expands to 407 evaluated rules, improving alignment with CIS and DISA STIG standards, and introduces enhanced Microsoft Defender Antivirus configurations. Administrators can now fine-tune drift control settings instead of disabling them globally, and the minimum password length has been raised to 14 characters to meet NIST 2 compliance. In preview, Software-Defined Networking (SDN) enabled by Azure Arc allows the creation and assignment of Network Security Groups (NSGs) and security rules for a consistent cloud-to-edge networking model. Additional features include an overprovisioning alert to warn of insufficient compute capacity before updates, .NET 8.0.17 runtime support, and the archival of Azure Local version 22H2 documentation. Notably, this release is not supported for Azure Local instances deployed in Azure Government cloud.

Conclusion

Over the past two weeks, Microsoft has introduced a slew of updates and announcements pertaining to Azure Infrastructure as a Service (IaaS) and Azure Local. These developments underscore the tech giant’s unwavering commitment to enhancing its cloud offerings and adapting to the ever-evolving needs of businesses and developers. Users of Azure can anticipate improved functionalities, streamlined services, and enriched features as a result of these changes. Stay tuned for more insights as I continue to monitor and report on Azure’s progression in the cloud sphere.

Azure Hybrid Management & Security: What’s New and Insights from the Field – June 2025

Once again this month, I’m back with my recurring series focused on the evolution of Azure management and security services, with a special focus on hybrid and multicloud scenarios enabled by Azure Arc and enhanced by the use of Artificial Intelligence.

This monthly series aims to:

  • Provide an overview of the most relevant updates released by Microsoft;

  • Share operational tips and field-proven best practices to help architects and IT leaders manage complex and distributed environments more effectively;

  • Follow the evolution towards a centralized, proactive, and AI-driven management model, in line with Microsoft’s vision of AI-powered Management.

The key areas we will cover in this series, along with the corresponding tools and services, include:

🔹 Hybrid and multicloud environment management – with Azure Arc, which extends policy, security, management, and automation capabilities to on-premises and multicloud resources.

🔹 AI and intelligent automation – enabled by Microsoft Copilot in Azure, AIOps capabilities, and predictive tools to streamline operations and support smarter decision-making.

🔹 Security posture across hybrid and multicloud infrastructures – using Microsoft Defender for Cloud and other native services for vulnerability management and advanced threat protection.

🔹 Governance and policy management – leveraging tools such as Azure Policy, Azure Cost Management, and Resource Graph to ensure control, standardization, and cost/resource optimization.

🔹 Update & Patching – through Azure Update Management, Azure Automation, and native patching capabilities across Azure Arc-enabled environments.

🔹 Backup & Resilience – using Azure Backup and Azure Site Recovery to ensure business continuity, data protection, and disaster recovery.

🔹 Monitoring – with tools like Azure Monitor, Log Analytics, and Application Insights for comprehensive visibility and effective troubleshooting.

Security posture across hybrid and multicloud infrastructures

Microsoft Defender for Cloud

New features, bug fixes, and deprecated features of Microsoft Defender for Cloud

The development of Microsoft Defender for Cloud is constantly evolving, with improvements being introduced on an ongoing basis. To stay updated on the latest developments, Microsoft maintains this page, which provides information on new features, bug fixes, and deprecated functionalities. Below are the main updates for the month:

Optional index tags for malware scan results in Defender for Storage (preview) – Microsoft has announced a new feature in Public Preview for Defender for Storage that introduces support for optional index tags in malware scan results, both during file uploads and on-demand scans. This option allows users to choose whether or not to publish scan results in the blob index tags, providing greater flexibility in managing stored information. The activation or deactivation of tags can be configured at the subscription or storage account level, via the Azure portal or API. This feature enables the service to be adapted to specific needs in terms of governance, compliance, and performance.

API discovery and security posture assessment for Function Apps and Logic Apps (preview) – Defender for Cloud extends its API Discovery and API Security Posture Management capabilities to Azure Function Apps and Logic Apps, previously supported only through Azure API Management. Thanks to this extension, security teams can gain a centralized and up-to-date view of the entire API attack surface within the organization. Key features include:

  • automatic inventory of APIs,
  • risk assessment of outdated, exposed, or unencrypted endpoints,
  • targeted remediation suggestions.

Agentless File Integrity Monitoring (preview) – File Integrity Monitoring (FIM) is now available in Public Preview in agentless mode, complementing the existing agent-based solution via Microsoft Defender for Endpoint. This new mode allows monitoring of file and registry key changes without the need to install agents, making monitoring simpler and more scalable—ideal for environments that require reduced operational complexity. Key features include:

  • custom definition of paths to monitor,
  • consolidation of events (agentless and agent-based) into a single table within the workspace, with clear source identification.

Agentless code scanning: GitHub support and customizable coverage (preview) – The agentless code scanning capability has been enhanced with new features, now available in Public Preview, to offer broader coverage and greater control over development environments. Notable updates include:

  • native support for GitHub repositories, in addition to Azure DevOps,
  • ability to choose scanning tools (e.g., Bandit, Checkov, ESLint),
  • granular configuration of scan scope (projects, repositories, or entire organizations).

Governance and policy management

Azure Advisor

Azure Advisor improves VM right-sizing with new SKUs and families

Azure Advisor has expanded the scope of its virtual machine right-sizing recommendations, now including a broader range of SKUs and support for the latest VM families in the D, E, and F series.
This update enables more accurate analysis of CPU performance and provides more precise suggestions for optimizing workloads. Organizations can identify oversized VMs and resize them based on actual usage, achieving tangible benefits in terms of:

  • reduced operational costs,
  • minimized resource waste,
  • contribution to environmental sustainability.

Azure Cost Management

Support for FOCUS 1.2 standard in Microsoft Cost Management (preview)

Microsoft has announced the Public Preview availability of support for the FinOps Open Cost and Usage Specification (FOCUS) 1.2 standard in Microsoft Cost Management. This update marks a significant step forward for FinOps teams by simplifying reporting, unifying multi-cloud billing data, and enabling financial analysis across multiple currencies.

