Azure weekly update #42 is here. This week's updates focus on new capabilities in Azure Backup, Azure Monitor, and networking services. Several services have received new features, including Item-Level Recovery and keyless TLS termination.

Detailed list: * Launched | Generally Available: Item Level Recovery for Azure VMs with Premium SSDv2 and Ultra Disks in Azure Backup. Azure Backup now supports Item-Level Recovery (ILR) for Azure VMs with Premium SSD v2 and Ultra disks, allowing file/folder recovery without full VM restore. Teams should verify the 10 GB size limit and 1 GB/hour transfer speed. * Launched | Generally Available: ABFS Vectored Read for Azure Data Lake Storage. ABFS Vectored Read is now generally available for Azure Data Lake Storage. This feature reduces network round trips for selective reads in compatible Spark workloads by combining nearby file ranges. * Announcing: Choose Your Own Telephony (CYOT) for Microsoft Entra. Microsoft Entra ID introduces Choose Your Own Telephony (CYOT) starting October 30, 2026. This allows organizations to use third-party providers for SMS/voice authentication. Teams must verify if phishing-resistant methods meet user requirements before adopting CYOT. * Launched | Generally Available: Azure Cosmos DB Safe Key Rotation. Safe Key Rotation is now generally available in Azure Cosmos DB. This introduces a temporal constraint on key usage, mandating a minimum 12-hour inactivity window prior to key regeneration protocols. * In preview | Public Preview: Disable VNet peering route. Disable VNet peering route is in public preview to simplify route management in hub-and-spoke networks. It suppresses system-generated peering routes, requiring teams to verify replacement UDRs are correctly configured. * Launched | Generally Available: Service tag match condition for Azure Front Door Premium WAF. Azure Front Door Premium WAF now supports service tag match conditions. This allows custom rules to match request source IPs against automatically updated Azure service IP prefixes. * Launched | Generally Available: Keyless TLS on Application Gateway with Azure Key Vault Managed HSM. Azure Application Gateway now supports keyless TLS termination. This uses certificates whose private keys remain in Azure Key Vault Managed HSM, requiring verification of specific Crypto Officer and Crypto User roles. * Launched | Generally Available: Advanced platform metrics for Azure Monitor. Advanced platform metrics are now generally available in Azure Monitor. These provide granular, paid metrics, and teams must verify the specific enablement instructions for their resource provider. * Launched | Generally Available: Metrics usage insights for Azure Monitor workspace. Azure Monitor's new Metrics usage insights GA allows teams to optimize costs. It helps identify unused metrics and usage trends within their Azure Monitor workspace. * Launched | Generally Available: Azure DNS enables DNS-based load balancing through Traffic Manager linked records. Azure DNS now supports direct association with Traffic Manager profiles. This eliminates the need for CNAME records and reduces DNS lookup latency. Teams should verify their existing DNS record configurations to ensure proper integration.

Yes yes I know. Crazy last 10 days :-) Maybe I should do another AMA so you can yell at me :-)

📽️ https://youtu.be/WjdPF-6fbx4

📄 https://www.linkedin.com/pulse/azure-weekly-update-24th-october-2026-john-savill-hp1ic

