Archivi categoria: Microsoft Azure

Azure Management services: what’s new in October 2023

This month, Microsoft has introduced a series of significant updates to the Azure management services. Through this series of monthly articles, I aim to provide an overview of the most relevant new features. The goal is to keep you constantly informed about these developments, giving you the essential information to further explore these topics.

The following diagram shows the different areas related to management, which are covered in this series of articles:

Figure 1 – Overview of Management Services in Azure

Monitor

Azure Monitor

VM insights: migration to Azure Monitor agent by August 31, 2024

On August 31, 2024, VM insights based on the Log Analytics agent will be retired. It is recommended to migrate to the Azure Monitor agent for VM insights, which offers several improvements, including:

  • Enhanced security and performance.
  • Data collection rules to help reduce costs.
  • A simplified management experience, facilitating troubleshooting.

Integrated Azure Monitor alerts for Azure Site Recovery (preview)

Microsoft recently announced the preview availability of integrated Azure Monitor alerts for Azure Site Recovery. This new feature allows Azure users to more effectively monitor the status and performance of their disaster recovery environments. The integrated alerts enable rapid detection of potential issues, ensuring more efficient and proactive management of resources in emergency recovery situations. With this integration, users can configure custom alerts based on specific performance and status parameters, improving resilience and operational readiness for their systems. This feature is particularly useful for organizations requiring high standards of operational continuity and data integrity.

Govern

Azure Policy

Protection of critical infrastructures from large-scale accidental deletions with Policies

Microsoft has introduced “DenyAction” in Azure Policy. This new feature allows blocking requests based on actions taken on the resource, rather than just its configuration or properties. In practice, with Deny Action, it is possible to protect infrastructures by preventing unwanted deletion calls. While in the past Azure Policy only offered the “deny” function, which blocked requests based on specific resource configurations, now with the addition of Deny Action, the blocking capability has been extended to actions included in the request.

Azure Cost Management

Updates related to Microsoft Cost Management

Microsoft is constantly seeking new methodologies to improve Microsoft Cost Management, the solution to provide greater visibility into where costs are accumulating in the cloud, identify and prevent incorrect spending patterns, and optimize costs. This article reports some of the latest improvements and updates regarding this solution.

Azure Arc

Azure Arc-enabled SCVMM (preview)

With the recent introduction of “Azure Arc-enabled System Center Virtual Machine Manager (SCVMM)”, it is now possible to manage SCVMM VMs more efficiently directly from Azure. This innovative solution facilitates the discovery, integration, and management of VMs. Microsoft is expanding the capabilities for SCVMM enabled in Azure Arc. Thanks to this update, Azure Arc-enabled SCVMM VMs receive full support for Azure management services. This includes protection offered by Microsoft Defender for Cloud, monitoring via Azure Monitor, and updates provided by Azure Update Manager. These new features offer customers a simpler and more effective management experience of their System Center-managed assets, all through Azure.

Secure

Microsoft Defender for Cloud

New features, bug fixes, and deprecated features of Microsoft Defender for Cloud

The development of Microsoft Defender for Cloud is constantly evolving, with continuous improvements being introduced. To stay updated on the latest developments, Microsoft updates this page, which provides information on new features, bug fixes, and deprecated features. Specifically, this month’s main news includes:

  • Public preview availability of recommendations for managing DevOps security posture;
  • Release of the CIS Azure Foundations Benchmark v2.0.0 in the Regulatory Compliance dashboard.

Protect

Azure Backup

Backup Vaults with MUA (Multi-User Authorization)

Azure Backup has announced the availability of backup vaults with MUA (Multi-User Authorization). These vaults offer an integrated backup solution that protects business data through a series of advanced access features. With this release, the backup administrator, who is usually the owner of the Backup vault, needs to obtain the collaborator role on the protected resource to perform certain operations. This requires an action by the owner of the protection resource to approve and grant the requested access. Additionally, it is possible to use Azure Active Directory Privileged Identity Management to manage just-in-time access on the protected resource.

Enhanced Soft Delete

Azure has announced the availability of the “Enhanced Soft Delete” feature for Azure Backup. This feature offers additional protection against data loss, ensuring that backup data remains available for recovery, even if the backup source is deleted. The Enhanced Soft Delete feature protects against accidental deletions and malicious activities. This adds an extra layer of security and resilience to backup data.

Regional Disaster Recovery for Azure Backup for AKS (preview)

Azure Backup for AKS allows customers to protect their containerized workloads along with application data deployed on AKS clusters. The solution enables scheduled backups of AKS clusters and their restoration in various scenarios. Customers also want to use their AKS backups to recover applications in the event of a regional disaster, following industry best practices for the 3-2-1 backup strategy. With this in mind, the Azure Backup service is announcing the private preview of the regional disaster recovery capability of AKS Backup. Using this feature, it is possible to recover the AKS cluster from backups in a secondary region, such as an Azure paired region, in the event of a regional disaster.

Migrate

Azure Migrate

New releases and features of Azure Migrate

Azure Migrate is the service in Azure that includes a broad portfolio of tools that can be used, through a guided user experience, to effectively address the most common migration scenarios. To stay updated on the latest developments of the solution, you can consult this page, which provides information on new releases and new features.

Azure Evaluation

For those who wish to explore and personally evaluate the services offered by Azure, a unique opportunity is available: by accessing this page, you can test various features and services for free. This will allow you to better understand how Azure can adapt and improve your IT operations, while ensuring security and innovation.

Azure IaaS and Azure Stack: announcements and updates (October 2023 – Weeks: 41 and 42)

This blog post series highlights the key announcements and major updates related to Azure Infrastructure as a Service (IaaS) and Azure Stack, as officially released by Microsoft in the past two weeks.

Azure

General

Microsoft Azure achieves HITRUST CSF v11.0.1 certification

I am thrilled to announce that Microsoft Azure has achieved HITRUST CSF v11.0.1 certification across 162 Azure services and 115 Azure Government services. This certification covers all GA Azure regions across both Azure and Azure Government clouds. This monumental achievement stands as a testament to Azure’s unwavering commitment to enhancing its security and compliance offerings, especially for valued customers in the healthcare sector.

HITRUST CSF v11.0.1 is the latest iteration of the framework, incorporating new requirements and updates from authoritative sources such as NIST SP 800-53 Rev 5, NIST Cybersecurity Framework v1.1, PCI DSS v3.2.1, FedRAMP High Baseline Rev 5, CSA CCM v3.0.1, GDPR, CCPA, and more. Moreover, HITRUST CSF v11.0.1 introduces innovative features and enhancements, including a maturity scoring model, risk factor analysis, an expanded inheritance program, improved assessment scoping tools, and more. By securing this certification, Azure reinforces its dedication to providing secure and compliant cloud services for customers in the healthcare industry.

Compute

Azure Dedicated Host – Resize

With the introduction of Azure Dedicated Host’s new ‘resize’ feature, users can now effortlessly transition their existing dedicated host to a different Azure Dedicated Host SKU, for instance, moving from Dsv3-Type1 to Dsv3-Type4. This innovative ‘resize’ feature significantly reduces the complexities and efforts associated with reconfiguring VMs when there’s a need to upgrade the foundational dedicated host system. One of the standout features is the ability to automatically create a new host, migrate all pre-existing VMs, and subsequently delete the old host. This eliminates the need for any manual interventions during the upgrade process of the dedicated host. Additionally, this could lead to potential cost savings, as users gain the capability to operate more VMs on the newly introduced dedicated host SKUs.

