Category Archives: Cloud

Azure Management services: What's new in May 2021

To stay constantly updated on news regarding Azure Management services, this summary is released monthly, allowing you to have an overview of the main new features of the month. In this article you will find the news, presented in a synthetic way and accompanied with the necessary references to be able to conduct further studies.

The following diagram shows the different areas related to management, which are covered in this series of articles, in order to stay up to date on these topics and to better deploy and maintain applications and resources.

Figure 1 – Management services in Azure overview

Monitor

Azure Monitor

Log Analytics workspace insights

Microsoft has announced the availability of Log Analytics workspace insights which allows you to obtain detailed information on the Log Analytics workspaces, providing a comprehensive overview of the following aspects: use, performance, integrity, agents, query e change logs.

These are the main questions to which the solution can provide an answer:

  • What are the main tables, those where most of the data is imported?
  • Which resource sends the most logs to the workspace?
  • How long does it take for the logs to reach the workspace?
  • How many agents are connected to the work area? How many are in a health state?
  • Query control: how many queries run in the workspace? What are their response codes and duration time? What are the slow and inefficient queries that require workspace overhead?
  • Who has set a daily limit? When data retention has changed?
    • Useful for keeping a log of changes in workspace settings.

Export of Azure Monitor logs to multiple destinations (preview)

You now have the option to create up to 10 data export rules in each Log Analytics workspace, having the flexibility to decide which tables to export and to which destination (storage accounts oppure event hubs). This configuration possibility makes it possible to address these aspects:

  • Event hub rate limit
  • Single storage account rate limit
  • Different logs can be exported to different destinations.

Updates related to the user interface(UI)

The following user interface updates have been introduced in Log Analytics(UI):

  • Consultation of custom logs: it is now possible to control and manage the table and the custom fields from a new dedicated panel, offering a new user interface that improves the experience of consulting custom logs.
  • Azure Dashboard: the parts of Log Analytics added to Azure dashboards support integration with filters.

Query packs in Azure Monitor (preview)

Query packages have been made available in Azure Monitor , which are essentially ARM objects containing several queries. Among the main features we find:

  • Being ARM objects, precise control of permissions is provided and can be distributed via code and incorporated into policies.
  • They work in all contexts and in all environments, with the ability to upload them to multiple subscriptions.
  • They allow organizations to better organize queries based on their taxonomy, thanks to the presence of new metadata.
  • The clear experience, harmonized and contextual to the environment is incorporated in Log Analytics.

Availability in new regions

Azure Monitor Log Analytics is now also available in the South India region. To check the availability of the service in all the Azure regions you can consult this document.

Secure

Azure Security Center

Integration con GitHub Actions (in public preview)

The integration of Azure Security Center (ASC) with GitHub Actions, in public preview, allows you to easily incorporate security and compliance early in the software development lifecycle. With this integrated experience, you can gain greater visibility into IT operations and IT security, both in the pipeline CI / CD, both in the security scans of container registry within ASC. Furthermore, end-to-end traceability makes it easier for developers to identify issues, improving resolution times and strengthening your cloud security posture.

Re-scanning of containers

Azure Security Center has introduced a new scan for containers that analyzes images to identify vulnerabilities before the push action occurs within the Azure container registries. In the future, ASC will also provide recommendations if you detect workflows that send Docker images without enabling scan actions CI / CD.

New features, bug fixes and deprecated features of Azure Security Center

Azure Security Center development is constantly evolving and improvements are being made on an ongoing basis. To stay up to date on the latest developments, Microsoft updates this page, this provides information about new features, bug fixes and deprecated features. In particular, this month the main news concern:

Protect

Azure Backup

Backup for Azure Blobs

Azure Blob Backup is a managed data protection solution, this helps protect block blobs from various data loss scenarios. The data is stored locally within the source storage account and can be restored from a certain time when necessary. This feature provides a simple means, safe and economical to protect blobs.

Azure Site Recovery

Enable Azure Site Recovery (ASR) when creating virtual machines

While creating new virtual machines from the Azure portal, you can now also enable the Azure Site Recovery replication process. This possibility is included in the virtual machine management options along with those already available, such as Monitoring, Identity, and Backup.

Migrate

Azure Migrate

New Azure Migrate releases and features

Azure Migrate is the service in Azure that includes a large portfolio of tools that you can use, through a guided experience, to address effectively the most common migration scenarios. To stay up-to-date on the latest developments in the solution, please consult the this page, that provides information about new releases and features. In particular, this month the main news is the migration of virtual machines and physical servers with operating system disks up to 4 TB, which is now supported using the migration method based on the presence of the agent.

Evaluation of Azure

To test for free and evaluate the services provided by Azure you can access this page.

Azure Management services: What's New in April 2021

Microsoft is constantly announcing news regarding Azure management services. This summary, released on a monthly basis, allows you to have an overall overview of the main news of the current month, in order to stay up to date on these news and have the necessary references to conduct further study.

The following diagram shows the different areas related to management, which are covered in this series of articles, in order to stay up to date on these topics and to better deploy and maintain applications and resources.

Figure 1 – Management services in Azure overview

Monitor

Azure Monitor

New agent version for Windows Systems

A new version of the Log Analytics agent has been released this month for Window systemss. The new version includes a new tool for troubleshooting and handles changes to certificates in Azure services differently.

The uniqueness of the name of the Log Analytics workspaces is now per resource group

In the past, the uniqueness of the Azure Monitor Log Analytics workspace was globally for all subscriptions. This meant that when a workspace name was used by a customer, it could not be reused by others. Microsoft has changed the way in which the uniqueness of the workspace name is requested and is now managed in the context of the resource group.

New definitions built-in of the Azure Policy for data encryption in Azure Monitor

Azure Monitor provides built-in policies for data encryption governance and control over the key used for encryption at rest. Here are the new built-in policies available for data encryption:

  • Azure Monitor logs clusters should be encrypted with customer-managed key – Audit if log analytics cluster is defined with customer-managed key.
  • Azure Monitor logs clusters should be created with infrastructure-encryption enabled (double encryption) – Audit log analytics cluster is created with Infrastructure enabled.
  • Azure Monitor logs for application insights should be linked to a log analytics workspace – Audit if application insights is linked to store data in log analytics workspace. Workspace can then be linked to a log analytics cluster for customer-managed key settings.
  • Saved-queries in Azure Monitor should be saved in customer storage account for logs encryption – Audit if workspace has linked storage account, which allows the encryption using customer-managed key.
  • Log alert queries in Azure Monitor will be saved in customer storage account, if workspace has linked storage account, which allows the encryption using customer-managed key.

Improvements for Log Alerts

Log Alerts are available in Azure Monitor that allow users to use a Log Analytics query to evaluate the resources logs at a set frequency and activate an alert based on the results obtained. Rules can trigger one or more actions using Action Groups. In this context, two new highly requested features have been released (in preview):

  • Stateful Log Alert: with this feature enabled, activated alerts are automatically resolved once the condition is no longer satisfied. In this way, the same behavior is adopted as in the alerts related to metrics.
  • Frequency of 1 minute: with this feature enabled, the alert query is evaluated every minute to verify the specified condition, thus reducing the overall time for activating a Log Alert.

Availability in new regions

Azure Monitor Log Analytics is also available in the region South India.

To check the availability of the service in all the Azure regions you can consult this document.

Container insights: support for the monitor of Kubernetes Azure Arc enabled environment (preview)

Containers insights in Azure Monitor has extended its monitor capabilities to Azure Arc Kubernetes clusters as well, providing the same monitoring capabilities present for the Azure Kubernetes service (AKS), which:

  • Visibility on the performance of the environment, through the memory and processor metrics for the controllers, nodes and containers.
  • View information collected through workbooks and in the Azure portal.
  • Alert and possibility of querying historical data for problem solving.
  • Ability to verify Prometheus metrics.