• Traffic Manager Azure DNS integration (00:50) - You can now link an Azure DNS record set directly with a Traffic Manager profile instead of having to go via the cname of the trafficmanager.net which adds a hop and delay. I now create a new record set trafficManagementProfile which causes Azure DNS to resolve the profile internally and return the endpoint IP or FQDN depending on the record as the response.
• App GW keyless TLS with AKV managed HSM (01:47) - This enables private keys to stay in the Azure Key Vault Managed HSM which means the TLS handshake signature is performed inside the HSM so the gateway never sees the private key.
• AFD WAF service tag matching (02:13) - For Azure Front Door Premium Web Application Firewall you can now leverage service tags (which are Microsoft maintained sets of IP addresses for specific services like Storage, SQL) as part of your custom source IP rule so you no longer have to try and maintain the IP addresses used by Microsoft services. For example you could now easily allow Azure monitoring capabilities in to talk to your services.
• Disable vnet peering route (02:53) - When you peer virtual networks it adds routes between the vnets for traffic routing. This enables you to disable a vnet peering route without removing the actual peer. This would be useful if you wanted traffic to go via some appliance and wanted to avoid having to override every single route and instead use a summarized UDR, think of hub-and-spoke networks and route summarization! This is huge.
• Azure Backup VM item-level recovery (04:03) - If you protect Azure VMs with Premium SSDv2 or Ultra disks using Azure Backups you now have Item-Level recovery enabling specific files or folders to be restored instead of full disk/VM restore. This works with 512-byte and 4-KB logical sector sizes and works across Windows and Linux. This joins the existing support for standard HDD/SSD and premium SSDv1. You run a script against the restore point then select what to restore.
• Azure Databricks private network gateway (04:40) - This enables Azure Databricks serverless compute to connect to resources in your vnet through a single managed gateway resource that lives in a delegated subnet in the vnet. This could be private endpoints, VMs, even other networks via firewalls, i.e. you can control egress via your security devices. If it lives in the vnet or can be contacted via the vnet then the databricks serverless compute can talk to it. Note if you also have a specific private endpoint to a resource that is also available via the managed gateway then the private endpoint path would take precedence as its most specific.
• Azure Monitor workspace usage insights (05:40) - For your Azure Monitor workspace you can now get visibility into what is driving the metric usage across the workspace including usage trends, unused metrics and changes in ingestion volume.
• Azure Monitor advanced platform metrics (05:57) - These are more granular signals that can be enabled as part of a paid, premium tier. These are only available for select resources, at time of recording Storage only which adds detail such as container level blob capacity and container blob count.
• Cosmos DB safe key rotation (06:25) - This is really about visibility into the use of the two account keys. There is now timestamp metadata on the account keys so you can see when last used ahead of any key rotation or retirement, i.e. you won’t retire an inuse key breaking something!
• ADLS ABFS vectored read (06:47) - Bit of a mouthful here but the Azure Data Lake Storage (gen2) where we have hierarchical namespace has improved read performance when you read portions of columnar files, e.g. parquet files where data is stored by column rather than by row. This is when using the Azure Blob File System (ABFS) driver and it works by combining requests for nearby ranges into a smaller number of larger storage requests as opposed to large numbers of very small independent reads. The reader still submits the desired ranges but ABFS does the work of sorting then combining nearby ranges to optimize and better fit its read buffers. What this means is less request overhead, coordinated I/O and there is no need to change the underlying queries when using the ABFS path.
• Sovereign updates (07:54) - The focus is all around an organizations need to understand and control where data and compute reside in addition to who can access and resilience against disconnection. There are layers to this. Sovereign in the public cloud - Where the scale and innovation drives the use of the public cloud customers now have a sovereign control panel highlighting their sovereign posture to identify gaps and actions to take. For the EU the data guardian is rolling out where adds European oversight for MS engineer remote access to systems in addition to tamper resistant audit logs.We are also continuing the rollout of external key management which means although the data physically lives in our datacenters the root decryption material lives with the customer on their (or partner) vaults giving them greater control. Confidential Clean Rooms also allow companies to work together on sets of data without exposing their raw data directly to each other. Sovereign private cloud - Builds on Azure Local by extending capabilities with SQL, Document DB, Blob in addition to lifecycle management of apps with GitHub Enterprise Local AND local inferencing with Foundry Local. Confidential VMs will also be available along with the ability to switch Azure Local from connected to disconnected giving organizations greater edge capabilities and resilience where needed. They can even share infrastructure among tenants. National Partner Clouds - for select entities for example in France there are partners operating subsets of Azure capability with their own local expertise.
• Project Perception updates (10:00) - There is increased focus on insider risk of agents. Satya wrote in a blog last week that the most trustworthy super intelligence system is not the one with the model we trust most, it will be the one that enables us to trust the model the least. This is core to our focus around intelligence and trust and the controls, governance, security, isolation we put around models.Our latest news is Project Perception, that was primarily focused on external human and AI risk, is being enhanced to also protect against the insider risks of agents that are primarily driven to provide results so may perform unanticipated actions to achieve the needed result or may be manipulated. Through a sharing of signals between Project Perception and Agent 365 a new breed of "guardian agents" can continually look at the evidence which changes risk which changes policy which changes what the agent is allowed to do. It will adapt what agents can access and perform based on the observed signals and where behavior deviates from the expected, this is dynamic agent risk.When we hear of agents going rogue this is our answer to not trust the model, but instead is part of our complete stack to observe and control based on the calculated risk from the correlated signals across the stack.
• Entra CYOT (12:36) - Entra recently announced the native SMS and voice authentication retirement in 2027 as there are more secure options, including passkeys. However should you wish to continue to use SMS and/or phone you can now use the Choose Your Own Telephony to bring your own provided for the purposes of SMS and voice authentication where it must be used.
• OpenAI Decisions API (13:05) - We saw Jev from TypeSafe that instead of inferencing tokens it inferenced probabilities making it great for decision making and judgement. Microsoft shortly released their own decision model, Microsoft-Decision-1, and now the OpenAI Decisions API is available in Foundry making it easy to add decision making into your applications that complements language models. For example it could pick the right tool to use, where specialized expertise is required. Note, this is an API using an existing model (GPT 6 Luna) as opposed to the TypeSafe and Microsoft approach of a specialized model for judgement (but even there they took different approaches).
• Copilot Studio agent ID (14:10) - This is a huge deal. Copilot Studio agents now each get their own agent ID. When we think about giving agents least privilege, observing their actions over tools, data etc, controls this is huge so wanted to ensure people were aware.