VMSS Automatic Instance Repairs – Reimage, Restart Repair Actions (preview)

Automatic instance repairs help Virtual Machine Scale Set customers achieve high application availability by automatically detecting and recovering unhealthy VM instances at runtime. Microsoft has announced that customers can now choose between Replace, Reimage (Preview), or Restart (Preview) as the default repair action performed in response to an “Unhealthy” application signal. These new options provide a less-impactful repair process, ensuring higher application availability while preserving VM properties and metadata for customers with sensitive workloads.

Networking

Default Outbound Access for VMs in Azure Will Be Retired

Microsoft has recently announced that starting from 30 September 2025, the default outbound access connectivity for all new virtual machines in Azure will be retired. This decision is in line with Azure’s move towards a secure-by-default model, which means that the default outbound access to the internet will be turned off. Consequently, after the mentioned date, Azure will no longer assign a default implicit IP for VMs to communicate with the internet. However, it’s important to note that existing VMs will not be affected by this retirement. For those who require outbound access post this date, Azure will provide an easy way to enable outbound internet access using explicit outbound methods. Additionally, for VMs currently having default outbound access and wishing to transition to a secure configuration after this date, Azure will offer a mechanism for easy opt-in. Users already utilizing explicit outbound connectivity methods will remain unaffected by this retirement. Azure emphasizes the benefits of explicit outbound connectivity methods, including greater control over internet connections, protection from public IP address changes, and traceable IP address resources beneficial for measurement and troubleshooting. Azure will be sending periodic updates to subscription owners impacted by this change in the coming months.

ExpressRoute Traffic Collector now generally available

Microsoft Azure has announced the general availability of the ExpressRoute Traffic Collector. This feature allows users to capture information about IP flows sent over ExpressRoute direct circuits. The ExpressRoute Traffic Collector supports flow logs capture for both Private and Microsoft peering. The captured flow logs data is sent to a Log Analytics workspace, enabling users to create custom log queries for in-depth analysis.

Some of the primary use cases for flow logs include:

  • Network Monitoring: gain near real-time visibility into network throughput and performance, perform network diagnosis, and forecast capacity.
  • Network Usage and Cost Optimization: analyze traffic trends by filtering sampled flows by IP, port, or applications. Identify top talkers for a source IP, destination IP, or applications. Optimize network traffic expenses by analyzing traffic patterns.
  • Network Forensics Analysis: identify potentially compromised IPs by analyzing all associated network flows. Users can also export flow logs to a SIEM tool of their choice to monitor and correlate events.

It’s important to note that the flow logs collected by the ExpressRoute Traffic Collector do not impact network throughput or latency. Users can enable or stop flow logs collection without any risk of affecting the network performance of an ExpressRoute direct circuit.

Azure Private Link for MySQL – Flexible Server

Azure Private Link allows users to connect to various PaaS services, such as Azure Database for MySQL – Flexible Server, in Azure, via a private endpoint. Private Link brings Azure services inside your private virtual network (VNet). Using the private IP address, the Azure Database for MySQL – Flexible Server becomes accessible just like any other resource within the VNet. This feature is now available for general use.

Storage

Azure Files improved support for Unicode characters

Azure Files has undergone enhancements to now support all valid Unicode characters. This development allows for the creation of SMB File shares with file and directory names that align with the NTFS file system, specifically for valid Unicode characters. This expanded character set support includes:

  • Control characters that are supported by NTFS.
  • Trailing dot (.) characters at the end of directory and file names.
  • Characters that function individually but were previously blocked when used in combination, especially in non-English languages.

Such advancements facilitate tools like AzCopy and Storage mover to migrate all files into Azure Files using the REST protocol. This expanded character support is now accessible in all Azure regions.

Zone Redundant Storage for Azure Disks in More Regions

Microsoft has announced the general availability of Zone Redundant Storage (ZRS) for Azure Disk Storage on Azure Premium SSDs and Standard SSDs in the Norway East and UAE North regions. Disks with ZRS offer synchronous replication of data across three availability zones within a region. This ensures that the disks can withstand zonal failures without disrupting the associated applications. The feature not only enhances the resilience of disks against zonal failures but also eliminates the need for application-level replication of data across zones. Furthermore, ZRS can be combined with shared disks to provide even higher availability for clustered or distributed applications, including SQL FCI, SAP ASCS/SCS, and GFS2.

Conclusion

Over the past two weeks, Microsoft has introduced a slew of updates and announcements pertaining to Azure Infrastructure as a Service (IaaS) and Azure Stack. These developments underscore the tech giant’s unwavering commitment to enhancing its cloud offerings and adapting to the ever-evolving needs of businesses and developers. Users of Azure can anticipate improved functionalities, streamlined services, and enriched features as a result of these changes. Stay tuned for more insights as I continue to monitor and report on Azure’s progression in the cloud sphere.

Azure IaaS and Azure Stack: announcements and updates (October 2023 – Weeks: 39 and 40)

This blog post series highlights the key announcements and major updates related to Azure Infrastructure as a Service (IaaS) and Azure Stack, as officially released by Microsoft in the past two weeks.

Azure

General

Microsoft Azure Now Available from New Cloud Region in Italy

Microsoft Azure has officially reached General Availability in a new cloud region in Italy. This expansion of Azure’s global presence brings its cloud services closer to businesses and organizations in Italy, enabling them to benefit from Azure’s comprehensive suite of services for their digital transformation initiatives. With this new cloud region, customers in Italy can now take advantage of low-latency, high-performance computing and networking capabilities offered by Azure, while complying with local data residency requirements and ensuring data sovereignty.

Networking

Default outbound access for VMs in Azure will be retired: Transition to a new method of internet access

Azure is retiring the default outbound access for virtual machines (VMs) and recommends transitioning to a new method of internet access. This change is part of Azure’s ongoing commitment to improve the security and performance of its services. Customers are advised to review the documentation and make necessary changes to ensure uninterrupted outbound connectivity for their VMs.

Domain Fronting update on Azure Front Door and Azure CDN

Azure has announced the general availability of the domain fronting update on Azure Front Door and Azure CDN. This update enhances the security and performance of the services. Domain fronting is a technique used to obfuscate the destination of HTTPS traffic. With this update, Azure aims to provide better security and improved performance for its users. The update ensures that the services are more resilient and can handle traffic more efficiently.

Gateway Load Balancer IPv6 support

Azure Gateway Load Balancer now supports IPv6, which allows you to build, deploy, and scale applications that use IPv6 addresses. This enhancement provides a consistent frontend IP for virtual appliances, ensuring that traffic is distributed evenly across multiple instances. With this update, Azure continues to expand its IPv6 capabilities, enabling you to meet the requirements of your IPv6-enabled applications.

Storage

Zone-redundant storage for Azure Disks is now available in more regions

Zone-redundant storage (ZRS) for Azure Disks is now available in more regions. ZRS replicates your data in availability zones, ensuring data resilience and protection against zone failures. This update provides a higher level of resilience for your critical applications and ensures that they remain operational even if one of the availability zones fails.

Customer-Managed Keys for Azure NetApp Files Volume Encryption is Now Available in US Gov Regions (preview)

Azure is excited to announce the availability of Customer-Managed Keys for Azure NetApp Files Volume Encryption in the US Gov Regions, now in public preview. This new feature empowers Azure customers in government sectors to have greater control over their data security and encryption keys when using Azure NetApp Files. With Customer-Managed Keys, customers can manage their own encryption keys using Azure Key Vault, ensuring a higher level of data security and compliance with specific regulatory requirements. This preview provides an opportunity for customers in government regions to evaluate and test this feature before its general availability.

