Category Archives: Azure Hybrid & Migration – 2025-2026

Azure IaaS and Azure Local: announcements and updates (May 2025 – Weeks: 17 and 18)

This blog post series highlights the key announcements and major updates related to Azure Infrastructure as a Service (IaaS) and Azure Local, as officially released by Microsoft in the past two weeks.

Azure

General

Microsoft Announces New European Digital Commitments

Microsoft has introduced five new commitments to deepen its partnership with Europe, focusing on digital resilience, data privacy, cybersecurity, and competitiveness. These actions reflect Microsoft’s goal to align with European values and regulations.

1. Expanding AI and Cloud Infrastructure
Microsoft will boost its European datacenter capacity by 40% over two years, covering 16 countries. This includes public and sovereign cloud operations, and partnerships with firms like Bleu (France) and Delos Cloud (Germany). Microsoft aims to support innovation while complying with EU laws.

2. Strengthening Digital Resilience
Microsoft will operate European cloud services under a Europe-based board and uphold a Digital Resilience Commitment, pledging to challenge any external attempts to disrupt services. Code backups in Switzerland and continuity partnerships will ensure service reliability.

3. Safeguarding Data Privacy
With the EU Data Boundary project completed, Microsoft enables customers to keep data within the EU. Customers can encrypt data with their own keys, use lockboxes, and restrict Microsoft access. Microsoft also legally defends against unlawful data requests.

4. Boosting Cybersecurity
Microsoft has supported Ukraine and NATO with $500 million in cybersecurity aid and intelligence. A new Deputy CISO for Europe will oversee compliance with EU cybersecurity regulations like DORA and CRA. Independent audits will confirm adherence.

5. Supporting Competitiveness and Open Source
Through its AI Access Principles, Microsoft ensures open access to over 1,800 AI models, many of them open-source. The company supports European businesses and research institutions in applying AI, and commits to continued local collaboration.

These commitments underline Microsoft’s long-term dedication to Europe’s digital future and its respect for local governance.

Semantic Ranker for Azure AI Search now available on ItalyNorth

The Semantic Ranker feature in Azure AI Search is now generally available in the ItalyNorth region. This capability enhances the relevance of search results by using deep learning models to understand the semantic meaning behind user queries. It enables more accurate and contextually appropriate responses, particularly beneficial for AI-powered applications requiring advanced search functionalities.

Azure Functions Flex Consumption plan hosting now available on ItalyNorth

The Flex Consumption plan for Azure Functions is now available in the ItalyNorth cloud region. This Linux-based hosting option builds upon the pay-as-you-go Consumption model, offering greater flexibility and customization. It introduces capabilities such as private networking, selectable instance memory sizes, and rapid, large-scale out scenarios—all while maintaining a serverless billing model. This provides developers with enhanced control over their serverless workloads without compromising on scalability or cost-efficiency.

UAE North regional availability with Microsoft Dev Box

Microsoft Dev Box is now available in the United Arab Emirates (UAE) North region. This expansion enables customers in the UAE and nearby areas to provision developer workstations closer to their users and data sources, enhancing performance and ensuring compliance with data residency requirements. With this regional support, organizations can now benefit from faster provisioning times and improved network performance for Dev Box environments.

Compute

Azure Compute Fleet

Azure Compute Fleet is now generally available across all Azure regions, offering a scalable and flexible way to deploy up to 10,000 virtual machines in a single fleet. This service intelligently selects and provisions VM instances that match specified parameters—such as core count, RAM, region, pricing model, and VM SKU—ensuring optimal resource allocation for diverse workloads. Azure Compute Fleet also includes robust management features to automatically adjust deployment based on factors like Spot VM evictions, capacity shortages, and cost optimization needs. It is particularly valuable for customers requiring dynamic scaling with a wide variety of VM configurations.

Instance Mix for Virtual Machine Scale Sets

Instance mix is now generally available for Virtual Machine Scale Sets, enabling the use of multiple VM sizes within a single scale set deployment. This new feature offers enhanced flexibility and cost optimization by allowing customers to specify a mix of VM sizes tailored to their workload requirements. It also includes allocation strategies that can prioritize either price or capacity based on customer preferences. With instance mix, deployments benefit from increased capacity availability and simplified management of diverse VM resources within a unified scale set. In addition, customers leveraging Spot Priority Mix can combine both Spot and On-Demand VM instances, further increasing their ability to secure necessary capacity at optimized costs.

Improve the security of Generation 2 VMs via Trusted Launch in Azure DevTest Labs (preview)

Trusted Launch is now available in public preview for Generation 2 virtual machines (Gen2 VMs) within Azure DevTest Labs. This feature introduces a set of coordinated infrastructure technologies that enhance protection against sophisticated and persistent threats. By leveraging Trusted Launch, users can enable key security capabilities—such as secure boot and virtual TPM—independently, thereby hardening their Gen2 VMs without significant configuration overhead. This enhancement is part of Azure’s ongoing efforts to provide secure-by-default infrastructure for development and testing environments.

