Everything Azure Shipped This Week, Ranked

The week in one paragraph

Ten announcements in five days, spread thinly: one Monday, one Tuesday, four Wednesday, three Thursday, one Friday. Nothing new launched. Every item was either a capability arriving at general availability, a performance ceiling being raised, or a date being set for something to be switched off — which makes this a maintenance week rather than a roadmap week, and those are the ones that quietly create work. Three separate items carry a hard calendar date between 23 August and 1 November, and two of them apply to tenants that take no action at all.

The single most useful number of the week came from Azure Firewall, and it is more interesting than the headline claimed.

The Firewall number worth reading twice

Azure Firewall Premium now supports up to 22 Gbps with TLS inspection and IDPS in Deny mode, up from 10 Gbps — the announcement bills it as a 2.2× improvement, and the arithmetic holds. Single-connection throughput with IDPS in Alert or Deny mode doubled to up to 600 Mbps.

That is a real gain. But put it next to the rest of the published performance table and a design constraint appears that the announcement does not mention:

Premium with IDPS actively blocking is still rated below Standard. 22 Gbps against 30. The premium SKU costs more and, in the configuration most people buy it for, moves less traffic. That is not a criticism of the product — inspecting and blocking traffic costs cycles, and 22 Gbps of inspected traffic is worth more than 30 Gbps of uninspected traffic — but it is the kind of fact that belongs in a capacity plan rather than in a surprise.

Two further details that matter if you are sizing from these numbers. Alert mode and Deny mode are not equivalent: with IDPS in Alert only, aggregate throughput stays at 100 Gbps, so the entire drop is the cost of blocking rather than the cost of inspecting. And every figure above assumes a maximum autoscale instance count of 20 — with prescaling enabled the firewall reaches 50 instances and the published values no longer apply.

The 600 Mbps per-connection ceiling is the one that catches architectures rather than budgets. A single large file transfer, a backup stream or a replication link does not get 22 Gbps; it gets 600 Mbps. Aggregate capacity is not per-flow capacity, and designs that assume otherwise fail on one connection while the firewall reports plenty of headroom.

Networking and edge

Azure Front Door mutual TLS entered public preview. Front Door can now authenticate clients with X.509 certificates before a request reaches the application, which moves client-certificate validation from the origin to the edge. For business-to-business APIs and IoT fleets this is the difference between every origin implementing certificate validation correctly and one place doing it.

Batch rule updates for Front Door reached general availability on Standard and Premium. Multiple rules in a rule set can be added, updated, deleted or reordered as one coordinated operation that either applies completely or not at all. Anyone who has half-applied a rule set change to a production edge will recognise what this fixes: rule sets were previously mutable one rule at a time, so a failed change left the edge in a state that was neither the old configuration nor the new one.

Containers and observability

Control plane metrics for AKS, through Azure Monitor managed service for Prometheus, reached general availability. The covered components are the API server, etcd, kube-scheduler, kube-controller-manager, the cluster autoscaler and node auto-provisioning.

This closes a genuine blind spot in managed Kubernetes. The control plane is the part AKS operates on your behalf, which has always meant that when the API server slowed down or etcd came under pressure, the symptom was visible in your workloads and the cause was not visible anywhere. Scheduler and autoscaler metrics are the ones I would wire up first: "why did this pod stay pending for four minutes" is a question that has never had a first-party answer.

Data and storage

Live resize for shared Premium SSD v2 and Ultra data disks reached general availability. Shared disks — the ones under clustered workloads such as failover clusters and shared-storage databases — can now be expanded without disrupting the applications using them. The practical effect is that the cost-optimisation advice for these disk types stops carrying a penalty: start small and grow, rather than provisioning for the eventual peak because growing later means downtime on a clustered workload.

Pre-upgrade validation checks for Azure Database for PostgreSQL flexible server reached general availability, runnable from the portal and from the CLI with --validate-only. Major version upgrades are the operation people defer for years; being able to find out what will break without committing to the upgrade is what turns that into a scheduled task.

