Category Archives: Microsoft Azure

Azure IaaS and Azure Stack: announcements and updates (February 2024 – Weeks: 05 and 06)

Azure

General

Azure VMware Solution Now Available in Italy North Region

Azure VMware Solution has been made available in the Italy North Azure Region. This expansion allows customers in Italy to integrate their VMware workloads with Azure services seamlessly, leveraging the global scale, security, and performance of Azure while maintaining the VMware tools and expertise they are accustomed to. This launch supports the growing demand for cloud solutions in the region, enabling local businesses to innovate and scale with the cloud’s flexibility and efficiency.

Italy North Region Added to Azure HDInsight

Azure HDInsight is now generally available in the Italy North region. This expansion enhances Azure’s managed, full-spectrum, open-source analytics service capabilities, allowing enterprises to leverage popular frameworks such as Hadoop, Apache Spark, Apache Hive, LLAP, Apache Kafka, and more within Italy North. The availability of HDInsight in this region enables local and global enterprises to process big data, run real-time analytics, and use machine learning more efficiently with reduced latency.

Networking

Azure Virtual Network Manager Security Admin Rule Configuration Feature

The Azure Virtual Network Manager’s security admin rule configuration feature has reached general availability (GA) across 30 regions. This feature empowers organizations to enforce security policies across their virtual networks (VNets) efficiently, spanning subscriptions and regions worldwide. By prioritizing these rules above network security groups (NSGs), it ensures a standardized approach to security, helping to mitigate misconfigurations and adherence to corporate policies. The introduction of security admin rules streamlines network management, reducing the complexity of operations while enhancing security measures for expanding network infrastructures.

Azure Virtual Network Manager Topology View

Azure Virtual Network Manager (AVNM) topology view has been officially launched and is now generally available. This innovative feature offers a scalable and reliable solution for managing networks across global subscriptions. It integrates with Azure Resource Topology (ART) to provide a comprehensive visualization of network resources, contextualized by AVNM connectivity configurations. The topology view facilitates a deeper understanding of network connections, offering insights into the connectivity among network groups and VNets, thus enhancing confidence in network deployment strategies.

ExpressRoute Guided Portal Experience (preview)

Microsoft announces the public preview of the ExpressRoute guided portal experience, aimed at simplifying the configuration of multi-site resilient ExpressRoute circuits. This new portal experience offers critical information, such as the distance between peering locations and traffic engineering recommendations, to assist customers in making informed decisions. During the preview, users can access this feature globally in the Azure public cloud via the Azure portal flight link. This initiative underscores Microsoft’s commitment to providing intuitive tools for enhancing network resiliency and connectivity.

Storage

Mount Azure Storage as a Local Share in App Service Linux Now Supports NFS

Azure App Service Linux now supports NFS when mounting an Azure File share as a local share for web apps. This update enables more flexible and efficient storage solutions for web applications hosted on Azure, streamlining the integration and management of file storage.

Azure Ultra Disk Storage Now Available in Canada East

Azure Ultra Disk Storage, offering high throughput, high IOPS, and consistent low-latency disk storage, is now available in Canada East. Ideal for data-intensive workloads such as SAP HANA, top-tier databases, and transaction-heavy workloads, Ultra Disk Storage enhances Azure Virtual Machines’ performance and capabilities in the region.

Azure NetApp Files Standard Network Features – Edit Volumes in US Gov Regions

Azure has launched a public preview for editing network features of Azure NetApp Files volumes in US Gov regions, leveraging advanced hardware and software integration. This update introduces Standard Network Features, enhancing the virtual networking experience with improved security for Azure NetApp Files. Users can now upgrade Basic network features to Standard, benefiting from increased IP limits, enhanced network security and control, and improved connectivity options. This preview is available across all US Gov regions (VA, TX, & AZ).

General Availability: Support for up to 100 TB of Storage for the FHIR Service

Azure announces general availability for expanded storage support in the FHIR service, part of Azure Health Data Services, up to 100 TB. This enhancement allows for the storage and exchange of vast amounts of health data, facilitating large-scale analytics, population health management, research, and insights from health data. Organizations requiring storage beyond the default 4 TB can request an increase through the Azure portal.

Azure Stack

Azure Stack HCI

Azure Stack HCI 23H2 General Availability

Microsoft has announced the general availability of Azure Stack HCI version 23H2, marking a significant update in cloud-managed edge infrastructure. This version is ready for production . It introduces several previews, including Azure Migrate and Microsoft Defender for Cloud, specifically designed for Azure Stack HCI environments. However, it’s noteworthy that certain features like stretched clustering and System Center VMM support are temporarily unavailable in some regions. The launch of Azure Stack HCI 23H2 represents a leap forward in Microsoft’s edge infrastructure offerings, providing enterprises with robust, scalable solutions for their hybrid cloud environments.

Key Highlights:

Production-Ready: Azure Stack HCI 23H2 is now ready for production environments, offering robust and reliable infrastructure solutions.
Seamless Update Process: An update from the previous version 22H2 to 23H2 will soon be available, specifically targeting 23H2 clusters to ensure smooth transitions.
Enhanced Solutions Availability: The GA version includes premier and integrated solutions, enriching the ecosystem for Azure Stack HCI users.
Azure Virtual Desktop (AVD) for Azure Stack HCI: AVD is now generally available, bringing together the advantages of Azure Virtual Desktop and Azure Stack HCI. This combination allows organizations to run virtualized desktops and apps securely, either on-premises at the edge or within data centers.
Azure Migrate Integration (Preview): Azure Stack HCI now supports Azure Migrate in preview, facilitating easier migration of workloads to Azure Stack HCI environments.
Microsoft Defender for Cloud Integration (Preview): Enhance your security posture with Microsoft Defender for Cloud for Azure Stack HCI, currently in preview.
Guidance on Using Version 22H2: It’s recommended to continue using version 22H2 temporarily if:
1. The service is not available in your region (currently limited to East US and West Europe).
2. You require stretched clustering support, which is not available in 23H2.
3. Your setup relies on System Center VMM, not supported by 23H2.