FOCUS 1.2 is a standardized, cloud-agnostic schema designed to improve cost management across IaaS, PaaS, and SaaS services. Key updates include:

  • improved column naming conventions,
  • introduction of new fields to support future extensions,
  • alignment with key billing constructs such as InvoiceId, ServiceModel, and AmortizationClass.

The main benefits include unified and consistent reporting, enhanced support for multi-currency scenarios, improved data quality and integrity, and streamlined FinOps workflows thanks to the schema’s increased extensibility.

Backup & Resilience

Azure Backup

Increased disk capacity for Azure virtual machine backup

Microsoft has announced the availability of extended disk capacity support for Azure VM Backup. It is now possible to protect virtual machines with individual disks up to 64 TB, with a total limit of up to 512 TB per VM. This update enhances business continuity and disaster recovery scenarios by enabling native protection—within the Azure ecosystem—even for the largest and most critical workloads.

Long-term backup for Azure Database for PostgreSQL – Flexible Server

Azure Database for PostgreSQL – Flexible Server introduces a new long-term backup capability through integration with Azure Backup. This development addresses compliance and data protection requirements by allowing custom backup policies, individual backup management, and a simplified configuration process. Key highlights include the ability to retain data for up to 10 years—an essential feature for regulated or audit-driven scenarios. These new options strengthen the data protection strategy in hybrid and multicloud environments, providing administrators with greater granularity in managing backup retention and accessibility, while ensuring regulatory and operational compliance.

Azure Site Recovery

Azure Site Recovery supports Linux VMs with Trusted Launch

Azure Site Recovery (ASR) support for Linux virtual machines with Trusted Launch is now generally available. This feature enables automated protection for Azure Generation 2 VMs that leverage the advanced security capabilities of Trusted Launch, including Secure Boot and vTPM (Virtual Trusted Platform Module). With this update, Linux VMs can now benefit from a fully managed and integrated disaster recovery solution in Azure, enhancing the resilience of environments that require high security standards. Support for Windows VMs with Trusted Launch was already available, and this extension to Linux completes the coverage, making ASR an even more robust choice for hybrid and mission-critical scenarios.

Azure Site Recovery support for virtual machines with Premium SSD v2 disks (preview)

Microsoft has announced the Public Preview of Azure Site Recovery (ASR) support for virtual machines using Premium SSD v2 disks. This enhancement extends disaster recovery capabilities to workloads that require high performance, such as SQL Server, Oracle, SAP, and big data environments. ASR enables efficient VM replication across Azure regions or from on-premises environments to the cloud, offering automated failover and the ability to run disaster recovery drills. The introduction of support for Premium SSD v2 disks—known for low latency, consistent performance, and independent scalability of IOPS and throughput—further increases flexibility and efficiency in protecting critical environments.

Support for Ultra Disks in Azure Site Recovery (preview)

Support for Azure Site Recovery (ASR) for virtual machines using Ultra Disks is now available in Public Preview. This enhancement enables advanced disaster recovery scenarios for performance-intensive workloads, extending resilience to VMs equipped with disks that offer sub-millisecond latency and extremely high throughput. Ultra Disks represent the highest-performing block storage in Azure, ideal for critical systems such as SAP HANA, enterprise-grade databases, and high-intensity transactional environments. With this update, ASR continues to strengthen its integrated workload protection offering, enabling replication across Azure regions or from on-premises environments, with features like automated failover and test failovers. It’s a key extension for organizations aiming for robust business continuity using native Azure tools for mission-critical workloads.

Monitoring

Azure Monitor

Ingestion issue monitoring with Azure Monitor Workspace (preview)

A new feature for proactive data ingestion issue monitoring in Azure Monitor Workspace is now available in Public Preview. This innovation enhances visibility into incoming data streams, allowing administrators to more easily detect errors, anomalies, or slowdowns in the monitoring pipeline. In complex and distributed environments, the ability to promptly identify such issues is essential to ensure the continuity of observability processes, improve operational responsiveness, and reduce the risk of losing critical data.

Query Editor in Azure Monitor Metrics now generally available

Microsoft has announced the General Availability of the new Query Editor within Azure Metric Explorer, now integrated with Azure Monitor Workspace. This feature enables direct querying of metric data collected from Prometheus using the PromQL language, all accessible directly from the Azure portal. This update introduces a more powerful and flexible way to explore and analyze monitoring data, allowing users to quickly gain targeted insights to optimize resources and improve performance in both cloud and hybrid environments. The native integration of PromQL in Metric Explorer represents a significant step toward more efficient, analytical, and data-driven management of distributed systems.

Conclusions

The landscape of hybrid and multicloud environment management and security continues to evolve with significant innovations. The updates introduced by Microsoft in June 2025 further strengthen organizations’ ability to protect, optimize, and effectively govern their infrastructures—both in the cloud and on-premises. The preview features of Microsoft Defender for Cloud, along with new resilience tools such as support for Ultra and Premium SSD v2 disks in Azure Site Recovery, represent a tangible step forward toward more secure, scalable, and high-performance architectures. At the same time, improvements in monitoring, cost management, and proactive resource recommendations enable more granular and informed control of distributed environments. It is essential for IT and security teams to stay up to date with these developments, adopt a data-driven approach, and progressively integrate new capabilities into their processes to ensure strong security posture and efficient governance in increasingly dynamic and complex scenarios.

Azure IaaS and Azure Local: announcements and updates (June 2025 – Weeks: 25 and 26)

This blog post series highlights the key announcements and major updates related to Azure Infrastructure as a Service (IaaS) and Azure Local, as officially released by Microsoft in the past two weeks.

Azure

General

Microsoft announces comprehensive sovereign solutions for European organizations (preview)

Microsoft has introduced a broad expansion of its sovereign cloud offerings with the goal of empowering European organizations with enhanced data privacy, operational autonomy, and digital resilience. Building on its longstanding presence in Europe, the new Microsoft Sovereign Cloud initiative spans public cloud, private cloud infrastructure, and national partner environments. Among the new capabilities announced are Data Guardian, which ensures only European personnel oversee remote system access; External Key Management, allowing customers to control encryption with their own HSMs; and Regulated Environment Management, a centralized portal for configuring and monitoring sovereign workloads.