Configure

Azure Automation

Availability in new regions

Azure Automation is also available in the region South India.

Support for System Assigned Managed Identities for cloud and Hybrid job (public preview)

Azure Automation has introduced support for System Assigned Managed Identities for cloud and Hybrid jobs. Among the advantages of using Managed Identities we find:

  • The ability to authenticate to any Azure service that supports Azure AD authentication.
  • Elimination of the management overhead associated with managing Run As accounts in runbook code. This makes it possible to access resources via the Managed Identity of an Automation account from a runbook, without having to worry about creating RunAsCertificate, RunAsConnection, etc.
  • It is not necessary to renew the certificate used by the Automation Run As account.

Govern

Azure Cost Management

Updates related toAzure Cost Management and Billing

Microsoft is constantly looking for new methodologies to improve Azure Cost Management and Billing, the solution to provide greater visibility into where costs are accumulating in the cloud, identify and prevent erroneous spending patterns and optimize costs . Inthis article some of the latest improvements and updates regarding this solution are reported, including:

Secure

Azure Security Center

New features, bug fixes and deprecated features of Azure Security Center

Azure Security Center development is constantly evolving and improvements are being made on an ongoing basis. To stay up to date on the latest developments, Microsoft updates this page, this provides information about new features, bug fixes and deprecated features. In particular, this month the main news concern:

Protect

Azure Backup

Azure Dedicated Host protection support

Azure Backup has introduced support for the backup and recovery of virtual machines residing on Azure Dedicated Host, physical servers dedicated to your organization whose capacity is not shared with other customers. This feature is available in all Azure regions where Azure Dedicated Host can be activated.

Azure VM Scale sets protection with orchestration templates (preview)

Azure Backup now allows you to backup and restore Azure VM Scale sets with orchestration models, which provide a logical grouping of virtual machines managed by the platform.

Improvements in encryption using customer managed keys (preview)

Azure Backup now allows you to use your own keys to encrypt backup data residing in the Recovery Services vaults. This new feature allows you to increase the control of the encryption of your data. Furthermore, you can use the Azure Policy to control and apply encryption using keys managed directly by the customer.

Azure Site Recovery

Support for Azure Policy (preview)

The ability to use Azure Policy is now provided to enable large-scale use of Azure Site Recovery for virtual machines. After creating a disaster recovery policy for a resource group, all new virtual machines that will be added to this resource group will have Site Recovery enabled automatically. Furthermore, through a Remediation process, Site Recovery can also be enabled for all virtual machines already present in the Resource Group.

Support for cross-continental disaster recovery (for 3 region pairs)

Azure Site Recovery introduced support for cross-continental disaster recovery. Thanks to this feature, a virtual machine can be replicated from an Azure region in one continent to a region in another continent. In the event of a planned or unplanned outage, you will be able to fail over the virtual machine on all continents and, once the interruption has been mitigated, it can be brought back to the continent of origin (fail-back) and protected. This feature is currently available for the following 3 pairs of intercontinental regions:

  • Southeast Asia and Australia East
  • Southeast Asia and Australia Southeast
  • West Europe and South Central US

Support of “proximity placement groups” in hybrid and cloud disaster recovery scenarios

Azure Site Recovery introduced support for “proximity placement groups (PPG)” in hybrid and cloud disaster recovery scenarios. With this support it will be possible to replicate an on-premises physical or virtual machine or an Azure virtual machine within a PPG, in the chosen Azure target area. Upon activation of the failover plan, Site Recovery will activate the failover VM within the target PPG selected by the user. This functionality is available both through the Azure portal and through PowerShell and REST API, across all Azure regions.

Migrate

Azure Migrate

New Azure Migrate releases and features

Azure Migrate is the service in Azure that includes a large portfolio of tools that you can use, through a guided experience, to address effectively the most common migration scenarios. To stay up-to-date on the latest developments in the solution, please consult the this page, that provides information about new releases and features. In particular, this new release was released this month:

  • The tools Azure Migrate: Discovery and Assessment and Azure Migrate: Server Migration can be used by connecting privately and securely to the Azure Migrate service via ExpressRoute or via a site-to-site VPN, using Azure private links. This connectivity method is recommended to use when there is an organizational requirement to access the Azure Migrate service and other Azure resources without crossing public networks or if you want to get better results in terms of bandwidth or latency.

Evaluation of Azure

To test for free and evaluate the services provided by Azure you can access this page.

Azure Management services: what's new in March 2021

In March there were several news announced by Microsoft regarding Azure management services. In this series of articles, reported monthly, major announcements are listed, accompanied by the necessary references to be able to conduct further studies on.

The following diagram shows the different areas related to management, which are covered in this series of articles, in order to stay up to date on these topics and to better deploy and maintain applications and resources.

Figure 1 – Management services in Azure overview

Monitor

Azure Monitor

What's new in Azure Monitor for Windows Virtual Desktop

Azure Monitor for Windows Virtual Desktop, that will be made available in the coming weeks, will allow you to have a centralized view, containing all the monitor information to help you troubleshoot and operate on a large scale. Thanks to the latest updates it is possible to:

  • View a summary of the status and health of the pool host
  • Find and resolve deployment issues
  • Understanding and addressing user feedback
  • Evaluate resource usage and make scalability decisions, thus achieving optimal cost management

ExpressRoute Monitors in Azure Monitor Network Insights

Azure Monitor Network Insights allows now, through a centralized console, to make the ExpressRoute monitor. The solution displays the following information regarding ExpressRoute connectivity:

  • Topology of all ExpressRoute circuit components (peering, connections and gateways)
  • Provisioning and health status of the various components
  • Circuit metrics (Availability, throughput and packet delivery)
  • Metrics of the ExpressRoute gateway connected to the circuit

Azure Monitor SQL insights for Azure SQL (preview)

Azure Monitor SQL Insights allows you to collect, the analysis and customized display of telemetry data for SQL Database, SQL Managed Instance and SQL Server on board Azure Virtual Machines. The interactive experience introduced by SQL Insights allows you to customize the collection, the frequency of telemetry and to combine data from multiple sources, providing a unified monitoring experience for the SQL environment. SQL Insights is based on the Azure Monitor platform, giving customers access to all the viewing and notification features in the solution.

Azure Monitor Alerts for Azure Backup (preview)

You can now manage backup alerts through the standard Azure Monitor experience. This integration allows users to have a consistent experience in managing alerts across Azure services, including backup.

Azure monitor for containers: live consultation of pods logs & Replica set

Azure monitor for containers introduced support for real-time access to Azure Kubernetes Service Pods and Replica sets logs (AKS). Thanks to this new feature you can search for, filter and view historical pod logs in Log Analytics, you can also troubleshoot and diagnose pods and replica sets.

Container Insights: Persistent Volume monitoring & Tab reports

Container Insights of Azure Monitor introduces two new features:

  • Monitoring dei Persistent Volume (PV) for AKS clusters.
  • A new Reports tab that provides full access to all workbooks related to Kubernetes.

Azure SQL auditing in Log Analytics

It is now possible to merge the audit logs of Azure SQL Database and Azure Synapse Analytics to a Log Analytics workspace and to the Event Hub. This way you can centralize SQL audit logs in one location and do large-scale analysis.

New version of the agent for Linux systems

A new version of the Log Analytics agent has been released this month for Linux systems, which introduces several improvements and greater stability.

