Azure Update - 30th May 2025

Key Concepts

NL Web, Entra ID Internet Access with TLS Inspection, App Service Hybrid Connection Manager, Private Subnet, Azure Firewall DNAT, App Gateway SSE, Azure Front Door Origins (Container Apps, Functions), Azure Front Door Managed Identity, API Management (Session Aware Load Balancing, LLM Logging, Workspace Gateway Metrics, Federated Login, Foundry Integration, Private Endpoint, Applications, Premium v2 Tier, AWS Bedrock), Azure NetApp Files Managed HSM, Premium SSD v2 & Ultra Disk Live Resizing, Elastic SAN Azure Backup, PostgreSQL Versionless CMK, Cosmos DB JavaScript SDK 4.0, Cosmos DB MongoDB vCore Change Stream, Cosmos DB MongoDB Function Triggers/Bindings, DocumentDB Docker Image, API Center Free Tier, MCP Support (API Center, APIM), Azure Migrate (Ultra Disk, Premium SSD v2, App Awareness), Microsoft Planetary Computer Pro, OpenAI Sora Model, Foundry Content Filtering Spotlighting.

Compute

• App Service Hybrid Connection Manager GA: Enables App Service to connect to resources in any network using a relay agent. Now supports Windows and Linux clients with improved logging, GUI, and CLI experience.

Networking

• Private Subnet GA: Removes the implicit public IP address assigned to resources in a subnet by default. After September 30, 2025, explicit internet access methods (NAT Gateway, Load Balancer with Public IP, Public IP, Firewall) will be required.
• Azure Firewall DNAT on Private IPs GA: Destination Network Address Translation (DNAT) is now available on Azure Firewall's private IP addresses, resolving IP address overlapping issues. DNAT transforms the destination IP/port and reverses responses.
• App Gateway SSE (Server-Sent Events) Preview: App Gateway, a Layer 7 application regional load balancer, now supports server-sent events for real-time streaming from server to multiple clients over persistent HTTP connections. Useful for dashboards, notifications, and live feeds.
• Azure Front Door Origins (Container Apps, Functions) GA: Azure Front Door (Premium SKU) now supports Container Apps and Functions using private link (accessed via IP address on a virtual network) as origins. Azure Front Door becomes the only way to consume those instances.
• Azure Front Door Managed Identity Preview: Azure Front Door can now use managed identities to communicate with origins (Standard and Premium SKUs).

API Management (APIM)

• Session Aware Load Balancing GA: Requests from the same session are routed to the same backend instance, crucial for backends maintaining state (e.g., OpenAI Assistants API, Batch API).
• LLM Logging GA: Captures and stores large language model prompts, completions, and token usage metrics via diagnostic settings, enabling observability and insights. Data can be sent to storage accounts, event hubs, Log Analytics workspace, or Azure Monitor Logs.
• Workspace Gateway Metrics: CPU and memory utilization percentages are now available for workspace gateway units. Workspace gateway autoscaling is also GA, scaling based on CPU/memory utilization or defined schedules.
• Federated Login GA: Provides a unified view of logs across the entire APIM instance, useful for platform teams needing a broader scope for security or insights.
• Foundry Integration GA: Direct import of model endpoints from Azure AI Foundry into APIM, simplifying onboarding. APIM policies can then be applied (throttling, token checks, etc.).
• Standard v2 Private Endpoint Support GA: Enables private endpoints for secure communication with the APIM instance, allowing for a complete end-to-end private solution.
• Applications Preview: Improves handling of OAuth-based access to APIs. Enables API products in APIM for application-based access, requiring Entra authentication (OAuth token) for client applications.
• Premium v2 Tier Preview: Architectural change separating management traffic from the data plane. Offers unlimited calls and high limits, designed for large-scale API requirements.
• AWS Bedrock Support Preview: APIM now supports AWS Bedrock APIs. APIM policies (token limits, metric policies, semantic caching) can be applied to AWS Bedrock model endpoints, enabling multi-cloud API management.

Storage

• Azure NetApp Files Managed HSM for CMK GA: Supports Managed HSM (Hardware Security Module) for customer-managed keys for volume encryption, providing FIPS 140-2 Level 3 security.
• Premium SSD v2 & Ultra Disk Live Resizing Preview: Premium SSD v2 and Ultra Disk (connected via NVMe protocol) now support live resizing (increasing size only). Requires NVMe-compatible VM SKUs and OS images.
• Elastic SAN Azure Backup Support Preview: Elastic SAN, a Microsoft-native iSCSI-based solution, now supports Azure Backup. Backups occur every 24 hours, with up to 450 restore points.

Database

• PostgreSQL Versionless CMK GA: Uses a key in Key Vault without specifying a version. PostgreSQL automatically picks up and uses newer key versions upon rotation, simplifying key management.
• Cosmos DB JavaScript SDK 4.0 GA: Improvements include better bulk operation support, client-side encryption, vector and full-text search support, better diagnostic logging, and more flexible/scalable query design.
• Cosmos DB MongoDB vCore Change Stream: Enables real-time notifications of changes, eliminating the need for application polling. Can be enabled/disabled via Azure CLI and ARM templates.
• Cosmos DB MongoDB Function Triggers/Bindings Preview: Triggers serverless Azure Functions when changes occur in MongoDB vCore. Allows binding for further updates/changes to the database.
• DocumentDB Docker Image Preview: Allows running DocumentDB locally for testing purposes.

Miscellaneous

• API Center Free Tier Preview: API Center, a development-time inventory, discovery, and management hub for APIs, now has a free tier (200 APIs, 5 versions per API).
• MCP Support (API Center, APIM) Preview: API Center and APIM now support MCP (Microsoft Cloud Platform), enabling AI applications to interact with knowledge and tools in a standardized way. APIM can enforce authentication, authorization, and rate limiting, while API Center can act as a private remote MCP registry.
• Azure Migrate Ultra Disk Support Preview: Azure Migrate will now consider Ultra Disk capabilities when assessing workloads and suggest it as a target for data disk migration.
• Azure Migrate Premium SSD v2 Support GA: Azure Migrate will now suggest Premium SSD v2 as a target for data disk migration if it's the best option.
• Azure Migrate App Awareness Preview (Private): Focuses on application migration instead of server/database. Identifies and tags dependent resources, groups them into waves, and evaluates them collectively.
• Microsoft Planetary Computer Pro Preview: A geospatial data platform for ingesting and acting on location-based data.
• OpenAI Sora Model: Available in Azure AI Foundry. Can be used in the new video playground and via the API. The video playground allows viewing code to recreate actions in the API.
• Foundry Content Filtering Spotlighting GA: Spotlighting, a sub-feature of prompt shields, tags documents added as input to large language models as lower trust, preventing unintended actions embedded within the document.

Synthesis/Conclusion

This Azure update covers a wide range of enhancements across compute, networking, API management, storage, databases, and AI. Key themes include enhanced security (Managed HSM, Private Endpoints, TLS Inspection), improved developer experience (API Center Free Tier, Foundry Integration, JavaScript SDK), support for modern architectures (Container Apps, Functions, Serverless), and enabling AI capabilities (LLM Logging, MCP Support, OpenAI Sora Model). The updates reflect a continued focus on providing more control, flexibility, and security for Azure users.