Additional Information:

Currently, 3-node switchless deployments are not supported.
The GA version includes proxy support for HCI infrastructure, but not yet for VMs.
Updates to 23H2 can be performed through the portal on existing preview clusters or by new deployment.
With Windows Defender Application Control (WDAC) enabled by default in Azure Stack HCI 23H2, steps may be needed to allow certain applications to run.

Conclusion

Over the past two weeks, Microsoft has introduced a slew of updates and announcements pertaining to Azure Infrastructure as a Service (IaaS) and Azure Stack. These developments underscore the tech giant’s unwavering commitment to enhancing its cloud offerings and adapting to the ever-evolving needs of businesses and developers. Users of Azure can anticipate improved functionalities, streamlined services, and enriched features as a result of these changes. Stay tuned for more insights as I continue to monitor and report on Azure’s progression in the cloud sphere.

Azure Management services: what’s new in January 2024

This month, Microsoft has introduced a series of significant updates for Azure management services. This is part of a series of monthly articles aimed at providing an in-depth and detailed analysis of the most relevant innovations. The goal is to keep users always informed about the ongoing evolutions of Azure, providing the essential information to explore these developments further.

The following diagram shows the different areas related to management, which are covered in this series of articles:

Figures 1 – Overview of Management Services in Azure

Monitor

Azure Monitor

Support for Azure Monitor VM Insights Dependency Agent for VM Linux RHEL 8.6

The Dependency Agent of Azure Monitor VM Insights is now supported for Linux Red Hat Enterprise Linux (RHEL) 8.6 VMs. This means that the Dependency Agent can be used to monitor network connections and processes of Linux RHEL 8.6 virtual machines and visualize the dependencies between them in the VM Insights Map function.

Integration of Azure Advisor with Azure Monitor Log Analytics Workspace

Azure Advisor is a cloud tool designed to help users follow best practices in optimizing their workloads in Azure. This solution analyzes resource configurations and telemetry data to provide targeted recommendations to improve four key areas: cost efficiency, performance, reliability, and security of Azure resources. Moreover, to support more effective management of Azure Monitor costs, Microsoft has implemented specific cost optimization recommendations and integrated Azure Advisor into the Log Analytics Workspace management interface.

Dedicated clusters in Azure Monitor logs now support different commitment levels

Microsoft has extended the capabilities of dedicated clusters in Azure Monitor Logs, now supporting any level of commitment, starting from a minimum of 100 GB per day. This new feature offers greater flexibility and customization for users who require specific solutions for their monitoring and logging needs. With this expansion, customers have the option to choose the service level that best fits their needs, ensuring more efficient and tailored data management.

Configure

Update management

Azure Update Manager on Azure Arc-enabled servers: new billing rules

From February 2024, Azure Update Manager will start generating consumption for Azure Arc-enabled servers. Azure Update Manager, formerly known as Azure Automation Update Management, has been available since September 2023. Customers who started using the service from that date will not be subject to costs until February 1, 2024.

Starting February 1, 2024, customers using Azure Update Manager on Azure Arc-enabled servers will be billed daily, with a specific rate per server per day, equivalent to about $5 USD per server per month.

An Azure Arc-enabled server is considered managed by Azure Update Manager on days when it meets both of the following conditions:

it has a connection status with Arc at any time of the day; an update operation is performed on it (patch on demand or via scheduled job, evaluation on demand or via periodic assessment) or it is associated with a schedule.

Govern

Azure Cost Management

Updates related to Microsoft Cost Management

Microsoft is constantly seeking new methodologies to improve Microsoft Cost Management, the solution to provide greater visibility into where costs are accumulating in the cloud, identify and prevent incorrect spending patterns, and optimize costs.This article reports some of the latest improvements and updates regarding this solution.

Azure Arc

Preview of the Azure Arc extension for Visual Studio Code

Microsoft has announced the public preview of the Azure Arc extension for Visual Studio Code. This extension allows developers to easily manage Azure Arc resources and services directly from Visual Studio Code. With this integration, developers can expect greater efficiency and simplified workflows, as they will have the ability to access and manage Azure Arc resources without leaving the Visual Studio Code development environment.

Secure

Microsoft Defender for Cloud

New features, bug fixes, and deprecated features of Microsoft Defender for Cloud

The development of Microsoft Defender for Cloud is constantly evolving, with continuous improvements being introduced. To stay updated on the latest developments, Microsoft updates this page, which provides information on new features, bug fixes, and deprecated features. Specifically, this month’s main news includes:

introduction of agentless container posture for GCP in Defender for Containers and Defender CSPM;
public preview of agentless malware scanning for servers;
integration of Defender for Cloud with Microsoft Defender XDR;
DevOps security annotations for Pull Requests enabled by default for Azure DevOps connectors.

Protect

Azure Site Recovery

Support for Azure VMs with Premium SSD v2

Azure Site Recovery now supports Azure VMs equipped with Premium SSD v2. This feature is available as a private preview in selected Azure regions. Premium SSD v2 disks represent Azure’s most advanced block storage solution, ideal for high I/O intensity enterprise workloads, offering sub-millisecond latencies, high IOPS, and throughput. This addition responds to a frequent customer request to be able to use Azure Site Recovery with Azure VMs on Premium SSD v2. Thanks to this feature, customers can ensure greater data security and operational continuity of applications and workloads, even in case of planned or unplanned interruptions.

Migrate

Azure Migrate

New releases and features of Azure Migrate

Azure Migrate is the service in Azure that includes a broad portfolio of tools that can be used, through a guided user experience, to effectively address the most common migration scenarios. To stay updated on the latest developments of the solution, you can consult this page, which provides information on new releases and new features.

