Azure Weekly Intelligence #12 - 26-30 October 2026

The week in one paragraph

Fifty-seven distinct items, and a quiet week for infrastructure after a loud one. Four Tech Community blogs that carried items last week — Infrastructure, Networking, Compute, Storage — published nothing in range, and the MSRC Update Guide returned zero Azure CVEs after four the week before. What volume there was went to AI: twelve of the fifty-seven came from the Foundry blog alone. The three networking changes that did land are unusually coherent, though, and all three are about the same thing: knowing and controlling what leaves a virtual network. Network Watcher got flow log filtering, Front Door got WAF policies at profile and route level, and API Management v2 got predictable outbound addresses back via NAT Gateway. Reading the flow logs documentation to check the first of those turned up something worth more than the announcement — a documented gap where the fastest ExpressRoute path is also the one your flow logs cannot see.

The instruments caught up with the plumbing

Three generally available networking changes, 26 to 29 October:

Flow logs are the one worth reading the documentation for, because the capability is more load-bearing than its name suggests. “Virtual network flow logs… log information about IP traffic flowing through a virtual network… sent to Azure Storage”, and the pitch against the older mechanism is both scope and cost: they “overcome some of the limitations of Network security group flow logs and are more cost efficient”.

The scope argument is the real one. NSG flow logs required logging at two levels — “network security groups are configured at both the subnet and the network interface” — whereas the newer form is enabled once on the virtual network and “traffic through all supported workloads within a virtual network is recorded”.

What makes this directly relevant to the last three architecture posts is the second thing it can now see: “Virtual network flow logs support identification of traffic that Azure Virtual Network Manager security admin rules allow or deny”, as well as NSG rules. Security admin rules are the layer that, as the hub-and-spoke guidance notes, takes precedence over and is evaluated before NSG rules — so this is the tool that tells you which of the two layers actually decided a flow's fate. Before, you could read both rule sets and still be guessing.

One warning to act on before enabling it anywhere: “We recommend disabling network security group flow logs before enabling virtual network flow logs on the same underlying workloads to avoid duplicate traffic recording and additional costs.” Running both is not additive coverage, it is a double bill.

The blind spot FastPath creates

This is the find of the week, and it is not in any announcement. The flow logs page carries a short section on ExpressRoute that produces an uncomfortable pairing with the performance guidance everyone follows.

FastPath exists to bypass the virtual network gateway for throughput, and it is the documented way to use circuit bandwidth above the gateway's ceiling. It turns out to bypass the observability at the same time, for the same reason: there is no gateway in the path to log at.

There is a related trap even without FastPath: “Outbound flows from virtual machines (VMs) to ExpressRoute circuit aren’t recorded if flow logging is enabled on the ExpressRoute gateway subnet. Such flows must be recorded at the subnet or NIC of the VM.”

So enabling flow logs on the gateway subnet — which is the intuitive place, since that is where hybrid traffic converges — is precisely the configuration that misses outbound hybrid flows. The fix is to log at the workload end instead, which is a different operational model: per-spoke rather than per-hub.

For anyone running a compliance argument on flow logs, that is worth knowing in advance rather than during an audit. “All traffic to on-premises is logged” is false by default on a FastPath circuit, and false in a particular way on a non-FastPath one if you instrumented the obvious subnet.

Why filtering is a cost control, not a convenience

The announcement is “filtering”, which sounds like a usability feature. The documentation explains why it is a budget feature, and the explanation lands squarely on hub-and-spoke designs:

“Virtual Network flow logs operate at the virtual network level and therefore capture traffic for resources such as gateways by default. As a result, traffic passing through these gateways is included, which can lead to a higher volume of log data.”

Put that next to the forced-tunnelling pattern and the arithmetic gets uncomfortable. A design that routes all egress through a hub gateway for inspection has deliberately concentrated every outbound flow onto the resource flow logs capture by default. And overriding the default route means “Azure sends all traffic to the next hop type specified in the route, including traffic destined for public IP addresses of Azure services” — so storage reads and Key Vault calls join the same log stream.

The pricing is per gigabyte with a modest allowance: “charged per gigabyte of Network flow logs collected and come with a free tier of 5 GB/month per subscription… Storage of logs is charged separately.” Traffic analytics on top has “no free tier” and bills per gigabyte processed.

The page is also candid that the newer form logs more than the old one did: “Virtual Network Flow Logs extend logging coverage beyond network security boundaries to include platform and application-level traffic scenarios… which may result in higher log volumes compared to more narrowly scoped flow logging configurations.” So “more cost efficient” per gigabyte and “more gigabytes” are both true, and filtering is what reconciles them.

Two other numbers are worth having before the first bill. The log record is per-flow at one-minute collection intervals, with ongoing flows reporting “statistics… at five-minute intervals”, and the documented worked example totals 9,125 packets and 5,256,000 bytes for a single TCP conversation — which is a useful reminder that a flow record is not one line per connection but one line per state change, with aggregate counters since the previous record.

Front Door and API Management, both about egress identity

The other two networking items pull in the same direction, one on the inbound side and one on the outbound.

Front Door WAF policies at profile and route level went GA on 27 October, with an HTTP DDoS ruleset for Premium WAF following on the 29th. Policy scoping is the kind of change that only matters once you have more than one application behind one profile — which is the normal end state — and it is the same shape of problem as route tables: a rule set that can only attach at one granularity forces you to merge unrelated intents into a single list.