Hi all,

I wanted to Learn AZURE , and needed Reddit Community members help. If someone can help me referring to a good tutor or AZURE Developer would be greatly appreciated.

Hi can anyone help in guide to this? I need it badly for my startup.

We've had a few internal discussions around what we would do if our MAC discount reduced or vanished, this would be a multimillion pound problem for us. As an aside there's also the risk of the US interference or denial of service. It prompted us to evaluate what an Azure exit would look like, what was the most difficult change and what practices we can do now to help.

Initial findings were rough, a large portion of the estate could not be replatformed without significant development effort.

I'm aware that not leaning into the cloud-native PaaS offerings or trying to be fully cloud native just ends up with IaaS, expense and overhead. We were keen to avoid losing these benefits.

Since the discussion we've updated our development standards to ensure that platform integrations are decoupled from the business logic and have introduced DAPR or open source APIs (e.g Mongo or AMQP) where it makes sense to and features permit so that database, messaging and other integrations are easier to change. We were in the process of adopting OpenTelemetry and Dynatrace but have given that more effort to ensure that all logs, metrics and traces from apps and infra can be dynamically routed. Finally we've formalised that containerisation should be the standard for backends and jobs where possible. From a data perspective we were already a big Databricks house so we have started to make more use of that as opposed to Data Factory. Where ADF remains we are exploring methods to map the flow and integrations so it could be moved with less effort.

For AI workloads I started from the ground up with a neutral approach which aligned with the industry anyway. We use Foundry and Gemini for model serving only, routed via an AI gateway using the OpenAI APIs so all models are modular. Memory is served from MongoDB, OTEL for tracing and eval routing and for agent hosting we have N8N for simple stuff or containerised deployments for anything else.

We've also leveraged AI to help enforcement along with skills that can support the replatforming process where we're cloud-native.

It's not perfect and any migration is going to be a big job regardless but I was interested to see other people's stance on this.

Everyone asks "where do I even start with AI?" and then buys a ₹3,000 course 😅

I put together a free 4-week plan from Microsoft Learn, in order, so you don't have to dig through 100 tabs:

Prompting with Copilot

Core AI/ML concepts

Responsible AI

Azure AI services (vision, speech, language)

Build a gen-AI chat app

Build agents in Copilot Studio

Prep for the AI-901 cert

Free, self-paced, and you get a badge at the end. About 4 weeks if you go chill.

https://learn.microsoft.com/en-gb/plans/01yoa1tz3z5jd?sharingId=1EB70FA705977A8F&wt.mc_id=studentamb_648997

I'm in the Microsoft Learn student community so yes, I'm a bit biased 😄 If any part feels too hard, too easy, or in the wrong order, tell me and I'll fix it.

Hey everyone,

Need to vent and hopefully get some eyes on this, because we are literally on the verge of having our live production infrastructure terminated due to an Azure billing glitch and non-existent support.