Azure Evaluation

For those who wish to explore and personally evaluate the services offered by Azure, a unique opportunity is available: by accessing this page, you can test various features and services for free. This will allow you to better understand how Azure can adapt and improve your IT operations, while ensuring security and innovation.

Azure IaaS and Azure Stack: announcements and updates (January 2024 – Weeks: 03 and 04)

Azure

General

Azure Cloud Services (Classic) Retirement

Microsoft has announced the retirement of its Azure Cloud Services (Classic) deployment model, effective August 31, 2024. This decision marks a significant shift towards more advanced and modern cloud solutions. Users of Azure Cloud Services (Classic) are encouraged to migrate their services to Cloud Services (Extended Support) in Azure Resource Manager, which offers new capabilities and improved efficiency. This transition is vital for maintaining service continuity and accessing enhanced features.

Compute

Automatic Image Creation

Azure has announced the general availability of its Automatic Image Creation service. This feature simplifies the process of creating and managing virtual machine images, allowing for automation and streamlining of deployments. The general availability of this service underscores Azure’s commitment to providing efficient and user-friendly solutions in cloud computing.

Upgrade of Azure Gen1 VMs to Gen2-Trusted Launch (private preview)

Microsoft has announced a private preview that allows users to upgrade their existing Azure Generation 1 (Gen1) virtual machines (VMs) to Generation 2 (Gen2) with Trusted Launch support. This upgrade enhances the foundational security of existing Azure VMs by enabling features like Secure Boot and vTPM capabilities, integral to the Trusted Launch service. Trusted Launch provides a robust security framework for Azure VMs, ensuring boot integrity and protection against advanced threats. The service works by ensuring that only signed operating systems and drivers can boot, establishing a root of trust for the VM software stack. It supports a wide range of compute-optimized, memory-optimized, and storage-optimized VM sizes, as well as multiple operating systems including various versions of Linux and Windows. Notably, this upgrade doesn’t increase existing VM pricing, making it an attractive option for users seeking enhanced security without additional costs.

Networking

Azure Virtual Network Encryption

Microsoft has released the general availability of Azure Virtual Network Encryption, providing an additional layer of security for data in transit. This new feature ensures that data moving within a virtual network is encrypted, enhancing protection against potential threats and unauthorized access. The availability of this feature signifies Microsoft’s ongoing commitment to offering robust security solutions in its cloud services.

Load Balancer in Azure API Management (preview)

Microsoft has introduced a public preview of the Load Balancer in Azure API Management. This feature aims to optimize the distribution of user requests across various servers, ensuring efficient resource utilization and improved response times. The introduction of this load balancer in the preview phase allows users to test and provide feedback, helping Microsoft enhance the feature before its full-scale release.

Conclusion

Leveraging Azure infrastructure in Italy: opportunities and strategies for businesses

In the digital era, the evolution of cloud computing represents a crucial turning point for businesses, radically changing the way data, applications, and IT infrastructures are managed. At the heart of this revolution stands Microsoft Azure, a leading cloud platform that offers an extensive assortment of services and solutions, designed to increase efficiency, security, and resilience of workloads. Azure’s availability in Italy presents an opportunity for businesses of all sizes to optimize their IT resources and expand in the digital landscape. This article aims to explore the potential of Azure’s infrastructure in Italy, highlighting how companies can benefit from its innovative services, seizing practical advantages and concrete opportunities that arise from it.

Azure: a flexible ecosystem for innovation

Azure’s philosophy is clear: simplify IT management without sacrificing reliability and efficiency. Microsoft has structured Azure to be a versatile platform, suitable for reducing costs and complexity for customers. This flexibility is manifested in Azure’s ability to integrate with existing environments, whether it be hybrid clouds with VMware and Nutanix, or in the implementation of IaaS and PaaS services for business applications. Microsoft’s approach is to put the customer at the center, offering customized solutions adaptable to every specific need.

Figure 1 – Microsoft Azure: The Infrastructure Designed for Various Workloads

The launch of Azure in Italy: a customer-oriented process

Azure’s service rollout follows a well-defined path. Initially, in the pre-launch phase, Microsoft establishes the ‘Azure Foundational Services’, which include the essential basic infrastructure: computing, storage, and networking. These components constitute the fundamental core of a cloud environment. With the official start of a region, Microsoft enters a new phase, introducing the ‘Azure Mainstream Services’. These services are expanded and adapted to directly meet customer needs, marking a crucial step in tailoring Microsoft’s cloud offering to the specificities of the local market. As the region matures, Microsoft launches the ‘Azure Strategic Services’, designed to meet more complex requirements and cover advanced use scenarios. At this stage, the focus is on close collaboration with customers to optimize workloads and performance, reflecting a continuous commitment to listening and responding to customer needs. Currently, the Azure Italy North region is in a phase of dynamic development, marked by a constant commitment to evolving services. Microsoft aims to grow in harmony with the needs of its customers, aiming not only to meet current needs but also to drive future innovation.

Figure 2 – Phases of Implementing Azure Services in a New Region

Reliability and resilience: a shared commitment and a framework for excellence

Reliability in the cloud represents a shared goal by both providers and users. Microsoft commits to providing a resilient foundation for the cloud, but it is up to companies to build robust systems on this foundation. Through the use of Azure, customers have the opportunity to implement resilience solutions, including high availability and disaster recovery, which integrate into their infrastructures to ensure operational continuity and security. The “Azure Well-Architected Framework” plays a crucial role in an effective cloud strategy. This framework guides companies through fundamental practices such as design, testing, and monitoring, emphasizing the need for a conscious approach in design, rigorous testing, and constant control. In this way, companies can ensure they operate in a reliable cloud environment.

Resilience and availability: Multi-Region vs. Single-Region

It is important to clarify a fundamental aspect. Historically, Microsoft Azure has adopted a multi-region design approach to ensure high cloud availability. By implementing multi-region architectures, Azure has allowed customers to distribute workloads across different regions, creating an effective failover architecture in case of interruptions. For example, European businesses have been able to distribute their workloads between West Europe and North Europe. In case of problems in one region, the other can automatically intervene, reducing the risk of downtime and ensuring operational continuity.

