This blog post series highlights the key announcements and major updates related to Azure Infrastructure as a Service (IaaS) and Azure Local, as officially released by Microsoft in the past two weeks.
Azure
General
Azure Enclave (preview)
Azure Enclave is now available in Public Preview, providing a platform-managed approach for deploying and operating secure, isolated, and compliant Azure environments for highly sensitive workloads. Designed for both commercial and air-gapped scenarios, Azure Enclave uses a hierarchical model built around communities, enclaves, and workloads. A community acts as a central hub for networking, governance, monitoring, and trusted connectivity, while enclaves are isolated, zero-trust software-defined networks based on Azure Virtual Network. Workloads are deployed into resource groups associated with an enclave and automatically inherit its security posture, policies, and permissions.
Azure Enclave combines managed routing, Azure Firewall, Network Security Groups, Azure Policy, Role-Based Access Control deny assignments, flow logging, and diagnostic controls to create protected virtual boundaries. Community and enclave networking resources cannot be modified directly and are instead managed through dedicated platform resources and endpoints, helping reduce configuration drift and unauthorized changes. Microsoft positions the service as a way to reduce the time required to establish secure environments from weeks or months to hours or days by using platform-managed infrastructure and built-in isolation and governance controls.
Reservation exchanges for services covered by Azure savings plans to end in 2027
Microsoft has announced that, starting February 1, 2027, reservation exchanges will no longer be available for Azure services covered by Azure savings plans. At the time of the announcement, the change applies to reservations for Azure Virtual Machines—including exchanges between non-premium and premium storage—Azure Dedicated Host, Azure App Service, Azure Database for PostgreSQL, Azure Database for MySQL, Azure DocumentDB, Azure Cosmos DB, Azure SQL Database, and Azure SQL Managed Instance. Each active reservation for an affected service purchased before February 1, 2027, will retain the right to one final exchange after that date. The change does not apply to products approaching retirement or to cloud environments that do not currently support savings plans. As savings plan coverage expands to additional services, reservations for those services will follow the same policy and will not support exchanges.
Compute
Trusted Launch as Default
Trusted Launch as Default (TLaD) is now Generally Available (GA) for new Generation 2 Azure Virtual Machines and Virtual Machine Scale Sets, automatically enabling Secure Boot and virtual Trusted Platform Module (vTPM) for supported deployments at no additional cost. New Gen2 VMs created through the Azure portal, Azure CLI, and Azure PowerShell automatically use Trusted Launch by default, while customers deploying through ARM templates, Bicep, Terraform, or Azure SDKs can enable the same default behavior through a one-time subscription registration. Existing virtual machines are not modified, and explicitly configured security settings continue to be respected. Trusted Launch as Default is supported across compatible x64 and Arm64 Gen2 VM sizes in Azure public, Azure Government, and Azure China regions.
Networking
Azure Virtual Network routing appliance
Azure Virtual Network routing appliance is now Generally Available (GA), providing a fully managed, platform-native routing service for high-performance private connectivity across Azure virtual networks. Built on specialized Azure networking hardware, the service is designed to deliver low latency, high throughput, and greater scalability than virtual machine-based routing solutions, while eliminating the operational overhead associated with deploying and maintaining custom routing infrastructure.
The service supports high-bandwidth east-west routing with configurable bandwidth tiers of up to 200 Gbps per instance, making it suitable for large AI platforms, distributed applications, analytics environments, and other workloads that generate significant east-west traffic. It also supports IPv4, IPv6, and dual-stack virtual networks, including IPv6 Access Control List (ACL) enforcement, and provides built-in high availability and Availability Zone resiliency. Integrated Azure Monitor metrics for throughput, packets, and flows are available without requiring additional diagnostic configuration.
Azure Virtual Network routing appliance is particularly relevant for large hub-and-spoke architectures, where it can provide a dedicated routing layer for connectivity between applications, shared services, and business units across hundreds or thousands of virtual networks. It also provides a foundation for scaling private connectivity, including global and cross-region Private Endpoint access through a single appliance, and can help extend Private Endpoint connectivity beyond the current 20,000-endpoint Hub-Spoke Private Endpoint boundary. For multi-region architectures, the appliance provides a centralized, high-performance routing layer that supports private communication across regions while maintaining an Azure-native operational and governance model. Overall, the service provides a scalable routing foundation for organizations expanding AI infrastructure, private connectivity, IPv6 adoption, and global Azure network architectures.