The Sovereign Public Cloud—an evolution of the Microsoft Cloud for Sovereignty—supports Microsoft Azure, Microsoft 365, Security, and Power Platform services across all European datacenter regions, guaranteeing data stays within the EU and is operated under European law by local staff. Additionally, Sovereign Private Cloud (preview), powered by Azure Local and the newly announced Microsoft 365 Local, enables deployment of productivity and cloud services in customer-controlled environments, supporting high levels of compliance and business continuity.

Microsoft is also expanding support for National Partner Clouds through collaborations such as Bleu in France and Delos Cloud in Germany, offering independently operated sovereign environments. These initiatives aim to deliver the most comprehensive sovereignty solutions in the industry, allowing European customers to operate confidently and in full compliance with evolving regulations—without sacrificing access to innovation or requiring data migration.

Microsoft Azure now available from new cloud region in Chile

Microsoft has announced the general availability of its first cloud region in Chile, further expanding its global infrastructure footprint. The new Chile Central region offers Azure Availability Zones and provides scalable, highly available, and resilient cloud services to customers across Latin America and beyond. This launch reinforces Microsoft’s commitment to accelerating digital transformation and innovation in Chile, while ensuring high standards of security, privacy, and regulatory compliance for data residency. Organizations in the region can now benefit from low-latency access to trusted Microsoft Cloud services hosted within the country.

Compute

Azure FXv2-series Virtual Machines

Microsoft has announced the General Availability of Azure FXv2-series Virtual Machines (VMs), powered by the 5th Generation Intel® Xeon® Platinum 8573C processor. These VMs deliver substantial enhancements in CPU performance, memory capacity, and storage throughput, making them ideal for compute-intensive workloads such as databases and data analytics. The FXv2-series VMs provide up to 50% better CPU performance compared to the previous generation, with sizes supporting up to 96 vCPUs and 1,832 GiB of memory. NVMe support ensures high-performance remote storage, with up to 400K IOPS and 11.25 GBps throughput. Designed for high-demand scenarios, such as SQL Server and electronic design automation (EDA), the FXv2-series offers enhanced memory configurations and improved I/O bandwidth.

Networking

Azure WAF integration in Microsoft Security Copilot

The integration of Azure Web Application Firewall (WAF) with Microsoft Copilot for Security has reached general availability. This integration spans both Azure Front Door WAF and Azure Application Gateway WAF, enabling organizations to enhance their threat detection and response capabilities through AI-powered insights. The solution provides automated analysis of SQL Injection (SQLi) and Cross-Site Scripting (XSS) attacks, delivering summaries and justifications for WAF actions. It also includes advanced diagnostics such as tracking attack trends, identifying top offending IPs, and analyzing frequently triggered WAF rules. These features help security teams streamline investigations and proactively adjust their defenses based on real-time intelligence.

Azure Virtual Network Manager IP address management

The IP address management capability in Azure Virtual Network Manager is now generally available, offering centralized tools to enhance IP planning and allocation across complex network environments. This feature allows automatic assignment of non-overlapping IP addresses, supports IP reservations for specific workloads, and prevents conflicts across Azure, on-premises, and multi-cloud environments. Integrated with Azure Policy, it also enforces network creation using designated IP pools, ensuring consistency and compliance. The feature provides clear visibility into IP usage across network resources, helping organizations maintain efficient and conflict-free IP address spaces.

Draft & Deploy on Azure Firewall (preview)

The new Draft & Deploy feature for Azure Firewall Policy introduces a more efficient, two-phase approach to managing firewall configurations, now available in public preview. Previously, any change to a policy would initiate a full deployment of both the policy and associated firewall, resulting in delays of 2–4 minutes per update. With this feature, users can create a draft version cloned from the current policy, allowing collaborative edits without impacting the live environment. Once all changes are finalized, the updated policy can be deployed in a single operation, streamlining the update process and reducing operational disruption.

Azure Front Door supports managed certificate for wildcard domains (preview)

Azure Front Door Standard and Premium profiles now support managed certificates for wildcard domains, a feature previously limited to Bring Your Own Certificate (BYOC) configurations. This enhancement allows customers to secure multiple subdomains using a single managed certificate, which is especially beneficial for SaaS providers and organizations operating large-scale, multi-tenant applications. The new capability simplifies operations by eliminating the need to manage certificates per subdomain, improves scalability by reducing configuration overhead, and enhances security through automated certificate renewals.

Storage

Transition existing platform-managed keys to customer-managed keys for Azure NetApp Files volumes

Customers can now seamlessly transition Azure NetApp Files volumes from platform-managed keys (PMK) to customer-managed keys (CMK), without requiring data migration. This capability is now generally available across all Azure NetApp Files supported regions. Using CMK provides enhanced security and control, allowing organizations to manage their own encryption key lifecycle, including renewals and rotations. It also aligns with stringent regulatory and compliance requirements typical in industries such as finance, healthcare, and government. Importantly, there is no performance impact when using CMK, as the feature simply secures the account encryption key with Azure Key Vault, offering protection against unauthorized access and insider threats.

Conclusion

Over the past two weeks, Microsoft has introduced a slew of updates and announcements pertaining to Azure Infrastructure as a Service (IaaS) and Azure Local. These developments underscore the tech giant’s unwavering commitment to enhancing its cloud offerings and adapting to the ever-evolving needs of businesses and developers. Users of Azure can anticipate improved functionalities, streamlined services, and enriched features as a result of these changes. Stay tuned for more insights as I continue to monitor and report on Azure’s progression in the cloud sphere.

Azure IaaS and Azure Local: announcements and updates (June 2025 – Weeks: 23 and 24)

This blog post series highlights the key announcements and major updates related to Azure Infrastructure as a Service (IaaS) and Azure Local, as officially released by Microsoft in the past two weeks.