Figure 3 – Multi-Region Model

The ‘Data Residency Boundary’ demonstrates that, despite geographic distribution, data remains confined within a designated area, ensuring compliance with local regulations. Azure thus meets not only the technical needs for availability but also the legal and compliance requirements of global customers.

However, with Microsoft’s global expansion, there has been an evolution in the design of cloud infrastructures. The Azure North Italy region is an example, adopting a single-region approach with three availability zones and no paired regions, still ensuring excellent service availability and resilience.

Figure 4 – Single-Region Model

The North Italy region, created after careful risk analysis, ensures optimal security and performance. With latencies below 2 milliseconds, it offers synchronous replication of applications and data, maintaining operational continuity and data integrity. Each availability zone has independent data centers with autonomous resources, highlighting Microsoft’s commitment to high operability and service reliability.

Respecting the ‘Data Residency Boundary’ is crucial in Europe, where data protection regulations are stringent. The North Italy region is a model of adaptation to these needs, ensuring that data remains within regional borders and compliant with local laws.

The Azure Italy North Region: an opportunity for italian businesses

Addressing Italian companies considering the cloud to expand or transfer their IT infrastructure, the Azure North Italy region emerges as a promising choice. For businesses with operational headquarters exclusively in Italy, adopting this region offers tangible benefits, such as reduced latency and high performance, critical aspects for those operating predominantly at the national level. This choice also aligns with EU and Italian data residency regulations.

For customers currently using Azure services in other regions, such as West Europe, the transition to North Italy requires a more in-depth analysis. Key elements to consider include the impact on existing IT infrastructures, operational costs, and application performance. It is also crucial to evaluate latency in interactions between services located in different regions.

Another relevant factor is the need to serve users in geographically distant areas. In such cases, it might be more effective to maintain some services in a region closer to end-users or consider solutions that involve the distribution of Azure services across multiple regions.

The decision on the most suitable Azure region depends on the specific needs of the company and the geographical distribution of users. The advantage of the cloud lies in its flexibility and ability to adapt to various scenarios. Therefore, for Italian companies, both in the initial phase of adopting the cloud and in the expansion phase, the Azure North Italy region represents an option to be carefully considered.

Why choose Azure in northern Italy

Among the main aspects leading to the choice of adopting the Azure region located in Italy are:

Opting for a data center located in Italy means that data is physically stored within the country, in compliance with Italian data residency regulations. This choice not only minimizes risks related to data sovereignty but also ensures compliance with national and European Union regulations.
Companies can be sure of operating within the data borders of the EU and take advantage of advanced confidential computing capabilities, which provide additional levels of protection for sensitive data.
Optimization of performance for applications. Whether it’s Internet of Things (IoT) applications, Virtual Desktop solutions, or hybrid infrastructures, the North Italy region has been designed to support intensive use scenarios and to ensure the necessary performance for these advanced technologies.
Energy cost savings and reduced environmental impact. The North Italy region stands out for its energy efficiency, with a Power Usage Effectiveness (PUE) index of 1.12 and a Water Usage Effectiveness (WUE) of 0.023 l/kWh. These figures reflect Microsoft’s commitment to sustainability and energy efficiency.

Conclusions

The presence of Microsoft Azure in Italy represents a valuable resource for local businesses. Azure stands out for its versatility and adaptability, proposing an ecosystem that is easily integrable with various operational contexts and capable of meeting specific business needs, while ensuring efficiency and reliability. The availability of this cloud platform in Italy allows companies to benefit from greater scalability in the digital sector, thanks to reduced latency, high performance, and full adherence to local regulations. A determining factor is compliance and sovereign data management: the Azure Italy North region strictly respects European data protection laws, ensuring that data remains within regional borders and compliant with current regulations. A distinctive feature of this region is also energy efficiency and a lower environmental impact, resulting in advantageous energy consumption. With Azure, Italian companies have the opportunity to embark on a path of digital innovation, availing themselves of customized solutions, maximum security, and regulatory compliance

Azure IaaS and Azure Stack: announcements and updates (January 2024 – Weeks: 01 and 02)

Azure

Storage

Customer-Managed Keys for Azure NetApp Files volume encryption

Azure NetApp Files now supports customer-managed keys for volume encryption, enhancing data security and control. This feature allows users to manage their encryption keys, providing an additional layer of security for sensitive data stored in the cloud. The integration of customer-managed keys with Azure NetApp Files ensures that data encryption aligns with organizational policies and regulatory requirements, offering a secure and compliant storage solution.

Premium SSD v2 and Ultra Disks support with Trusted Launch

Azure introduces the general availability of Premium SSD v2 and Ultra disks support for Trusted Launch virtual machines. This integration enhances security and performance for Azure virtual machines. Trusted Launch provides foundational security with features like Secure Boot and vTPM, protecting against advanced threats. The Ultra disks offer high-performance storage ideal for data-intensive workloads, while Premium SSD v2 disks provide a cost-effective solution for a broad range of enterprise applications.

Zone Redundant Storage for Azure Disks in more regions

Azure has expanded the availability of Zone Redundant Storage (ZRS) for Azure Disk Storage. Now available in West US3 and Germany West Central regions, ZRS enables synchronous data replication across three availability zones. This feature enhances data resilience and application uptime by mitigating the impact of zonal failures. ZRS is compatible with Azure Premium SSDs and Standard SSDs, ensuring high availability for critical workloads.

Azure Ultra Disk Storage Now Available in UK West and Poland Central

Azure has expanded its Ultra Disk Storage to the UK West and Poland Central regions, offering high throughput, high IOPS, and consistent low-latency disk storage. Azure Ultra Disk Storage is ideal for handling data-intensive workloads like SAP HANA, top-tier databases, and transaction-heavy processes. This expansion provides users in these regions with access to Azure’s most advanced storage solutions, optimizing performance for critical applications.