Azure Stack

Azure Stack HCI

Premier Solutions for Azure Stack HCI

The introduction of Premier Solutions for Azure Stack HCI represents a significant leap forward in Azure’s offerings for customers seeking enhanced operational efficiency, rapid deployment, and flexible procurement options. This innovative category of products has been developed in close collaboration with industry leaders like Dell Technologies and Lenovo, resulting in a seamless and comprehensive edge infrastructure solution.

Key Benefits of Premier Solutions for Azure Stack HCI:

  • Improved Operational Experience: Premier Solutions are designed to streamline and enhance the operational experience for Azure Stack HCI users. By leveraging the expertise and technology of Azure, customers can expect greater reliability, scalability, and ease of management, ensuring that their infrastructure runs smoothly without interruptions.
  • Faster Time to Value: With Premier Solutions, customers can deploy Azure Stack HCI more quickly and efficiently. The integration of hardware, software, and cloud services simplifies the setup process, reducing the time and effort required to get the system up and running. This means organizations can start realizing the benefits of their HCI infrastructure sooner.
  • Greater Flexibility with as-a-Service Procurement: Premier Solutions offer flexible procurement options, aligning with the as-a-service model that is becoming increasingly popular in the IT industry. This allows organizations to scale their infrastructure as needed, optimizing costs and resources while ensuring they have access to the latest technologies and features.
  • Deep Integration: The collaboration with leading partners, including Dell Technologies and Lenovo, ensures a high level of integration between hardware and software components. This deep integration results in a more cohesive and efficient HCI solution, delivering improved performance and reliability.
  • Seamless Connectivity: Premier Solutions enable seamless connectivity between on-premises infrastructure and the Azure cloud. This connectivity ensures that organizations can leverage the full power of Azure services while maintaining control over their data and resources.

Conclusion

Over the past two weeks, Microsoft has introduced a slew of updates and announcements pertaining to Azure Infrastructure as a Service (IaaS) and Azure Stack. These developments underscore the tech giant’s unwavering commitment to enhancing its cloud offerings and adapting to the ever-evolving needs of businesses and developers. Users of Azure can anticipate improved functionalities, streamlined services, and enriched features as a result of these changes. Stay tuned for more insights as I continue to monitor and report on Azure’s progression in the cloud sphere.

Azure Management services: le novità di settembre 2023

Nel mese di settembre ci sono state diverse novità che Microsoft ha annunciato in merito agli Azure management services. In questo articolo vengono elencati i principali annunci, accompagnati dai riferimenti necessari per poter effettuare ulteriori approfondimenti in merito.

Il diagramma seguente mostra le diverse aree relative al management, che sono contemplate in questa serie di articoli:

Figura 1 – Overview dei Management services in Azure

Monitor

Azure Monitor

Azure Monitor VM Insights ora disponibile con Azure Monitor Agent

Azure ha annunciato la disponibilità di “Azure Monitor VM Insights” attraverso l’uso dell’Azure Monitor Agent. Questo servizio offre un metodo rapido e semplice per monitorare i carichi di lavoro dei clienti sulle macchine virtuali Azure e sugli scale set, nonché sui server abilitati ad Azure Arc che operano in un ambiente on-premises e/o multi-cloud.

La nuova versione dell’agente offre vari benefici, tra cui risparmi sui costi, una gestione semplificata e sicurezza e performance migliorate. Se precedentemente si faceva uso di VM Insights utilizzando Log Analytics Agent (ora deprecato), Microsoft suggerisce di consultare la loro guida alla migrazione per passare all’Azure Monitor Agent.

Vista cronologica per gli alert di Azure Monitor (preview)

Monitorare le risorse e gli avvisi in Azure è ora più semplice e intuitivo grazie alla nuova vista cronologica in anteprima di Azure Monitor. Questa vista offre una panoramica chiara degli avvisi attivati, permettendo agli utenti di identificare rapidamente i problemi

Distribuzione OpenTelemetry-based per Node.js e Python

Azure Monitor ora offre la distribuzione OpenTelemetry-based per Node.js e Python, permettendo agli sviluppatori di integrarsi facilmente con Azure Monitor e raccogliere dati di telemetria. Questa nuova funzionalità garantisce che gli sviluppatori possano monitorare efficacemente le loro applicazioni, ottenendo informazioni sulle prestazioni, sugli errori e su altre metriche principali.

Configure

Update management

Azure Update Manager: gestione degli aggiornamenti rinnovata e potenziata

Azure Update Manager offre una soluzione SaaS per gestire e governare gli aggiornamenti software su macchine Windows e Linux in ambienti Azure, on-premises e multi cloud. Si tratta di un’evoluzione della soluzione di gestione degli aggiornamenti di Azure Automation con nuove funzionalità. Azure Update Manager è stato riprogettato per offrire nuove capacità senza dipendere dall’agente di Log Analytics o dall’agente di Azure Monitor. Si basa sul VM agent di Microsoft Azure per gestire i flussi di aggiornamento sulle VM Azure e sull’agente Azure Connected Machine per gestire i server abilitati ad Azure Arc.

Govern

Azure Cost Management

Esportazione dei dati di Cost Management in account di archiviazione protetti con firewall

Risulta ora possibile esportare i dati di Cost Management negli account di archiviazione di Azure protetti con firewall. Gli utenti possono utilizzare l’API Exports o il portale Azure per creare attività ricorrenti per l’esportazione automatica dei dati dei costi in formato CSV. Questo può essere programmato su base giornaliera, settimanale o mensile, e i dati esportati possono essere utilizzati per la creazione di dashboard o per l’integrazione con sistemi finanziari.

Aggiornamenti relativi a Microsoft Cost Management

Microsoft è costantemente alla ricerca di nuove metodologie per migliorare Microsoft Cost Management, la soluzione per fornire una maggiore visibilità su dove si stanno accumulando costi nel cloud, identificare e prevenire modelli di spesa errati ed ottimizzare i costi . In questo articolo sono riportati alcuni degli ultimi miglioramenti ed aggiornamenti riguardanti questa soluzione.

Secure

Microsoft Defender for Cloud

Scansione malware in Defender for Storage

Defender per Storage introduce la funzionalità di scansione malware, superando le sfide tradizionali legate alla protezione da malware e fornendo una soluzione ideale per settori fortemente regolamentati. Questa funzione, disponibile come componente aggiuntivo, rappresenta un notevole potenziamento delle soluzioni di sicurezza di Microsoft Defender for Storage. Con la scansione malware si ottengono i seguenti benefici.

  • Protezione, in tempo pressoché reale, senza agent: capacità di intercettare malware avanzati come quelli polimorfici e metamorfici.
  • Ottimizzazione dei costi: grazie a una tariffazione flessibile, si possono controllare i costi basandosi sulla quantità di dati esaminati e con una granularità a livello di risorsa.
  • Abilitazione su larga scala: senza necessità di manutenzione, supporta risposte automatizzate su larga scala e offre diverse opzioni per l’attivazione tramite strumenti e piattaforme come Azure policy, Bicep, ARM, Terraform, API REST e il portale Azure.
  • Versatilità applicativa: basandosi sul feedback degli utenti beta negli ultimi due anni, la scansione malware si è dimostrata utile in una varietà di scenari, come applicazioni web, protezione dei contenuti, conformità, integrazioni con terze parti, piattaforme collaborative, flussi di dati e set di dati per l’apprendimento automatico (ML).