Improve the security of Generation 2 VMs via Trusted Launch in Azure DevTest Labs (preview)

Trusted Launch is now available in public preview for Generation 2 virtual machines (Gen2 VMs) within Azure DevTest Labs. This feature introduces a set of coordinated infrastructure technologies that enhance protection against sophisticated and persistent threats. By leveraging Trusted Launch, users can enable key security capabilities—such as secure boot and virtual TPM—independently, thereby hardening their Gen2 VMs without significant configuration overhead. This enhancement is part of Azure’s ongoing efforts to provide secure-by-default infrastructure for development and testing environments.

Networking

Azure Firewall integration in Security Copilot

The integration of Azure Firewall with Microsoft Security Copilot enhances the way analysts investigate threats by leveraging natural language interactions. This feature enables users to analyze malicious traffic intercepted by the Intrusion Detection and Prevention System (IDPS) across all deployed firewalls without writing complex KQL queries. Through either the Security Copilot portal or the Copilot in Azure experience, users can: retrieve the top IDPS signature hits, enrich threat profiles with additional intelligence, perform fleet-wide signature searches across tenants, and generate environment-specific security recommendations. This integration streamlines threat analysis and empowers teams with faster, more actionable insights.

Azure Firewall Log Tables Now Supported in Azure Monitor Basic Plan

All resource-specific log tables for Azure Firewall now support the Azure Monitor Basic log plan. This addition enables customers to reduce their logging costs by up to 80%. While this plan provides significant savings, it is important to note that it does not support integrations with Policy Analytics or Microsoft Security Copilot. Organizations looking to balance cost efficiency with basic firewall logging capabilities may find this update especially beneficial.

Next hop IP support for Virtual WAN

Azure Virtual WAN has introduced support for Next hop IP, enhancing routing flexibility for complex networking scenarios. The virtual hub router within Azure Virtual WAN can now peer with Network Virtual Appliances (NVAs) or BGP-enabled endpoints to exchange routes directly. This enables customers to advertise routes for virtual machines that reside behind load balancers, streamlining traffic flows and optimizing network architecture across virtual hubs. This improvement significantly simplifies route management in hybrid and large-scale cloud networks.

Azure virtual network terminal access point (TAP) (preview)

Azure Virtual Network TAP is now in public preview, offering a powerful way to stream virtual machine network traffic directly to packet collectors or analysis tools. This agentless solution eliminates the need for additional appliances or changes to existing network topologies, enabling transparent traffic mirroring with zero impact on VM performance. Furthermore, mirrored traffic does not count against the VM’s bandwidth quota. With broad compatibility across third-party tools, Virtual Network TAP facilitates robust integration into existing security and monitoring frameworks—an essential advancement for organizations requiring deep network visibility in their cloud environments.

Azure WAF CAPTCHA Challenge for Azure Front Door (preview)

Azure Web Application Firewall (WAF) for Azure Front Door now includes CAPTCHA challenge support in public preview. This new capability introduces an adaptive layer of defense to mitigate threats from automated attacks such as bots, scrapers, and brute-force attempts, which often bypass traditional protections like IP filtering or rate limiting. By requiring real-time human verification through an interactive CAPTCHA, this feature enhances application security while maintaining usability for legitimate users. It provides a modern and effective way to safeguard web applications from malicious automated traffic.

Storage

Next-Generation Azure Data Box Devices Now Available

Microsoft has announced the general availability of the next-generation Azure Data Box 120 and Azure Data Box 525. These compact, NVMe-based devices are now available for order in the US, US Gov, Canada, EU, and UK Azure regions, with broader regional availability expected soon. Since their preview debut at Ignite ’24, these devices have successfully facilitated petabyte-scale data ingestion across numerous customer projects and industry verticals. Customers have reported up to 10x improvements in data transfer speeds, citing enhanced reliability and efficiency as key benefits. The design of these devices is based on extensive customer feedback and reflects the growing demands of large-scale data migrations. Azure Data Box continues to offer one of the most cost-effective solutions for offline data transfers, with a competitive price per terabyte and seamless ordering through the Azure portal.

Cross-Region Data Transfer Support in Azure Data Box

Azure Data Box now supports cross-region data transfer for all Azure region pairs, marking a significant enhancement in flexibility for distributed storage strategies. Customers can now upload data from any on-premises location directly to any Azure region, eliminating the need to physically transport the device across commerce boundaries. For example, data collected in Japan can be uploaded to an Azure data center in the European Union, while the Data Box itself remains within Japan. The transfer is carried out over the Azure network at no additional cost, making this feature particularly valuable for global enterprises managing multi-regional data workloads.

