Azure Update 1st May 2026

Key Concepts

• Azure CNI powered by Cilium: Container networking interface using Cilium for advanced networking.
• WireGuard: A modern, high-performance VPN protocol used for in-transit encryption.
• Azure Front Door: Global Layer 7 load balancer and content delivery network.
• Azure Elastic SAN: A high-performance, scalable block storage service using iSCSI.
• User Delegated SAS: Shared Access Signatures signed by Entra ID identities rather than storage account keys.
• Cascading Read Replicas: A database architecture allowing replicas to be created from other replicas.
• Microsoft Agent Framework: A unified framework for building AI agents, merging Semantic Kernel and AutoGen.
• Foundry Agent Service: A platform for deploying, managing, and providing memory to AI agents.

Compute and Container Services

• AKS Encryption: AKS clusters using Azure CNI powered by Cilium can now enable in-transit encryption via WireGuard. This encrypts pod-to-pod traffic without requiring application changes or sidecars. Note: Enabling this requires a Cilium agent restart, which impacts workloads.
• AKS Insights Agent: Now in preview, this tool allows natural language interaction to query telemetry, logs, and metrics to identify root causes and receive remediation advice.
• Red Hat OpenShift: Now generally available (GA) in the Austria East region.
• Azure Functions: Java 25 support is now GA for both Windows and Linux, including the Flex Consumption plan.

Networking and Security

• Azure Front Door WAF: A new HTTP DDoS protection rule set is available for the Premium SKU. It utilizes machine learning to establish traffic baselines, detect surges, and selectively block malicious traffic.
• Azure Virtual Network Manager (AVNM): Now supports cross-region IP Address Management (IPAM) pool association, allowing IP pools to be associated with VNets in different regions.

Storage

• Azure Elastic SAN Enhancements:
  • CRC32C Checksums: Enables data integrity validation. Can be enforced at the volume level, where the service will reject connections lacking the required data digest.
  • Windows VM Extensions: Simplifies configuration by automating the setup of native iSCSI and Multipath I/O (MPIO) on Windows VMs, allowing for full automation via ARM/Bicep/Terraform templates.
  • Azure Backup Support: Provides protection against logical corruption or malicious deletion by taking snapshots every 24 hours, maintaining up to 450 recovery points.
• Blob Storage: User-delegated SAS now supports prefix-based restrictions. This allows developers to restrict access to specific virtual directories within a storage account, enhancing security for multi-tenant or multi-project environments.

Database

• PostgreSQL Cascading Read Replicas: Now GA. This feature allows for a "replica of a replica" architecture (up to two levels deep). Users can now have up to 30 read replicas total (5 primary replicas, each with 5 sub-replicas), significantly offloading read-heavy workloads from the primary instance.

AI and Agent Frameworks

• Microsoft Agent Framework (1.0): Now GA for .NET and Python. It merges Semantic Kernel and AutoGen, supporting both agentic workflows and graph-based multi-step tasks.
• Foundry Hosted Agents: In preview, these provide isolated, secure execution environments (VM kernel mode) for agent sessions. Users provide a container image via Azure Container Registry, and the service handles deployment, identity, and endpoint exposure.
• Foundry Agent Service:
  • Bring Your Own AI Gateway: Now GA, allowing users to integrate non-Azure AI model gateways.
  • Managed Memory (Preview): Provides "memory as a service," allowing agents to maintain long-term conversation history, user preferences, and personalization. It integrates with Microsoft Agent Framework and LangGraph, using a memory search tool for read/write operations.
• Retirement: Prompt flow is scheduled for retirement in April 2027, as the Microsoft Agent Framework supersedes its functionality.

Synthesis

This week’s updates focus heavily on security and scalability. The introduction of WireGuard encryption for AKS and DDoS protection for Front Door highlights a push toward "secure by default" networking. The enhancements to Elastic SAN and PostgreSQL read replicas provide enterprise-grade reliability and performance for data-heavy applications. Finally, the consolidation of AI tooling into the Microsoft Agent Framework and the addition of managed memory services signal a shift toward more sophisticated, stateful, and secure AI agent deployments in the Azure ecosystem.