GitHub Advanced Security per Azure DevOps

Risulta ora possibile visualizzare gli alert di GitHub Advanced Security per Azure DevOps (GHAzDO) relativi a CodeQL, secret e dipendenze, direttamente in Defender for Cloud. I risultati verranno visualizzati nella sezione DevOps e nelle Raccomandazioni. Per vedere questi risultati, è necessario integrare i propri repository abilitati a GHAzDO in Defender for Cloud.

Nuove funzionalità, correzioni di bug e funzionalità deprecate di Microsoft Defender for Cloud

Lo sviluppo di Microsoft Defender for Cloud è in costante evoluzione e vengono introdotti miglioramenti su base continua. Per rimanere aggiornati sugli sviluppi più recenti, Microsoft aggiorna questa pagina, che fornisce informazioni su nuove funzionalità, correzioni di bug e funzionalità deprecate. Per conoscere  le principali novità che hanno caratterizzato Defender for Cloud nell’estate 2023, delineando come queste innovazioni possano rappresentare un valore aggiunto per le aziende, potete consultare questo articolo.

Protect

Azure Backup

Cross Region Restore (CRR) for Recovery Services Agent (MARS) 

In seguito alla Disponibilità Generale del Ripristino Cross Region per i backup di VM, SQL e SAP HANA e per rafforzare il pilastro di resilienza, Microsoft ha annunciato il supporto del Ripristino Cross Region per l’Agente dei Servizi di Ripristino (MARS) utilizzando Azure Backup.

I clienti di Azure sfruttano l’Agente dei Servizi di Ripristino per eseguire il backup dei loro file/cartelle e dello stato del sistema in un Vault dei Servizi di Ripristino di Azure. I dati di backup nella regione primaria possono anche essere replicati geograficamente in una regione secondaria abbinata ad Azure per garantire la durabilità. In precedenza, i dati replicati nella regione secondaria erano disponibili per il ripristino nella regione secondaria solo se Azure dichiarava un disastro nella regione primaria. Con l’introduzione di questo nuovo supporto, i clienti possono attivare il ripristino dei backup dell’Agente dei Servizi di Ripristino nella regione secondaria in qualsiasi momento.

Questa capacità può essere sfruttata nei seguenti scenari:

  • quando la regione primaria è disponibile per testare i ripristini dai dati di backup nella regione secondaria per scopi di audit/conformità;
  • quando la regione primaria non è disponibile, i clienti possono attivare il ripristino dei dati salvati in backup nella regione secondaria anche se la regione primaria di Azure è parzialmente indisponibile o completamente indisponibile senza alcun tempo di attesa.

Salvataggio della passphrase di Azure Backup Recovery Services Agent (MARS) in Azure Key Vault (preview)

La sicurezza dei dati è una priorità per Microsoft, e con la nuova funzionalità in anteprima che permette di salvare la passphrase di cifratura dell’Agente di Servizi di Ripristino direttamente in Azure Key Vault, gli utenti possono ora godere di un livello di sicurezza ancora maggiore. Questa integrazione rende l’installazione dell’Agente di Servizi di Ripristino più fluida e sicura, eliminando la necessità di script personalizzati.

Backup di Azure Files nelle regioni cinesi

Il backup di Azure Files è ora generalmente disponibile nelle regioni cinesi. Questa funzionalità consente agli utenti di eseguire il backup dei loro file su Azure in modo sicuro e affidabile.

Migrate

Azure Migrate

Nuovi rilasci e funzionalità di Azure Migrate

Azure Migrate è il servizio presente in Azure che comprende un ampio portafoglio di strumenti che è possibile utilizzare, tramite una esperienza di utilizzo guidata, per affrontare in modo efficace i più comuni scenari di migrazione. Per rimanere aggiornati sugli sviluppi più recenti della soluzione è possibile consultare questa pagina, che fornisce informazioni su nuovi rilasci e nuove funzionalità.

Valutazione di Azure

Per testare e valutare in modo gratuito i servizi offerti da Azure è possibile accedere a questa pagina.

Azure IaaS and Azure Stack: announcements and updates (September 2023 – Weeks: 37 and 38)

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Compute

Latest generation burstable VMs – Bsv2, Basv2, and Bpsv2

The Bsv2, Basv2, and Bpsv2 series virtual machines represent the latest generation of Azure burstable general-purpose VMs. These VMs provide a baseline level of CPU utilization and can expand to higher CPU utilization as workload volume increases. They are ideal for various applications, including development and test servers, low-traffic web servers, small databases, microservices, proof-of-concept servers, build servers, and code repositories. Compared to the B series v1, these new B series v2 virtual machines offer up to 15% better price-performance, up to 5X higher network bandwidth with accelerated networking, and 10X higher remote storage throughput.

Networking

Sensitive Data Protection for Application Gateway Web Application Firewall

Azure’s regional Web Application Firewall (WAF) running on Application Gateway has introduced support for sensitive data protection through log scrubbing. When a request aligns with the criteria of a rule and activates a WAF action, the event is documented within the WAF logs. These logs are maintained as plain text for easier debugging. However, this means that any patterns matching sensitive customer data, such as IP addresses, passwords, and other personally identifiable information, could potentially be recorded in the logs as plain text. To enhance the security of this sensitive data, users can now establish log scrubbing rules that substitute the sensitive data with “******”. The sensitive data protection feature using log scrubbing facilitates the creation of rules using various variables, including Request Header Names, Request Cookie Names, Request Arg Names, Request Post Arg Names, Request JSON Arg Names, and Request IP Address.

Azure Front Door Standard and Premium support Bring Your Own Certificates (BYOC) based domain ownership validation (preview)

Azure Front Door Standard and Premium now support Bring Your Own Certificates (BYOC) based domain ownership validation. With this feature, Azure Front Door can automatically approve domain ownership if the Certificate Name (CN) or Subject Alternative Name (SAN) of the provided certificate matches the custom domain. This reduces the steps and efforts required to prove domain ownership, streamlining the Dev-Ops experience. For domains created before this feature’s support and whose validation status is not yet approved, users will need to trigger the auto-approval of domain ownership validation manually.

Storage

Azure Premium SSD v2 Disk Storage now available in multiple regions

Azure Premium SSD v2 Disk Storage is now generally available in the Australia East, France Central, Norway East, and UAE North regions. This expansion offers customers in these regions the opportunity to leverage the benefits of Azure Premium SSD v2 Disk Storage for their workloads. Azure Premium SSD v2 Disk Storage provides high-performance and low-latency disk support for virtual machines running I/O-intensive workloads. By utilizing this storage solution, users can expect consistent performance, enhanced durability, and availability.

Azure IaaS and Azure Stack: announcements and updates (September 2023 – Weeks: 35 and 36)

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Compute

Trusted launch as default for VMs deployed through the Azure portal

Azure has introduced “Trusted launch” as a default feature for virtual machines deployed through the Azure portal. Trusted launch hardens Azure virtual machines with security features, ensuring that administrators deploy VMs with verified and signed bootloaders, OS kernels, and a boot policy. The feature encompasses secure boot, vTPM, and boot integrity monitoring, offering protection against boot kits, rootkits, and kernel-level malware. Secure Boot ensures that only signed OSes and drivers boot, while the Virtual TPM (vTPM) safeguards keys, certificates, and secrets within the virtual machine. Additionally, Boot integrity monitoring, in conjunction with Microsoft Azure Attestation and Azure Security Center, provides integrity alerts, recommendations, and remediation actions if remote attestation fails.

