Weekly Azure Roundup: Arc Automation, HSM Audits and Agent Tools

by TechHub

Azure Arc Automatic Agent Upgrade is now generally available, letting teams automate Connected Machine agent maintenance through Azure Policy and onboarding settings, while Azure Advisor flags disconnected servers before certificate expiration forces re-onboarding. Azure Cloud HSM is rolling out hardware audit logging with independently verifiable signed records, giving security teams evidence of supported management and key operations. Developer tooling adds deployment inspection through azd deploy --preview, a public-preview local CLI for Logic Apps Standard, and the first stable Cosmos DB SDK for Rust, which requires migration changes for preview users. Foundry Agent Service introduces the Microsoft Copilot harness in public preview and makes long-running resilience generally available, although applications must still save progress and prevent duplicate actions after restarts. Together, these updates emphasize automated operations and reviewable deployment and security workflows while retaining explicit recovery and approval responsibilities.

This Week's Overview

Azure Arc automates agent maintenance and supports incident investigations

Azure Arc updates address both routine agent upkeep and the consequences of losing connectivity. A related operations guide shows how to use Arc-connected server telemetry for investigations without moving on-premises workloads.

Automatic Agent Upgrade reaches general availability

Automatic Agent Upgrade is now generally available for Azure Arc-enabled servers. When enabled, Microsoft manages Azure Connected Machine agent upgrades to the latest version, rolling them out in regional batches during off-peak hours.

Teams can use the built-in Azure Policy to enable upgrades across an assigned scope and remediate machines that are not configured. For new servers, onboarding supports the --enable-automatic-upgrade flag with azcmagent connect, or the Automatic Agent Upgrade option in portal-generated scripts. These options let administrators incorporate automatic maintenance into both existing fleet management and new-server onboarding.

Advisor identifies servers at risk of losing management access

Azure Arc marks a server Disconnected after more than 15 minutes without an agent heartbeat, but longer outages introduce a certificate-expiration risk. The agent's managed identity certificate lasts 90 days, with renewal attempted when 45 or fewer days remain. Azure Advisor recommends restoring connectivity after 30-44 disconnected days and reconnecting servers disconnected for at least 45 days.

An expired certificate requires re-onboarding the server, so restoring network connectivity alone will not restore Azure Arc management. Administrators can review recommendations in Azure Advisor or individual server resource pages, and query them across subscriptions with Azure Resource Graph.

SRE Agent investigations extend to on-premises servers

A proposed architecture uses Azure Arc to expose on-premises Windows and Linux servers as Azure resources, then collects telemetry through Azure Monitor Agent and Data Collection Rules into Log Analytics. Azure SRE Agent uses Azure Monitor alerts, server telemetry, and defined response plans to investigate incidents.

Examples cover SQL Server crash diagnosis, cross-platform patch planning, inventory changes, and SQL Best Practices Assessment results. The rollout guidance puts telemetry verification, action permissions, and approval responsibilities ahead of expansion beyond pilot servers.

Azure Cloud HSM adds independently verifiable audit records

Azure Cloud HSM Hardware Audit Logging captures supported hardware security module management operations, including authentication, administrator changes, policy updates, key lifecycle operations, and backup and restore activity. Customers receive readable records alongside HSM-signed binary audit data, signatures, and certificates, allowing independent verification of signed audit batches.

Logging is enabled through an immutable HSM partition policy, making its configuration part of the security boundary rather than a freely changeable reporting setting. Events flow into Azure Monitor Log Analytics and can support Microsoft Sentinel security operations workflows. The feature is rolling out across public regions and is automatically enabled for newly provisioned Azure Cloud HSM resources where available.

High-performance computing addresses simulation scale and node maintenance

Azure high-performance computing coverage spans parallel reservoir analysis and maintenance of existing compute fleets. The practical concerns differ: matching storage to simulation concurrency, and updating operating system images without rebuilding an entire scale set.

