Azure updates: recovery, networking and data protection
Principal Cloud Solutions Architect
Azure updates add recovery, networking and data-protection options for teams managing workloads across compute, storage and databases.
Key insights
- Azure Site Recovery for Azure Local is generally available for replicating Windows and Linux workloads to Azure.
- App Gateway for Containers adds preview features for private ingress, MCP gateways and JWT validation.
- Advanced capacity insights for Azure Storage Discovery and new Azure SQL Database features are in preview.
- Azure PostgreSQL Flexible Server can migrate from VNet integration to private endpoints, with about 10 minutes of connectivity interruption.
Azure’s latest updates add disaster-recovery options, networking controls and data-protection features across compute, storage and databases. They matter to Azure administrators and architects who manage workloads, connectivity and recovery plans. John Savill’s [MVP] reviews the announcements and demonstrates or explains their operation in a YouTube update.
What’s new
The announcements include generally available updates as well as previews, so teams should distinguish features they can use now from capabilities that remain under evaluation. In compute, Azure Site Recovery for Azure Local is generally available for replicating Windows and Linux workloads to Azure. VM Scale Sets Flexible orchestration also gains a way to replicate individual VMs rather than treating the entire scale set as one unit.
Networking changes cover Azure Front Door, Application Gateway and Azure Route Server. Front Door’s TLS key exchange using post-quantum cryptography is generally available for the client-to-edge connection. Application Gateway for Containers has preview support for private ingress, publishing MCP servers through a gateway, and JWT validation. Application Gateway WAF insights are generally available, while Azure Firewall application rules for IPv6 are in preview.
Storage Actions adds task-definition propagation to existing assignments, the ability to stop a run in progress, and case-sensitive operators. Advanced capacity insights for Azure Storage Discovery are in preview. For databases, Azure SQL Database adds preview support for database-level managed identities and immutable point-in-time recovery retention, while PostgreSQL Flexible Server can transition from VNet integration to private endpoints.
Who it is for and what you need
These updates are relevant to Azure infrastructure and platform teams, including administrators responsible for recovery, network security, storage operations and database access. The announcements identify several feature states: Site Recovery for Azure Local, VMSS Flexible replication, Service Bus geo-replication, Front Door post-quantum TLS key exchange, WAF insights, Route Server route maps, Storage Actions, SQL restart or failover from the portal, and the PostgreSQL REST API update are described as generally available.
Other capabilities are explicitly in preview: crash-consistent multi-disk restore points for Premium SSDv2 and Ultra disks; Application Gateway for Containers features; Azure Firewall IPv6 application rules; advanced storage capacity insights; NAS discovery and assessment in Azure Migrate; and the SQL database-level identity and backup-retention features. The update does not state licensing, regional availability or tenant prerequisites, so check the relevant Azure service documentation before planning a deployment.
Some requirements are specific to the feature. The multi-disk restore-point support described applies to Premium SSDv2 and Ultra disks attached through the SCSI disk controller. The PostgreSQL migration discussion concerns servers previously using VNet integration. The video does not give a detailed setup guide or configuration commands for these announcements.
How it works
With Azure Site Recovery for Azure Local, the described task is to replicate supported Windows or Linux workloads running on Azure Local to Azure for disaster recovery. For VMSS Flexible, replication is configured per VM and targets a new flexible scale set in the destination region. After failover, the VM created in that set can be re-protected back to the original region.
For Azure Front Door, the post-quantum key exchange applies between the client and the Front Door edge location, not between the edge and the backend. This distinction matters when assessing which leg of an application’s traffic receives the protection. Application Gateway for Containers can expose an individual MCP server or aggregate multiple servers behind one endpoint; the gateway provides a standardized place for configuration, authentication and health monitoring.
Azure Route Server route maps let administrators control route advertisements and routing behavior. The update describes summarizing routes, modifying AS paths to influence path selection, tagging routes with BGP communities, and applying route maps on BGP peerings, ExpressRoute and VPN gateways, and VNet peer connections. Application Gateway WAF insights brings diagnostic logs and time-series metrics into Monitor and Triage dashboards for ongoing visibility and investigation.
In Azure Storage Actions, an updated task definition now propagates to existing assignments, operators can stop an in-progress run, and several operators can use case-sensitive matching. Advanced capacity insights can break down data by access, age, tier composition and object size, with views scoped to accounts, containers or prefixes. Azure Migrate’s preview NAS assessment covers Dell OneFS and NetApp ONTAP shares and can assess readiness and produce business cases.
Database-level managed identity in Azure SQL Database provides a user-assigned identity for each database, rather than requiring an identity at the server level for the described access scenarios. For PostgreSQL Flexible Server, the move from VNet integration to private endpoints causes about 10 minutes of connectivity interruption; public access is disabled by default after the change.
Limitations and open questions
Preview status means several of the announced features may change and should not be treated as generally available. The update does not provide portal paths, commands, pricing, regional availability or exact rollout schedules for most items. It also does not specify how to enable each feature, so consult the service documentation and confirm preview terms before relying on one in production.
Crash-consistent restore points capture multiple disks at the same moment, avoiding timing differences between disk snapshots. They are not application-consistent and do not call guest operating-system capabilities such as Windows Volume Shadow Copy Service; the described approach requires no in-guest agent. For SQL point-in-time recovery, retention can be extended from the current seven days to as many as 35 days, but the configured retention is immutable and cannot later be reduced.
For Service Bus Premium partitioned namespaces, geo-replication can be asynchronous with a configured maximum lag time, or synchronous at a performance cost because messages are acknowledged after storage at replicas. The update recommends keeping regions on the same continent in typical cases, while noting a different continent is possible. These tradeoffs should inform recovery objectives and latency expectations.
Sources
Frequently asked questions
Can Azure Site Recovery replicate Azure Local workloads to Azure?
Yes. The update describes generally available support for replicating Windows and Linux workloads running on Azure Local to Azure for disaster recovery.
Does Azure Front Door’s post-quantum TLS key exchange protect the backend connection?
No. The described key exchange applies from the client to the Azure Front Door edge, not from the edge to the backend.
How long does PostgreSQL Flexible Server migration to private endpoints interrupt connectivity?
The update says the transition causes about 10 minutes of connectivity interruption. Public access is disabled by default after the change.
Can Azure SQL point-in-time recovery retention be reduced after setting it?
No. The preview feature allows retention to be extended up to 35 days, but the configured retention is immutable and cannot be reduced.