NAT64 on StandardV2 NAT Gateway
Azure StandardV2 NAT Gateway now generally supports NAT64, enabling IPv6 workloads to communicate with IPv4-only internet destinations. The capability works with a DNS64-capable resolver, which synthesizes IPv6 addresses by embedding IPv4 destination addresses into the standard NAT64 well-known prefix,
Application Routing with Gateway API for AKS
Application Routing with Gateway API is now Generally Available (GA) on Azure Kubernetes Service (AKS), bringing the Kubernetes Gateway API to ingress management without requiring a service mesh. The capability provides a standardized and extensible routing model for Kubernetes applications while preserving a lightweight operational footprint. Existing ingress-nginx-based Application Routing remains supported until November, allowing customers to migrate gradually to the Gateway API-based model. Microsoft also supports the open-source
HTTP header insertion in Azure Firewall
Azure Firewall now generally supports HTTP header insertion, enabling organizations to add or overwrite HTTP and HTTPS request headers directly through Azure Firewall application rules. This capability can be used to enforce security and access controls, support Microsoft Entra tenant restriction scenarios, integrate with backend services, and manage access to SaaS applications without relying on third-party proxy platforms or routing traffic back to on-premises infrastructure solely for header injection.
HTTP header insertion is supported in Azure Firewall Premium for HTTP traffic and for HTTPS traffic decrypted through TLS Inspection. On the Standard and Basic SKUs, it is supported for HTTP traffic. The feature is particularly relevant for Azure Virtual Desktop, Virtual Desktop Infrastructure, enterprise egress filtering, SaaS access governance, and tenant restriction scenarios. It can be configured through the Azure portal, Azure CLI, PowerShell, REST APIs, Terraform, and the Azure Firewall Draft & Deploy workflow.
Route Maps for Azure Route Server (preview)
Route Maps for Azure Route Server are now available in Public Preview, providing more granular control over routes advertised to and received from Azure Route Server Border Gateway Protocol (BGP) peerings. Customers can apply route policies across connections with Network Virtual Appliances (NVAs), ExpressRoute gateways, and VPN gateways located in the same virtual network. The capability supports route summarization for on-premises networks connected through ExpressRoute or VPN, control over routes exchanged between on-premises environments, NVAs, and Azure virtual networks, and path-selection adjustments by modifying BGP attributes such as AS-PATH. Administrators can also tag routes using BGP Community attributes, enabling more flexible traffic engineering and routing-policy enforcement across complex hybrid network topologies.
Azure ExpressRoute resiliency guard (preview)
Azure ExpressRoute resiliency guard is now available in Public Preview for ExpressRoute virtual network gateways, introducing a new resiliency model that helps customers align gateway configurations with workload availability requirements. Administrators can explicitly define a gateway as single-homed or multi-homed. For multi-homed configurations, resiliency guard provides guidance and safeguards to ensure connectivity through either two ExpressRoute circuits in different peering locations or an ExpressRoute Metro circuit. Azure portal guidance helps identify incomplete configurations and warns against changes that could reduce resiliency, while single-homed deployments remain supported for workloads that do not require multi-site redundancy.
Azure Firewall explicit proxy
Azure Firewall explicit proxy is now Generally Available (GA), allowing applications and browsers to send HTTP and HTTPS traffic directly to Azure Firewall through standard proxy settings. This provides an alternative to route-based traffic steering and enables more granular control over outbound web traffic. The GA release introduces enhancements based on public preview feedback, including support for serving both HTTP and HTTPS destinations through a single proxy endpoint, Managed Identity-based retrieval of Proxy Auto-Configuration (PAC) files, and an improved Azure portal configuration experience. A particularly relevant scenario is Azure Arc onboarding in hybrid environments, where Azure Firewall can act as a forward proxy for Arc-enabled servers, providing controlled connectivity to required Microsoft services while maintaining centralized outbound security policies.
Azure Private Link support over IPv6 (preview)
Azure Private Link now supports IPv6 connectivity in Public Preview, enabling customers to privately access supported Azure Platform as a Service (PaaS) resources—such as Azure Storage and Azure SQL Database—using IPv6 private endpoints. IPv6 clients running inside an Azure virtual network can connect directly to these private endpoints, and organizations can also extend IPv6-based private connectivity from on-premises environments through Azure ExpressRoute. This capability helps customers adopt end-to-end IPv6 architectures while retaining the isolation and private connectivity benefits of Azure Private Link.
Azure DNS integration with Traffic Manager for DNS-based load balancing (preview)
Azure DNS now integrates directly with Azure Traffic Manager in Public Preview, simplifying DNS-based traffic routing and load-balancing scenarios. Customers can associate an Azure DNS record set directly with a Traffic Manager profile without creating an intermediate CNAME record for the
Storage
Migrate from AWS FSx for Windows File Server to Azure Files with Azure Storage Mover (preview)
Azure Storage Mover now supports agentless, cloud-to-cloud migration from Amazon Web Services (AWS) FSx for Windows File Server to Azure Files in Public Preview. This capability enables organizations to migrate SMB file shares from AWS directly into Azure Files without deploying or managing migration agents. Azure Storage Mover manages the transfer as a fully managed service, with file data moving from FSx to the target Azure file share over private connectivity between Azure and the customer’s AWS network. This provides a simplified migration path for organizations consolidating Windows file workloads onto Azure while maintaining private network boundaries during the transfer.