Azure Files: Metadata Cache for Azure SSD (Premium) SMB

Azure Files has introduced a new enhancement that significantly improves metadata operations performance for both SMB and REST protocols. This capability is automatically available at no extra cost and benefits both new and existing file shares. Whether used to support critical business applications, streamline DevOps workflows, or provide storage for large-scale virtual desktop environments, Azure Files now offers improved speed, scalability, and performance optimization. This update reinforces Azure Files as a high-performance storage option for demanding enterprise workloads.

Azure Premium SSD v2 and Ultra Disk Storage Now Available in Australia Central 2 and Norway West

Azure Premium SSD v2 and Ultra Disk Storage have been made generally available in the Australia Central 2 and Norway West regions. Azure Ultra Disk Storage provides high throughput, elevated IOPS, and consistently low latency, making it an optimal choice for data-heavy applications such as SAP HANA, high-performance databases, and applications requiring intensive transactional operations. Azure Premium SSD v2, designed as a next-generation block storage solution, delivers sub-millisecond latencies and cost-efficient performance for IO-intensive workloads. It is ideal for a wide spectrum of enterprise production scenarios, including SQL Server, Oracle, MariaDB, SAP, big data analytics, gaming on virtual machines, and stateful containers.

Cross-tenant customer-managed keys for Azure NetApp Files volume encryption (preview)

A new feature in public preview enables cross-tenant customer-managed keys (CMK) for Azure NetApp Files volume encryption. This capability allows end users to manage their own encryption keys across different Azure tenancies, rather than relying on the SaaS provider’s key management. Particularly useful in SaaS provider-to-customer models, it ensures that customers maintain full control over their data protection. Available in all regions that support Azure NetApp Files, this enhancement provides increased flexibility and transparency in key management strategies for both providers and consumers.

Azure Local

Azure Local 2504: new OS version, feature enhancements, and improved update experience

The 2504 release of Azure Local introduces several enhancements aimed at improving performance, security, and manageability. New deployments now use OS version 261000.3775, while existing systems remain on version 23598.1551. Customers can obtain this OS image and compatible drivers through the Azure portal or via their OEM partners.

Significant improvements have been made in several areas. .NET update installations are now more reliable, and update processes benefit from enhanced health checks and simplified tracking via the Azure portal. Registration and deployment processes are more flexible, allowing customers to select from up to six supported software versions, and error logging has been improved.

Security is also strengthened: Dynamic Root of Trust for Measurement (DRTM) is now enabled by default for new deployments. Azure Local VMs gain new capabilities, such as data disk expansion and live migration for VMs using GPU partitioning (GPU-P), provided the latest NVIDIA vGPU drivers are used.

Additional changes include renamed OEM licenses to reflect Azure Local branding, improved handling of solution extensions, a new crash dump collection feature for observability, and updates to billing logic for newer deployments. Documentation for version 22H2 will be archived after May 31, 2025.

Conclusion

Over the past two weeks, Microsoft has introduced a slew of updates and announcements pertaining to Azure Infrastructure as a Service (IaaS) and Azure Local. These developments underscore the tech giant’s unwavering commitment to enhancing its cloud offerings and adapting to the ever-evolving needs of businesses and developers. Users of Azure can anticipate improved functionalities, streamlined services, and enriched features as a result of these changes. Stay tuned for more insights as I continue to monitor and report on Azure’s progression in the cloud sphere.

Azure Hybrid Management & Security: What’s New and Insights from the Field – April 2025

With this article, I’m launching a new monthly series focused on the management and security of hybrid and multicloud environments with Azure, which takes over from the previous “Azure Management Services: What’s New” series.

The evolution of IT architectures and the growing adoption of hybrid models require a shift in how we approach operations, governance, and resource protection. Tools like Azure Arc, the integration of Artificial Intelligence into management processes, and new models for automation now form the foundation for modern, scalable IT control.

This new series, “Azure Hybrid Management & Security: What’s New and Insights from the Field”, is designed to follow this transformation closely. Every month, I will share:

  • the most relevant updates and announcements from Microsoft;

  • a selection of hands-on recommendations and field-proven practices;

  • a focus on the key tools that enable effective and secure management.

The goal is twofold: to keep you up to date, and to offer practical guidance for architects, IT leaders, and operational teams dealing with complex and distributed environments.

The key areas we will cover in this series, along with the corresponding tools and services, include:

🔹 Hybrid and multicloud environment management – with Azure Arc, which extends policy, security, management, and automation capabilities to on-premises and multicloud resources.

🔹 AI and intelligent automation – enabled by Microsoft Copilot in Azure, AIOps capabilities, and predictive tools to streamline operations and support smarter decision-making.

🔹 Security posture across hybrid and multicloud infrastructures – using Microsoft Defender for Cloud and other native services for vulnerability management and advanced threat protection.

