Azure Update - 18th July 2025

Azure Update - July 18th Summary

Key Concepts:

• Entra ID, Microsoft Security Copilot, Conditional Access
• Durable Functions, Versioning Orchestration
• AKS (Azure Kubernetes Service), Node Autoprovisioning, VM Node Pools, Availability Sets, Extension Manager
• Express Route Gateways, Hobo Public IP
• Azure Front Door, Azure CDN, CNAME Domain Validation
• Blob NFS, Blobfuse, Libfuse 3
• Event Hubs, Geo-Replication
• Ephemeral OS Disks, SSD Storage
• Cosmos DB, Microsoft Fabric, OneLake, Unity Catalog
• PostgreSQL Flexible Server
• Azure Backup, Enhanced Policies, Trusted Launch VMs, GRS, CRR
• Azure AI Speaker Recognition
• Azure Cloud HSM, FIPS 140-3 Level 3, PKCS11

Entra ID and Microsoft Security Copilot

• Entra for Microsoft Security Copilot: A significant update allows interaction with Entra using natural language.
• Conditional Access Agent: Proactively identifies gaps in conditional access policies due to new users or applications falling outside existing policy scopes. It also helps in merging redundant policies.

Compute Updates

• PowerShell Durable Functions SDK GA: A standalone PowerShell module simplifies authoring durable function apps, eliminating previous complexities.
• Durable Functions Versioning Orchestration: Enables assigning versions to different orchestrations within durable function apps. This allows for controlled rollouts of changes and alignment of workers with specific versions. Available for .NET isolated durable function mode, including the durable task scheduler.
• Azure Functions Kafka Trigger: Azure Functions can now be triggered by Kafka topics, enabling real-time message processing within the consumption plan.
• Azure Functions Kafka Output Binding: Azure Functions can now write to Kafka topics via output bindings.
• AKS Node Autoprovisioning GA: Optimizes node provisioning by creating single-instance nodes based on the exact resource requirements of unscheduled pods. This avoids over-provisioning and reduces costs compared to standard node pool autoscaling. Built on the open-source Carpenter project.
• AKS VM Node Pools GA: Allows for node pools containing VMs with different SKUs and sizes within the same VM family. This provides greater flexibility in matching VM resources to workload needs, further optimizing costs. Unlike standard node pools based on VM scale sets, VM node pools individually provision and manage VMs.
• AKS Availability Set Migration (Preview): Provides a command to migrate AKS clusters from availability sets to availability zones. This is crucial due to the deprecation of basic load balancers and public IPs associated with availability sets. The migration process involves installing prerequisites and running the AKS update command with the migrate-vmss-to-vm switch.
• AKS Max Blocked Nodes Allowed (Preview): Allows specifying the maximum number of nodes that can fail to drain during an upgrade or similar operation.
• AKS Extension Manager GA: The AKS Extension Manager, responsible for managing the lifecycle of AKS cluster extensions (e.g., Flux, Azure Backup, Cilium, Dapper), has moved to the control plane. This simplifies security, networking, and reduces operational overhead by removing the extensions from the worker nodes.
• Hobo Public IP for Express Route Gateways GA: Microsoft now hosts the public IP address required for Express Route gateways (used for control plane operations), relieving customers of the management burden and enabling Microsoft to apply policies like data rate limiting and enhanced auditing.

Storage Updates

• Azure Front Door Classic and Azure CDN Classic SKUs Retirement: The classic SKUs are retiring in mid-August. Users must migrate to Azure Front Door Standard or Premium SKUs for new domains or profiles. CNAME-based domain control validation is also being deprecated, requiring alternative validation methods.
• Blob NFS 3.0 Major Update: The Blob NFS solution, which enables accessing Azure Blob Storage using the NFS protocol, has been updated to version 3.0. This version utilizes the same libfuse3 library as Blobfuse, resulting in significant performance improvements (5x read speed, 3x write speed), larger file support (up to 5 TB), removal of the 16-group user limit, and better metadata performance.
• Azure Event Hubs Geo-Replication GA: For premium and dedicated tiers, geo-replication protects against regional outages by continuously replicating metadata and data from the primary region to one or more secondary regions. Promoting a secondary to primary automatically switches the current primary to secondary and reverses the replication flow.
• SSD Storage for Ephemeral OS Disks GA: Allows using SSD (Standard or Premium) storage for the base image of ephemeral OS disks. Ephemeral OS disks use local node storage for the OS disk, with a base image stored separately. Previously, the base image was only stored on standard HDD. Choosing SSD for the base image improves performance and SLA, but incurs a cost.

Database Updates

• Cosmos DB in Microsoft Fabric (Preview): Cosmos DB is now integrated with Microsoft Fabric, mirroring data into OneLake in near real-time. This enables leveraging Fabric's capabilities for faster insights without ETL processes. A Cosmos DB artifact is created in Fabric to initiate the mirroring.
• Azure Databricks Unity Catalog to Microsoft OneLake in Fabric GA: Allows Fabric to access Azure Databricks tables as a read-only data source, with data automatically kept in sync.
• PostgreSQL Flexible Server Available in Indonesia Central: The flexible server deployment option, offering greater control, tuning, high availability, and VM SKU options, is now available in the Indonesia Central region.

Miscellaneous Updates

• Azure Backup Standard to Enhanced Policies Migration GA: Enables migrating from standard to enhanced backup policies without disrupting existing backups. Enhanced policies offer features like multiple backups per day, longer snapshot retention, multi-disk crash consistency, and zonal resilience. Standard policies now support protecting trusted launch enabled VMs.
• Azure Backup GRS and CRR for Premium SSD v2 GA (New Regions): Geo-redundant storage (GRS) and cross-region restore (CRR) are now available for premium SSD v2 virtual machines in Norway West, Norway East, Japan West, and Japan East.
• Azure AI Speaker Recognition Retirement: The Azure AI Speaker Recognition service will be retired at the end of September 2025. Users need to find alternative solutions.
• Azure Cloud HSM GA: A single-tenant hardware security module (HSM) service meeting FIPS 140-3 Level 3 compliance. Customers have full administrative control of their HSM cluster, which consists of three HSM partitions with automatic key and policy synchronization. This is the replacement for Azure Dedicated HSM and is suitable for sensitive applications requiring domain cryptographic-based isolation security. Supports PKCS11 and is a migration target from Azure Dedicated HSM and AWS CloudHSM.

Conclusion

This week's Azure updates cover a wide range of services, focusing on enhanced performance, cost optimization, security, and regional availability. Key takeaways include the general availability of AKS node autoprovisioning and VM node pools for improved resource utilization, the integration of Cosmos DB with Microsoft Fabric for streamlined data analytics, and the introduction of Azure Cloud HSM for highly secure key management. Users should also be aware of the upcoming retirement of Azure Front Door Classic and Azure CDN Classic SKUs and the need to migrate to newer options.