Networking

Azure Firewall Single-Click Upgrade and Downgrade Now in General Availability

Azure has introduced a new capability for its Firewall service, allowing users to seamlessly upgrade from the Standard SKU to the Premium SKU, and vice versa. This enhancement simplifies the upgrade and downgrade process, ensuring that users can make these changes without any service interruptions. With just a single click, Azure customers can now easily transition between the two firewall versions. This feature is especially beneficial for those looking to leverage the advanced functionalities of the Premium SKU or revert to the Standard SKU based on their requirements. The Azure Firewall Single-Click Upgrade and Downgrade feature was officially made available on August 31, 2023.

Azure Container Apps support for UDR, NAT Gateway, and smaller subnets

Azure has announced the general availability of Azure Container Apps support for User Defined Routes (UDR), NAT Gateway, and smaller subnets. This enhancement provides users with more flexibility and control over their networking configurations, allowing for more customized and optimized network setups. Azure Container Apps is a fully managed platform for building and running microservices and APIs. With this update, users can now leverage UDR to define custom routes, utilize NAT Gateway for outbound connectivity, and deploy in smaller subnets for more granular network segmentation.

Azure Firewall: Explicit Proxy (preview)

Microsoft Azure has recently introduced a public preview of the Azure Firewall Explicit Proxy. This new feature is designed to enhance the security and performance of Azure’s firewall services. As it is currently in public preview, users can explore its functionalities and provide feedback to help improve the service before its general release. For more details and to stay updated on further developments, you can visit the official announcement page.

Azure Firewall: Auto-Learn SNAT Routes Feature Now in Public Preview (preview)

Azure has introduced a new feature in public preview, named “Auto-Learn SNAT Routes”, promising to simplify and expedite network configurations. This feature allows the Azure Firewall to automatically learn address ranges and configure them to be excluded from SNAT, thereby reducing the time and complexity spent on manually defining private SNAT ranges. To utilize this feature, the Azure Route Server needs to be deployed in the same virtual network as the Azure Firewall. Released on August 31, 2023, this feature promises to be a valuable tool for network administrators seeking to optimize their processes. For more information, you can visit the official page.

Storage

Azure Premium SSD v2 Disk Storage Now Available in Select Regions

Microsoft has announced the general availability of Azure Premium SSD v2 Disk Storage in several regions, including Australia East, France Central, Norway East, and UAE North. This new offering promises to deliver high-quality storage performance while ensuring security and reliability. Users in these regions can now benefit from the advanced storage features offered by Azure, helping to enhance the efficiency and resilience of their systems. For further details, you can visit the official page.

Azure Management services: le novità di agosto 2023

Microsoft rilascia costantemente novità riguardanti gli Azure management services. Pubblicando questo riepilogo si vuole una visione d’insieme delle innovazioni più significative introdotte nell’ultimo mese. Questo consente di rimanere sempre aggiornati su questi argomenti ed avere i riferimenti necessari per condurre ulteriori approfondimenti.

Il diagramma seguente mostra le diverse aree relative al management, che sono contemplate in questa serie di articoli:

Figura 1 – Overview dei Management services in Azure

Monitor

Azure Monitor

Azure Monitor container insights offre nuove impostazioni di ottimizzazione dei costi

Container insights amplia l’anteprima pubblica delle impostazioni di ottimizzazione dei costi, consentendo ora una terza dimensione per l’adeguamento delle impostazioni di raccolta dei dati di container insights, con una configurazione per tabella. I clienti possono ora selezionare individualmente quali tabelle di dati inglobare nel loro workspace di Log Analytics.
Le configurazioni per tabella possono essere abilitate tramite ARM, CLI ed Azure Portal.

Configure

Azure Advisor

Migliora la resilienza delle VM con le raccomandazione relative alle zone di disponibilità

Una delle pratiche consigliate per ottenere una elevata resilienza, secondo le linee guida del Well Architected Framework (WAF), è la distribuzione in zone differenti dei workload. Adottando questa raccomandazione, ora disponibile in Azure Advisor, è possibile progettare le soluzioni per utilizzare VM “zonali”, garantendo così l’isolamento delle macchine virtuali da potenziali guasti in altre zone.

Govern

Azure Cost Management

Nuove opportunità di ottimizzazione dei costi utilizzando il nuovo modello di workbook in Azure Advisor
Il workbook di ottimizzazione dei costi di Azure funge da hub centralizzato per alcuni degli strumenti più utilizzati che possono aiutare il cliente a raggiungere gli obiettivi di utilizzo ed efficienza. Offre una serie di raccomandazioni, tra cui le raccomandazioni sui costi di Azure Advisor, l’identificazione delle risorse inattive e la gestione delle macchine virtuali non deallocate correttamente. Inoltre, fornisce intuizioni sull’utilizzo delle opzioni Azure Hybrid benefit per Windows, Linux e database SQL.

Esportazione dei dati in un account di archiviazione protetto con firewall

Azure Cost Management ora supporta l’esportazione dei dati in un account di archiviazione protetto dal firewall, garantendo un elevato livello di sicurezza. L’esportazione può essere programmata su base giornaliera, settimanale o mensile e i dati esportati possono essere utilizzati per la creazione di dashboard o per l’integrazione con i sistemi finanziari.

Secure

Microsoft Defender for Cloud

Nuove funzionalità, correzioni di bug e funzionalità deprecate di Microsoft Defender for Cloud

Lo sviluppo di Microsoft Defender for Cloud è in costante evoluzione e vengono introdotti miglioramenti su base continua. Per rimanere aggiornati sugli sviluppi più recenti, Microsoft aggiorna questa pagina, che fornisce informazioni su nuove funzionalità, correzioni di bug e funzionalità deprecate. In particolare, questo mese le principali novità riguardano:

  • Defender for Container: discovery senza agenti per Kubernetes;
  • rilascio in anteprima del supporto GCP in Defender CSPM;
  • nuovi alert di sicurezza in Defender for Servers Plan 2: rilevamento di potenziali attacchi che abusano delle estensioni delle macchine virtuali Azure;
  • aggiornamenti del modello di business e dei prezzi per i piani Defender for Cloud.

Protect

Azure Backup

Cross Subscription Restore for Azure Virtual Machines

Microsoft ha introdotto la possibilità di ripristinare le VM Azure in un’altra sottoscrizione all’interno dello stesso tenant della sottoscrizione in cui è presente la VM sorgente, a condizione di avere le autorizzazioni necessarie. Di default, il ripristino avviene nella stessa sottoscrizione in cui è presente la macchina virtuale sorgente. Questa funzione è consentita solo se si ha la proprietà Cross Subscription Restore abilitata per il Recovery Services vault. Cross Subscription Restore consente di ripristinare creando una VM oppure ripristinando i dischi. È possibile utilizzare Cross Zonal Restore e/o Cross Region Restore insieme a questa opzione di ripristino.

Azure Backup introduce il ripristino Cross Region per PostgreSQL (preview)

Azure Backup ha lanciato una nuova funzionalità in anteprima: il ripristino Cross Region per i backup di PostgreSQL. Questa funzione sfrutta lo storage Geo-Redundant con accesso in Lettura, permettendo di conservare i dati in due regioni diverse. L’innovazione sta nel fatto che ora non solo si può accedere ai backup quando si verifica un problema in una region di Azure, ma è possibile farlo in qualsiasi momento, garantendo una maggiore flessibilità e sicurezza. Questa opzione è particolarmente utile per chi desidera testare la prontezza dei propri backup oppure per chi cerca una maggiore resilienza dei dati. Attualmente, questa funzionalità è disponibile per PostgreSQL in alcune regioni selezionate, arricchendo l’offerta di Azure Backup in termini di accessibilità dei dati.

