Azure Update - 4th July 2025

Key Concepts:

• Azure App Service on Azure Stack Hub
• VM Insights Map & Dependency Agent Retirement
• Azure Firewall FQDN Filtering
• Azure DNS Security Policy
• Azure Files NFS Encryption in Transit
• Azure SQL Database Enhanced Audit
• Azure SQL Database Hyperscale Migration
• MSQL Python Driver Update
• MSQL Extension for VS Code Updates
• Cosmos DB for MongoDB Secondary Users
• PostgreSQL Flexible Server Version 17 GA
• Azure Monitor Metrics Query Editor
• Entra Domain Services Two-Way Forest Trust

1. Azure App Service on Azure Stack Hub 25R1 GA

• The 25R1 release of Azure App Service on Azure Stack Hub is now generally available (GA).
• This release includes a set of enhancements and new capabilities for users of Azure Stack Hub.

2. VM Insights Map & Dependency Agent Retirement

• VM insights map and dependency agent are being retired in three years, by the end of June 2028.
• New virtual machines will not be able to be onboarded to these capabilities after September 30, 2025.
• Users are advised to seek alternative solutions in the Azure Marketplace for dependency mapping and connection visualization.

3. Azure Firewall FQDN Filtering in Destination NAT Rules

• Azure Firewall now supports Fully Qualified Domain Name (FQDN) filtering in Destination Network Address Translation (DNAT) rules.
• Destination NAT enables routing inbound traffic to backend resources based on the port of the inbound connection.
• Instead of routing to a specific IP address, DNAT rules can now route traffic to an FQDN.
• This is useful for scenarios with dynamic IP addresses, as the firewall will resolve the FQDN to the current IP address.

4. Azure DNS Security Policy GA

• Azure DNS Security Policy is now generally available.
• It enables filtering DNS traffic based on domain names, allowing administrators to allow, block, or alert on specific domains.
• This helps prevent DNS-based attacks by blocking resolution of malicious domains.
• Full visibility into DNS traffic is provided by sending information via diagnostic settings to a storage account, Log Analytics workspace, or Event Hub.
• A DNS security policy is created in a specific region and contains traffic rules with a priority, a list of domains, and an action.
• The policy can be associated with virtual networks in the same region.

5. Azure Files NFS Encryption in Transit GA

• Azure Files now supports encryption in transit for Network File System (NFS) shares, now GA.
• Data is always encrypted at rest, and now encryption is supported over the wire using TLS 1.3.
• Configuration is simplified using an NFS mount helper on the client side.
• The NFS mount helper establishes a TLS tunnel (using Stunnel behind the scenes) for all mount operations.
• Traffic is streamed within this tunnel, encrypted using AES-GCM.
• No Kerberos requirement, unlike some other NFS encryption implementations.
• SMB traffic already supports encryption if the correct SMB version and client support are in place.
• Supported across major Linux distributions, including Azure Linux.

6. Azure SQL Database Enhanced Audit GA

• Azure SQL Database has an enhanced audit capability, now GA.
• Event sessions have been shifted to the server level, capturing audit events across all databases under a server.
• Previously, there was an audit session per database.
• This reduces overhead and ensures a consistent audit experience for all databases on the server.

7. Azure SQL Database Hyperscale Migration Preview

• Azure SQL Database Hyperscale migration is now in preview.
• Allows converting an existing Azure SQL database to the Hyperscale tier.
• Hyperscale separates page servers from query processing for higher scale and performance.
• The key benefit is the ability to maintain existing geo-replication or failover group configurations during migration.
• Previously, these configurations had to be removed before migration.

8. MSQL Python Driver Update Preview

• The MSQL Python driver has been updated and is now in preview.
• Facilitates easy connection to Microsoft SQL Server and Azure SQL Services using Python.
• Available for download on GitHub.
• Now supports macOS as a client and includes connection pooling for optimized resource use.

9. MSQL Extension for VS Code Updates Preview

• The MSQL extension for Visual Studio Code (VS Code) has updates in preview.
• Allows easy spin-up of a local SQL Server container within the extension.
• No need to know Docker commands; the extension handles container creation.
• Uses SQL Server 2025 by default.
• Supports GitHub Copilot agent mode for natural language database optimization.
• Includes connection groups for organizing saved connections into folders.

10. Cosmos DB for MongoDB Secondary Users GA

• Cosmos DB for MongoDB now supports secondary users in Vcore-based clusters, now GA.
• Provides more flexible access control.
• Previously, there was a single user with full privileges.
• Now, additional users can be added with cluster admin, read-write, or read-only permissions.
• Enables granular control over access for different identities.

11. PostgreSQL Flexible Server Version 17 GA

• PostgreSQL Flexible Server now supports version 17, now GA.
• Also includes minor version upgrades: 17.5, 16.9, 15.13, 14.18, and 13.21.
• These upgrades are automatically applied as part of regular monthly maintenance.

12. Azure Monitor Metrics Query Editor GA

• The Azure Monitor metrics query editor is now generally available (GA).
• Specifically for the metrics workspace, where managed Prometheus metrics from Kubernetes are written.
• Users can now directly use PromQL within the metric explorer to interact with these metrics.

13. Entra Domain Services Two-Way Forest Trust GA

• Entra Domain Services now supports two-way forest trust, now GA.
• Forest trust is established at the root of different forests, allowing identities from one forest to access resources in another.
• This feature allows more flexibility in the type of forest trust created between Active Directory Domain Services (on-premises) and Entra Domain Services (Azure).
• The forest trust can be single-direction (inbound or outbound) or bi-directional (two-way).
• Requires an Enterprise or Premium SKU license.

Synthesis/Conclusion:

This week's Azure update covers a range of improvements and new features across various services, including App Service, Firewall, DNS, Files, SQL Database, Cosmos DB, PostgreSQL, and Entra Domain Services. Key highlights include the GA of NFS encryption in transit for Azure Files, enhanced audit capabilities for Azure SQL Database, and the introduction of FQDN filtering in Azure Firewall DNAT rules. The update also emphasizes enhanced security, flexibility, and performance improvements across the Azure ecosystem.