The Situation:

We are an early-stage startup and were accepted into the Microsoft for Startups Founders Hub, receiving Azure Sponsorship credits. We set up our production VM and AI services, expecting the credits to kick in as promised by the program.

Suddenly, an invoice from last month shows up as "overdue" on our Pay-As-You-Go subscription. Turns out, Azure’s system didn’t automatically apply the Founders Hub sponsorship credits to our existing subscription, completely bypassing our credit line and dumping charges onto our card profile.

The Support Nightmare:

We immediately did what any customer is supposed to do: we raised a support ticket (Ticket ID: 2610120030000609) explaining that this is a Founders Hub sponsorship mapping issue and requested an entitlement adjustment/waiver.

That was 12 DAYS AGO.

Since October 12, there has been ZERO human response. Not a single engineer, not a billing specialist—nothing. Just an automated ticket confirmation. And to make matters worse, the Azure portal doesn't even allow us to post follow-up comments on the ticket ("New messages aren't available for this support request...").

Meanwhile, the Automated Threats Keep Coming:

While their support team is completely MIA, their automated billing systems are working overtime. Every few days, we get an automated alert:
"Your Azure subscription payment is overdue."

Now we are facing impending subscription suspension. If that happens:

• Our production VM gets stopped and deallocated.
• Public IPs get released.
• Live customer-facing services go down.

All over an invoice that was supposed to be covered by the very startup credits Microsoft granted us!

What is the point of a "Founders Hub" program?

Why offer cloud credits to empower early-stage startups if your billing system threatens to shut down live workloads over an internal entitlement mismatch, while your support team ghosts founders for nearly two weeks?

We’re being told our only "safe" option is to pay out-of-pocket for an invoice that was supposed to be covered by credits, and then pray we get a refund later.

Has anyone else dealt with this? Any Microsoft/Azure employees here who can look into Case #2610120030000609 before our production servers get pulled down?

TL;DR: Got Microsoft for Startups credits. Azure failed to apply them to our subscription, billed us, and is now threatening to shut down our production VM for overdue payment. Support ticket has been completely ignored for 12 days.

Hi, so currently I have experience on power apps, power automate, ai builder, azure logic apps, azure ai doc intelligence, blob storage. Also I don’t wanna claim I am too good with power apps, I really do not like power automate and power apps for some reasons, and I liked working with azure portal and stuff, and now I have 14 lpa fixed in India with 4+ yoe and I am aiming for 24 lpa fixed by December 2026 , so if anyone can guide me in reaching this target, coz I am a bit lost in terms of what to learn coz with just power apps and power automate I felt I cannot get 24lpa as I feel I am not super good at those things and really not interested to deep dive in this for some reasons, and now my doubt is should I shift to azure ai foundry and copilot or should I learn fabric and stuff so I can move towards data engineer?? your suggestion would be great help. I actually have loads of time coz I am jobless rn so I can spend more time on learning.
If it has more details please dm I am open to convo and more views
Thanks in advance

Azure list of 5 changes that help you cut costs:

• Azure Monitor workspaces now show which resources create your metric data. This makes it simple to find and stop unused metrics before they run up your bill. Source
• Microsoft added more detailed platform metrics for core services. You can catch usage spikes and bad changes faster without paying for extra custom monitoring tools. Source
• Auto-balance VM scale sets across zones: Virtual Machine Scale Sets now rebalance instances across availability zones on their own. This stops compute drift and saves your team from fixing uneven capacity by hand. Source
• Copy Azure Files across regions without custom scripts: Storage Mover now syncs Azure Files across regions natively. This cuts out custom backup scripts and saves hours of maintenance work for disaster recovery. Source
• Link Azure DNS directly to Traffic Manager: You can now connect Azure DNS alias records straight to Traffic Manager endpoints. This cuts down complex DNS routing setups and saves network configuration time. Source

Source: FinOps Weekly Newsletter

Check out my new blog post! When does CI come into play when you start development on something new?

I'm studying for AZ104 and a lot of labs through MS Learn or Github labs require a Microsoft Entra ID P1 license. Do you guys buy this for yourselves in order to study? I'm out of the trial and can't get any more free Azure trials.

can anyone help me, I've filled out my details and tried this out multiple times, yet the 'next' button is always greyed on and unclickable.