Azure Site Recovery

DR per dischi condivisi (preview)

Microsoft ha rilasciato l’anteprima privata del DR per i dischi condivisi di Azure per i carichi di lavoro che eseguono Windows Server Failover Clusters (WSFC) su macchine virtuali Azure. Risulta pertanto possibile proteggere, monitorare e ripristinare i cluster WSFC come un’unica unità durante tutto il suo ciclo di vita, generando allo stesso tempo punti di ripristino coerenti con il cluster.

Caratteristiche salienti:

  • l’anteprima privata supporterà la protezione dei Windows Server failover cluster. Alcune applicazioni che utilizzano questa architettura sono SQL FCI, SAP ASCS, Scale-out File Servers, ecc.
    • SO supportati: Windows Server 2016 e versioni successive;
    • numero di nodi: fino a 4 nodi per cluster;
    • dischi condivisi: qualsiasi numero di dischi condivisi può essere collegato al cluster;
  • l’operazione di failover supporta il failover dell’intero cluster contemporaneamente;
  • una volta eseguito un failover, sarà necessario riabilitare la replica per la protezione in direzione inversa.

Nuovo Update Rollup

Per Azure Site Recovery è stato rilasciato l’Update Rollup 68 che risolve diverse problematiche e introduce alcuni miglioramenti. I relativi dettagli e la procedura da seguire per l’installazione è consultabile nella KB specifica.

Supporto in presenza di un maggiore livello di “churn” sui dati

Azure Site Recovery ora supporta scenari con una maggiore rotazione dei dati. Questo miglioramento offre ai clienti la capacità di gestire scenari con un alto volume di cambiamenti di dati, garantendo una maggiore resilienza e affidabilità per le loro applicazioni critiche.

Migrate

Azure Migrate

Nuovi rilasci e funzionalità di Azure Migrate

Azure Migrate è il servizio presente in Azure che comprende un ampio portafoglio di strumenti che è possibile utilizzare, tramite una esperienza di utilizzo guidata, per affrontare in modo efficace i più comuni scenari di migrazione. Per rimanere aggiornati sugli sviluppi più recenti della soluzione è possibile consultare questa pagina, che fornisce informazioni su nuovi rilasci e nuove funzionalità.

Azure Database Migration

Esperienza del portale Azure per Azure Database Migration Service (preview)

Ora è possibile utilizzare DMS per eseguire migrazioni sia dal portale Azure sia dall’estensione ADS. L’esperienza del portale Azure consente di eseguire attività come la creazione di un nuovo servizio di migrazione dei database da Azure Portal, avviando la migrazione da SQL Server on-premises verso vari target Azure e accedendo a una pagina di configurazione dell’integration runtime. L’esperienza del portale Azure offre anche un elenco di prerequisiti, documentazione e collegamenti ai tutorial, personalizzati in base al target selezionato.

Valutazione di Azure

Per testare e valutare in modo gratuito i servizi offerti da Azure è possibile accedere a questa pagina.

Azure IaaS and Azure Stack: announcements and updates (August 2023 – Weeks: 33 and 34)

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Compute

Azure Mv3 Medium Memory (MM) Virtual Machines (preview)

Microsoft announced the public preview of the next generation Mv3 Medium Memory (MM) virtual machine series. These virtual machines are designed to offer improved performance and higher reliability compared to their predecessors. Some of the key features of the new Mv3 MM VMs include:

  • Powered by the 4th Generation Intel® Xeon® Scalable Processor and DDR5 DRAM technology.
  • Capability to scale for SAP workloads ranging from 250GB to 4TB, ensuring faster performance and a lower total cost of ownership (TCO).
  • With Azure Boost, the Mv3 MM VMs deliver approximately a 25% improvement in network throughput and up to a 1.5X boost in remote storage throughput compared to the previous M-series families.
  • Azure Boost’s isolated architecture enhances security for the Mv3 MM virtual machines by processing storage and networking separately on dedicated hardware, rather than on the host server.
  • Enhanced resilience against failures in memory, disks, and networking, leveraging insights from previous generations.
  • Availability in both disk and diskless configurations, providing customers with the flexibility to select the option that best suits their workload requirements.

For a more detailed exploration of this release, you can read their blog.

Networking

New Monitoring and Logging Updates in Azure Firewall

New Monitoring and Logging Updates in Azure Firewall are available:

  • Structured Logs: new logging format that provides a more detailed view of firewall events. Structured Logs provide the following benefits: they are easier to work with data in log queries and help discover schemas; they improves performance and reduce latency; they allow ability to grant Azure RBAC rights on specific tables.
  • Latency Probe: The Latency Probe metric is designed to measure the overall latency of Azure Firewall and provide insight into the health of the service.
  • Resource Health (preview): monitor that provides visibility into Azure Firewall health status and allows you to address service problems that may affect your Azure Firewall resource.
  • Embedded Firewall Workbooks (preview): Integrated workbooks into the Azure Firewall Portal that provide valuable insights and statistics regarding your firewall activities and events.

Illumio for Microsoft Azure Firewall

Illumio has joined forces with Microsoft to introduce microsegmentation support for Microsoft Azure Firewall, which is now generally available. This collaboration allows Azure customers to enforce Zero Trust Segmentation, going beyond mere network and application filtering. The integration aids firewall operations teams in understanding rules with a richer context of the resources they are safeguarding. With this enriched context, administrators can effortlessly identify which resource is secured by a particular rule, determine its owner, and confidently manage the rule’s lifecycle.

For a more detailed exploration of this integration and its benefits, you can learn more here.

Quick create Azure Front Door endpoints for Azure Storage accounts

You can now create Azure Front Door Standard and Azure Front Door Premium endpoints directly from the Azure portal, similar to any other Azure CDN endpoint. This integration facilitates the management of all Azure Front Door and/or Azure CDN profiles linked to a storage account from a unified interface. Setting up a new Azure Front Door Service and endpoint for a storage account is straightforward. Users can simply browse to their storage account in the Azure portal and navigate to the Front Door and CDN profiles section. From this location, it’s possible to establish new endpoints, swiftly access the endpoint profiles, manage custom domains for the endpoints, and activate security features such as the Web Application Firewall and/or Private Link. For a more detailed understanding, you can read the documentation.

Azure Front Door Standard/Premium in Azure Government

Azure Front Door (AFD) Standard and Premium tier is now generally available in Azure Government, specifically in the regions of Arizona and Texas. With this release, Local Government (US) customers and their partners can leverage the new and enhanced capabilities offered in the standard and premium tiers. Some of these capabilities include improved reporting and diagnostic tools, an expanded rules engine with server variables, an enhanced Web Application Firewall with features like the latest DRS rule set, Bot protection, and more. The integration with Microsoft Sentinel Analytics and other security features such as Private Link connectivity and subdomain takeover prevention further enhance the offering. However, it’s important to note that the managed certificate for enabling HTTPS is currently not supported in Azure Government, and users are advised to utilize their own certificates.

Rate-limit rules for Application Gateway Web Application Firewall (preview)

Azure’s regional Web Application Firewall (WAF) running on Application Gateway has introduced support for rate-limit custom rules. These rules are designed to detect and block unusually high traffic levels aimed at your application. By implementing rate limiting, users can counteract various denial-of-service attacks, safeguard against clients that might have been mistakenly set up to send a large number of requests in a brief period, and manage traffic rates to their site from specific regions.

For more details, you can learn more here.