SMB Opportunistic Locking configuration for Azure NetApp Files (preview)
Azure NetApp Files now supports configuration of SMB Opportunistic Locking (Oplocks) for SMB and dual-protocol volumes in Public Preview. Oplocks improve client-side caching and can enhance performance for SMB workloads by allowing clients to cache file data and metadata more efficiently. The setting can be configured when creating a new volume or changed on an existing volume, with System default selected by default to enable opportunistic locking. For cross-region replication scenarios, the destination volume can use an oplock configuration that is independent from the source volume, giving administrators greater flexibility when tuning performance and compatibility across replicated environments.
Azure Local
Azure Local: Features and improvements in 2607
Microsoft has released the July 2026 update for hyperconverged deployments of Azure Local, identified as version 12.2607.1003.73. The release includes reliability improvements and bug fixes together with several enhancements across virtual machines, migration, external storage, security, disaggregated architectures, and update management. In the 2607 release, all new and existing Azure Local deployments run OS version 26100.33158, and customers must use drivers compatible with this OS version or Windows Server 2025. The build also updates the runtime stack to .NET 8.0.29 and .NET 10.0.10 for both .NET Runtime and ASP.NET Core.
For Azure Local VMs, DNS server and gateway appliances for workload networks are now Generally Available (GA). Administrators can assign Azure Local VMs the DNS server or gateway IP address of a workload logical network, enabling scenarios such as hosting Active Directory Domain Services (AD DS) and DNS services or deploying Network Virtual Appliance (NVA) gateways directly on Azure Local. This capability is not supported on clusters using Software Defined Networking (SDN) enabled by Azure Arc. Storage visibility has also been improved, with storage path properties now displaying the complete file system location, including the GUID folder, for both existing and newly created paths.
The release also introduces important migration and storage enhancements. Azure Migrate adds new purpose-built Azure RBAC roles for configuring, executing, and monitoring Azure Local migrations, while Terraform-based replication and migration to Azure Local is now available in Public Preview. External SAN integration through iSCSI is now Generally Available (GA) for both hyperconverged and disaggregated deployments, complementing existing Fibre Channel connectivity and giving customers greater flexibility when reusing enterprise storage infrastructure. For disaggregated architectures, deployment validation now blocks unsupported SAN vendors and LUNs, while local availability zones can be configured through PowerShell and used when deploying Azure Local VMs from the Azure portal.
Security capabilities are also strengthened in 2607. Confidential VMs on Azure Local are now available in Public Preview, using AMD Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) to provide workload attestation and hardware-backed memory encryption for sensitive virtual machines. The Azure Local security baseline also increases the minimum local account password length to 14 characters, helping align deployments with current security and compliance guidance.
Finally, update management has been enhanced for environments with restricted connectivity. Administrators can now download Azure Local update packages directly from the Azure portal, simplifying limited-connectivity and offline update scenarios. Azure Local may also offer newer builds of the currently installed version as available updates, allowing administrators to review the associated changes and determine whether they are applicable before deployment.
Azure Local security monitoring integrations with IBM QRadar and Splunk
Microsoft has expanded the Azure Local security ecosystem with new integrations for IBM QRadar and Splunk, enabling organizations to incorporate Azure Local security signals into existing Security Operations Center (SOC) monitoring and investigation workflows. This is particularly relevant for governments, critical infrastructure operators, defense organizations, and regulated industries that need to run cloud capabilities within customer-controlled or sovereign environments while preserving established security tooling and operational processes.
Azure Local already includes built-in security capabilities such as CIS- and DISA STIG-aligned security baselines, BitLocker encryption, Microsoft Defender Antivirus, and Attack Surface Reduction controls. The new integrations extend this security model by allowing Azure Local audit logs, alerts, and other security-relevant signals to be consumed by IBM QRadar and Splunk for centralized monitoring, investigation, and correlation with the broader enterprise security estate. This enables customers to modernize infrastructure or deploy sovereign private cloud environments without replacing existing SIEM investments or redesigning established security operations processes.
Microsoft is also continuing to expand the Azure Local partner security ecosystem beyond SIEM integration, including areas such as Endpoint Detection and Response (EDR), vulnerability management, and container security. The objective is to provide greater customer choice while allowing Azure Local and Sovereign Private Cloud deployments to integrate more naturally with the security platforms and operational practices already adopted within highly regulated environments.
Conclusion
Over the past two weeks, Microsoft has introduced a slew of updates and announcements pertaining to Azure Infrastructure as a Service (IaaS) and Azure Local. These developments underscore the tech giant’s unwavering commitment to enhancing its cloud offerings and adapting to the ever-evolving needs of businesses and developers. Users of Azure can anticipate improved functionalities, streamlined services, and enriched features as a result of these changes. Stay tuned for more insights as I continue to monitor and report on Azure’s progression in the cloud sphere.