Reservoir modeling becomes generally available

SLB agile reservoir modeling on Azure Data Manager for Energy is generally available. Azure high-performance computing runs multiple reservoir realizations in parallel, while Azure Files supplies shared storage for concurrent reads and writes. Compute capacity, storage capacity, throughput, and input/output operations per second (IOPS) can scale independently to match the number of concurrent simulations.

Azure Data Manager for Energy supplies OSDU-aligned data services and search capabilities for discovering published simulation results. Entitlement-based access integrates with Microsoft Entra ID, while OSDU legal tags support compliance controls. This connects simulation execution with controlled access to the resulting data.

CycleCloud node images can be updated selectively

A validated CycleCloud procedure upgrades the Ubuntu HPC image from 24.04.2026052601 to 24.04.2026092501 without recreating the entire Virtual Machine Scale Set. In Manual upgrade mode, changing the scale-set model does not update existing instances automatically, so the procedure drains a Slurm node, updates the model, and applies it to a selected instance with az vmss update-instances.

Selected nodes experience downtime, and validation covers latestModelApplied, in-guest image metadata, operating system health, Slurm registration, GPU drivers, remote direct memory access (RDMA), containers, and representative workloads. After validation, the CycleCloud node-array image configuration must be updated to prevent configuration drift.

Deployment tooling adds previews and clarifies infrastructure lifecycle choices

The October Azure Developer CLI recap adds deployment inspection and automation changes. Companion infrastructure-as-code guides explain where Bicep, ARM templates, and Terraform differ, particularly when resources disappear from declarations.

Azure Developer CLI deployment and extension changes

The recap covers Azure Developer CLI releases 1.35.0, 1.35.1, 1.36.0, 1.37.0, 1.37.1, and 1.37.2. The azd deploy --preview command inspects deployment operations without deploying and supports structured JSON output. Container Apps express deployments use the containerapp host and image-based strategy, but do not support multiple revisions or traffic splitting.

Generated GitHub Actions and Azure Pipelines definitions now install extensions required by extension-defined infrastructure providers. Developers maintaining custom integrations need to account for exported environment and state path Go APIs returning errors, which requires updates to custom implementations and mocks.

Bicep improves authoring without changing the deployment engine

Bicep compiles into ARM template JSON, and both approaches deploy through Azure Resource Manager. Bicep adds type checking, symbolic resource references, reusable modules, and automatic dependency inference. Microsoft recommends it for the template authoring experience while continuing to support ARM template JSON.

Both formats work with Azure CLI, Azure PowerShell, GitHub Actions, and Azure Pipelines. The Azure CLI what-if operation previews anticipated infrastructure changes without applying them, giving teams a review step regardless of their authoring format.

Bicep and Terraform require different removal and state practices

Removing a resource declaration leaves the resource intact in standard incremental Bicep deployments, while Terraform normally proposes destroying resources still tracked in its state. Deployment stacks can detach or delete removed resources according to actionOnUnmanage, but their stored what-if results are not executable Terraform-style saved plans.

AzAPI exposes ARM resource types and API versions while retaining Terraform's state and plan workflow. Azure Verified Modules support both tools, but differing storage-account defaults make version pinning and configuration review important. The guide recommends disposable pilots that test drift detection, reconciliation, declaration removal, and adoption of existing resources before selecting an approach.

Logic Apps expands terminal development and documents hybrid storage behavior

Logic Apps coverage pairs a public-preview local CLI with measured results from a hybrid SQL-backed deployment. Both articles spell out constraints that matter when moving from a demonstration to a repeatable development or testing workflow.

Standard workflows gain a local CLI preview

The Logic Apps Standard Azure CLI extension enters public preview with 59 extension-owned commands for local development and execution diagnostics. The logicapp 1.0.0b1 preview requires Azure CLI 2.67.0 or later and Python 3.10 or later. Its Outlook-to-Blob walkthrough runs workflows locally while keeping the mailbox, managed connection, and storage account in cloud services.

The azure-logic-apps-standard-cli skill on Awesome Copilot provides connector discovery, validation, and approval procedures for GitHub Copilot. Local managed-connector wiring remains manual, and the current testing SDK and engine combination has a reported typed-output limitation. Local execution therefore does not remove every cloud dependency or setup step.