API Management v2 regaining predictable outbound IP addresses via NAT Gateway is a Tech Community piece rather than an announcement, and it is the one I would read in full. It is the same problem the hub firewall has: every third party that allow-lists you is allow-listing your egress addresses, and a platform that hands you unpredictable ones breaks that contract. NAT Gateway is the documented answer in the hub case too, attached to the firewall subnet to raise the SNAT budget and give downstream systems a stable, contiguous set to permit.

Worth noting for anyone instrumenting an APIM estate this week: flow logs now cover “Azure API management” where NSG flow logs did not — but Traffic Analytics on top has a narrower scope. “Traffic Analytics currently supports only Azure API Management instances deployed using VNet Injection. VNet Integration deployments aren’t supported.” So the deployment model you chose for APIM determines whether the analytics layer sees it.

Four security analyses and no Azure CVEs

The MSRC Update Guide returned zero Azure CVEs for the window — 321 non-Azure CVEs were suppressed as out of scope — which is a change from the four Azure CVEs the previous week, including that Azure Pipelines remote code execution.

Microsoft's security researchers published four pieces instead. Two are worth time:

• AD CS abuse via ESC1 and ESC8, from help desk impersonation through to certificate services abuse. Certificate-based privilege escalation keeps turning up, and the help-desk entry point is the part most organisations under-model.
• AI adoption in North Korean threat actor tradecraft — a follow-on in theme from the ARTEX campaign analysis two weeks ago, tracking how these groups are actually using the tooling rather than speculating about it.

The other two are positioning: an IDC MarketScape placement and a CISO-role piece. Neither carries anything to act on.

One genuine follow-up did land, and it is the kind this series exists to catch: PHP2Shell and Azure DevOps: what to check, published 26 October on the DevOps blog. The PHP2Shell CVEs and their WAF mitigations were covered in #11; this is a different team telling you where to look in a different product, which makes it new rather than a repeat.

The three Azure Network Security WAF articles themselves reappeared in this window's feed with 26 October dates, having carried 22 and 23 October dates when #11 covered them. Same URLs, same content. They are excluded from the inventory below as already published, and the arithmetic shows it.

The rest, briefly

Platform and resilience. Cross-tenant restore with Azure Backup went to public preview — a real gap closed for anyone whose recovery plan assumes a tenant boundary can be crossed under duress. Large OS disk encryption for Confidential VM migrations reached GA. The per-region, per-subscription limit on Blob Storage accounts went up, which is the sort of quota change that unblocks a landing-zone design nobody wants to redesign.

A migration with a clock on it. Container Apps logging is moving from Log Analytics to Azure Monitor. Announced as a migration rather than an option, which means it belongs on a diary rather than a backlog.

Identity and data. Database-level managed identity, including federated identity credentials, is in preview for CREATE DATABASE SCOPED CREDENTIAL in T-SQL — narrowing credential scope from server to database is a meaningful blast-radius reduction. Four PostgreSQL pieces and a Hyperscale architecture explainer rounded out the data side.

Tooling. Azure MCP Server 3.0 reached GA. The October Azure SDK release and an Azure Developer CLI round-up both landed, as did Azure DevOps Server RC 26H2 and Terraform AzureRM. An Azure Cloud HSM hardware audit logging post is worth a look if you are building a verifiable audit trail story.

AI. Twelve Foundry items, the densest source of the week by a wide margin, plus cost management and tagging for Claude models in Foundry and a Copilot harness in Foundry Agent Service. Volume rather than architecture, as it has been for several weeks.

What I would act on

Complete inventory — all 57

Every item the feed audit returned for 26–30 October 2026, from 47 probed sources with none broken or empty and no truncation warning. The sources reporting zero items for the window are not listed.

The arithmetic. The sources reported 72 items in range. Eleven are double-counted — the Azure Updates announcements arrive through both the release-communications archive and the RSS feed, and the same eleven appear in each — leaving 61 distinct. Four of those were already published in #11 and reappeared in this window with later dates; they are excluded as repeats rather than counted twice across two roundups. That leaves 57 new items, which is the number of rows below. Nothing was dropped for being minor.

Official Azure references

Fetched and used — the pages this post's claims were verified against:

• Virtual network flow logs overview — 29 claims: what they record and how they compare with NSG flow logs, security admin rule visibility, the log format and flow states, the worked packet and byte arithmetic, the ExpressRoute and FastPath gaps, the unsupported services, pricing and the storage account constraints
• Azure Firewall forced tunneling — 1 claim: the SNAT behaviour that hides source addresses from an on-premises firewall
• Azure virtual network traffic routing — 1 claim: that overriding the default route captures Azure service traffic too

Listed but not fetched — these carry no claims in this post:

• Every link in the inventory table above. Announcement pages on azure.microsoft.com/updates are rendered client-side and cannot be read as a source; Tech Community, MSRC and the Microsoft security and developer blogs are not documentation hosts. They are inventory, which is what the table is for.
• Network security group flow logs overview — the older mechanism this week’s change is measured against
• Traffic analytics — the processing layer whose pricing and APIM scope are referenced above