🔹 Governance and policy management – leveraging tools such as Azure Policy, Azure Cost Management, and Resource Graph to ensure control, standardization, and cost/resource optimization.

🔹 Update & Patching – through Azure Update Management, Azure Automation, and native patching capabilities across Azure Arc-enabled environments.

🔹 Backup & Resilience – using Azure Backup and Azure Site Recovery to ensure business continuity, data protection, and disaster recovery.

🔹 Monitoring – with tools like Azure Monitor, Log Analytics, and Application Insights for comprehensive visibility and effective troubleshooting.

AI and intelligent automation

Microsoft Copilot in Azure

Microsoft Copilot in Azure is now available!

Microsoft has announced the general availability of Copilot in Azure, marking a significant milestone in the evolution of intelligent cloud management. Copilot in Azure introduces an AI-based assistant that leverages Large Language Models (LLMs), the Azure control plane, and real-time information from the user’s environment. This enables the optimization of operational tasks, improved productivity, and full realization of the benefits offered by the cloud. With its production release, users can now enjoy enhanced performance, greater response accuracy, and full localization support across all languages of the Azure portal. The currently available features come at no additional cost, although Microsoft has indicated that future enhancements may introduce a pricing model. To ensure fair and sustainable use, protective mechanisms such as temporary throttling in case of excessive use of generative services have been implemented.

Security posture across hybrid and multicloud infrastructures

Microsoft Defender for Cloud

Threat Detection in Azure Backup with Microsoft Defender for Cloud (Private Preview)

A new Threat Detection feature for Azure Backup, integrated with Microsoft Defender for Cloud (MDC), has been released in Private Preview. This innovative capability allows for the assessment of the health status of Azure VM recovery points (RPs), distinguishing between secure and potentially compromised restore points. The analysis relies on signals from real-time scans performed by Microsoft Defender for Endpoint (MDE), as part of Microsoft Defender for Servers plans. Azure Backup uses behavioral and heuristic signals detected by MDE to identify anomalies that may indicate the presence of ransomware in backup data.

New features, bug fixes, and deprecated features of Microsoft Defender for Cloud

The development of Microsoft Defender for Cloud is constantly evolving, with continuous improvements being introduced. To stay updated on the latest developments, Microsoft updates this page, which provides information on new features, bug fixes, and deprecated features. Specifically, this month’s main news includes:

  • AI Posture Management in GCP Vertex AI (Preview): support has been extended to AI workloads on Google Cloud Platform (GCP) via Vertex AI. Key features introduced include:
  • Automatic discovery of AI components, data, and artifacts.
  • Detection of misconfigurations with integrated suggestions and remediation actions.
  • Attack path analysis to identify and mitigate security risks.

  • Integration with Mend.io (Preview): a new integration designed to enhance application security by identifying and mitigating vulnerabilities in third-party software dependencies.

  • GitHub Permissions Update: GitHub connectors can now request administrative permissions for Custom Properties, useful for enabling new contextualization capabilities. Permissions can be granted:
  • Directly from the GitHub Apps section in the organization settings.
  • Or via an automated email from GitHub Support.

  • Defender for SQL Server on Machines Plan Update: a new lightweight agent has been introduced, which no longer requires the Azure Monitor Agent. This simplifies onboarding and improves coverage.

Note: after the update, costs may increase if additional SQL Server instances are protected.

  • New Malware Scanning Limit in Defender for Storage: the default limit for on-upload malware scanning has been increased from 5,000GB to 10,000GB. This applies to:
  • New subscriptions
  • Reactivated subscriptions
    The limit can be customized based on specific needs.

  • API Security Posture Management (General Availability): this capability is now generally available (GA) within the Defender CSPM Plan. Key features include:
  • Unified API inventory
  • Identification of new risk types, such as unauthenticated or unencrypted APIs
  • Mapping of exposed APIs via Azure API Management to Kubernetes Ingress and VMs
  • Support for Attack Path Analysis to better manage and mitigate risks

  • Improvements to Defender for App Service Alerts (effective April 30, 2025):
  • New alerts introduced for suspicious code execution and access to internal or remote endpoints
  • Detection optimized to reduce false positives
  • Deprecated alert: “Suspicious WordPress theme invocation detected”

Governance and policy management

Azure Cost Management

AKS Cost Optimization with Azure Advisor

Azure Advisor introduces a new feature designed to support cost optimization in Azure Kubernetes Service (AKS) clusters. Thanks to AKS-specific recommendations, it is now possible to identify concrete saving opportunities through actionable suggestions based on container cost management best practices. The recommendations are tailored to the cluster’s configuration and cover key scenarios such as rightsizing, autoscaling, consumption visibility, and SKU selection.