Conclusion

Microsoft Cloud for Sovereignty: the solution to meet sovereignty requirements in the cloud and hybrid environments

Microsoft has recently announced the availability of Microsoft Cloud for Sovereignty across all Azure regions. This solution offers reliable options for the public sector, designed to support the migration, development, and transformation of workloads in Microsoft’s cloud while complying with regulatory, security, and control requirements. In this article, we delve into the distinctive features of Microsoft Cloud for Sovereignty, exploring how it can ensure rapid digital transformation for government entities in compliance with regulations.

Sovereignty in the Hyperscale Cloud

Governments worldwide must meet a wide range of national and regional compliance requirements for applications and workloads, including governance, security controls, privacy, and in some cases, data residency and sovereign protections. Until now, most solutions to meet these regulatory requirements relied on private clouds and on-premises environments, slowing the adoption of scalable, secure, and resilient cloud solutions.

What is Data Sovereignty and Microsoft’s Stance on ‘Sovereignty’?

Data sovereignty is the concept that data is under the customer’s control and regulated by local laws. While data residency ensures data remains in a specific geographic location, data sovereignty ensures adherence to the regulations of the country where the public sector customer is located. Each jurisdiction has its own requirements, vision, and unique needs when it comes to addressing sovereignty. In this regard, while Microsoft believes many of these needs are met through standard cloud solutions, it has introduced Microsoft Cloud for Sovereignty, providing an additional layer of capabilities to meet the individual needs of public sector and government clients. It is then up to partners and clients to determine what is appropriate for their specific needs. For the most sensitive workloads that cannot be hosted in the public cloud, Microsoft offers hybrid options, such as Azure Stack HCI, allowing customers to keep data in their own on-premises environments.

The following paragraphs outline the most common requests for achieving data sovereignty in the cloud.

Residency, Security, and Compliance in the Hyperscale Cloud

Microsoft Cloud for Sovereignty is rooted in over 60 global Azure cloud regions, ensuring unmatched security and a wide range of regulatory compliance. This positions Microsoft as the cloud provider with the most regions worldwide, and this infrastructure allows customers to implement specific policies to ensure their data and applications remain within their preferred geographic boundary, fully respecting national or regional data residency requirements.

Controls for Data Access

Microsoft Cloud for Sovereignty provides controls to ensure sovereignty, protection, and encryption of sensitive data and to control access, enabled by:

Sovereign Landing Zone: A specific Azure landing zone designed for entities requiring privacy, security, and sovereign controls in compliance with governmental regulations. These zones provide a repeatable and secure approach for cloud service development and deployment. Governments facing complex and multilevel regulatory contexts find in the Sovereign Landing Zones an effective solution for designing, implementing, and managing solutions, adhering to established policies. They allow for the implementation and configuration of Azure resources, ensuring alignment with the best practices of the Cloud Adoption Framework (CAF). These guides enable organizations to meet data sovereignty requirements. For more information on SLZ and their features, it is recommended to consult the documentation on GitHub.
Azure Confidential Computing: A technology developed by Microsoft aimed at enhancing data security while being processed in the cloud. Traditionally, data can be protected while at rest (stored) or in transit (during transmission), but become vulnerable when in use or running on a server. Confidential Computing seeks to bridge this gap by protecting data even when in execution. This is achieved through the use of a technology called “Trusted Execution Environment” (TEE), which is essentially a secure area of the processor. TEEs isolate data and code in execution from other processes, including those of the operating system, so that only authorized code can access the data. This means that even if an attacker manages to penetrate the operating system or network, they would not be able to access the protected data within the TEE. Azure Confidential Computing is particularly useful for use cases requiring a high level of data security, such as financial transactions, healthcare information management, or handling sensitive data for businesses or governments.

The Complexity of Addressing Regulations that Vary from Country to Country

Digital sovereignty is a complex issue, varying significantly from one nation to another. To address this challenge, Microsoft has adopted a collaborative and customized approach with its Microsoft Cloud for Sovereignty. By working closely with local partners in different countries, Microsoft is able to tailor its cloud solutions to the specific needs of each client, maximizing efficiency and ensuring secure implementations.

In this context, Microsoft offers its clients the ability to adopt specific policies related to sovereignty through Azure, simplifying the process of complying with national and regional regulations. These initiatives (set of policies) help clients establish cloud security parameters, facilitating compliance with regulations.

A concrete example is the adoption of the Azure Cloud Security Benchmark. Clients can start here, then add the new Sovereignty Policy Baseline to strengthen digital sovereignty practices. Additionally, they can integrate specific layers for their regions, such as the guidelines for cloud migration from the Italian National Agency for Cybersecurity of Public Administration (ACN) for clients in Italy.

Furthermore, the new Cloud Security Alliance Cloud Controls Matrix (CSA CCM v4) policy initiative offers a global benchmark that informs and guides many regional standards, further consolidating Microsoft’s commitment to secure, compliant, and sovereign cloud solutions.

How Microsoft Ensures Data Remains in a Specific Country and Supports Sovereignty Needs of Governments Without Azure Regions in Their Territory?

Microsoft provides detailed information about data residency in the Microsoft Cloud through its documentation and the Microsoft Trust Portal. Additional measures to maximize data residency have been announced as part of the EU Data Boundary. Governments worldwide have different preferences regarding sovereignty and data residency. For some clients, data residency in their own country is not a prerequisite for sovereignty. Moreover, the sovereignty controls that Microsoft provides can be used anywhere, even in the absence of a region in their own country.