Azure

Compute

New Storage Optimized Laosv4, Lasv4, and Lsv4 Azure VM Series

Azure has announced the general availability of the Laosv4, Lasv4, and Lsv4 storage-optimized virtual machine series. The Laosv4 and Lasv4 VMs are powered by 4th Gen AMD EPYC™ (Genoa) processors, while the Lsv4 series uses 5th Gen Intel® Xeon® (Emerald Rapids) CPUs. These VMs offer sizes ranging from 2 to 96 vCPUs, with 8GB of memory and substantial local NVMe disk capacity per vCPU. In particular, the largest VMs offer up to 23TB of local storage. All three VM series come with Azure Boost and Azure Boost SSDs, support NVMe local SSD disk encryption by default, and feature an NVMe remote storage interface with premium storage caching, enhancing remote storage performance. These VMs are ideal for storage-intensive, distributed workloads such as big data analytics, Elasticsearch, distributed file systems, and data warehousing, delivering the high performance and flexibility needed for modern enterprise applications.

Networking

Profile and Route WAF Policies on Azure Front Door (private preview)

Azure has introduced a private preview of profile and route-based Web Application Firewall (WAF) policies for Azure Front Door. Previously, WAF policies could only be associated with a Front Door instance via frontends or custom domains. With this update, WAF policies can now also be applied at the Front Door profile level and at the individual route level within a domain. This new flexibility allows administrators to define a global policy at the profile level to cover all associated domains, while also enabling more granular security through route-specific policies. For instance, more sensitive routes—such as login or payment pages—can have stricter rules applied. The policy hierarchy ensures that more specific policies override broader ones: route-level policies take precedence over domain-level policies, which in turn override profile-level policies. This enhancement empowers organizations to implement targeted protection strategies within a unified WAF framework.

Azure Virtual Network Manager in Azure China

Azure Virtual Network Manager is now generally available in Azure China, bringing centralized control over connectivity, security rules, and routing configurations across subscriptions at scale. This service simplifies network topology management using hub-and-spoke or mesh configurations, helping administrators ensure consistent connectivity and policy enforcement throughout complex environments. The  security admin rules feature allows organizations to define security policies that take precedence over traditional Network Security Group (NSG) rules, helping to avoid misconfigurations and maintain compliance across environments. Additionally, flow logs offer visibility and diagnostics for traffic governed by these rules. Routing configurations can also be standardized and applied automatically to multiple subnets or virtual networks, supporting scenarios like routing spoke traffic through Azure Firewall or enabling cross-hub connections, further simplifying enterprise network architecture.

Storage

Archive Access Tier Now Available in Italy North

The Archive access tier for Azure Blob Storage is now generally available in the Italy North region. This development enables customers to store infrequently accessed data in a highly cost-effective manner while ensuring data residency and compliance with Italian regulations. Ideal for long-term data retention, backup, and compliance scenarios, the Archive tier supports comprehensive data lifecycle management. Users can manage data in the Archive tier through the Azure portal, CLI, PowerShell, or REST API. With this release, the Italy North region now supports the full spectrum of Azure Blob Storage tiers—Hot, Cool, Cold, and Archive—aligning it with other fully featured Azure regions.

Azure Storage Mover support for SMB source to Azure Blob target

Azure Storage Mover has expanded its capabilities to support the migration of SMB shares directly to Azure Blob containers. This fully managed migration service enables seamless and secure transfer of on-premises files and folders to Azure Storage, minimizing downtime during migration processes. With integration features like just-in-time permission setting and Azure Key Vault support, organizations can perform secure migrations end-to-end. This enhancement complements the existing support for migrations from NFS shares to Azure Blob and from SMB sources to Azure File shares.

NFS Azure Files volume mount support in Azure Container Apps (preview)

Azure Container Apps now support mounting Network File System (NFS) Azure Files volumes to containerized applications. This enhancement allows developers to leverage a scalable and high-performance file system that can be shared across multiple containers within an application. The use of NFS Azure Files volumes also ensures data persistence across container restarts, making it ideal for stateful workloads or data-intensive jobs running in container environments.

Encrypt Premium SSD v2 and Ultra Disks with Cross-Tenant Customer Managed Keys (preview)

Microsoft has introduced a public preview for encrypting Premium SSD v2 and Ultra Disks using Cross-Tenant Customer Managed Keys (CMK) in select regions. This feature enables encryption of managed disks using a CMK that resides in an Azure Key Vault located in a different Microsoft Entra tenant from the disk itself. This advancement is particularly beneficial for service providers building Software as a Service (SaaS) solutions on Azure, as it allows their customers to manage their own encryption keys independently. Customers can now host and control their CMKs in their own tenant, granting them full sovereignty over their data and encryption practices.

Conclusion

Over the past two weeks, Microsoft has introduced a slew of updates and announcements pertaining to Azure Infrastructure as a Service (IaaS) and Azure Local. These developments underscore the tech giant’s unwavering commitment to enhancing its cloud offerings and adapting to the ever-evolving needs of businesses and developers. Users of Azure can anticipate improved functionalities, streamlined services, and enriched features as a result of these changes. Stay tuned for more insights as I continue to monitor and report on Azure’s progression in the cloud sphere.

Azure IaaS and Azure Local: announcements and updates (May 2025 – Weeks: 21 and 22)

This blog post series highlights the key announcements and major updates related to Azure Infrastructure as a Service (IaaS) and Azure Local, as officially released by Microsoft in the past two weeks.

Azure

General

GitHub Copilot for Azure

GitHub Copilot for Azure is now generally available, delivering a streamlined and intelligent development experience across the Azure ecosystem. Designed to enhance developer productivity, this solution integrates natively with Azure resources and offers support for Infrastructure as Code (IaC) through Bicep and Terraform. It enables efficient diagnostics and issue resolution, while providing real-time recommendations to improve code quality. GitHub Copilot for Azure acts as a comprehensive assistant, helping developers design resilient architectures, manage cloud resources, and elevate their Azure expertise with minimal disruption.

Cloudera on Cloud Available in Italy North Region

Cloudera on Cloud is now available in the Italy North Azure region through the Azure Marketplace. This availability expands the regional presence of Cloudera’s analytics and data platform, allowing customers in Italy to deploy and operate Cloudera environments more efficiently and in compliance with local data residency requirements.