Storage

Incremental Snapshots for Premium SSD v2 Disk and Ultra Disk Storage

Azure has announced the general availability of incremental snapshots support for Premium SSD v2 and Ultra Disk. This feature comes with an instant restore capability and is available in all regions where Premium SSD v2 and Ultra Disk are supported. With this update, users can instantly restore Premium SSD v2 and Ultra Disks from snapshots and attach them to a running VM without waiting for any background data copy. This new capability allows immediate read and write access to disks after their creation from snapshots. This ensures a quick recovery of data from accidental deletions or disasters.

For more information and a deeper understanding of this feature, you can refer to the documentation.

Custom NFSv4.1 ID domain in Azure NetApp Files (preview)

Azure NetApp Files now supports custom NFSv4.1 ID domains in public preview. This feature allows users to customize the NFSv4.1 ID domain for their volume, ensuring a seamless migration of NFSv4.1 workloads to Azure NetApp Files. This enhancement provides flexibility and aids in the migration of workloads without the need to modify the client configuration.

Azure NetApp Files Cloud Backup for Virtual Machines (preview)

Azure NetApp Files introduces Cloud Backup for Virtual Machines in public preview. This feature provides an integrated, native backup solution for Azure Virtual Machines, ensuring data protection and business continuity. With Cloud Backup for Virtual Machines, you can now create VM consistent snapshot backups of VMs on Azure NetApp Files datastores. The associated virtual appliance installs in the Azure VMware Solution cluster and provides policy based automated and consistent backup of VMs integrated with Azure NetApp Files snapshot technology for fast backups and restores of VMs, groups of VMs (organized in resource groups) or complete datastores lowering RTO, RPO, and improving total cost of ownership.

Azure Elastic SAN Updates: Private Endpoints & Shared Volumes (preview)

As Azure approaches the general availability of Azure Elastic SAN, they have been continuously enhancing the service and introducing new features based on feedback from Azure customers. Recently, they have released support for private endpoints and volume sharing via SCSI (Small Computer System Interface) Persistent Reservation.

With the introduction of private endpoint support, users can now access Elastic SAN volumes either through private endpoints or via public endpoints that are restricted to specific virtual network subnets. This update is crucial for those who need the added layer of security that private endpoints provide. Additionally, the shared volume support allows users to connect and utilize an Elastic SAN volume from multiple compute clients, such as virtual machines. This is done while using SCSI reservation commands to select from various supported access modes to read or write to the volume. Furthermore, persistent reservations are supported, ensuring uninterrupted access to data even across reboots.

For a deeper understanding and more details on these features, you can read the blog and refer to the documentation about Azure Elastic SAN.

Hotpatching di Windows Server: una rivoluzione nella gestione delle macchine virtuali

Nell’era digitale, assicurare una continuità operativa è essenziale, non più solo un valore aggiunto. Per molte aziende, interruzioni frequenti, anche di breve durata, sono inaccettabili per i loro workload critici. Tuttavia, garantire tale continuità può risultare complesso, considerando che la gestione delle macchine virtuali (VM) con sistema operativo Windows Server è per certi aspetti complessa, soprattutto in relazione all’applicazione di patch di sicurezza e aggiornamenti. Con l’avvento della funzionalità di hotpatching da parte di Microsoft, si è aperto un nuovo capitolo nella gestione delle VM: un approccio più efficiente che minimizza le interruzioni, garantendo server sempre aggiornati e protetti. Questo articolo esamina le caratteristiche e i vantaggi di questa innovativa soluzione.

Cos’è l’Hotpatching?

L’hotpatching, introdotto da Microsoft, è una tecnica avanzata che consente di aggiornare sistemi operativi Windows Server senza la necessità di effettuare un riavvio. Immagina di poter “cambiare le gomme” della tua auto in movimento senza doverla fermare. Questa è la “magia” dell’hotpatching.

Dove è possibile utilizzare l’Hotpatching

La funzionalità Hotpatch è supportata sul sistema operativo “Windows Server 2022 Datacenter: Azure Edition”, che è possibile utilizzarlo per le VM che girano in ambiente Azure ed Azure Stack HCI.

Le immagini Azure disponibili per questa funzionalità sono:

  • Windows Server 2022 Datacenter: Azure Edition Hotpatch (Desktop Experience)
  • Windows Server 2022 Datacenter: Azure Edition Core

Da notare che Hotpatch è attivato di default sulle immagini Server Core e che Microsoft ha recentemente esteso il supporto all’hotpatching per includere Windows Server con Desktop Experience, ampliando ulteriormente il campo di applicazione di questa funzionalità.

Aggiornamenti supportati

Hotpatch copre gli aggiornamenti di sicurezza di Windows e mantiene un allineamento con il contenuto degli aggiornamenti di sicurezza emessi nel canale di aggiornamento Windows regolare (non hotpatch).

Ci sono alcune considerazioni importanti per l’esecuzione di una VM Windows Server Azure Edition con hotpatch abilitato:

  • i riavvii sono ancora necessari per installare gli aggiornamenti che non sono inclusi nel programma hotpatch;
  • i riavvii sono anche richiesti periodicamente dopo che è stata installata una nuova baseline;
  • i riavvii mantengono la VM sincronizzata con le patch non di sicurezza incluse nell’ultimo aggiornamento cumulativo.

Le patch attualmente non incluse nel programma hotpatch includono aggiornamenti non di sicurezza rilasciati per Windows, aggiornamenti .NET e aggiornamenti non-Windows (come driver, aggiornamenti firmware, ecc.). Questi tipi di patch potrebbero richiedere un riavvio durante i mesi di Hotpatch.

Benefici dell’Hotpatching

I benefici di questa tecnologia sono molteplici:

  • Migliore sicurezza: con l’hotpatching, le patch di sicurezza vengono applicate in modo rapido ed efficiente. Questo riduce la finestra di vulnerabilità tra il rilascio di una patch e la sua applicazione, offrendo una protezione rapida contro le minacce.
  • Minimizzazione del downtime: uno dei principali vantaggi dell’hotpatching è la capacità di applicare aggiornamenti senza la necessità di riavviare il server. Ciò significa meno interruzioni e una maggiore disponibilità per le applicazioni e per i servizi.
  • Gestione più flessibile: gli amministratori di sistema hanno la libertà di decidere quando applicare le patch, senza la preoccupazione di dover effettuare una attenta pianificazione per garantire che i processi in esecuzione non vengano interrotti durante l’applicazione degli aggiornamenti.

Come funziona l’Hotpatching

Durante un processo di hotpatching, la patch di sicurezza viene iniettata nel codice in esecuzione del sistema operativo in memoria, aggiornando il sistema mentre è ancora in funzione.

Hotpatch funziona stabilendo prima una baseline con l’attuale Aggiornamento Cumulativo per Windows Server. Periodicamente (con cadenza trimestrale), la baseline viene aggiornata con l’ultimo Aggiornamento Cumulativo, dopodiché vengono rilasciati hotpatch per i due mesi successivi. Ad esempio, se a gennaio viene rilasciato un Aggiornamento Cumulativo, febbraio e marzo vedrebbero il rilascio di hotpatch. Per il calendario di rilascio degli hotpatch, è possibile consulta le note di rilascio per Hotpatch in Azure Automanage per Windows Server 2022.

Gli hotpatch contengono aggiornamenti che non richiedono un riavvio. Poiché Hotpatch corregge il codice in memoria dei processi in esecuzione senza la necessità di riavviare il processo, le applicazioni ospitate sul sistema operativo non sono influenzate dal processo di patching. Questa azione è separata da eventuali implicazioni sulle prestazioni e sulle funzionalità della patch stessa.

L’immagine seguente riporta un esempio di un programma annuale di rilascio degli aggiornamenti (inclusi esempi di baseline non pianificate a causa di correzioni zero-day).

