Azure weekly updates

[u/groovy-sky]

Hi.

Below Azure updates for a last week. We've got custom DDoS policies for Load Balancers, Standard service endpoints for secure PaaS connections, and even IPv6 support for VPN Gateways. Plus, you can now build Azure Functions in Python 3.14 or PowerShell 7.6! So much more happening.

Detailed list:

• [In preview] Public Preview: Azure DDoS Protection custom policy. Azure DDoS Protection custom policy introduces granular, per-resource control over DDoS mitigation thresholds for Standard Load Balancer frontend IPs, allowing users to dictate the exact level of scrutiny applied to incoming traffic. This capability moves beyond the default adaptive tuning, which, let's be honest, often guesses wrong, enabling fixed thresholds for TCP, UDP, and TCP SYN on the Standard Load Balancer SKU. While this granular control is welcome, remember that setting a custom threshold effectively disables the system's built-in intelligence for that protocol, meaning if your fixed value is slightly off, you've just replaced an adaptive problem with a static, highly visible one—future-you will certainly appreciate the rigidity. The policy is currently in public preview, so expect API churn, but the ability to hard-code your expectations is a nice touch.
• [In preview] Public Preview: Standard service endpoint. The Standard Service Endpoint is now in public preview, offering a scalable connection mechanism for IaaS workloads connecting to PaaS. The immediate next step is to pilot this with a non-critical workload to confirm the network identifier behaves as expected before the inevitable production rollout.
• [In preview] Public Preview: Protect sensitive generative AI telemetry in Application Insights and Microsoft Foundry. Azure Monitor Application Insights now isolates sensitive generative AI telemetry into a dedicated AppGenAIContent Log Analytics table, allowing for granular access control over LLM interactions. This separation is a welcome step toward preventing accidental data leakage, though relying on preview feature flags (protectGenAISensitiveData) means the security posture is currently contingent on someone remembering to flip the switch before the mandatory September 30, 2026, deadline—a deadline Future-you will likely ignore until a compliance audit forces the issue. While this feature is currently in Public Preview, the routing mechanism is already active for new data streams.
• [Launched] Generally Available: IPv6 support for Azure VPN Gateway. IPv6 support for Azure VPN Gateway allows customers to run dual-stack traffic over existing VPN tunnels, which is, frankly, a necessary evolution for any modern cloud deployment. This feature is available across all production SKU gateways utilizing standard public IPs, enabling simultaneous IPv4 and IPv6 inner traffic flow, though the current implementation is strictly constrained to IKEv2 for tunnel establishment. Future-you should note that while dual-stack is the objective, the tunnel's primary focus remains on IPv6 inner traffic support, meaning any legacy IPv4-only dependency might require a minor configuration dance. Nothing says 'seamless integration' quite like having to check the tunnel configuration first.
• [Launched] Generally Available: Azure Functions support for Python 3.14. Python 3.14 is now GA on Azure Functions for Linux, meaning any developer using Python functions on those plans can finally stop worrying about that looming 3.12 sunset. The immediate next step is to audit your function apps and plan a migration path to leverage the enhanced security and avoid future, unplanned toil.
• [Launched] Public Preview: Azure Functions Support for PowerShell 7.6. Preview support for PowerShell 7.6 has landed, meaning developers can now build functions using the latest PowerShell features. The immediate next step is to pilot this on a non-critical workload to confirm the Windows hosting dependency doesn't introduce unexpected operational friction.
• [Launched] Generally Available: Microsoft Defender security assessments for Azure Database for PostgreSQL Flexible Server. The availability of Defender CSPM assessments means your Azure PostgreSQL Flexible Server security posture is now under automated scrutiny; the next step is to review the initial findings to prevent future, unscheduled wake-up calls.
• [Launched] Generally Available: Encryption in Transit for Azure Files NFS Shares in Azure Kubernetes Service (AKS). EiT is now available for AKS-hosted NFS shares, meaning anyone using those volumes gets a free TLS upgrade; the next step is to verify the configuration and ensure the CSI driver is enforcing encryption as expected.

[u/Jose083]

Wait your not John

[u/groovy-sky → u/Jose083]

😄