Availability in new regions

Azure Monitor Log Analytics is available in the following new regions:

  • Australia Central 2

To check the availability of the service in all the Azure regions you can consult this document.

Configure

Azure Automation

Availability in new regions

Azure Automation is available in the following new regions:

  • UK West

Azure Automanage

New features for Windows systems and extension to Linux distro

Azure Automanage is a new solution that automates several operations throughout the entire lifecycle of virtual machines located in Azure. It allows you to automatically implement best practices in virtual machine management ensuring compliance regarding security aspects, corporate compliance and business continuity. In this solution, new features have been added to simplify operations on virtual machines (VM) Windows Server, such as installing security patches without restarting. This feature allows security patches to be deployed in seconds, this makes it easier to protect servers from critical threats. Azure Automanage has also been extended to major Linux distributions.

Govern

Azure Policy

Azure Cost Management

Updates related toAzure Cost Management and Billing

Microsoft is constantly looking for new methodologies to improve Azure Cost Management and Billing, the solution to provide greater visibility into where costs are accumulating in the cloud, identify and prevent erroneous spending patterns and optimize costs . Inthis article some of the latest improvements and updates regarding this solution are reported, including:

  • Ability to monitor spending through alerts on expected costs (forecasted cost alerts)
  • New view of subscription costs
  • Cost Management Labs News

Secure

Azure Security Center

New features, bug fixes and deprecated features of Azure Security Center

Azure Security Center development is constantly evolving and improvements are being made on an ongoing basis. To stay up to date on the latest developments, Microsoft updates this page, this provides information about new features, bug fixes and deprecated features. In particular, this month the main news concern:

  • Integrating Azure Firewall management into Security Center
  • Inclusion of the “Disable rule” experience in SQL vulnerability assessment (preview)
  • Azure Monitor Workbooks built into Security Center
  • Azure Audit reports included in the regulatory compliance dashboard (preview)
  • Ability to view recommendation data in Azure Resource Graph with “Explore in ARG”
  • Workflow Automation Deployment Policy Updates
  • Improvements in the recommendations page

Protect

Azure Backup

Backup Center

The new Backup Center solution is now available and offers a unique experience designed for centralized management of large-scale backups. With Backup Center, you can dynamically explore large backup inventories between vaults, subscriptions, different locations and even tenants using Azure Lighthouse. The Backup Center can also govern any actions related to backups. Thanks to integration with Azure Policies and recent additional features for tag-based Azure Policies, large-scale governance can be implemented and compliance monitoring simplified. Backup Center also provides useful information to detect resources that are not protected from backups.

Backup Center supports the following types of workloads:

  • Azure Virtual Machines
  • SQL in Azure Virtual Machines
  • HANA in Azure VMs
  • Azure Files

Furthermore, the following workloads are supported in preview:

  • Azure Disks
  • Azure Blobs
  • Azure Database for PostgreSQL Servers

Azure Managed Disk backups

Azure Backup offers the ability to protect managed disks. All this takes place through the periodic creation of snapshots that are kept for a duration established by backup policy. The solution does not require the presence of specific agents and supports backup and recovery of both operating system and data disks (including shared disks), regardless of whether or not they are connected to a virtual machine running in Azure.

SAP HANA Incremental Backup Support

Azure Backup introduces support for creating incremental SAP HANA backups (at the moment in all regions, except Germany Northeast, Germany Central, France South, and US Gov IOWA). Sap HANA's large DB protection is faster and cheaper with this feature.

Support for Archive storage for backup of VMs and SQL on board VMs (preview)

In Azure Backup, you can now move recovery points to save costs and keep your backup data longer. This feature is available for Azure VMs and SQL Servers installed on board Azure VMs. Using Azure PowerShell, you can move these backups from the standard tier to the new archive tier. Restores can be done in an integrated way from the Azure portal, with a simple and intuitive process. In addition to this, Azure Backup will provide, using a specific API, recommendations for moving recovery points to the tier archive.

Backup for Azure Blobs (preview)

Azure Blob backup is an on-premises and managed data protection solution, this helps protect block blobs from various data loss scenarios. Data is stored locally within the source storage account and can be restored from a certain selected time when needed. This feature provides a simple means, safe and economical to protect blobs.

Azure Site Recovery

Expanding DR scenarios to Availability Zones from Azure

Although Availability Zones are traditionally used by customers for high-availability configurations of environments, can now also be leveraged to implement specific disaster recovery scenarios. This feature allows you to define DR plans for scenarios where the maintenance of data residency and local compliance is required, improving the Recovery Point Objective (RPO). This configuration also reduces the complexity of the configurations required to implement a DR strategy in a secondary region.

Migrate

Azure Migrate

New Azure Migrate releases and features

Azure Migrate is the service in Azure that includes a large portfolio of tools that you can use, through a guided experience, to address effectively the most common migration scenarios. To stay up-to-date on the latest developments in the solution, please consult the this page, that provides information about new releases and features. In particular, this month the main news concern:

  • Support to provide multiple server credentials on the Azure Migrate appliance needed to detect installed applications (software inventory), perform agentless dependency analysis and discover SQL Server instances and databases in the VMware environment.
  • Agentless VMware migration now supports simultaneous replication of 500 VMs for vCenter.
  • Azure Migrate automatically installs the Azure VM agent during migration (using the agentless migration method).
  • Azure Migrate Hub now includes an app containerization tool (preview), with support for ASP.NET and Java web applications, which allows you to facilitate the migration of containerized applications running on Azure Kubernetes Service (AKS).
  • Ability to perform assessment for migration to Azure VMware Solution.
  • The new Azure Migrate PowerShell module (preview) adds support for Server Migration agentless tools for migrating VMware virtual machines (VM) in Azure. Furthermore, you can configure and manage server replication to Azure and migrate them, using Azure PowerShell cmdlets in an automated and repeatable way.

Azure Database Migration

SQL Server discovery and assessment agentless

With Azure Migrate, you can now discover SQL Server instances and databases running in a VMware environment, analyze their configuration, application performance and dependencies to migrate to Azure SQL databases and Azure SQL Managed Instances. The solution can provide information regarding the possibility of migration, correct sizing and SQL Azure cost projections.

Evaluation of Azure

To test for free and evaluate the services provided by Azure you can access this page.

Azure IaaS and Azure Stack: announcements and updates (March 2021 – Weeks: 11 and 12)

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Compute

Brazil South Availability Zones

Availability Zones give users additional options for high availability for their most demanding applications and services as well as confidence and protection from potential hardware and software failures by providing three or more unique physical locations within an Azure region. Availability Zones in Brazil South are made up of three unique physically separated locations or “zones” within a single region to bring higher availability and asynchronous replication across Azure regions for disaster recovery protection.

Azure expands PCI DSS certification

PCI DSS is a global information security standard designed to secure payments and reduce credit card fraud. Microsoft Azure has increased the scope of its Payment Card Industry Data Security Standard (PCI DSS) certification, providing coverage across all live Azure regions.

Make workloads on AMD-backed virtual machines confidential without recompiling code (limited preview)

Microsoft is further broadening the confidential computing options available to Azure customers through the technology partnership with AMD, specifically by being the first major cloud provider to offer confidential virtual machines on the new AMD EPYC™ 7003 series processors. This new approach complements existing Azure confidential computing solutions such as confidential containers for Azure Kubernetes Service and opens the possibility to create new confidential applications without requiring code modifications which in turn substantially simplifies the process of creating confidential applications.

