Azure Update - 25th July 2025

Key Concepts

• Generative AI workload selection
• Azure CNI static block allocation
• Azure Firewall ingestion time transformations
• Web Application Firewall (WAF) for App Gateway for Containers
• Azure Managed Lustre V-Net encryption support
• Log Analytics search job enhancements
• Log Analytics summary rules
• Microsoft Sentinel data lake support

Generative AI Workload Selection

Many organizations are trying to implement generative AI in their applications but struggle with selecting the right initial workload. The speaker emphasizes the importance of choosing a "safe" first workload to build confidence within the organization. Considerations include evaluating opportunities and identifying workloads with a high likelihood of success.

Azure CNI Static Block Allocation

Azure Container Networking Interface (CNI) with static block allocation has reached General Availability (GA). Azure CNI provides a flat network where pods receive IP addresses routable from the virtual network. Previously, Azure CNI was limited to 60,000 pods due to a /16 CIDR range restriction. Static block allocation overcomes this limitation, enabling scaling to over 1 million pods while maintaining V-Net routable IP addresses. Each node in the node pool receives a pre-allocated block of IPs (a CIDR range), and pods on that node consume IPs from that range. This removes scale as a limiting factor for Azure CNI. While overlay networks are often preferred, this enhancement makes Azure CNI a viable option for large-scale deployments.

Azure Firewall Ingestion Time Transformations

Azure Firewall now offers ingestion time transformations for its logging, which is now GA. Logging generates a large volume of data, leading to high ingestion and storage costs. Ingestion time transformation allows modifying logs as they are ingested into the Log Analytics workspace, reducing data volume and associated costs. This involves filtering, modifying, and keeping only relevant data. The process is similar to traditional ETL (Extract, Transform, Load) pipelines. Transformations are created using Kusto Query Language (KQL) statements. Every write to the Log Analytics workspace triggers the KQL statement, modifying or filtering the data before storage.

Web Application Firewall (WAF) for App Gateway for Containers

Web Application Firewall (WAF) is now available in preview for App Gateway for Containers. This was a highly requested feature. Despite the name, App Gateway for Containers was rebuilt from the ground up specifically for Kubernetes workloads. It uses Kubernetes gateway APIs, mapping them to the Azure control plane for data plane updates. Users interact with Kubernetes and gateway APIs without needing to manage Azure-specific configurations. The WAF provides regional protection against threats like SQL injection and cross-site scripting. It includes a default rule set and supports additional features like rate limiting and bot manager rule sets.

Azure Managed Lustre V-Net Encryption Support

Azure Managed Lustre now supports V-Net encryption. Azure Managed Lustre is commonly used in high-performance computing (HPC) scenarios due to its support for massive parallel access and throughput. Lustre enables numerous compute instances to access the same data simultaneously. V-Net encryption ensures data is encrypted in transit between virtual machines within the virtual network. This provides data confidentiality between HPC compute nodes (VMs) and storage, meeting data confidentiality requirements and regulations.

Log Analytics Search Job Enhancements

Log Analytics has enhancements to search jobs, which are now GA. Azure Managed Logs has different tiers of data storage. Data in long-term retention or the archive store requires a search job to access. A search job finds the data and pulls the results into a regular analytics table, where KQL can be used. Enhancements include:

• Cost estimation before running the job.
• Improved user interface.
• Ability to run more jobs in parallel.
• Increased number of results that can be returned and stored.
• Additional KQL support.

Log Analytics Summary Rules

Summary rules are now GA for Log Analytics. Summary rules are useful for high ingestion streams and work with analytics basic auxiliary plans. At a set cadence, a summarization query defined in KQL is run. This allows storing massive amounts of data in a cheaper storage tier while creating a summarized, aggregated view of the data in an analytics table. The summarization query runs at a defined interval (e.g., every minute, 5 minutes, 10 minutes) to create the aggregated view. This reduces the amount of data stored in the analytics tier, saving money. The summarized data can be stored for longer. Up to 100 summarization rules can be created.

Microsoft Sentinel Data Lake Support

Microsoft Sentinel now has data lake support in preview. Traditionally, Sentinel uses a Log Analytics workspace for ingestion and storage of security signals, which can be costly. This often leads to compromises on the amount of data ingested, potentially impacting threat detection capabilities. The new data lake capability builds on Azure Data Lake to provide a cheaper storage option. It uses the same schemas as Log Analytics workspaces and works with existing connectors. Users can choose to send data to the traditional analytics tier or the data lake tier. All analytics data will go to the data lake tier as well. KQL and Python-based analytics can still be run on data in the data lake, but performance is lower than with data in the analytics tier. The data lake is suitable for verbose logs needed for hunting and can be used for long-term retention (up to 12 years). The analytics tier is still used for querying, visualization, alerting, and proactive issue identification. This provides the ability to store more data without compromising on cost.

Conclusion

This week's Azure updates focus on optimizing cost and enhancing security. Key updates include static block allocation for Azure CNI, ingestion time transformations for Azure Firewall logs, WAF for App Gateway for Containers, V-Net encryption for Azure Managed Lustre, enhancements to Log Analytics search jobs and summary rules, and data lake support for Microsoft Sentinel. These updates provide greater scalability, cost efficiency, and security for Azure deployments.