Azure Chaos Studio available in ItalyNorth

Azure Chaos Studio has expanded its regional availability and is now offered in the ItalyNorth region. This service enables customers to improve the resilience of their applications by simulating faults and disruptions in a controlled manner. By testing real-world failure scenarios, organizations can proactively address reliability issues and strengthen the stability of their cloud workloads.

Retirement of Azure China North 1 and East 1 Regions

Microsoft has announced the planned retirement of the China North 1 and China East 1 regions, operated by 21Vianet, effective July 1, 2026. This decision follows an ongoing effort to modernize and optimize the Azure infrastructure in China. Customers are encouraged to migrate their resources to newer regions, such as China North 3, which offer improved performance, security, and support for advanced Azure services. To avoid service disruption, all migrations should be completed before the retirement date. Azure in China will continue its operations in multiple enhanced regions to meet evolving customer needs.

Azure Quota Groups

Azure Quota Groups is now generally available, bringing enhanced flexibility and centralized control for Enterprise Agreement (EA) and internal customers. This feature allows quotas to be shared across multiple subscriptions within a designated group, reducing the volume of individual quota requests and simplifying management. Through the use of a centralized Quota Group Azure Resource Manager (ARM) object, customers can self-manage their quota allocations—without requiring Microsoft approval. Benefits include the ability to reassign unused quota across subscriptions, reduced support overhead, and the ability to submit a single quota request for the entire group. Azure Quota Groups significantly streamlines resource governance and boosts operational efficiency.

Compute

ND96isr_H200_v5 Virtual Machines available in ItalyNorth

Azure has expanded the regional availability of ND96isr_H200_v5 Virtual Machines, which are now offered in the ItalyNorth region. These VMs are optimized for high-performance computing and AI workloads, providing enhanced GPU capabilities designed to accelerate demanding applications such as deep learning, data analytics, and large-scale simulations.

Network Optimized Azure Virtual Machines – Dnsv6, Dndsv6, Dnlsv6, Dnldsv6, Ensv6 and Endsv6 (preview)

Azure has introduced a new class of Network Optimized Virtual Machines, now in public preview, built on the 5th Generation Intel® Xeon® Platinum 8537C (Emerald Rapids) processors. These VMs provide enhanced performance and flexibility with three memory-to-core configurations and options with or without local SSDs. Leveraging Azure Boost, these VMs deliver superior network bandwidth per vCPU, increased vNIC capacity, and faster connection setup times. The new SKUs, including Dnsv6, Dndsv6, Dnlsv6, Dnldsv6, Ensv6, and Endsv6, expand the v6 family of Intel-based Azure VMs, making them ideal for network-intensive workloads.

Networking

Private Subnet

Azure announces the general availability of the private subnet functionality. Traditionally, virtual machines created in a virtual network without explicit outbound configuration were assigned a default outbound public IP address. These implicit IPs presented security challenges and lacked association with subscriptions, making them unreliable and difficult to manage. With the private subnet feature, any new subnet defaults to having “default outbound access” set to false, thus eliminating implicit outbound connectivity and promoting Azure’s “secure by default” principle. Users must now explicitly configure outbound access using services such as NAT Gateway or Public IP addresses. Starting September 30th, 2025, all new virtual networks will adopt this default behavior, although existing networks and older API versions will remain unaffected.

Azure Traffic Manager SLA Increased to 100%

Azure Traffic Manager now offers a 100% service level agreement (SLA) for global DNS resolution, guaranteeing uninterrupted resolution of DNS queries to healthy service endpoints. This enhancement reinforces Azure’s commitment to reliability and performance, ensuring that all Traffic Manager profiles automatically benefit from this updated SLA without requiring any customer-side changes.

Destination Network Address Translation (DNAT) on Azure Firewall Private IP address

Azure Firewall now supports Destination Network Address Translation (DNAT) rule configurations on its Private IP address, enabling port translations that were previously unavailable. This enhancement is particularly useful for enterprises dealing with overlapping IP ranges, such as during the integration of new partners or mergers and acquisitions. In hybrid networking scenarios, this feature allows on-premises datacenters to establish communication with Azure resources using private, non-routable IP addresses, ensuring seamless interoperability and connectivity across diverse environments.

Container Apps and Functions as Private Link enabled origins for Front Door Premium

Azure Front Door Premium now supports configuring Azure Container Apps and Azure Functions as Private Link enabled origins. This capability ensures secure backend communication by restricting origin exposure to the public internet. Even though users access content through public Front Door endpoints, the actual origin services remain securely accessible only via Private Link, improving overall network security posture for web applications and APIs.

Azure Front Door supports origin authentication via Managed Identities (preview)

Azure Front Door Standard and Premium now support origin authentication using Managed Identities, currently in public preview. This feature allows secure, identity-based access control between Front Door and its backend origins. By leveraging Managed Identities, customers can avoid the risks and operational overhead associated with managing credentials, ensuring that only authorized Front Door instances can access origin services.

VM Network Troubleshooter in Azure Portal (preview)

Azure has introduced a new VM Network Troubleshooter tool in the Azure Portal, now in public preview. Accessible from the VM Overview blade, this tool allows users to run diagnostics and detect common issues such as blocked ports. This feature significantly streamlines network troubleshooting, enabling quicker identification and resolution of connectivity problems that often affect virtual machine workloads.

Using Server-sent events with Application Gateway (preview)

Azure Application Gateway introduces preview support for Server-sent events (SSE), a technology that enables servers to push real-time updates to clients over persistent HTTP connections. This preview allows developers to build low-latency applications requiring continuous data streaming directly from the server. To utilize this capability, both the Application Gateway and the backend application must be configured appropriately. This feature enhances the ability to deliver dynamic content to clients while maintaining control over scalability and performance at the application delivery layer.

Storage

Availability Set Support for Premium SSD v2 Disk Storage

Azure has added support for Availability Sets with Premium SSD v2 (Pv2) disk storage in regions without Availability Zones, including Australia Southeast, Canada East, North Central US, UK West, West Central US, and West US. Premium SSD v2 offers scalable IOPS and throughput, low latency, and consistent performance—making it a strong choice for enterprise workloads such as SQL Server, Oracle, SAP, and big data platforms. This enhancement allows customers in these regions to build resilient architectures using Availability Sets, ensuring higher availability even in the absence of zonal infrastructure.