Environmental Sustainability

New Enhancements for Carbon Optimization in Azure (Preview)

The Carbon Optimization feature in Azure is enriched with new capabilities in Public Preview, aimed at improving the analysis and visibility of emissions data generated by cloud workloads. Key updates include a new version of the API (2024-02-01-preview), which surpasses the previous limit of 5,000 items, enabling the processing of much larger datasets for in-depth analysis. Additionally, the access model has been expanded: users with the Subscription Reader role can now view emissions data, promoting a more collaborative approach to sustainability. Another important update involves the categorization of emissions: data is now organized by resource type (e.g., virtual machines or Azure Data Explorer) rather than by service, offering more useful granularity to identify critical areas. Finally, new filters by resource type and geographic region make it easier to focus on specific segments of the infrastructure for environmental optimization.

Backup & Resilience

Azure Backup

Backup for Azure File Share in AKS with Azure Backup (Private Preview)

Microsoft has announced the start of the Private Preview for backup support of Persistent Volumes based on Azure File Share in Azure Kubernetes Service (AKS) environments. This new feature extends protection coverage for stateful workloads running on AKS, adding support for SMB-based Azure File Shares in addition to the existing support for Azure Disks.
Through snapshot-based backup mechanisms, it’s now possible to enable application-level protection for a broader range of workloads, maintaining an instant backup and restore experience with retention of up to 30 days.

Vaulted Backup for Azure Data Lake Storage (Public Preview)

Vaulted backup for Azure Data Lake Storage is now available in Public Preview, enabling more comprehensive and resilient data protection using Azure Backup vaults. The vault stores recovery points over time and allows for the definition of a backup schedule (daily or weekly), with retention options of up to 10 years to meet the most stringent compliance requirements.
This new feature introduces an effective off-site copy strategy, safeguarding backups from accidental deletion or malicious attacks through source-data isolation, soft-delete, immutability, and data encryption. In the event the source storage is compromised, recovery can be performed on an alternate account, ensuring business continuity even in critical scenarios.

Azure Site Recovery

Shared Disk Protection

Azure Site Recovery for Shared Disk is now generally available, enabling protection, monitoring, and recovery of workloads running on Windows Server Failover Clusters (WSFC) hosted on Azure virtual machines with shared disks. This new capability extends business continuity and disaster recovery options to mission-critical scenarios such as SQL Server with Failover Cluster Instance (FCI), SAP ASCS, and Scale-out File Server.
The feature supports Windows Server 2016 and later, up to four nodes per cluster, and allows an unlimited number of shared disks per environment. Additionally, support for high write-frequency scenarios and PowerShell integration ensures scalable and automated management. This represents a significant advancement for organizations looking to implement advanced disaster recovery solutions in complex and distributed Azure environments.

Monitoring

Azure Monitor

I/O Performance Analysis for SQL Server on Azure Virtual Machines

I/O performance analysis for SQL Server running on Azure virtual machines is now available. This feature enables the identification and resolution of I/O-related bottlenecks. From the Azure portal, users can view detailed metrics and receive operational guidance to improve SQL Server instance performance, particularly when delays are caused by disk or VM throttling.
This feature allows immediate assessment of storage health and application of best practice rules. When no issues are detected, a green visual indicator is shown; otherwise, the system identifies the impact level and the exact moment of the anomaly, which may relate to disk or cache latency. It is also possible to run a subset of SQL Server best practice assessment rules and compare results over time, gaining a useful historical perspective for performance tuning.

Monitoring Java and Node.js Microservices on AKS (Preview)

A new integration between Azure Monitor Application Insights and Java and Node.js microservices deployed on AKS is now available in Public Preview. This enables automatic monitoring without any code changes.
Thanks to auto-instrumentation built into the AKS cluster, immediate visibility into Java and Node.js applications running on Linux nodes is now possible, using specific libraries. Log data, metrics, and tracing—compliant with the OpenTelemetry standard—are sent directly to the Application Insights resource.
This integration also allows application telemetry to be linked with infrastructure signals through OpenTelemetry Resource attributes, simplifying root cause analysis and improving correlation with Container Insights data. The result is faster and more effective application performance diagnostics.

Conclusions

The growing complexity of IT environments—now increasingly hybrid and distributed—requires an evolved approach to management and security. With this new monthly column, Azure Hybrid Management & Security: updates and field insights, I aim to provide a reliable reference point for navigating updates, tools, and best practices, with a practical and concrete focus.
The proposed insights not only help keep pace with Microsoft’s ongoing innovations but are especially designed to support IT professionals in the conscious adoption of scalable, secure, and sustainable solutions. I encourage you to follow this article series regularly to stay up to date and more effectively tackle the challenges of multi-cloud management.