Markdown for Agents in Azure App Service entered public preview: App Service can convert an app's HTML response to Markdown when a client asks for it, with no application code change.

Retirements and dated deadlines

Three items this week set a date. Two of them change behaviour for tenants that do nothing.

The Sentinel one is the dangerous shape of retirement: nothing fails at the moment of retirement except the arrival of data. A SIEM that stops receiving SAP logs does not raise an alert about the logs it is no longer receiving unless somebody built that alert.

Security advisories

August's Patch Tuesday carried six advisories affecting Azure and Entra components:

• CVE-2026-47299 — Azure Monitor Agent, elevation of privilege
• CVE-2026-65673 — Microsoft Entra Connect, elevation of privilege
• CVE-2026-70340 — Azure CycleCloud, elevation of privilege
• CVE-2026-65806 — Azure CycleCloud, information disclosure
• CVE-2026-57104 — Azure Storage Explorer, elevation of privilege
• CVE-2026-54123 — Microsoft Defender for Endpoint for Mac, information disclosure

Entra Connect is the one to look at first. It sits on-premises, holds directory synchronisation credentials, and an elevation of privilege there reaches the identity plane every other control on this list depends on.

Beyond the announcements

Three pieces from Microsoft's own engineering blogs that carry more detail than anything announced this week:

• I Enabled RBAC and Everything Broke — on the Cosmos DB data-plane RBAC model, and why enabling it disables key-based access in ways people do not expect.
• Your best friend: BlockOnPossibleDataLoss=True — on the Azure SQL failover-group flag that decides whether a failover is allowed to lose committed transactions.
• Azure Monitor Auxiliary Logs expands — Azure table support, plan switching and sovereign clouds. The auxiliary tier is the lever that decides what a high-volume logging architecture costs.

On the platform side, Microsoft Entra Tenant Governance reached general availability, and AKS shipped release 2026-08-07. Azure CLI reached 2.89.1 and the Terraform AzureRM provider reached v5.1.0.

What I would act on

1. Check whether anything still runs on Databricks Runtime 10.4 LTS. It has been out of support since March 2025 and stops running on 1 November 2026. This is the only item this week that ends with workloads failing rather than degrading.
2. Find out whether your Sentinel SAP connector is the containerized one. If it is, the replacement is GA and you have until 14 September. Then build the alert that fires when SAP logs stop arriving — the retirement is a good reason to have it, but the absence of that alert is the real problem.
3. Re-check your Azure Firewall capacity assumptions against 22 Gbps and 600 Mbps. Especially the per-connection figure, and especially if any single flow — backup, replication, data transfer — crosses the firewall. Confirm whether your deployment is in the 20-instance or the prescaled 50-instance regime, because the published numbers only describe the first.
4. Decide the Fabric Item Recovery setting before 23 August rather than after. A 3-day recovery window arriving by default is a reasonable default, but it is a change to recovery behaviour that will happen without anyone approving it.
5. Turn on AKS control plane metrics on one cluster. Scheduler and autoscaler metrics first. It costs a configuration change and answers the pending-pod question that has never had a first-party answer.

Complete inventory — all 10

Every announcement published to Azure Updates between Monday 10 and Friday 14 August 2026.

Official Azure references

• Azure Firewall performance — the throughput table quoted above
• 2.2X IDPS performance optimization in Azure Firewall
• Azure Databricks Runtime 10.4 LTS end of life
• Microsoft Fabric Item Recovery default change
• Sentinel SAP containerized connector retirement
• AKS control plane metrics with Managed Prometheus
• PostgreSQL flexible server pre-upgrade validation checks
• Live Resize for shared Premium SSD v2 and Ultra disks
• Azure Front Door mutual TLS
• Batch rule updates for Azure Front Door
• Markdown for Agents in Azure App Service