Customer-managed keys for Azure NetApp Files volume encryption with Azure Key Vault Managed HSM

Azure NetApp Files now supports customer-managed keys for volume encryption using Azure Key Vault Managed HSM. This enhancement provides an elevated level of security, transitioning from FIPS 140-2 Level 2 to Level 3 compliance for critical deployments. The use of Managed HSM is particularly relevant in sectors that demand high-security standards, such as financial services, public sector, telecommunications, and energy. Applications benefiting from this include payment processing systems, authentication services, and solutions requiring application-level encryption.

Encryption in Transit for Azure Files NFS Shares (preview)

Microsoft has introduced support for encryption in transit for Azure Files NFS v4.1 shares, now available in public preview. This feature enhances data protection by enabling TLS-based encryption for NFS traffic, securing data as it travels between applications and Azure File shares. The solution integrates with the lightweight AZNFS mount helper to deliver a seamless user experience, and it offers flexibility by allowing connections to be mounted with or without encryption, depending on user requirements.

Live Resize for Premium SSD v2 and Ultra NVMe Disks (preview)

Microsoft has announced the public preview of Live Resize for Premium SSD v2 (Pv2) and Ultra NVMe Disks. This new capability enables users to dynamically increase the storage capacity of their disks without causing any disruption to running applications. With Live Resize, organizations can adopt a more cost-effective storage strategy by starting with smaller disk sizes and scaling up as needed—ensuring flexibility, efficiency, and continuous application availability.

Conclusion

Over the past two weeks, Microsoft has introduced a slew of updates and announcements pertaining to Azure Infrastructure as a Service (IaaS) and Azure Local. These developments underscore the tech giant’s unwavering commitment to enhancing its cloud offerings and adapting to the ever-evolving needs of businesses and developers. Users of Azure can anticipate improved functionalities, streamlined services, and enriched features as a result of these changes. Stay tuned for more insights as I continue to monitor and report on Azure’s progression in the cloud sphere.

Azure Hybrid Management & Security: What’s New and Insights from the Field – May 2025

Once again this month, I’m back with my recurring series focused on the evolution of Azure management and security services, with a special focus on hybrid and multicloud scenarios enabled by Azure Arc and enhanced by the use of Artificial Intelligence.

This monthly series aims to:

  • Provide an overview of the most relevant updates released by Microsoft;

  • Share operational tips and field-proven best practices to help architects and IT leaders manage complex and distributed environments more effectively;

  • Follow the evolution towards a centralized, proactive, and AI-driven management model, in line with Microsoft’s vision of AI-powered Management.

The key areas we will cover in this series, along with the corresponding tools and services, include:

🔹 Hybrid and multicloud environment management – with Azure Arc, which extends policy, security, management, and automation capabilities to on-premises and multicloud resources.

🔹 AI and intelligent automation – enabled by Microsoft Copilot in Azure, AIOps capabilities, and predictive tools to streamline operations and support smarter decision-making.

🔹 Security posture across hybrid and multicloud infrastructures – using Microsoft Defender for Cloud and other native services for vulnerability management and advanced threat protection.

🔹 Governance and policy management – leveraging tools such as Azure Policy, Azure Cost Management, and Resource Graph to ensure control, standardization, and cost/resource optimization.

🔹 Update & Patching – through Azure Update Management, Azure Automation, and native patching capabilities across Azure Arc-enabled environments.

🔹 Backup & Resilience – using Azure Backup and Azure Site Recovery to ensure business continuity, data protection, and disaster recovery.

🔹 Monitoring – with tools like Azure Monitor, Log Analytics, and Application Insights for comprehensive visibility and effective troubleshooting.

Hybrid and multicloud environment management

Measure, manage, and reduce carbon emissions in Azure

Microsoft has announced the general availability of the carbon optimization feature in Azure, a native solution designed to help organizations measure, manage, and reduce the carbon emissions generated by their cloud workloads. Integrated directly into the Azure portal, this feature provides preconfigured dashboards and KPIs to monitor environmental impact over time. Emission data is available at the individual resource level, offering a high level of detail and the ability to identify concrete optimization opportunities. Role-Based Access Control (RBAC) ensures that only authorized users can view relevant information. Additionally, operational recommendations are provided to support both emission reduction and cost savings. This announcement reaffirms Microsoft’s commitment to supporting customers in achieving more sustainable cloud management by offering integrated tools for more environmentally conscious IT decisions. A significant step forward for organizations that prioritize these aspects.

AI and intelligent automation

Microsoft Copilot in Azure

GitHub Copilot for Azure: smarter, more integrated cloud development

GitHub Copilot for Azure is now generally available—a solution that revolutionizes cloud development through an AI assistant seamlessly integrated with Azure resources. Designed to simplify and accelerate developers’ work, this tool supports Infrastructure as Code (IaC) using languages such as Bicep and Terraform, helps proactively identify and resolve issues, and provides contextual recommendations to improve code quality in real time. Copilot proves to be a valuable ally for those designing resilient and modern architectures, transforming how code is written, distributed environments are managed, and new cloud skills are acquired. Its availability marks a concrete step toward adopting an AI-enhanced cloud management model.

AI-powered Investigation for troubleshooting in Azure Monitor (preview)

The AI-powered Investigation feature is now available in Public Preview in Azure Monitor, aimed at improving the troubleshooting experience and speeding up the detection and resolution of issues in applications and infrastructure. Artificial intelligence deeply analyzes telemetry collected by Azure Monitor—including metrics, logs, resource status, alerts, and application topology—to identify anomalies and suggest potential root causes and solutions. Analyses are personalized through direct interaction with the AI, making results more accurate and relevant. A new entity, called an “issue,” aggregates all information related to a problem, seamlessly integrating these capabilities into the alert management workflow. Currently available for Application Insights, this feature will soon expand to other resources.