SQL Server Licensing: How Azure Arc Can Change the Rules

In my previous article, I explored how Azure Arc enables organizations to harness the power of the Azure cloud in managing SQL Servers, regardless of where the databases reside: on-premises, at the edge, or in other cloud environments. This extension of the Azure platform allows for centralized governance, enhanced security, and advanced features without requiring a full migration to the cloud.

But once this new management approach is enabled, what services are available, and how is licensing handled? What models are available, and how do they differ from traditional SQL Server licensing?

In this article, we’ll answer these questions by delving into the SQL Server licensing model enabled by Azure Arc and comparing the different approaches to help organizations choose the solution that best fits their needs.

Features Included at No Additional Cost

Azure Arc for SQL Server provides many features at no extra charge, depending on the type of license held. If the organization already has a SQL Server license with Software Assurance (L+that) or opts for the PAYG (Pay-As-You-Go) model, it can access advanced tools for free, such as:

  • Best practices assessment

  • Automated patching

  • Automated local backups

  • Point-in-time restore

  • TDE encryption via Azure Key Vault

For customers with a License-only (L-only) model, even without SA, key governance features are still included—such as resource inventory, failover cluster management, and support for Always-On Availability Groups.

These capabilities allow for a cloud-like management experience, even while keeping databases on local infrastructure.

Figures 1 – SQL Server enabled by Azure Arc pricing model

Value-Added Advanced Services

Naturally, Azure Arc also enables the extension of feature sets through optional paid services, which can be activated selectively based on need:

  • Microsoft Defender for SQL Server, for advanced protection

  • Log Analytics and Azure Monitor, for deep monitoring

  • Azure Policy, for configuration and compliance management

  • Purview, for data governance

  • Cluster-aware patching and long-term backups to Azure or Amazon S3, for resilient and modern operations

This modularity allows organizations to scale their management capabilities based on actual needs while maintaining control over costs.

A New Perspective on Licensing Management

Traditionally, SQL Server licensing has been based mainly on Enterprise Agreements and Software Assurance contracts, binding companies to three-year purchases and requiring accurate forecasting of future usage. However, this approach doesn’t align well with modern IT environments, which are marked by workload fluctuations, hybrid adoption, and the need for more dynamic cost optimization.

Limitations of Traditional Licensing

In the face of this new flexibility, it’s worth highlighting the shortcomings of the traditional model. In addition to rigid contracts and lack of flexibility for workloads, organizations often face:

  • Difficulty tracking actual usage

  • Risk of under- or over-provisioning

  • Unexpected and costly true-ups

  • Complexities in managing across multiple teams and locations

In hybrid and distributed scenarios, these limitations can slow down processes and increase costs.

This is exactly where Azure Arc comes in—not only to extend management functionalities but also to introduce new licensing models that overcome past limitations.

The PAYG Model: Licensing That Fits

To meet these needs, Azure Arc offers a Pay-As-You-Go (PAYG) model for SQL Server, allowing organizations to pay strictly for what they use—hourly or monthly.

The benefits are significant:

  • No upfront costs: Ideal for temporary environments, testing, or seasonal workloads.

  • Adaptability: Licensing follows actual usage, reducing waste.

  • Targeted billing: Costs can be broken down by project, department, or individual server.

  • Visibility and control: The Azure portal enables continuous monitoring, compliance checks, and role-based access.

  • Cost-saving opportunities: PAYG licenses can be included in MACC agreements and treated as OpEx, making spending more predictable.

Conclusion

The true value of Azure Arc for SQL Server lies not only in its technical capabilities but in the innovative operating model it enables: greater visibility, centralized control, process automation, and cost optimization.

Whether it’s environments under strict regulatory requirements, intermittent workloads, or gradual modernization journeys, Azure Arc offers a flexible licensing approach that aligns perfectly with real business needs.

Azure Arc truly revolutionizes SQL Server license management, moving beyond a traditional, often rigid and complex model, to embrace a dynamic, transparent model that is natively integrated with Azure cloud tools.

This evolution allows organizations to respond more agilely to the challenges of an increasingly distributed IT landscape, making the most of existing infrastructure and accelerating digital transformation.

Azure IaaS and Azure Local: announcements and updates (April 2025 – Weeks: 13 and 14)

This blog post series highlights the key announcements and major updates related to Azure Infrastructure as a Service (IaaS) and Azure Local, as officially released by Microsoft in the past two weeks.

Azure

Compute

Retirement of D, Ds, Dv2, Dsv2, and Ls Series Virtual Machines

Microsoft has announced the retirement of the D, Ds, Dv2, Dsv2, and Ls series virtual machines, effective May 1, 2028. After this date, these VM series will no longer be available for use or purchase. Customers currently utilizing these VM types are advised to begin planning their migration strategies toward newer VM generations to ensure ongoing compatibility and support for their applications. As part of the phased retirement process, three-year reserved instances for these VMs will no longer be available for purchase or renewal starting May 1, 2025. One-year reservations will continue to be offered until 2027. For those with active three-year reservation contracts, the benefits will remain valid until contract expiration. Beyond that point, instances will revert to pay-as-you-go pricing. To avoid billing surprises and ensure continuity, customers should review their reservations and take action to transition affected workloads.