HBv3-Series VMs: now generally available in some regions

Azure HBv3-series virtual machines (VMs) for high-performance computing (HPC)
are generally available in the East US, South Central US, and West Europe Azure regions. HBv3 Virtual Machines feature AMD EPYC™ 7003-series (Milan) CPU cores, 448 GB of RAM, 480 MB of L3 cache, and no simultaneous multithreading (SMT). HBv2 Virtual Machines provide up to 340 GB/sec of memory bandwidth. HBv3 VMs can be deployed with a range of CPU core counts to support a diverse set of HPC workload needs.

Publishing VM Images from Shared Image Gallery to Azure Marketplace

You can now publish a VM Image in Shared Image Gallery (SIG) to Azure Marketplace. This capability simplifies your image preparation, testing, and submission process as you no longer have to extract vhds, upload them, and generate SAS URIs. With this capability, you can now manage the full image lifecycle within Azure. You can simply create your image from the VM or a vhd into Shared Image Gallery, then select the SIG Image to publish it in Partner Center.

New VM series supported by Azure Batch

The selection of VMs that can be used by Azure Batch has been expanded, allowing newer Azure VM series to be used. The following additional VM series can now be specified when Batch pools are created:

  • DCsv2
  • HBv3
  • NCasT4_v3

Storage

Azure Storage Explorer v1.18.0

Azure Storage Explorer helps you upload, download, and manage the data you store in Azure Storage. The released version v1.18.0 includes the following new capabilities:

  • Decrease startup and load time of Storage Explorer.
  • New connection flow to make it easier to specify the type of resource.
  • For faster data transfer, Storage Explorer now uses AzCopy v10.8.0.
  • Log files now have more descriptive names and, easier way to clean up old logs.
  • Authorizing via shared access signatures (SAS) is now enabled for ADLS Gen2 accounts. You can now attach to an ADLS Gen2 Storage account, container, or folder via SAS using Storage Explorer.

Networking

IPv6 Support for ExpressRoute Private Peering (preview)

IPv6 support for ExpressRoute Private Peering is now available for public preview with ExpressRoute circuits globally and Azure environments in regions with Availability zones. IPv6 support will unlock hybrid connectivity for you as you look to expand into mobile and IoT markets with Azure, or to address IPv4 exhaustion in your on-premise networks.

Here are the new capabilities available with this support:

  • Establish BGP sessions between the customer and Microsoft edge over ExpressRoute using IPv4 subnets, IPv6 subnets, or both
  • Connect to dual-stack deployments in Azure using a new or existing ExpressRoute gateway
  • Use FastPath with an ExpressRoute connection to route IPv6 traffic

Service Tags for User Defined Routing (preview)

You can now specify a Service Tag for the address prefix parameter in a user defined route for your route table. You can choose from tags representing over 60 Microsoft and Azure services to simplify route creation and maintenance.

  • You no longer need to manually update routes when services change or add to their list of endpoints. Routes with Service Tags will update automatically to include new changes.
    • This also eliminates the need for regularly updating routes based on the IP data in the weekly JSON file downloads we provide.
  • This also helps reduce the likelihood of running into the routes per route table limit (400) which is common when configuring routing for multiple Microsoft and Azure services. By using Service Tags, you can avoid this, since the tag condenses all ranges for that service into one group.
    • For example, we list more than 4,500 prefixes which collectively represent the Azure address space. You can now use one route with the AzureCloud Service Tag which will include all of these.

The feature is available through REST, PowerShell, CLI, and can also be used in ARM templates. This feature is not currently available through the Azure Portal.

Azure Stack

Stream Analytics runs on Azure Stack Hub

Azure Stream Analytics now is supported on Azure Stack Hub as an IoT Edge module. It allows customer to leverage Azure Stack features, to interact with SQL, Event Hubs, and IoT Hubs running in an Azure Stack Hub subscription. Customers can build truly hybrid architectures for stream processing in your own private, autonomous cloud, which can be connected or disconnected with cloud-native apps using consistent Azure services on-premises.

Azure IaaS and Azure Stack: announcements and updates (March 2021 – Weeks: 09 and 10)

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

In this dedicated post you can find the most important announcements and major updates officialized last week during Microsoft Ignite 2021 conference.

Azure

Compute

Microsoft introduces Narya: advancing failure prediction and mitigation

Project Narya is an end-to-end prediction and mitigation service. Not only does it predict and mitigate Azure host failures but also measures the impact of its mitigation actions and to use an automatic feedback loop to intelligently adjust its mitigation strategy.

Storage

Azure File Sync agent v11.2

Azure File Sync agent v11.2 release is now on Microsoft Update and Microsoft Download Center.

Improvements and issues that are fixed:

  • If a sync session is cancelled due to a high number of per-item errors, sync may go through reconciliation when a new session starts if the Azure File Sync service determines a custom sync session is needed to correct the per-item errors.
  • Registering a server using the Register-AzStorageSyncServer cmdlet may fail with “Unhandled Exception” error.
  • New PowerShell cmdlet (Add-StorageSyncAllowedServerEndpointPath) to configure allowed server endpoints paths on a server. This cmdlet is useful for scenarios in which the Azure File Sync deployment is managed by a Cloud Solution Provider (CSP) or Service Provider and the customer wants to configure allowed server endpoints paths on a server. When creating a server endpoint, if the path specified is not in the allow list, the server endpoint creation will fail. Note, this is an optional feature and all supported paths are allowed by default when creating a server endpoint. To learn more, see the release notes.

More information about this release:

  • This update is available for Windows Server 2012 R2, Windows Server 2016 and Windows Server 2019 installations that have Azure File Sync agent version 4.0.1.0 or later installed.
  • The agent version for this release is 11.2.0.0.
  • A restart may be required if files are in use during the installation.
  • Installation instructions are documented in KB4539952.

Routing Preferences

Routing Preference for Azure Storage provides you the flexibility to choose how network traffic is routed between clients outside Azure and your storage accounts by optimizing for exceptional network reliability and performance or by optimizing for lower costs. You now have the choice to direct network traffic to the public endpoint of your storage account using the ‘Microsoft Global Network‘ or over the ‘Public Internet‘. The Microsoft global network delivers exceptional network reliability with premium performance, while using your ISP network may help achieve cost efficiency.

  • Routing over the Microsoft Global Network: The Microsoft global network is one of the largest networks on the globe that currently spans over 165,000 fiber miles with over 180 edge Points of Presence (POPs). The network is well provisioned with multiple redundant fiber paths and traffic engineered intelligently to ensure exceptionally high reliability and performance. Internet traffic enters and exits the Microsoft network at the POP closest to the client to provide optimized network experience (cold potato routing).
  • Routing via the transit ISP network: The new competitive egress tier minimizes traversal over the Microsoft global network and maximizes traversal over the transit ISP network. Internet traffic enters and exits Microsoft network at the POP closest to your storage account’s region (hot potato routing).

By default and to date, network traffic between clients outside Azure and the storage account always uses the Microsoft global network. You can change the routing preference configuration for the default public endpoint to the ISP network for storage accounts in major Azure regions where the feature is available. In addition, you now have the ability to publish additional route-specific endpoints for your storage accounts. These route-specific endpoints will always route traffic between clients outside Azure and the storage account over the appropriate path.

Protection of multi-cloud environments with Azure Security Center

The tendency of companies to adopt a multi-cloud strategy is increasingly widespread, but this operating model makes it particularly challenging to achieve high safety standards for your environment. To meet this need, Microsoft has officially made multi-cloud security support available in the Azure Security Center solution, allowing you to also contemplate amazon web services resources (AWS) and Google Cloud Platform (GCP). this article describes the features of this solution that provides a high degree of security and improves security postures in multi-cloud environments.