Copilot in SQL Server Management Studio (preview)

The new Copilot integration in SQL Server Management Studio (SSMS) is also now in Public Preview. This AI assistant is designed to help developers and administrators write, modify, and troubleshoot T-SQL queries using natural language. Copilot leverages the database context to provide personalized responses based on the specific environment, covering areas such as maintenance, configuration, and database management—whether in the cloud or on-premises. This innovation is part of Microsoft’s broader journey toward increasingly intelligent and proactive management tools, powered by AI to boost productivity and reduce the complexity of day-to-day operations.

Security posture across hybrid and multicloud infrastructures

Microsoft Defender for Cloud

New features, bug fixes, and deprecated features of Microsoft Defender for Cloud

The development of Microsoft Defender for Cloud is constantly evolving, with continuous improvements being introduced. To stay updated on the latest developments, Microsoft updates this page, which provides information on new features, bug fixes, and deprecated features. Specifically, this month’s main news includes:

  • Active User (Public Preview): a new feature designed to help administrators quickly identify the most relevant users for each recommendation, based on recent control plane activity. For each recommendation, up to three active users are suggested at the resource, resource group, or subscription level. You can assign the recommendation, set a due date, and directly notify the assigned user, streamlining remediation workflows and reducing investigation time.
  • General Availability of Defender for AI Services: runtime protection is now available for Azure AI services, previously known as threat protection for AI workloads. This protection covers specific AI-related scenarios such as jailbreak attempts, wallet abuse, data exposure, and suspicious access patterns, leveraging signals from Microsoft Threat Intelligence and Azure AI Prompt Shields.
  • Security Copilot now GA in Defender for Cloud: the general availability of Microsoft Security Copilot enables faster risk response through AI-generated summaries, remediation suggestions, and automated notifications. Administrators can quickly summarize recommendations, generate remediation scripts, and delegate tasks via email, boosting the operational efficiency of security teams.
  • Data and AI Security Dashboard: the new dashboard provides a unified and centralized view for monitoring the security posture of data and AI resources. It includes capabilities such as sensitive data discovery, identification of active AI resources (including containers, datasets, and models), and highlighting critical issues based on high-severity recommendations, alerts, and attack paths.
  • Defender CSPM: Billing for MySQL and PostgreSQL Flexible Server starting June 2025: starting June 1, 2025, Microsoft will begin billing for Azure Database for MySQL Flexible Server and PostgreSQL Flexible Server workloads protected by Defender CSPM. No action is required from users, but monthly billing may change depending on the protected resources.
  • Customizable filters for malware scanning on upload in Defender for Storage: Microsoft Defender for Storage now officially supports customizable filters for on-upload malware scanning. Users can define exclusion rules based on blob path prefixes or suffixes, as well as blob size. This update allows non-critical or temporary files, such as logs or transient files, to be excluded from scanning—optimizing security processes and helping reduce operational costs.

Governance and policy management

Azure Cost Management

Advanced Exports in Cost Management

Advanced exports in Cost Management are now generally available across all Azure regions and clouds. This feature introduces significant improvements in how organizations can automate the analysis of cost and usage data. Key enhancements include an expanded set of exportable datasets (including price sheets, recommendations, and reservation details), new export formats (CSV with Gzip compression, Parquet with Snappy compression), and support for the FinOps Open Cost and Usage Specification (FOCUS) version 1.0. Organizations can now configure partitioned files, enable overwrites, retrieve historical data (up to thirteen months via the portal, seven years through the REST API), and export to storage accounts protected by firewalls or network policies. Schema versioning is also supported, ensuring compatibility with existing data pipelines. This update is extremely valuable for streamlining FinOps workflows, managing costs at scale, and aligning with enterprise security and compliance requirements.

Improvements to Purchase Details in Cost Management for MCA Customers (Preview)

By June, new preview features will enhance purchase details in Cost Management for customers under the Microsoft Customer Agreement (MCA). The improvements primarily focus on reserved instances (RIs), Azure savings plans (ASPs), and third-party purchases made through the Azure Marketplace. Users will be able to view the subscription ID associated with RIs and ASPs, simplifying showback and chargeback activities. Start and end dates will display the full duration of the offer, and cost data will be available in both the billing currency and US dollars, facilitating comparison with list prices. For monthly-billed offers, the pricingCurrency and costInPricingCurrency fields will show values for each installment. For Marketplace purchases completed through the Azure portal, tag support will be added, and fields such as the resource URI, subscription ID, and resource group name (where supported) will be visible. Additionally, the “Effective Price” field will be available, expressed in the pricing currency. Partner customers will also be able to view purchases and refunds at the subscription level, improving transparency in cost management.

Backup & Resilience

Azure Backup

Backup for Azure Database for PostgreSQL – Flexible Server

The Vaulted Backup feature for Azure Database for PostgreSQL – Flexible Server is now generally available and managed through Azure Backup. This solution offers scalable and secure backups with fully automated management via scheduled policies, eliminating the need for manual intervention. Key benefits include enhanced security through immutable vaults and role-based access controls, long-term retention (LTR) of up to 10 years to meet global regulatory requirements, and enterprise-level management via the Azure Business Continuity Center, which enables unified operations and governance of all protected resources from a single console. This is an ideal solution for businesses and developers who require operational continuity and regulatory compliance in critical environments.

GRS and CRR Support for Azure Backup with Premium SSD v2 Expanded to New Regions

Geo-Redundant Storage (GRS) and Cross-Region Restore (CRR) support in Azure Backup for virtual machines using Premium SSD v2 is now available in even more regions. Premium SSD v2 is a high-performance block storage solution that offers low latency, high IOPS, and high throughput at a cost-effective rate. With GRS and CRR, data can be protected from irreversible loss and restored on demand in a secondary region, making this functionality ideal for audit or disaster recovery scenarios. Newly supported regions include Brazil South, South Central US, North Central US, East US 2, Central US, UK West, UK South, Canada East, Canada Central, West US, West Central US, West US 2, Australia Southeast, and Australia East. A strategic solution for ensuring the resilience of critical workloads.