SQL storage benchmarks expose shared-disk constraints

Two 30-minute hybrid Logic Apps tests offered 1 KiB files at 100 files per second, with no failed workflow runs in either measured window. The repeat delivered 3.87% higher successful throughput, 6.40% lower p95 execution latency, and 8.68% lower p99 execution latency.

Those results came from a single host and backing disk shared by OpenShift, SMB files, SQL Server 2025 data and logs, and cluster virtual machine storage. Average workflow-state data-file write latency rose from 12.958 to 38.652 milliseconds, while instance-wide accumulated lock waiting stayed near 1,470 task-seconds. Autoscaling permitted 1-10 workflow replicas on that same single-node infrastructure, so increasing replica count did not add disk capacity.

Azure SDK updates authentication and stabilizes Cosmos DB for Rust

The October Azure SDK release includes authentication additions and a token-cache fix, alongside the first stable Cosmos DB release for Rust. Existing Rust preview users have explicit migration work.

Authentication support and token-cache correctness

Azure Core 1.63.0 for .NET adds mutual TLS (mTLS) proof-of-possession support for client certificate authentication and the managed identity federated identity flow. Azure Identity 1.26.0 for Python and 1.18.7 for Java add user-assigned managed identity support on Azure Arc-enabled servers. The Python release also fixes a shared-token-cache issue that could return a cached token for another account.

Cosmos DB for Rust reaches its first stable release

Cosmos DB 1.0.0 for Rust is the first stable release, accompanied by the Cosmos DB Client Driver and SDK Macros crates. Applications upgrading from the preview must rename three feature flags to their unstable equivalents and replace CosmosCredential::MasterKey with CosmosCredential::AccountKey.

Foundry previews the Microsoft Copilot harness

The Microsoft Copilot harness enters public preview in Foundry Agent Service, while long-running resilience for hosted agents is generally available. The release separates managed execution capabilities from application responsibilities for safe restarts.

Agent execution and preview constraints

The harness provides reusable skills, connected tools, managed execution, subagents, and source-controlled agent definitions. During preview, developers must select it when creating an agent because switching afterward is unsupported. Foundry controls CPU, memory, and idle settings.

Long-running resilience does not remove the need for application-level recovery logic. Applications must save progress and prevent duplicate actions when interrupted work restarts.

Runtime billing begins in December

Harness runtime billing begins December 1, 2026, but model inference and separately billed tools remain chargeable before then. Starting on that date, sandbox compute costs USD $0.0994 per vCPU-hour and memory costs $0.0118 per GiB-hour, subject to regional and agreement variations.

Oracle AI Database@Azure adds placement and sovereignty controls

Oracle AI Database@Azure updates cover application-to-database proximity, resource governance, and planned government deployments. The placement and sovereignty guidance both emphasize decisions that need attention before provisioning.

Proximity placement groups become generally available

Proximity placement group integration is generally available for Exadata Database Service on Dedicated Infrastructure. Oracle infrastructure anchors placement first, and supported Azure application virtual machines are then placed nearby using the same group. Oracle internal testing recorded median regional reductions of 54% in average network round-trip time (RTT) and 52% in p50 RTT, not equivalent improvements in application performance.

Placement groups constrain location but neither reserve Azure virtual machine capacity nor provide a multi-zone resilience strategy. A group cannot be added retroactively to an existing Network Anchor, making this a deployment-planning consideration rather than a simple configuration change.

Government plans and sovereign controls require broader tenancy review

Oracle plans to obtain FedRAMP Class D certification for Oracle AI Database@Azure in Azure Government, with dedicated Exadata infrastructure planned for US Gov Virginia and US Gov Arizona. These are plans, not a completed certification announcement. The Oracle Azure Resource Provider now supports Azure Policy and the EU Data Boundary, covering EU member states and the four EFTA countries.