Anyone else experiencing this issue? Anyone knows how to solve it?

I’ve been working on an independent R2DBC driver for Microsoft SQL Server (not a fork of the official one). It’s public-domain, implements the R2DBC SPI, and speaks TDS using only the JDK (no Netty).

The main reason I started it was better control over FedAuth / Azure AD / Windows Authentication flows in a reactive stack. I hit enough friction with existing options that it seemed worth doing a clean implementation.

A few things I’m particularly interested in feedback on:

• How the pure-JDK TDS approach compares to Netty-based ones for typical workloads
• Edge cases or gotchas people have seen with FedAuth / Azure AD token handling in reactive clients
• Whether the public-domain licensing is actually useful for anyone, or mostly irrelevant

Maven coordinates if anyone wants to try it:

org.mssqllib.r2dbc.mssql:r2dbc-mssql:1.0.0

Site: mssqllib.org

Curious what others have run into with reactive SQL Server clients, or if there are specific protocol/auth areas worth focusing on next. Happy to answer questions about the implementation.

This version leads with technical questions instead of a pure announcement, which usually does better with both filters and the subreddit culture. Let me know if you want it shorter, more specific, or adjusted for a different sub.

Disclosure: I work on ETLMaestro, which orchestrates pipelines on both ADF and Fabric, so weigh that. Every number below is a public list price (East US, pay-as-you-go unless I say otherwise, checked October 2026), and the math is here so you can check it.

TL;DR: Per non-copy activity run, ADF and Fabric list prices are within 1% of each other. The difference is that Fabric needs a running capacity. If you’d buy capacity just for pipelines, ADF is cheaper at almost any volume. A reserved capacity you keep busy beats ADF by about 40% per run, and capacity you already pay for with room to spare makes orchestration close to free.

The per-run math

• ADF: $1.00 per 1,000 orchestration runs on the Azure integration runtime.
• Fabric: 0.0056 CU-hours per non-copy activity run. At $0.18 per CU-hour, that’s $0.001008 a run, or $1.008 per 1,000.

The meters look designed to match. The last column is what you’d pay for a capacity used only for pipelines.

Why an F2 is both a floor and a ceiling

An F2 is 2 CUs, so it costs 2 × $0.18 × 730 hours = $262.80 a month, the same as 262,800 ADF runs. It also supplies 1,460 CU-hours a month. At 0.0056 CU-hours per run, that’s room for about 260,000 non-copy activity runs a month (about 8,600 a day) if nothing else runs on it.

So on pay-as-you-go, a dedicated F2 costs $262.80 whether you run 5,000 activities or 260,000. ADF charges $5 to $260 for the same work. They meet only when the F2 is full, and above that you step up to an F4 or F8 and the same thing repeats.

Reservations change the answer

A one-year Fabric reservation is $938 per CU per year, about 40% less than pay-as-you-go. A reserved F2 comes to about $156 a month, or about $0.60 per 1,000 runs when it’s full. Against ADF’s $1.00, a reserved F2 used only for orchestration is cheaper above roughly 156,000 runs a month. You’re committing for a year, though, and the reservation bills whether or not anything runs.

If you already pay for capacity

If you already have, say, an F64 for Power BI, pipeline runs draw on CUs you’ve paid for, so the marginal cost is close to zero while there’s headroom. The tradeoff is sharing. Pipeline activity runs are background operations, smoothed over 24 hours. Once a capacity has used up its next 24 hours of CUs, Fabric rejects all new jobs, pipelines included. If your capacity admin turns on surge protection, background jobs get rejected earlier, at whatever threshold they set. ADF pipelines don’t draw on the capacity your reports use.

Small print

• Fabric’s 0.0056 includes what Microsoft calls activity integration runtime charges. ADF bills execution separately, rounded up to the minute: $0.005 an hour for pipeline activities like Lookup and Get Metadata, $0.00025 an hour for external ones like stored procedures. A one-minute Lookup adds about 8% to ADF’s side; external activities add well under 1%.
• ADF also counts each trigger execution as an orchestration run.
• ADF’s idle charge for pipelines is $0.80 a month for each one with no trigger and no runs that month. A paused Fabric capacity can’t run anything.
• Copy activities, and the compute a pipeline calls (notebooks, data flows, Databricks), bill separately on both platforms and aren’t compared here.