Azure Security Center (ASC) was originally developed as the best tool to protect resources in an azure environment. However, the need for customers to protect resources located on multiple public clouds is widespread and for this reason the product team has decided to expand the capacity for action, simplifying security management tools in multi-cloud environments. Azure Security Center can protect not only resources in hybrid environments but also contemplate multi-cloud architectures, including AWS and GCP.

Figure 1 – Multi-cloud and hybrid protection in Azure Security Center

These are the features that are made available to users to cover multi-cloud scenarios:

  • Connecting your AWS or GCP accounts to Azure Security Center provides a unified multi-cloud view of your environment's security postures. In particular, if the solutions AWS Security Hub or GCP Security Command Center detect incorrect configurations, these reports are included in the Secure Score template and in the compliance assessment against specific regulations (Regulatory Compliance), present in Azure Security Center.
  • Thanks to the fact that Azure Defender for Servers take advantage of Azure Arc you can simplify the onboarding process, and enable the protection of virtual machines running in AWS environments, GCP or hybrid cloud. All of which includes several features, including, automatic provisioning of agents, policy management, vulnerabilities and EDR (Endpoint Detection and Response) integrated. In particular, for vulnerability assessment functionality it is possible to perform manual or large-scale scans, and analyze the vulnerabilities detected, on scanned systems, through a unified experience.

These features complement multi-cloud support, also recently announced, of Azure Defender for SQL, this allows you to constantly monitor sql server implementations to detect known threats and vulnerabilities. these features are usable for sql server enabled in an on-premises environment, on virtual machines in Azure and also in multi-cloud deployment, contemplating Amazon Web Services (AWS) e Google Cloud Platform (GCP).

The solutionAzure Arc plays a fundamental role in all this and allows you to extend azure management services and principles to any infrastructure. To achieve this, Microsoft has decided to extend the model Azure Resource Manager to support hybrid and multi-cloud environments, this makes it easier to implement the security features in Azure on all infrastructure components.

Figure 2 – Azure Arc for hybrid and multi-cloud environments

The onboarding process and capabilities offered vary depending on the public cloud you intend to incorporate into Azure Security Center. the following paragraphs provide features for both amazon web services (AWS) that for Google Cloud Platform (GCP).

Amazon Web Services (AWS)

The onboarding process of your AWS account integrates the solution AWS Security Hub with Azure Security Center. In this way it is possible to obtain complete visibility and protection of these cloud environments to provide:

  • Automatic agent provisioning. ASC uses Azure Arc to deploy Log Analytics agent on board AWS instances.
  • Policy management.
  • Vulnerability management.
  • EDR (Endpoint Detection and Response) integrated.
  • Detecting security-impacting configuration errors.
  • A single view that can show ASC recommendations and AWS Security Hub.
  • An ASC score that also includes AWS resources.
  • Regulatory compliance assessments also for AWS resources.

The moment the connection with AWS Security Hub is configured correctly:

  • ASC scans AWS environment for EC2 instances, onboarding is done in Azure Arc, allowing log analytics agent to be installed. This gives you threat protection and gets security advice.
  • The ASC service scans new AWS EC2 instances each 6 hours and integrates them according to the configuration made.
  • The AWS CIS standard is shown in asc's regulatory compliance dashboard.
  • If the AWS Security Hub are enabled, recommendations will appear in the asc portal and regulatory compliance dashboard, after a few minutes after the completion of the onboarding process.

Figure 3 – AWS recommendations displayed in the ASC portal

To view active recommendations for your resources by type, you can use the security center asset inventory page and apply the specific filter for the type of aws resource that interests you:

Figure 4 – Display filters for AWS resources

Google Cloud Platform (GCP)

The onboarding mechanism of your GCP account allows you to integrate GCP Security Command with Azure Security Center and to have complete visibility and protection, in particular by providing:

  • Detecting security-impacting configuration errors.
  • A single view that can show ASC recommendations and GCP Security Command Center.
  • An ASC score that also includes GCP resources.
  • Integration of boards of GCP Security Command Center CIS-based within the Azure Security Center regulatory compliance dashboard.

The moment the connection with GCP Security Command completes:

  • The CIS GCP standard is shown in asc's regulatory compliance dashboard.
  • Security recommendations for resources located in GCP will appear in the Azure Security Center portal and regulatory compliance dashboard within minutes of completing onboarding.

Figure 5 – GCP recommendations displayed in the ASC portal

GCP virtual machine onboarding is currently manual, but you can adopt scripts to do it on a large scale.

On the Azure Security Center recommendations page, you can view all azure resource security recommendations along with AWS and GCP recommendations, thus obtaining a multi-cloud view.

Conclusions

The ability to adopt Azure Security Center as a centralized control solution, where security information from other public clouds also converges, combined with the possibilities given by integration with Azure Arc, to extend the protection of your systems, allows you to achieve a high degree of security and improve security postures in multi-cloud environments. Multi-cloud strategy adoption will become increasingly widespread, and Microsoft will continue to expand Azure Security Center to provide the best solutions to protect Azure, hybrid environments and multi-cloud operating models.

Azure IaaS and Azure Stack: most impactful announcements at Microsoft Ignite 2021

This special edition includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft this week during Microsoft Ignite 2021 conference. Microsoft announced several important additions to its Azure infrastructure as a service (IaaS) portfolio and the Microsoft infrastructure services continue to evolve to optimize the experience of running business-critical workloads.

Azure

Compute

Microsoft adding datacenter region in China

To meet growing customer demand in China, Microsoft will establish a new datacenter region in northern China. The new region will enable more customers to innovate and collaborate with the Microsoft Cloud, including Microsoft Azure, Office 365, Dynamics 365 and Power BI.

Azure Resource Mover now generally available

Azure Resource Mover, which provides portability between Azure regions is now generally available. Azure Resource Mover allows new customers to create applications in existing regions and migrate them upon new region launch or move into regions with availability zones (AZs) if not planned for their region. Azure Resource Mover moves multiple resources among Azure regions and performs dependency analysis for the workloads to ensure a successful move.

On-demand capacity reservations for Azure Virtual Machines will be
available (preview in April)

On-demand capacity reservations for Azure Virtual Machines enable customers to access virtual machines (VMs) in advance with service-level agreement (SLA) guarantees. This is particularly important to organizations that want to ensure high levels of availability when running business-critical applications on Azure.

Azure Virtual Machine Scale Sets flexible orchestration mode (preview).

Azure Virtual Machine Scale Sets help customers simplify the deployment, management and scalability of their applications while increasing high availability. Customers may now change VM sizes without redeploying their scale set, resulting in greater operational agility. Customers will also be able to mix Spot Virtual Machines and pay-as-yougo VMs within the same scale set to optimize costs.

New Mv2 Azure Virtual Machines for memory intensive workloads (preview)

These offerings expand the range of workloads that customers can run in Azure while addressing specific organizational compliance requirements and can give a 20% increase in CPU performance. Customers will be able to deploy the same VMs to Azure Dedicated Hosts.

Automatic VM guest patching for Linux VMs (preview)

Automatic VM guest patching for virtual machines helps ease update management by safely and automatically patching virtual machines to maintain security compliance. With automatic VM guest patching enabled, the VM is assessed periodically to determine the applicable patches for that VM. Updates classified as ‘Security’ or ‘Critical’ are automatically downloaded and applied on the VM during off-peak hours. Patch orchestration is managed by Azure and patches are applied following availability-first principles.

Improve Azure Spot Virtual Machines runtime and simulate evictions with new features (preview)

With Azure Spot Virtual Machines (Spot VMs), IT organizations can acquire scalable compute capacity at deep discounts for interruptible workloads. New ‘try & restore’ capabilities can now improve the overall runtime of workloads running on Spot virtual machines if they get evicted due to capacity constraints. This new capability applies when a Spot VM is part of a virtual machine scale set. Customers can also use recently added REST APIs to simulate evictions and test the behavior of their workload making sure it can tolerate interruptions when deployed on Spot VMs.