Customer-managed keys support Azure Key Vault Standard, Premium, and Managed HSM. Revoking a key prevents database startup, recovery, and backup restoration using that key. Advanced networking for new deployments applies Network Security Groups, user-defined routes, Azure Firewall, and virtual network flow logs to the database subnet.

Sovereignty review must extend beyond the database's Azure region because Oracle Cloud Infrastructure's Default identity domain replicates to every subscribed region. Existing databases continue serving reads and writes during OCI control-plane outages, while provisioning, scaling, configuration changes, and maintenance wait. For proximity placement support, existing Exadata customers can contact Oracle Support about their options.

MANA networking updates no longer require an LTS kernel upgrade

Microsoft announced an out-of-tree Microsoft Azure Network Adapter (MANA) driver for supported Linux long-term support kernels. The package contains identical upstream MANA driver source plus a thin compatibility layer for older supported kernels, allowing driver updates without a kernel upgrade. Supported versions are 5.15, 6.1, 6.6, 6.12, and 6.18.

Users build the MANA kernel module from source against the headers of their running kernel. Custom or heavily modified kernels fall outside normal support scope, and replacing distribution-provided drivers may affect vendor support coverage. Teams should check that support boundary before adopting the package on maintained production images.

PostgreSQL workflows bring query development and diagnosis into VS Code

PostgreSQL coverage connects database exploration, query authoring, and performance investigation inside Visual Studio Code. Both walkthroughs retain user review rather than treating AI-generated recommendations as automatically safe changes.

Investigate performance and verify controlled changes

The performance demonstration starts in the Performance Dashboard, identifies database workloads and queries, reviews Azure Advisor guidance, and verifies the result after a controlled action. The Database Agent experience brings issue context and recommended actions together while retaining user review and approval.

Use connected database context for SQL development

Microsoft's PostgreSQL extension supports database object exploration, SQL execution, and reusable connection profiles in Visual Studio Code. Azure connections support Microsoft Entra ID sign-in and selection of a subscription, server, and database, while GitHub Copilot can use connected database context to answer schema questions and help analyze query plans and execution metrics.

The authors recommend verifying generated SQL and comparing original and revised query results before accepting performance changes. The accompanying video presents Database Agent as upcoming, with manually applied actions and automated remediation discussed as a future capability.

Other Azure News

Azure NAT Gateway can provide a predictable public source IP for applicable internet-bound API Management traffic in Standard v2 with virtual network integration, or Premium v2 with integration or injection. The walkthrough requires Microsoft.Web/serverFarms subnet delegation for outbound integration, validates the backend-observed address against the gateway's public IP, and treats IP allowlisting as a supplement to strong service-to-service authentication.

Karthik Uthaman, a principal software engineer in Microsoft's Azure Front Door group, explains how distributed denial-of-service attacks exhaust CPU, memory, and network resources, including the relationship between request rates and CPU utilization. The discussion shows why per-IP rate limiting alone is insufficient and examines Microsoft Threat Intelligence, JA4 fingerprints, and probabilistic data structures as signals for real-time, inline analysis.

A tested 64 GB laptop held Qwen3.8-27B, its draft model, and the full 262,144-token context, measuring 44.1 tokens per second in the final full-context profile. Separate 70-minute agent runs completed 111 requests at one-request concurrency versus 74 at two, while OpenTelemetry sent metrics to Azure Monitor managed service for Prometheus and traces to Application Insights using Microsoft Entra ID authentication.

The weekly video covers Container Apps logging destinations, higher storage account resource quotas, confidential virtual machines, virtual network flow-log filtering, Front Door web application firewall policies, and Azure Backup cross-tenant restore. Its AI coverage includes Foundry Claude model cost management, Azure MCP Server 3.0, GPT-6.1 Terra, MAI-Image-2.6, MAI-Image-2.6-Flash, and GitHub Universe.

A physical AI overview connects Azure IoT Hub's device connectivity and updates with Azure IoT Operations' data curation and inference in operational technology environments. Azure Device Registry supplies policy, role-based access control, and certificate management for those devices as part of learning loops that improve machine behavior through execution.

Also relevant this week

Dates to know

Deadlines