Microsoft Cloud for Sovereignty for Italian Clients

A significant step towards digital sovereignty in Italy is represented by the introduction of the new Azure Italy North region. This region opens new possibilities for public and private clients, offering them access to Sovereign Landing Zones. Additionally, Azure Italy North stands out for adopting cutting-edge technologies like Azure Confidential Computing. With the addition of Azure Italy North, Microsoft demonstrates its commitment to supporting the specific needs of Italian clients, providing advanced technological solutions that meet the challenges of digital sovereignty and data security.

Capabilities of Microsoft Cloud for Sovereignty

The capabilities of Microsoft Cloud for Sovereignty extend across several levels:

Built on the capabilities of the public Azure cloud.
Regulatory compliance and transparency on cloud operator activities.
Sovereignty guidance through codified architectures, workload templates, Azure Policy Initiatives, tools, and guidelines.
Advanced control services like Azure Confidential Computing and Azure Key Vault Managed HSM.

Figure 1 – The Various Layers that Compose Microsoft Cloud for Sovereignty

New Capabilities for Sovereignty

The following new solutions highlight Microsoft’s ongoing investment in improving sovereignty in the hyperscale cloud:

Drift Analysis Capability: Continuous administration and maintenance can potentially introduce changes that are not compliant with established policies, causing the deployment to deviate from compliance over time. The new drift analysis tool inspects the deployment and generates a list of non-compliant settings, along with a severity assessment, facilitating the identification of discrepancies to be remedied and the verification of compliance in specific environments.
Transparency Logs: Provides eligible customers with visibility into instances where Microsoft engineers have accessed customer resources through Just-In-Time (JIT) access, most commonly in response to a customer support request.
New Configuration Tools in the Azure Portal: Allow customers to create a new custom Sovereign Landing Zone in two simple steps using a guided experience.

Conclusions

In conclusion, Microsoft Cloud for Sovereignty represents a significant turning point in data management and digital sovereignty in the cloud and hybrid environments. With its ability to meet complex compliance requirements and ensure data security, this solution stands as a fundamental pillar for the public and governmental sector. The availability across all Azure regions, coupled with innovative Azure Confidential Computing and Sovereign Landing Zones, offers customers unprecedented flexibility to keep data within national or regional boundaries, respecting local regulations. Microsoft’s personalized and collaborative approach in responding to the specific needs of each country demonstrates a clear commitment to digital sovereignty, offering secure, scalable, and reliable solutions. Particularly for Italian clients, the opening of the Azure Italy North region is a significant step forward, highlighting Microsoft’s investment in supporting local needs and strengthening data security. Overall, Microsoft Cloud for Sovereignty emerges as an important innovation in the cloud computing landscape, advancing the mission of a safer, compliant, and sovereign digital future.

Azure Management services: what’s new in December 2023

This month, Microsoft introduced a series of significant updates to the Azure management services. Through this series of monthly articles, the aim is to offer an overview of the most relevant news. The goal is to keep you constantly informed about these developments, providing you with the essential information to further explore these topics.

The following diagram shows the different areas related to management, which are covered in this series of articles:

Figures 1 – Overview of Management Services in Azure

Configure

Azure Automation

Retirement of Azure Automation Services – August 31, 2024

Microsoft has announced that on August 31, 2024, two services in Azure Automation will be retired: the Update Management service and the Change Tracking and Inventory service, both using the Log Analytics agent.

Retirement of the Azure Automation Update Management service: This service, currently used for update management and system maintenance, will no longer be available after August 31, 2024. Users are encouraged to migrate to alternative solutions offered by Azure to maintain effectiveness in managing their system updates.
Retirement of the Change Tracking and Inventory service with Log Analytics Agent: Similarly, the Change Tracking and Inventory service, which utilizes the Log Analytics agent in Azure Automation, will end its operations on the same date. Customers are invited to explore and adopt other solutions provided by Azure to effectively manage change tracking and inventory management of IT resources.

Microsoft urges its users to take timely action to ensure a smooth transition to the new proposed solutions, thus ensuring continuity and efficiency in managing their IT infrastructures.

Govern

Azure Cost Management

Updates related to Microsoft Cost Management

Microsoft is constantly looking for innovative ways to enhance Microsoft Cost Management, their solution designed to provide greater transparency on cloud costs, identify and prevent inefficient spending patterns, and optimize overall costs. During 2023, numerous improvements and significant updates have been implemented to this solution. These updates aim to make Microsoft Cost Management even more effective in providing its users with the information and tools necessary to manage cloud expenses more efficiently and consciously.

Secure

Microsoft Defender for Cloud

New features, bug fixes, and deprecated features of Microsoft Defender for Cloud

The development of Microsoft Defender for Cloud is constantly evolving, and improvements are introduced on an ongoing basis. To stay up-to-date on the most recent developments, Microsoft updates this page, which provides information on new features, bug fixes, and deprecated features. Specifically, this month’s main news includes:

Defender for Servers at the resource level: it is now possible to manage Defender for Servers on specific resources within one’s subscription, allowing full control over the protection strategy. This capability allows for configuring specific resources with custom settings different from those configured at the subscription level.
Retirement of the classic multi-cloud connectors: the experience of the classic multi-cloud connectors has been retired, and data is no longer transmitted to connectors created through that mechanism. The new native multi-cloud connectors, available for AWS and GCP since March 2022 without additional costs, completely replace the value of these classic connectors.
Release of the coverage workbook: this tool allows monitoring which Defender for Cloud plans are active on which parts of the environment, helping to ensure complete protection of environments and subscriptions.
Vulnerability assessment for Container Images in Azure Government and Azure managed by 21Vianet: vulnerability assessment for Linux container images in Azure is now also available in Azure Government and Azure managed by 21Vianet.
Support for Windows in the Container Vulnerability Assessment (preview): support for Windows images has been released in public preview as part of the vulnerability assessment for Azure and Azure Kubernetes Services container registries.
Agentless container security posture for AWS in Defender for Containers and Defender CSPM (preview): the new agentless capabilities of container security posture are now available for AWS.
Support for PostgreSQL Flexible Server in the Defender plan for open-source relational databases: Microsoft has announced support for PostgreSQL Flexible Server in the Microsoft Defender plan for open-source relational databases.