Azure trusted launch for Virtual Machines (preview)

Azure trusted launch protects your virtual machines against boot kits, rootkits, and kernel-level malware. Trusted launch allows administrators to deploy virtual machines with verified and signed bootloaders, OS kernels, and drivers. By leveraging secure and measured boot, administrators gain insights and confidence of the entire boot chain’s integrity. With virtual Trusted Platform Module (vTPM), administrators can securely protect keys, certificates, and secrets in the virtual machines. In addition, administrators can monitor and attest to the integrity of virtual machines as well as reacting to any changes to the attestation policy baseline. Azure Security Center serves as a single pane of glass for integrity alerts, recommendations, and remediations generated by trusted launch. These new features are easily enabled, trusted launch is switched on with a simple change in deployment code or a checkbox within the Azure portal for all virtual machines.

Storage

New Azure Disk Storage capabilities for running mission-critical applications (preview)

Several Azure Disk Storage product enhancements for running mission-critical
applications on Azure are now available in preview, including:

  • Azure Premium SSD and Standard SSD, which offer zone-redundant
    storage (ZRS) support to protect data in the event of a zone failure, a
    key feature to provide customers with high availability for mission-critical
    workloads. Disks with ZRS also provide a recovery point objective (RPO)
    of zero that minimizes data loss and helps ensure successful data recovery.
  • Performance tiers on Azure Premium SSD, which provide sustained
    higher performance for a planned event like a seasonal sales promotion,
    giving customers the flexibility to scale performance without increasing
    the disk size by selecting a higher performance tier. Customers can now
    upgrade performance tiers on Premium SSDs without any downtime to
    avoid disruption to their workloads.
  • Auto-key rotation of customer-managed keys, which gives customers
    the option to automatically update all their disks, snapshots and
    images using the same encryption key when a new version of a key is
    generated. Customers no longer need to manually update all their Azure
    resources and can ensure that their data is always secured with the
    latest key versions and that they meet their organization’s security and
    compliance requirements.

Operational backup for Azure Blobs (preview)

Operational backup for Azure Blobs is a managed, local data protection solution that lets you protect your block blobs from various data loss scenarios like blob corruptions, blob deletions, and accidental storage account deletion. The data is stored locally within the source storage account itself and can be restored to a selected point in time whenever needed. So this provides a simple, secure, and cost-effective means to protect your blobs. Operational backup for blobs uses capabilities available from the blob service, like blob point-in-time restore, blob versioning, blob soft delete, and blob change feed, to restore all or a subset of blobs in a storage account. The solution integrates with Backup Center and other Backup management capabilities to provide a single pane of glass that can help you govern, monitor, operate, and analyze backups at scale.

Networking

Azure load balancing options

Azure load balancing options include a guided experience to help customers choose
the load balancing options that match their architectural and application requirements. Azure Load Balancer, now generally available, supports load balancing across IP addresses in the backend pool. Previously, network interfaces associated with virtual machines (VMs) could be added only in the backend of a Load Balancer. This feature enables flexibility to load balance across containers in addition to VMs and VM scale sets associated with their load balancer.

Azure Public IP SKU upgrade and load balancer upgrade

Azure Public IP SKU allows customers to upgrade and retain the same IPs without
management overhead or notices to their end customers and now supports the ability to upgrade from Basic to Standard SKU. In addition, any Basic Public Load Balancer can now be upgraded to a Standard Public Load Balancer, while retaining the same public IP address. This is supported via PowerShell, command line interface (CLI) templates and API, and is available across all Azure regions.

Azure Networking routing preference

Azure Networking routing preference is now generally available and lets Azure customers choose how their traffic is routed between Azure and the internet. Azure customers can choose to optimize for performance (Microsoft network) or cost (ISP network/open internet). These options are also referred to as “cold potato routing” and “hot potato routing,” respectively. Egress data transfer price varies based on the routing
selection. This update will give customers more flexibility to optimize their underlying routing network for performance or cost on a per workload basis.

Azure Route Server (preview)

Azure Route Server facilitates dynamic routing between network virtual appliance (NVA) and virtual networks. By establishing the Border Gateway Protocol (BGP) peering between an NVA and Azure Router Server, customers can inject IP addresses
(i.e., routes) from their NVA to their virtual network and let the NVA learn
what IP addresses their virtual network has. Azure Route Server is a fully
managed service with built-in high availability.

ExpressRoute IPv6 Support

To be released to preview later this month, will support both IPv4- and IPv6-based private peering in availability zones (AZs). IPv6 will enable key internet of things (IoT) scenarios. It will simplify enterprises’ migration or expansion to Azure even as they run
out of IPv4 addresses in their on-premises network.

New ExpressRoute Gateway metrics (preview)

ExpressRoute Gateway metrics enable users to monitor the count of routes learned, count of routes advertised, number of virtual machines (VMs) in the virtual network and frequency of routes changed for their ExpressRoute gateways, and set up alerts to manage capacity accordingly.

New ExpressRoute Portal Experience

It allows users to have a more complete peering and Global Reach configuration experience in Azure Portal.

Azure Virtual WAN now offers integration with VMware SD-WAN (preview)

This allows customers to connect all branch offices and remote locations to Azure through VMWare SD-WAN. Users can now manage last-mile connectivity and dynamic path optimization through VMWare SD-WAN and leverage global connectivity, routing intelligence and security through Azure Virtual WAN, benefiting from a complete Secure
Access Service Edge (SASE) solution.

Virtual WAN Remote User VPN Features

Virtual WAN Remote User VPN Features enable 100,000 remote users to connect to a Virtual WAN hub in a region (increased from the previous 10,000 limit). It will allow remote users to authenticate using any combination of Certificates, Azure Active Directory and Radius Servers. It also offers custom IPsec parameters for remote user VPN. Finally, it will connect multiple Radius servers to a single Virtual WAN Hub for Remote User authentication.

Scalable Bastion Gateway (preview)

Scalable Bastion Gateway will be released in preview later this month. Scalable Bastion Gateway will allow users to increase the size of Bastion gateway to support as many as 500 concurrent sessions and decrease the gateway size when the usage demand goes down. Bastion will support native Azure Active Directory (Azure AD) authentication integration for Linux VMs deployed on Azure.

Advanced VPN diagnostic features

Advanced VPN diagnostic features, including Packet Capture, the BGP Dashboard and VPN Connection features, will be released in preview this month. Packet Capture helps customers troubleshoot their connectivity issues and inspect the traffic flowing through their VPN gateways. The BGP Dashboard provides an all-up view for customers to see their route exchange between Azure and their on-premises networks. VPN Connection features (Reset, Show SA, Modes) allow customers to have fine-grained control and visibility to their VPN tunnels for monitoring, troubleshooting and management.

Application Gateway Ingress Controller (AGIC)

The Application Gateway Ingress Controller (AGIC) is now generally available as an add-on in Azure Kubernetes Service (AKS). You can now easily create or attach an existing Application Gateway instance to their AKS clusters. You can use the standard Kubernetes ingress API to define your routing rules, then have those rules be implemented by the managed Application Gateway service. The Azure Application Gateway is a scalable, reliable, and secure L7 load balancer. By using Application Gateway as the entry point to the AKS applications, you don’t have to self-manage third party networking tools.