Networking

Azure Firewall Updates – Parallel IP Group Updates

Azure Firewall now supports Parallel IP Group Updates, enabling administrators to update multiple IP Groups simultaneously as part of their firewall or firewall policy changes.

Key Benefits

  • Faster & Scalable Updates: Update up to 20 IP Groups in parallel, achieving up to 2x faster update times compared to sequential updates.
  • Improved Visibility: Enhanced error messaging allows administrators to quickly identify and resolve issues. Even if one IP Group fails, other updates continue uninterrupted, preserving overall system integrity.

This update significantly improves management efficiency and scalability for large-scale or dynamic firewall policy environments.

New Regions for Azure Front Door Premium with Private Link-Enabled Origins

Azure Front Door Premium now supports Private Link-enabled origins in West US 2 and Southeast Asia regions. This feature allows content to be delivered through public Front Door endpoints while keeping backend origins inaccessible from the public internet, enhancing security and privacy. With the addition of these new regions, organizations can now deploy Private Link-enabled architectures in more geographies, improving network performance and meeting regional compliance requirements.

Network isolated cluster in AKS

Azure Kubernetes Service (AKS) now offers network isolated clusters, enabling a simplified approach to securing network access to Kubernetes workloads. While customers have traditionally relied on Azure Firewall to control egress traffic and enforce isolation, this approach often introduces added complexity and cost. With network isolated clusters, organizations can reduce the risk of unintentional exposure of public endpoints and strengthen the security posture of their AKS deployments. This built-in feature helps minimize attack surfaces by ensuring tighter control over how clusters connect to external networks, supporting compliance and data protection goals with greater ease.

ExpressRoute Resiliency Enhancements (preview)

Microsoft has introduced new resiliency validation and insight capabilities for ExpressRoute, now available in public preview. These enhancements aim to improve the assessment and monitoring of ExpressRoute-enabled workloads, offering more robust and transparent insights into network reliability. The resiliency validation feature allows customers to simulate site failovers on their Virtual Network Gateways, enabling proactive testing during planned migrations or outage scenarios. This helps verify failover mechanisms and ensures continued connectivity to Azure services. In addition, the new resiliency insights capability introduces a resiliency index — a percentage-based score that evaluates ExpressRoute reliability based on criteria such as route resilience, use of zone-redundant gateways, advisory feedback, and test results from resiliency validation. These metrics allow organizations to identify weak points in their network architecture and make informed improvements to enhance the robustness of their connectivity.

Increased VNet limits for Private Endpoints (preview)

Microsoft has introduced High Scale Private Endpoints, now in public preview, enabling significantly increased limits for deploying Azure Private Endpoints within Virtual Networks (VNets) and across peered VNets. Previously, customers could only create up to 1,000 private endpoints within a single VNet, and exceeding this limit required a support request. Additionally, Microsoft recommended a soft limit of 4,000 private endpoints across peered VNets to avoid connectivity issues. With the introduction of High Scale Private Endpoints, these limits are substantially raised—allowing up to 5,000 private endpoints within a single VNet and 20,000 across peered VNets. This capability is especially beneficial for large-scale, service-rich environments where extensive use of private connectivity is essential. Customers seeking greater scalability for their private networking configurations are encouraged to adopt High Scale Private Endpoints to support growing infrastructure needs without the complexity of manual quota increases.

Storage

Vaulted Backup for Azure Files

Azure Backup has announced the general availability of Vaulted Backup support for Azure Files – Standard tier, providing a robust, enterprise-grade solution to protect data and applications hosted on Azure SMB file shares.

Key Features & Benefits

  • Integrated Protection Policy: Combine snapshot and vaulted backup in a single policy to protect data in a secure Recovery Services vault.

  • Regional Recovery: Ensure data resilience with support for cross-region restore.

  • Advanced Protection Capabilities:

    • Ransomware protection and immutability

    • Restore capability even if the file share is deleted

  • Azure File Sync Integration: Seamlessly protect cloud-tiered data from Azure File Sync, enabling long-term retention in a cost-effective way.

With this release, customers can meet compliance, security, and business continuity requirements while simplifying backup management and reducing data protection costs.