Protect

Azure Backup

Crash Consistent Multi-Disk VM Restore Points

Microsoft recently announced the introduction of support for the ‘Crash Consistent’ multi-disk mode in virtual machine (VM) restore points. This feature provides an agentless solution that captures and preserves both the VM configuration and write- and timing-consistent snapshots for all managed disks connected to the VM. The captured state is equivalent to that of the data present in the VM in the event of a power outage or system crash. This innovation aims to significantly improve reliability and data management in Azure infrastructures.

Azure Site Recovery

New Update Rollup

Update Rollup 70 has been released for Azure Site Recovery. This update brings significant improvements in terms of functionality and service stability, consolidating Azure Site Recovery’s position as a reliable solution for disaster recovery. The related details and the procedure to follow for installation can be found in the specific KB.

Migrate

Azure Migrate

‘As on-premises’ in Azure Migrate SQL Discovery and Assessment (preview)

Azure Migrate has introduced the new ‘As on-premises’ sizing policy for SQL instance assessments. This feature allows for quick and accurate analysis of SQL instances identified by the Azure Migrate appliance. The ‘As on-premises’ policy is based on the source SQL instance configuration to provide appropriate sizing recommendations for the target Azure SQL service. Additionally, if performance data is available, an assessment can be carried out based on these performances to obtain customized SKU recommendations for the source workload on Azure. In cases where performance data is not available for some specific instances, the ‘As on-premises’ sizing is employed to ensure precise and reliable target sizing.

New releases and features of Azure Migrate

Azure Evaluation

Azure IaaS and Azure Stack: announcements and updates (December 2023 – Weeks: 51 and 52)

This blog post series highlights the key announcements and major updates related to Azure Infrastructure as a Service (IaaS) and Azure Stack, as officially released by Microsoft in the past two weeks. This release marks the final update for the year 2023, and I take this opportunity to wish everyone the best for the upcoming year 2024!

Azure

General

Microsoft Cloud for Sovereignty

Microsoft has announced the general availability of Microsoft Cloud for Sovereignty, a significant advancement in cloud technology for government agencies. This new offering is designed to meet the unique compliance, security, and policy requirements of governments while leveraging cloud capabilities to deliver enhanced value to citizens.

Key Highlights:

Compliance and Security: Microsoft Cloud for Sovereignty is built on over 60 cloud regions, providing industry-leading cybersecurity and the broadest compliance coverage. It enables governments to implement policies that align with national or regional data residency requirements.
Sovereign Controls: The platform offers sovereign controls to protect and encrypt sensitive data. This includes sovereign landing zones and Azure Confidential Computing, which secures data in memory in hardware-based trusted execution environments.
Policy Initiatives: Governments can adopt sovereignty-focused Azure policy initiatives to address the complexity of compliance with national and regional regulatory requirements. This includes the Azure Cloud Security Benchmark and Sovereignty Policy Baseline, among others.

New Capabilities:

Drift Analysis Tool: Identifies non-compliant settings and helps maintain policy compliance.
Transparency Logs: Provides visibility into instances where Microsoft engineers access customer resources.
Configuration Tools in Azure Portal: Simplifies the creation of sovereign landing zones.

This development marks a significant step in enabling governments to harness the power of cloud technology while maintaining strict control over data sovereignty and regulatory compliance.

Compute

Red Hat Enterprise Linux 8.9 on Azure Virtual Machines

Azure now supports Red Hat Enterprise Linux (RHEL) 8.9 on its Virtual Machines, marking the latest minor release of RHEL 8. This version offers enhanced stability, security, and performance for production environments. Key features include streamlined deployment and migration options, new metrics in the performance co-pilot, and new Application Streams for Node.js 20, Java-21, and compiler toolkits. RHEL 8.9’s release emphasizes Azure’s commitment to providing a versatile and efficient operating environment for varied infrastructures.

Networking

Security Update for Azure Front Door WAF CVE-2023-50164

Azure has deployed a new managed rule for its global Web Application Firewall (WAF) customers to address the security vulnerability CVE-2023-50164. This update is crucial for applications potentially impacted by this vulnerability. The fix has been implemented in the ruleset versions 2.1, 2.0, and earlier. The rule, identified as ID 99001017 in the MS-ThreatIntel-CVEs Rule Group, is initially set to ‘Disabled’ with an ‘Anomaly Score’ action, and users are advised to enable it if their application is vulnerable. This update underscores Azure’s commitment to providing robust security for web applications.

Security Update for Application Gateway WAF CVE-2023-50164

Azure has announced the general availability of a security update for the Application Gateway WAF to address the CVE-2023-50164 vulnerability. This update is vital for regional WAF customers to safeguard their applications. The update includes changes to the Default Ruleset (DRS) and Core Ruleset (CRS), with the rule ID 99001017 now set to ‘Enabled’ and ‘Log’ action. It’s important to note that the ‘Anomaly Score’ action is not supported for this rule, and users with older WAFs running CRS 3.1 should upgrade to enable ‘Block’ mode.

Conclusion

Azure IaaS and Azure Stack: announcements and updates (December 2023 – Weeks: 49 and 50)

Azure

General

Azure Support Plan offer extended

Microsoft Azure has announced an extension of its Azure Support offer. Starting from January 1, 2024, all new and renewing Azure customers who purchase an Enterprise Agreement (EA or EES) or are part of the field-led Microsoft Customer Agreement (MCA) will receive free Azure Standard support. This promotion, designed to assist customers in their cloud journey, will be available until June 30, 2024, at no additional charge. The offer aims to provide an extra level of access to expert technical support, enhancing the Azure experience for enterprise customers. Existing customers will automatically benefit from this offer, with no additional action required. The terms of the promotion can be viewed on the Azure website, with updates to be visible from January 1, 2024.