Multiple new features for Azure VPN Gateway (preview)

The following new features for Azure VPN Gateway are in public preview:

  • Multiple authentication types for point-to-site VPN: you can now enable multiple authentication types on a single gateway for OpenVPN tunnel type. Azure AD, certificate-based and RADIUS can all be enabled on a single gateway.
  • VPN connection management: with new enhancements in VPN connection management capabilities, you can now reset an individual connection instead of resetting the whole gateway. You can also set the IKE mode of the gateway to responder-only, initiator-only or both and view the Security Association (SA) of a connection.

Azure Stack

Event Hubs on Azure Stack Hub

Event Hubs is a reliable and scalable event streaming engine that backs thousands of applications across every kind of industry in Microsoft Azure. Microsoft is now announcing the general availability of Event Hubs on Azure Stack Hub for disconnected scenarios.

Azure IaaS and Azure Stack: announcements and updates (February 2021 – Weeks: 07 and 08)

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Compute

Automatic Azure VM extension upgrade capabilities (preview)

Azure virtual machine extensions are small applications that provide post-deployment configuration and automation on Azure VMs. The ability to automatically upgrade Azure VM extensions is now available in public preview for Azure virtual machines and virtual machine scale sets. If the automatic extension upgrade feature is enabled for an extension on a VM or a VM scale set, the extension is upgraded automatically whenever the extension publisher releases a new version. Azure manages the upgrade rollout and the upgrades are safely applied following availability-first principles, keeping your environments more secure and up to date.

Azure Image Builder Service now generally available

Azure Image Builder service offers unification and simplification for your image building process across Azure and Azure Stack with an automated image building pipeline. Whether you want to build Windows or Linux virtual machine images, you can use existing image security configurations to build compliant images for your organization and patch existing custom images using Linux commands or Windows Update. Azure Image Builder supports images from multiple Linux distributions, Azure Marketplace, and Windows Virtual Desktop environments and you can build images for specialized VM sizes, such as creating images for GPU VMs.

New datacenter region in Indonesia

Microsoft announced plans to establish its first datacenter region in Indonesia to deliver trusted Azure services locally, with world-class data security, privacy, and the ability to store data in the country. In addition, Microsoft announced plans to skill an additional 3 million Indonesians to empower a total of 24 million Indonesians by the end of 2021 through its long-established skilling programs designed to help create inclusive economic opportunities in the digital era.

Storage

Azure NetApp Files: Volume hard quota change

From the beginning Azure NetApp Files has been using a ‘capacity pool’ provisioning and automatic growth mechanism. Azure NetApp Files volumes are thinly provisioned on an underlaying, customer-provisioned ‘capacity pool’ of a selected tier and size. Volume sizes (‘quotas’) are used to provide performance and capacity, and these ‘quotas’ can be adjusted on-the-fly at any time. This behavior means that, currently, the volume quota is a performance lever used to control bandwidth to the volume. Currently, underlaying capacity pools automatically grow when capacity fills up. The Azure NetApp Files behavior of volume and capacity pool provisioning will change to a manual and controllable mechanism. Starting March 15th, 2021, volume sizes (quota) will manage bandwidth performance, as well as provisioned capacity, and underlying capacity pools will no longer grow automatically.

Networking

Azure Firewall Premium (preview)

With the new Azure Firewall Premium now in public preview, you can now perform the following new capabilities:

  1. Transport Layer Security (TLS) Inspection: Azure Firewall Premium decrypts outbound traffic, performs the required value-added security functions and re-encrypt the traffic which is sent to the original destination.
  2. Intrusion Detection and Prevention System (IDPS): Azure Firewall Premium provides signature-based IDPS to allow rapid detection of attacks by looking for specific patterns, such as byte sequences in network traffic, or known malicious instruction sequences used by malware.
  3. Web Categories: Allows administrators to allow or deny user access to the Internet based on categories (e.g. social networking, search engines, gambling), reducing the time spent on managing individual FQDNs and URLs. This capability is also available for Azure Firewall Standard based on FQDNs only.
  4. URL Filtering: Allow users to access specific URLs for both plain text and encrypted traffic, typically being used in congestion with web categories.

Azure Firewall Premium is utilizing Firewall Policy, a global resource that can be used to centrally manage your firewalls using Azure Firewall Manager. Starting this release, all new features will be configurable via Firewall Policy only. This includes TLS Inspection, IDPS, URL Filtering, web categories and more. Firewall Rules (Classic) continues to be supported and can be used for configuring existing features of Standard Firewall. Firewall Policy can be managed independently or using Azure Firewall manager. Firewall policy associated with a single firewall has no charge.

Azure Front Door: Standard and Premium now in public preview

Microsoft is introducing the preview of two new SKUs to the Azure Front Door family, which combines capabilities of: Azure Front Door, Azure Content Delivery Network (CDN) standard, and Azure Web Application Firewall (WAF) into a single secure cloud CDN platform with intelligent threat protection and a simple to understand pricing model.

  • Azure Front Door standard SKU is content delivery optimized, offering both static and dynamic content acceleration, global load balancing, SSL offload, domain and certificate management, enhanced traffic analytics, and basic security capabilities.
  • Azure Front Door premium SKU builds on capabilities of the standard SKU, and adds extensive security capabilities across WAF, BOT protection, Azure Private Link support, integration with Microsoft Threat Intelligence, and security analytics. 

Azure Front Door Standard/Premium (Preview) is a secure cloud CDN service that cyber security teams can use to accelerate content delivery while protecting apps, APIs, and websites from cyberthreats. It combines intelligent threat protection and modern CDN technology in a tightly integrated service. Your users get friction-free access to internal apps, and APIs and websites are delivered fast at a global scale. And best of all, implementing Azure Front Door Standard/Premium (Preview) across your internal and external digital assets is quick, easy and cost effective with a simplified billing model.

Web Application Firewall Integration with Azure Front Door Standard and Premium SKU

Azure Web Application Firewall is now integrated into Azure Front Door Standard and Premium SKU (Preview). Azure Front Door Standard supports custom WAF rules only, and the Premium SKU supports custom WAF rules, managed ruleset, and Bot manager.

Azure Front Door: Web Application Firewall ruleset refresh

Azure Web Application Firewall with Azure Front Door has a new version of managed ruleset available: Microsoft_DefaultRuleSet_1.1. Powered by Microsoft Threat Intelligence, Microsoft_DefaultRuleSet_1.1 adds new rules for broader coverage and modifications for some existing rules to reduce false positives.

Azure Management services: what's new in February 2021

The month of February was full of news and there are several updates that have affected the Azure management services. This article provides an overview of the month's top news, so that we can stay up to date on these topics and have the necessary references to conduct further insights.

The following diagram shows the different areas related to management, which are covered in this series of articles, in order to stay up to date on these topics and to better deploy and maintain applications and resources.

Figure 1 – Management services in Azure overview

Monitor

Azure Monitor

Availability in new regions

Azure Monitor Log Analytics is available in the following new regions:

  • UAE Central
  • Japan West
  • Australia Central 2 (preview)

To check the availability of the service in all the Azure regions you can consult this document.

The new Azure Monitor agent and the new data collection rules features(preview) extend to new regions and distros

Azure Monitor currently has (in preview) a new unified agent (Azure Monitor Agent – AMA) and a new concept to make data collection more efficient (Data Collection Rules – DCR).