Azure File Sync support for managed identities

Azure File Sync now supports managed identities, a feature that has reached general availability. This enhancement replaces the need for shared keys with a more secure and streamlined authentication mechanism through system-assigned managed identities provided by Microsoft Entra ID. By configuring managed identities within an Azure File Sync deployment, these identities will handle authentication in several key scenarios: the Storage Sync Service authenticating to the Azure file share, registered servers authenticating to the Azure file share, and registered servers authenticating to the Storage Sync Service. To further simplify the setup and improve security, managed identities are now enabled by default for all new Storage Sync Services. Configuration can be completed directly through the Azure portal, eliminating the previous dependency on PowerShell. This updated experience is being gradually rolled out across all Azure regions. The feature is available at no additional cost in all Azure Public and Government cloud regions, making it a recommended approach for customers seeking enhanced security and simplified identity management.

Azure NetApp Files Flexible Service Level (Preview)

Azure has introduced a Flexible Service Level for Azure NetApp Files, now in public preview, allowing customers to independently configure storage capacity and throughput for greater cost and performance optimization.

Key Features & Benefits

  • Customizable Throughput: Scale throughput independently from capacity, up to 640 MiB/s per provisioned TiB, which is up to 5x higher than the Ultra tier.

  • Manual QoS Pools: Supported with manual QoS capacity pools, offering a baseline throughput of 128 MiB/s at no additional cost.

  • Right-Sized Performance:

    • High throughput for smaller pools – Ideal for SAP HANA, Oracle, and other demanding workloads.

    • Cost savings for high-capacity/low-throughput workloads – Reduce cost without compromising storage footprint.

  • No Volume Moves Required: Avoid service disruptions or reconfigurations when scaling performance or storage.

This new service level offers unprecedented flexibility, allowing customers to fine-tune Azure NetApp Files performance and cost based on exact workload requirements.

Azure Local

Azure Local – 2503 Update Released

The 2503 update for Azure Local has been officially released as of March 31st, introducing a set of baseline enhancements focused on improving registration, deployment, and overall management experience. This update reflects ongoing efforts to simplify operations and bolster security within Azure Local environments.

Key changes include a shift in the extension installation process: extensions are no longer installed during the registration phase but are now deployed during machine validation. Additionally, the local UI used for bootstrapping has been deprecated in favor of the Configurator app, providing a more modern and flexible onboarding experience. The Arc registration flow has also been streamlined—Service Principal Name (SPN) is deprecated, and a simplified Arc installer script now relies solely on the Start-ArcBootstrap command.

The update also supports composed images for OEMs and enables deployment of both current and previous versions of Azure Local. While the Azure portal supports the latest version, prior versions must be deployed using dedicated Azure Resource Manager templates.

Other notable improvements include enhanced security for the Bootstrap service, integrated environment checks for connectivity and validation, improved update applicability logic, and support for downloading platform update packages via URLs. Finally, users can now connect to Azure Local VMs over SSH or RDP from within the host network, removing the requirement for line-of-sight access.

Azure Local Performance Metrics Dashboard

Microsoft has introduced the Azure Local Performance Metrics Dashboard, a powerful new tool designed to provide comprehensive visibility into the health and performance of Azure Local systems. With over 60 metrics collected by default—at no additional cost—this out-of-the-box solution delivers actionable insights across storage, network, and compute resources.

Metrics are automatically gathered by the TelemetryAndDiagnostics agent, which is configured during deployment, enabling seamless access to system telemetry without requiring manual setup. The dashboard offers deep visibility into several critical performance areas:

  • Storage Performance: Includes disk read/write operations and throughput, volume latency, and insights into VHD and physical disk activity to help optimize storage usage.

  • Network Performance: Monitors data transmission metrics such as Netadapter Bytes Sent/Received, RDMA traffic, and VM-level network activity for early detection of bottlenecks or connectivity issues.

  • Compute Metrics: Tracks memory usage (available, assigned, used, pressure) across host and guest environments, along with CPU utilization metrics for both host and virtual machines.

This centralized performance dashboard empowers administrators to proactively manage their Azure Local environments, facilitating data-driven decisions to maintain system efficiency and reliability.

Support for 4-node switchless configuration

Microsoft has introduced official documentation to support 4-node switchless configurations, expanding the deployment options for Azure Stack HCI and other Azure-integrated infrastructure solutions.

This update provides organizations with the flexibility to deploy smaller, cost-effective clusters without the need for dedicated network switches between nodes. The switchless architecture simplifies the physical setup and reduces hardware requirements while maintaining essential performance and connectivity capabilities for supported scenarios.

By adding support for this topology, Microsoft continues to enhance deployment versatility, especially for edge and branch environments where simplicity and space efficiency are crucial.

Conclusion

Over the past two weeks, Microsoft has introduced a slew of updates and announcements pertaining to Azure Infrastructure as a Service (IaaS) and Azure Local. These developments underscore the tech giant’s unwavering commitment to enhancing its cloud offerings and adapting to the ever-evolving needs of businesses and developers. Users of Azure can anticipate improved functionalities, streamlined services, and enriched features as a result of these changes. Stay tuned for more insights as I continue to monitor and report on Azure’s progression in the cloud sphere.