Azure Backup for Elastic SAN (Preview)

Microsoft has announced the public preview of Azure Backup support for Elastic SAN—a fully managed solution for protecting and restoring Elastic SAN volumes. This integration allows data to be safeguarded against accidental deletion, ransomware attacks, and application updates by exporting Elastic SAN volumes into incremental Managed Disk snapshots, independent of the lifecycle of the original volumes. The snapshots are stored using locally redundant storage (LRS) and support up to 450 recovery points with a backup frequency of up to every 24 hours. Currently, the feature is available only in select Azure regions and supports volumes up to 4 TiB. During this preview phase, long-term vault backups and hourly backups are not available. There is no Azure Backup Protected Instance cost, but standard rates apply for incremental snapshots. This marks an important step toward native, scalable protection of modern SAN environments hosted in Azure.

Monitoring

Azure Monitor

Cross-region replication for Log Analytics Workspace

Cross-region replication for Log Analytics Workspace is now generally available. This feature enhances the resilience of distributed monitoring environments by allowing administrators to enable a replica of the workspace in a secondary geographic region. Once activated, the replication enables simultaneous log ingestion in both regions, ensuring uninterrupted visibility through dashboards, alerts, and advanced solutions like Microsoft Sentinel—even in the event of a regional outage. This represents a significant advancement in business continuity management for critical or geographically distributed environments.

Increased record limit per query in Log Analytics to 100,000

Azure Monitor Log Analytics has increased the record limit per query in the UI to 100,000, up from the previous limit of 30,000. This enhancement enables deeper analysis and more detailed investigations directly within the Azure portal, without the need for external tools to process large volumes of data. To enable this option, simply select “Max. limit” from the “Show” menu in the Logs interface or set it as the default value. Microsoft is actively monitoring usage and performance to assess future extensions. For even larger-scale analysis, exports of up to 500,000 records via API remain available.

Managed Prometheus visualizations and enhanced monitoring for AKS

Managed Prometheus-based visualizations in Azure Monitor are now generally available, offering a unified and enhanced monitoring experience for Azure Kubernetes Service (AKS). This update allows users to centralize all critical information for AKS cluster management in a single view, overcoming the limitations of previous Log Analytics-based dashboards. With integrated managed Prometheus, customers benefit from a more cost-effective and responsive observability solution. Key capabilities include: cost optimization by migrating from Log Analytics to Prometheus, improved query performance, integration with recommended Prometheus-based alerts, visibility into control plane components for deeper diagnostics, and an optimized multi-cluster view for large-scale monitoring. A significant step forward for managing containerized environments in Azure.

Recommended Prometheus alerts now available for AKS cluster

Recommended community Prometheus alerts are now directly available for Azure Kubernetes Service (AKS) clusters through the Azure portal. This feature significantly simplifies monitoring management by eliminating the need to download templates or use command-line tools. The predefined alerts provide comprehensive coverage across all layers of the cluster—infrastructure, nodes, and pods. The goal is to deliver a powerful tool for timely anomaly detection, simplified diagnostics, and enhanced reliability for containerized applications. Integration with managed Prometheus metrics further strengthens Microsoft’s strategy for centralized, proactive, and cloud-native operations management.

Simple Log Alerts in Azure Monitor (Preview)

As of May, the new Simple Log Alerts feature in Azure Monitor is available in Public Preview. Designed to simplify alert creation and improve event detection timeliness, this feature differs from Log Search-based alerts, which evaluate sets of rows over a time window. Simple Log Alerts evaluate each row individually, enabling near real-time notifications. With simplified use of KQL, alerts can be defined quickly and intuitively. This solution also supports log tiers previously excluded from alerting, such as Basic Logs and Analytics. The pricing model is similar to traditional alerts, with minute-based evaluation billing. This is a particularly useful feature in operational scenarios that require fast and granular responses.

Prometheus Community Recommended Alerts for Arc-enabled Kubernetes Clusters (Preview)

In Public Preview, one-click activation of Prometheus community recommended alerts is now available for Kubernetes clusters managed via Azure Arc. Accessible directly from the Azure portal, these alerts provide comprehensive coverage for cluster, node, and pod metrics, based on community-refined Prometheus rules. Previously, enabling these alerts required manual operations via CLI and templates. To activate them, the Azure Monitor managed service for Prometheus must be enabled on the cluster.

Managed Prometheus for Arc-enabled Kubernetes Clusters in Azure Monitor (Preview)

A new Azure Monitor feature is now in Public Preview, allowing telemetry data visualization for Arc-enabled Kubernetes clusters using Managed Prometheus. This integration offers a more performant and cost-effective alternative to collecting metric data via Log Analytics. With this update, customers can: reduce costs by migrating to Prometheus-managed metrics, improve query performance, adopt preconfigured Prometheus-based alert rules, and centrally monitor multiple clusters at scale. This marks an important evolution for managing distributed containerized environments, simplifying monitoring while maintaining high levels of control and resource optimization.

Granular RBAC in Log Analytics Workspaces (Preview)

A new feature in Public Preview enables more granular access control in Azure Monitor’s Log Analytics Workspaces. Through integration with Azure Attribute-Based Access Control (ABAC), it is now possible to define row-level RBAC within the same centralized workspace. This allows organizations to segment data access based on criteria such as job role, organizational unit, geographic location, or data sensitivity. This approach enables more precise governance aligned with least-privilege principles while retaining the advantages of a centralized log platform. It is especially well-suited for complex enterprise environments with high security requirements.

Conclusions

The latest updates from Microsoft for Azure confirm a clear and strategic direction: making the cloud increasingly sustainable, secure, and governable. The integration of artificial intelligence into tools such as GitHub Copilot for Azure, SQL Server Management Studio, and Azure Monitor is no longer a future promise—it is a concrete reality that is transforming the way developers, administrators, and analysts work every day. At the same time, the focus on sustainability—with native features for monitoring and reducing carbon emissions—marks a significant step toward more responsible and environmentally conscious IT. In parallel, improvements in security posture—thanks to Microsoft Defender for Cloud—and advancements in monitoring and backup help strengthen the resilience of hybrid and multicloud environments. Lastly, the latest innovations in governance and FinOps provide increasingly advanced tools for cost optimization and consumption transparency, benefiting both IT teams and financial decision-makers.