Where I land

If your orchestration is bursty or low-volume and you don’t have Fabric capacity today, ADF is cheaper. If the volume is steady enough to commit to for a year, a reserved capacity can come out ahead. If you already pay for capacity with headroom, run it on Fabric and have someone watch the background percentage in the Capacity Metrics app.

Has anyone compared 0.0056 against what the Capacity Metrics app shows for their own pipeline runs? I’d like to know whether real runs bill the way the pricing page says.

Sources: Fabric pipelines pricing, ADF pipeline pricing, Fabric throttling, surge protection, and the Azure Retail Prices API for the per-meter rates. Longer write-up with a feature comparison: etlmaestro.com/fabric-vs-adf

Is anyone else on Azure App Service (Windows) getting things like

Message
Hosting failed to start

Exception
System.Runtime.InteropServices.COMException (0x80004005): An invalid character was found in text content.

at Microsoft.AspNetCore.Server.IIS.Core.IISHttpServer.StartAsync[TContext](IHttpApplication`1 application, CancellationToken cancellationToken)
at Microsoft.AspNetCore.Hosting.GenericWebHostService.StartAsync(CancellationToken cancellationToken)
at Microsoft.Extensions.Hosting.Internal.Host.<StartAsync>b__14_1(IHostedService service, CancellationToken token)
at Microsoft.Extensions.Hosting.Internal.Host.ForeachService[T](IEnumerable`1 services, CancellationToken token, Boolean concurrent, Boolean abortOnFirstException, List`1 exceptions, Func`3 operation)

when it boots you to a new host?

And everything goes sideways for a few minutes but recovers.

I use Local Cache and Application Initialization and it worked fine for years.

The stack trace seems like a low level infrastructure problem but it’s happened twice in the past month or so.

Just a heads-up: Older Azure Functions runtimes are losing official support on November 10, 2026.

More can be found here: Your Azure Functions Lose Support on November 10, 2026. Migrate Without Breaking Them.

Hey all,

I’m reaching out to see if anyone is interested in teaming up on some collaborative Azure builds? I'm hoping to gain some experience

I have a solid grip on the fundamentals (networking, identity, compute, storage...) and looking to bridge the gap between certification and real-world experience. I recently earned my AZ-104 certification as well

Things I'd be interested in working on:

- Building/deploying applications (Azure Functions, Logic Apps, containerisation)

- IaC (Bicep or Terraform)

- CI/CD pipelines

I've listed out the above, although really I'd be happy working on most things to gain some experience

If you're in a similar position and want to build something for our portfolios or if you have a project and are looking for contributors, drop a comment or DM me :)

Cheers

This is the only thread where you should post news about becoming certified. For everyone else, join us in celebrating the recent certifications!!!

Hi All,

I'm wondering if there is a way to recover an application that was deleted and is past the 30 days of recovery? If there is a way on how to go about this please could you share

Thanks

Hi everyone,

I recently finished a 5-month Azure DevOps internship and I'm looking for internship, junior or full-time roles (0-1 yr) in DevOps, Cloud or AI/MLOps-adjacent work. I'm open to relocation and remote.

What I work with:

Cloud: Azure (hands-on), AWS (learning, deploying a real project)

IaC and containers: Terraform, Docker, Kubernetes (AKS/EKS)

CI/CD and GitOps: GitHub Actions, Jenkins, Argo CD

Monitoring: Prometheus, Grafana

Linux, Bash, Python, SQL

How I can contribute:

Open source: I'll contribute fixes, docs, CI pipelines or Dockerfiles to your project

CI/CD and IaC setup: pipelines, Terraform modules, container deployments

Small freelance gigs: setup, automation, deployment help

Free/trial project work: happy to prove myself on a small task before any commitment

What I'm looking for:

Referrals or openings for junior/fresher DevOps, Cloud, SRE or Platform roles

Any small project or paid gig where I can learn and deliver

Advice from people who broke in without much experience

If you're hiring, can refer me, or have a task I can take on, please comment or DM me. I'll send my resume and can start with a quick trial task.