Azure updates: storage quotas, backup and network controls

Key insights

• The standard-endpoint storage account quota is now 1,000 per region per subscription, up from 250.
• VNet flow log filters can combine metadata criteria with AND and OR logic to limit captured traffic.
• Azure Backup cross-tenant restore is in preview and currently supports vaulted recovery points.
• Front Door WAF policies can be applied at profile and route levels; the narrowest scope takes precedence.
• Azure Container Apps logging should move toward Azure Monitor logging, although existing configurations continue to work.

Azure’s latest updates include a higher standard-endpoint storage account quota, filtering for Virtual Network flow logs, and cross-tenant VM backup restore in preview. These changes matter to Azure administrators and architects managing storage capacity, network visibility, web application protection or recovery plans. John Savill's [MVP] demonstrates and discusses these updates in an Azure Weekly Update.

What's new

The updates cover compute, networking, storage and Microsoft Foundry. Some are generally available, while Azure Backup cross-tenant restore is identified as a preview. The practical impact ranges from reducing the need to split storage accounts across subscriptions to narrowing which network-flow metadata gets collected.

For storage, the quota for standard-endpoint storage accounts is now 1,000 per region per subscription, increased from 250. The change can reduce the need to distribute accounts across subscriptions solely to stay within that limit. The update does not describe other quota types or storage-account configuration changes.

Networking updates include general availability of filtering for Network Watcher VNet flow logs and more flexible Azure Front Door Web Application Firewall (WAF) policy scope. Flow logs capture traffic metadata, and filtering lets administrators specify which traffic to include. Front Door WAF policies can now be set at profile and route levels, with the more narrowly scoped route taking precedence over a domain, and a domain over a profile.

The Azure Front Door Premium WAF ruleset for HTTP distributed denial-of-service (DDoS) protection is also generally available. It is designed to address anomalous traffic surges and traffic from known bots, with exceptions available for known healthy traffic. The transcript identifies Premium as a requirement for this ruleset.

Who it is for and what you need

Azure storage administrators can use the higher quota when planning account distribution within a region and subscription. Network teams using Network Watcher VNet flow logs can use filters to focus collection on relevant traffic metadata. The transcript does not state specific permissions or setup prerequisites for either change.

Web application and platform teams using Azure Front Door can consider whether profile-, domain- or route-level WAF policies fit their policy structure. HTTP DDoS ruleset details in the source are limited to its Azure Front Door Premium WAF context, its protection against traffic surges and known bots, and the ability to define exceptions.

For recovery planning, cross-tenant restore is in preview. The feature is described for Azure virtual machine backups restored to a subscription that trusts a different Microsoft Entra tenant. The transcript says source and target Recovery Services vaults must be mapped and that only vaulted recovery points are supported at this stage. It also says the feature does not integrate with Resource Guard, so multi-user authorization is needed.

Two other operational notes affect teams managing existing services. Azure Container Apps logging guidance points users from Log Analytics logging toward Azure Monitor logging; existing configurations continue to function. Confidential VMs now support large OS disk encryption in general availability, including OS disks larger than the prior 127 GB limit. The transcript does not provide detailed configuration steps or eligibility conditions for either update.

How it works

For the VNet flow log change, filters use traffic metadata and can combine multiple criteria. Conditions can use equal or not equal comparisons, joined with AND or OR logic. The stated goal is to capture the traffic that matters to a monitoring or compliance need while reducing unwanted data collection and associated cost.

For Azure Front Door WAF scope, policy precedence follows the most specific level described in the update. A route-level policy overrides a domain-level policy, which overrides a profile-level policy. This allows broad policy coverage at the profile level with more specific handling on selected routes.

1. For Azure Backup cross-tenant restore, map the source and target Recovery Services vaults.
2. Select a supported vaulted recovery point for the restore.
3. Account for the requirement for multi-user authorization because Resource Guard integration is not available in this preview.

For Azure Container Apps, review deployments currently using Log Analytics logging and evaluate migration to Azure Monitor logging. The reason given is that Azure Monitor logging uses the log ingestion API rather than the more deprecated HTTP Data Collector API, and supports transformations, multiple destinations, destination schema management and granular role-based access control.

Limitations and open questions

The cross-tenant restore capability remains in preview, supports only vaulted recovery points according to the transcript, and does not integrate with Resource Guard. The source does not explain the precise trust configuration, restore workflow screens or regional availability, so teams should verify those details before incorporating it into a recovery runbook.

For VNet flow logs, the transcript describes the kinds of metadata and filter logic available but does not give a portal path, syntax examples or current pricing. It also does not specify quotas for storage accounts beyond the standard-endpoint figure. The Front Door updates likewise do not include setup instructions or detailed rule configuration.

Azure MCP Server 3.0 is generally available, but the transcript warns that discovery and communication changed from version 2 and recommends checking the change log and testing migration. Other announcements include Claude model cost management in Foundry, new model and image-generation updates, and a Copilot harness option in Foundry; detailed prerequisites and licensing are not provided here.

Sources

• John Savill's Azure Weekly Update discussion

Frequently asked questions

What is the new Azure storage account quota?

The quota is 1,000 storage accounts with standard endpoints per region per subscription, up from 250.

Is Azure Backup cross-tenant restore generally available?

No. It is in preview. The transcript says it supports vaulted recovery points and requires mapping source and target Recovery Services vaults.

Can I filter Azure VNet flow logs?

Filtering is generally available. You can combine metadata criteria using equal or not equal comparisons and AND or OR logic.

What should Azure Container Apps users do about Log Analytics logging?

Review a move to Azure Monitor logging, which uses the log ingestion API. Existing Log Analytics configurations continue to function.