Among the various key features of this new agent we find:

  • Support for Azure Arc server(Windows and Linux) 
  • Virtual Machine Scale Set support (VMSS)
  • Installation via ARM template

As far as the Data Collection is concerned, it introduces these innovations:

  • Better control in defining the scope of data collection (e.g.. ability to collect from a subset of VMs for a single workspace)
  • Single collection and sending to both Log Analytics and Azure Monitor Metrics
  • Send to multiple workspaces (multi-homing for Linux)
  • Ability to better filter Windows events
  • Better extension management

AMA on Linux supports the following new distros for data collection (Data Collection Rules – DCR):

  • CentOS Linux 8*
  • Debian 10
  • Oracle Linux 8*
  • Red Hat Enterprise Linux Server 8*
  • SUSE Linux Enterprise Server 15.2*
  • SUSE Linux Enterprise Server 15.1*
  • Ubuntu 20

*Known issue with Syslog events. Currently only Performance Counters are supported (CPU, Memory, Disk, Network)

Furthermore, AMA and DCR are now available in new regions:

  • UK West (Wuk)
  • Korea Central (If)
  • France Central (Frc)
  • South Africa North (Jnb)
  • Switzerland North

New disk bursting metrics

Azure Monitor allows you to obtain detailed information on the resources deployed and running in the Azure environment. Through metrics, which are resource performance indicators in Azure, you can get detailed information about what's happening. Azure Monitor releases new metrics to help you better understand disk bursting performance. These new metrics provide the expected performance from Premium SSD disks and indicate the amount of bursting credits that have been used.

Configure

Azure Automation

Availability in new regions

Azure Automation is available in the following new regions:

  • Japan West
  • UAE Central

To check the availability of the service in all the Azure regions you can consult this document.

Govern

Azure Cost Management

Availability for Azure Government Pay-As-You-Go subscription

Azure Cost Management features are now also available for Azure Government Pay-As-You-Go subscriptions.

Updates related toAzure Cost Management and Billing

Microsoft is constantly looking for new methodologies to improve Azure Cost Management and Billing, the solution to provide greater visibility into where costs are accumulating in the cloud, identify and prevent erroneous spending patterns and optimize costs . Inthis article some of the latest improvements and updates regarding this solution are reported, including:

Secure

Azure Security Center

What's new in Azure Security Center

Azure Security Center development is constantly evolving and improvements are being made on an ongoing basis. To stay up to date on the latest developments, Microsoft updates this page, this provides information about new features, bug fixes and deprecated features. In particular, this month the main news concern:

Protect

Azure Backup

Cross Region Restore (CRR) for Azure virtual machines

Azure Backup stores the backup data in the Recovery Service vault on which a geographical redundancy is set by default. This results in the backup data in the primary region being geographically replicated to the associated secondary region (paired region). However, replicated data in the secondary region is available for recovery only if Azure declares an emergency in the primary region. By adopting this new functionality in Azure Backup, you will be able to start restores of virtual machines in a secondary region at will, making them completely controlled by the customer. To do this, however, the Recovery Service vault that holds the backups must be set up in geographical redundancy. Recovery between different Azure regions is available, still in preview, also for SQL and SAP HANA.

New features for Azure Backup Center (preview)

Backup Center, currently in preview, now also supports the following workloads: SQL in Azure VM, SAP HANA in Azure VM and Azure Files. With the Backup Center, you can centrally manage and monitor backups of all supported Azure workloads.

Furthermore, new built-in policies for Azure Backup have been included in the Backup Center that allow you to configure the backups of virtual machines in Azure based on the resource groups they belong to and the assigned tags.

Azure Backup for SAP HANA: soft limit increased by 2 TB to 8 TB

Thanks to the new data transfer features, Azure Backup now helps protect larger SAP HANA DB. Azure Backup for SAP HANA now allows you to reach data transfer speeds up to 420 MBps for non-log backups (for example full, differential and incremental) and 100 MBps for log backups. Thanks to this improvement in data transfer capacity it is possible to back up ~ 1,5 TB per hour, which results in 6-8 TB of full backups in 4-6 hours. The Azure Backup Service allows you to provide similar speeds even during restore operations.

Azure Site Recovery

New Update Rollup

For Azure Site Recovery was released theUpdate Rollup 54 that solves several issues and introduces some improvements. The details and the procedure to follow for the installation can be found in the specific KB.

Evaluation of Azure

To test for free and evaluate the services provided by Azure you can access this page.

Azure IaaS and Azure Stack: announcements and updates (February 2021 – Weeks: 05 and 06)

This series of blog posts includes the most important announcements and major updates regarding Azure infrastructure as a service (IaaS) and Azure Stack, officialized by Microsoft in the last two weeks.

Azure

Compute

Azure achieves new certifications

Microsoft Azure has achieved this new certifications:

  • Its first PCI 3-D Secure (PCI 3DS) certification
  • It has increased the scope of its HITRUST CSF certification to include 172 Azure offerings across 49 Azure regions. Azure’s HITRUST certification letters are available on the Service Trust Portal and include the full list of HITRUST CSF certified Azure offerings and regions.

New planned datacenter region in Georgia (East US 3)

The new datacenter region will have a presence in Douglas and Fulton counties, in response to growing customer demand, supporting the creation of new jobs and local business growth. Availability Zones in the new East US 3 region will provide customers with high availability and additional tolerance to datacenter failures.

Storage

Soft delete for Azure file shares is now on by default for new storage accounts

Soft delete for Azure file shares is now enabled by default and this change will apply to all new storage accounts. Soft delete protects your Azure file shares from accidental deletion. Soft delete acts like a recycle bin for Azure file shares, meaning that deleted shares remain recoverable for their entire retention period (7 days by default for storage accounts created after January 31st). You will be charged for soft deleted data on the snapshot meter. If you have automated the creation of new storage accounts and the creation/deletion of new file shares within them, you must modify your scripts to explicitly disable soft delete after the creation of a new storage account. Soft delete will remain disabled by default for existing storage accounts.

Azure File Sync agent v11.2

The Azure File Sync agent v11.2 release is being flighted to servers which are configured to automatically update when a new version becomes available.

Improvements and issues that are fixed:

  • If a sync session is cancelled due to a high number of per-item errors, sync may go through reconciliation when a new session starts if the Azure File Sync service determines a custom sync session is needed to correct the per-item errors.
  • Registering a server using the Register-AzStorageSyncServer cmdlet may fail with “Unhandled Exception” error.
  • New PowerShell cmdlet (Add-StorageSyncAllowedServerEndpointPath) to configure allowed server endpoints paths on a server. This cmdlet is useful for scenarios in which the Azure File Sync deployment is managed by a Cloud Solution Provider (CSP) or Service Provider and the customer wants to configure allowed server endpoints paths on a server. When creating a server endpoint, if the path specified is not in the allow list, the server endpoint creation will fail. Note, this is an optional feature and all supported paths are allowed by default when creating a server endpoint. To learn more, see the release notes.

How to obtain and install this update:

  • To obtain and install this update, configure your Azure File Sync agent to automatically update when a new version becomes available or manually download the update from the Microsoft Update Catalog.

More information about this update rollup:

  • This update is available for Windows Server 2012 R2, Windows Server 2016 and Windows Server 2019 installations that have Azure File Sync agent version 4.0.1.0 or later installed.
  • The agent version of this update rollup is 11.2.0.0.
  • A restart may be required if files are in use during the installation.
  • Installation instructions are documented in KB4539952.

Append blob support for Azure Data Lake Storage (limited public preview)

Append blobs allow users to append data to the end of a blob or file quickly and existing content does not need to be modified. This makes append blobs great for applications such as logging that need to add information to existing files efficiently and continuously. Until now, only block blobs were supported in Azure Data Lake Storage accounts. With this preview, applications can use create append blobs in these accounts also and write to them using Append Block operations.

Ingest up to 10 files and blobs with the new Azure Data Explorer intuitive UX

You can now easily ingest blobs or files into Azure Data Explorer with the new ingestion intuitive wizard. This ingestion wizard also allows you to create a table automatically based on the source structure.