Figura 1 – Schema di una programmazione annuale di esempio per il rilascio degli aggiornamenti Hotpatch

Ci sono due tipi di baseline:

  • Baseline Pianificate: vengono rilasciate con una cadenza regolare, con rilasci di hotpatch nel mezzo. Le Baseline Pianificate includono tutti gli aggiornamenti in un Aggiornamento Cumulativo più recente e richiedono un riavvio.
  • Baseline Non Pianificate: vengono rilasciate quando viene rilasciato un aggiornamento importante (come una correzione zero-day) e quel particolare aggiornamento non può essere rilasciato come hotpatch. Quando vengono rilasciate le baseline non pianificate, un rilascio di hotpatch viene sostituito con una baseline non pianificata in quel mese. Anche le Baseline Non Pianificate includono tutti gli aggiornamenti in un Aggiornamento Cumulativo più recente e richiedono un riavvio.

La programmazione riportata nell’immagine di esempio illustra:

  • quattro rilasci di baseline pianificate in un anno solare (cinque in totale nel diagramma) e otto rilasci di hotpatch;
  • due baseline non pianificate che sostituirebbero i rilasci di hotpatch per quei mesi.

Processo di orchestrazione delle patch

Hotpatch è da considerate come un’estensione di Windows Update e gli strumenti di orchestrazione delle patch variano a seconda della piattaforma in uso.

Orchestrazione di Hotpatch in Azure

Le macchine virtuali create in Azure sono abilitate di default per il patching automatico se utilizzata un’immagine supportata di “Windows Server Datacenter: Azure Edition”:

  • le patch classificate come Critiche o di Sicurezza vengono automaticamente scaricate e applicate sulla VM;
  • le patch vengono applicate durante le ore di minore attività considerando il fuso orario della VM;
  • Azure gestisce l’orchestrazione delle patch e le patch vengono applicate seguendo i principi di disponibilità;
  • lo stato di salute della macchina virtuale, determinato attraverso i segnali di salute della piattaforma Azure, viene monitorato per rilevare fallimenti nel patching.

Orchestrazione di Hotpatch in Azure Stack HCI

Gli aggiornamenti Hotpatch per le macchine virtuali attive in ambiente Azure Stack HCI possono essere orchestrati utilizzando:

  • Group Policy per configurare le impostazioni del client Windows Update;
  • le impostazioni del client Windows Update oppure SCONFIG per Server Core;
  • una soluzione di gestione delle patch di terze parti.

Considerazioni e limitazioni

Tuttavia, come ogni tecnologia, anche l’hotpatching ha le sue sfumature. Non tutte le patch sono adatte per l’hotpatching; alcune potrebbero ancora richiedere un riavvio tradizionale. Inoltre, prima di applicare qualsiasi patch, rimane fondamentale testarla in un ambiente controllato per evitare potenziali problemi.

L’installazione di aggiornamenti Hotpatch non supporta il rollback automatico. Infatti, se una VM riscontra un problema durante o dopo un aggiornamento, risulta necessario disinstallare l’aggiornamento e installare l’ultimo aggiornamento baseline noto come valido. In seguito al rollback sarà necessario riavviare la VM.

Conclusione

L’introduzione dell’hotpatching da parte di Microsoft rappresenta un passo avanti significativo nella gestione delle VM con sistema operativo Windows Server. Con la capacità di applicare patch di sicurezza e aggiornamenti senza interruzioni, gli amministratori possono garantire che i loro server siano protetti e aggiornati in un modo più rapido ed efficace. In un mondo in cui la sicurezza è di primaria importanza e in cui ogni secondo conta, l’hotpatching si posiziona come una soluzione di valore per ogni azienda che utilizza Windows Server in ambiente Azure oppure in ambiente Azure Stack HCI.

Azure IaaS and Azure Stack: announcements and updates (August 2023 – Weeks: 31 and 32)

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Networking

Cloud Next-Generation Firewall (NGFW) by Palo Alto Networks – an Azure Native ISV Service

Cloud NGFW by Palo Alto Networks is the first ISV next-generation firewall service natively integrated in Azure. Developed through a collaboration between Microsoft and Palo Alto Networks, this service delivers the cutting-edge security features of Palo Alto Network’s NGFW technology while also offering the simplicity and convenience of cloud-native scaling and management.
NGFWs provide superior network security by offering enhanced capabilities compared to traditional firewalls. These include deep packet inspection, advanced visibility and control features, and the use of AI to improve threat detection and response. The service is now more broadly available in the following 12 regions: US (Central, East, East 2, West, West 3), Australia (East, Southeast), UK (South, West), Canada Central, East Asia and West Europe.

Route Server hub routing preference (preview)

Azure Route Server now supports hub routing preference in public preview. When branch-to-branch is enabled and Route Server learns multiple routes across site-to-site (S2S) VPN, ExpressRoute, and SD-WAN NVAs, for the same on-premises destination route prefix, users can now configure connection preferences to influence Route Server route selection.

Support for new custom error pages in Application Gateway (preview)

In addition to the response codes 403 and 502, the Azure Application Gateway now lets you configure company-branded error pages for more response codes: 400, 405, 408, 500, 503, and 504. You can configure these error pages at a global level to apply to all the listeners on your gateway or individually for each listener. The custom error pages you set are displayed to the clients when the Application Gateway generates these response codes. You can host these error page files at any publicly accessible URLs.

Storage

Azure NetApp Files: SMB Continuous Availability (CA) shares

To enhance resiliency during storage service maintenance operations, SMB volumes used by Citrix App Layering, FSLogix user profile containers and Microsoft SQL Server on Microsoft Windows Server can be enabled with Continuous Availability. Continuous Availability enables SMB Transparent Failover to eliminate disruptions as a result of service maintenance events and improves reliability and user experience. This feature is now Generally Available. It can be enabled on new or existing SMB volumes.

Zone Redundant Storage for Azure Disks is now available in East Asia

Zone Redundant Storage (ZRS) for Azure Disk Storage is now generally available on Azure Premium SSDs and Standard SSDs in East Asia region.

Azure Blob Storage Cold Tier

Azure Blob Storage Cold Tier is now generally available. It is a new online access tier that is the most cost-effective Azure Blob offering for storing infrequently accessed data with long-term retention requirements, while providing instant access. Azure Blob Storage is optimized for storing massive amounts of unstructured data. With blob access tiers, you can store your data most cost-effectively based on how frequently it will be accessed and how long it will be retained. The pricing of the cold tier storage option lies between the cool and archive tiers, and it follows a 90-day early deletion policy. You can seamlessly utilize the cold tier in the same way as the hot and cool tiers, through REST API, SDKs, tools, and lifecycle management policies.

Azure Premium SSD v2 Disk Storage is available in more regions

Azure Premium SSD v2 Disk Storage is now available in Brazil South, East Asia and Central India regions. This next-generation storage solution offers advanced general-purpose block storage with the best price performance, delivering sub-millisecond disk latencies for demanding IO-intensive workloads at a low cost. It is well-suited for a wide range of enterprise production workloads, including SQL Server, Oracle, MariaDB, SAP, Cassandra, MongoDB, big data analytics, gaming on virtual machines, and stateful containers.

Azure Storage Mover support for SMB and Azure Files (preview)

Azure Storage Mover can now migrate your SMB shares to Azure file shares. Storage Mover is a fully managed migration service that enables you to migrate on-premises files and folders to Azure Storage while minimizing downtime for your workload. Besides the existing general available capability to migrate from an on-premises NFS share to an Azure blob container, Storage Mover will support many additional source and target combinations in the near future.