Compute

Intel TDX based confidential VMs now available in Azure (preview)

Microsoft Azure has introduced the public preview of DCesv5 and ECesv5-series confidential virtual machines (VMs), marking a significant advancement in cloud computing security. These VMs, powered by 4th Gen Intel® Xeon® Scalable processors with Intel® Trust Domain Extensions (Intel® TDX), are now accessible through the Azure portal, Azure CLI, and ARM templates. This development enables organizations to bring confidential workloads to the cloud without necessitating code changes to applications. Initially available in select regions including Europe West, Central US, and East US 2, these VMs represent a leap forward in Azure’s confidential computing capabilities. The introduction of these VMs underscores Azure’s commitment to providing secure and innovative cloud solutions.

Networking

Delaying domain Front Block on Azure Front Door and CDN Services

Microsoft Azure has announced the postponement of the enforcement of blocking domain fronting on Azure Front Door and Azure CDN Standard from Microsoft (classic) to January 22, 2024. This decision, influenced by customer feedback, aims to provide additional time for users to adapt to the upcoming changes. Azure plans to introduce two log fields, “SNI” and “Result,” by December 25, 2023, to assist customers in identifying domain fronting behavior in their resources. The enforcement of this block is intended to enhance security by preventing traffic that attempts to bypass domain fronting checks. It’s important to note that this change will not affect regular users accessing the service through compliant browsers, APIs, SDKs, etc., and is focused on enhancing the security of Azure’s network services.

Storage

Azure File Sync agent v17 release: enhanced performance and expanded features

Microsoft has announced the release of Azure File Sync agent v17, now in flighting and accessible on the Microsoft Update Catalog. This latest update introduces significant improvements and fixes, enhancing the overall performance and functionality of Azure File Sync. Key enhancements include:

Sync Upload performance improvements: users will experience notable improvements in sync upload performance, especially beneficial during file share migrations and high churn events where a large number of files need uploading.
Expanded character support for file and directory names: the update extends the list of supported characters for file and directory names in SMB File shares, aligning with the NTFS file system’s capabilities for valid Unicode characters. This expansion allows for greater flexibility in naming conventions.
New Cloud Tiering low disk space mode metric: a new feature enables users to configure alerts for servers in low disk space mode, enhancing monitoring capabilities.
Resolved agent update issue: the update addresses and resolves a previous issue where the agent update process would hang, improving reliability.
Miscellaneous reliability and telemetry improvements: the release also includes various enhancements for cloud tiering and sync, focusing on reliability and telemetry.

Additional Release Information:

The v17 release is compatible with Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, and Windows Server 2022.
Windows Server 2012 R2 users must have .NET Framework version 4.6.2 or higher.
The agent version for this release is 17.0.0.0.

For installation instructions and further details, users can refer to KB5023053 in the Microsoft knowledge base. This release marks a significant step forward in the Azure File Sync service, offering enhanced performance and expanded capabilities to users.

Conclusion

Azure IaaS and Azure Stack: announcements and updates (December 2023 – Weeks: 47 and 48)

Azure

Storage

Encryption at Host for Premium SSD v2 and Ultra Disks

Azure has announced the general availability of encryption at host for Premium SSD v2 and Ultra Disks. This feature, already available for other Azure Disk types, ensures that data on the Virtual Machine (VM) host is encrypted at rest and remains encrypted during transit to the Storage service. The encryption at host for Premium SSD v2 and Ultra Disks enhances data security and privacy, providing an additional layer of protection for sensitive information stored on Azure. This update is a significant step forward in Azure’s commitment to offering secure and reliable cloud storage solutions.

Azure NetApp Files support for 2 TiB Capacity Pools

Azure NetApp Files now supports the creation of capacity pools with a minimum size of 2TiB, a feature that has reached general availability. This enhancement is particularly useful for workloads such as SAP shared files and VDI, which require lower capacity pool sizes for their capacity and performance needs. Customers can now start with a 2TiB pool and increase in 1TiB increments, providing a more cost-effective solution for managing capacities less than 3TiB. This update is supported in all regions with standard network features, offering customers the flexibility to re-evaluate volume planning and take advantage of the savings associated with smaller capacity pools.

User and Group quota management in Azure NetApp Files

Azure NetApp Files has reached general availability with its user and group quota management feature. This functionality allows administrators to control storage consumption by setting capacity limits for individual users or groups within a specific Azure NetApp Files volume. It supports NFS, SMB, and dual protocol-enabled volumes, offering both default and individual user quotas. For NFS-enabled volumes, default or individual group quotas can be defined. This feature is now available in Azure commercial regions and US Government regions, providing a robust solution for managing capacity consumption and ensuring efficient storage utilization.

Azure NetApp Files: standard network features support in US Government Regions

Azure NetApp Files now offers general availability of standard network features in US Government regions, including Virginia, Texas, and Arizona. This enhancement delivers an improved Virtual Networking experience for non-Azure host-based workloads like Azure NetApp Files. Key features include increased route scale for VNets with ANF volumes, enhanced network security with support for Network Security Groups (NSGs) on ANF delegated subnets, and improved network control through User Defined Routes (UDRs). Additionally, it facilitates on-premises connectivity, ExpressRoute FastPath connectivity, cross-region mount volumes, and support for Private Link and service endpoints. This update significantly enhances the networking capabilities and security for Azure NetApp Files in US Government regions.

Conclusion

Over the past two weeks, Microsoft has introduced a slew of updates and announcements pertaining to Azure Infrastructure as a Service (IaaS). These developments underscore the tech giant’s unwavering commitment to enhancing its cloud offerings and adapting to the ever-evolving needs of businesses and developers. Users of Azure can anticipate improved functionalities, streamlined services, and enriched features as a result of these changes. Stay tuned for more insights as I continue to monitor and report on Azure’s progression in the cloud sphere.