Everything Azure Shipped This Week, Ranked

The week in one paragraph

Eight announcements across five days, two a day from Tuesday to Friday and none on Monday — the flattest and thinnest week this series has covered. The announcement feed was quiet; the security feed was not. Patch Tuesday on 8 September carried twelve Azure advisories, with a thirteenth the following day, and three of the thirteen sit in the Entra family.

In a week with nothing structural in it, the ranking falls to what changes a design rather than what changes a number. That is the storage item, which is a small GA with a large idea inside it: the end of the anonymous bearer token as the default way to share Azure Storage.

The bearer token finally gets a name on it

User-bound user delegation SAS for Azure Storage is now generally available for all regions, and it is worth more attention than its two-paragraph announcement suggests.

A shared access signature has always had one structural weakness: it is a bearer token. Whoever holds the string has the access. User delegation SAS, already GA for Azure Blobs, Azure Files, Azure Tables, and Azure Queues, fixed half of that by putting a name on the issuer — the token is tied to the delegator, meaning the delegator must verify their identity with Entra to create the token, it can be traced to the delegator, and it can only be valid for up to 7 days. You gained attribution and a ceiling on blast radius.

What you did not gain was any control over who used it after issue. This release closes that: user-bound user delegation SAS creates a more secure SAS token than account SAS, service SAS, or normal user delegation SAS by restricting the usage of the SAS token to an end user identity. The token now names both ends. Leak it, and it does not work for the finder.

This matters beyond storage, because it is the same move the platform has been making everywhere: replace a secret that proves possession with an identity that proves who you are. It is the argument behind managed identities, behind workload identity federation, and behind this. And the economics point the same way — there is no additional cost to use user-bound user delegation SAS.

The practical read: if you have a SAS-generating service, the question to ask this week is whether it knows the identity of the person it is generating for. If it does, this is a small change with a large reduction in what a leaked URL is worth. If it does not — if your SAS tokens are minted by a backend that never learns who the caller is — that architectural gap is now the thing standing between you and the better token.

A retirement with two dates, and only the second one bites

The week's one dated retirement is Azure Linux with OS Guard in AKS, and it is a good example of a retirement notice that has to be read to the end.

Support will end on December 10, 2026, with Azure Container Linux as the replacement. Starting that day, three things stop: you won't be able to create new Azure Linux with OS Guard (preview) node pools, AKS won't produce new node images for affected node pools, and existing node pools won't receive security patches. Unpleasant, but survivable — your clusters keep running.

The date that actually breaks things is the second one. On March 10, 2027, AKS will remove the Azure Linux with OS Guard node images, and after the images are removed, scaling and remediation operations, including reimage and redeploy operations, will fail for affected node pools.

Two migration paths are offered: migrate an existing node pool in place, which performs a standard node image upgrade, or stand up a new Azure Container Linux node pool, move and validate workloads, and delete the old one. The in-place option is the cheaper one and is available now, which argues for doing this well before December rather than treating March as the deadline.

Ten times the I/O, for twice the disk

Azure Ephemeral OS Disk with full caching is now generally available for new VMs and scale sets. It caches the complete OS image on a VM's local storage, eliminating remote-storage reads after caching finishes, delivering low-millisecond OS disk access, up to 10× better I/O performance, and greater resilience during storage interruptions — and notably without slowing VM provisioning because caching runs asynchronously after boot.

The cost is stated plainly, which is rarer than it should be: full caching uses a VM's cache, resource, or NVMe disk and reduces available local capacity by twice the OS disk size. Twice, not once — so a 64 GB OS disk takes 128 GB out of local capacity that your workload may have been planning to use for scratch space.

That single sentence is the whole sizing decision, and it is the reason this is a design change rather than a toggle. The target workloads named are I/O-sensitive, stateless workloads such as AI training and inference, quorum-based databases, real-time analytics, and large-scale services — which is precisely the set of workloads most likely to already be using local disk for something. Available on supported 8-core-and-larger GPU, storage-optimized, memory-optimized, HPC, general-purpose, and compute-optimized VM series, enabled through CLI, ARM templates or REST.

Three that quietly remove an agent, a gap and a region limit

Agentless SMB migration in Azure Storage Mover (preview) removes a deployment step that has sunk more than one migration: you can now move file data from Windows Server or NAS shares into Azure without deploying, registering, or maintaining a migration agent on-premises. The service connects directly to your SMB share over your existing private connection (VPN or ExpressRoute). Worth noting how it authenticates, given this week's theme — source credentials are stored securely in Azure Key Vault, and Storage Mover's managed identities handle access to both the source secrets and the target share. No agent, and no credential in the migration tool.

TLS certificates for Azure Functions Flex Consumption reach GA through a new site-scoped certificate model, where each function app can hold up to 3 private (.pfx) and 3 public (.cer) certificates, uploaded, imported from Key Vault, or issued as free App Service Managed Certificates. This closes a real gap: custom domains, client-certificate authentication and mutual TLS were the standing reasons a workload could not move to Flex Consumption. End-to-end TLS encryption is GA alongside it, encrypting traffic between the platform front ends and the workers that run your functions.

And Playwright Workspaces adds Switzerland North, Japan East and Australia East — a regional expansion rather than a feature, but the kind that decides whether a team in Zurich or Sydney can use a service at all under a data residency rule.

Rounding out the eight: the Azure Developer CLI extension framework is GA, letting teams extend Azure Developer CLI with custom capabilities; and the Azure Copilot Troubleshooting Agent is GA, reachable through both Azure Copilot and Support + Troubleshooting in the Azure portal.

Security advisories

Thirteen Azure advisories, twelve of them on Patch Tuesday, 8 September, and one the following day. Elevation of privilege dominates again — and three of the thirteen are in the identity plane, which is the cluster to read first:

• Identity — CVE-2026-62916 and CVE-2026-83941, both Microsoft Entra ID elevation of privilege, plus CVE-2026-83711 Azure Active Directory B2C elevation of privilege.
• Tooling — CVE-2026-83948 Microsoft Azure CLI remote code execution. The only RCE in the set, and the one advisory here that concerns software running on your machines and build agents rather than a service Microsoft patches for you. Check your pipeline images.
• Hybrid and data — CVE-2026-62895 Azure Arc SQL Server Extension, CVE-2026-69857 Azure Cosmos DB spoofing, CVE-2026-81349 Azure HDInsight Ambari, and CVE-2026-77909 Azure CycleCloud information disclosure.
• AI and platform — CVE-2026-45499 Azure OpenAI, CVE-2026-70352 Azure AI Language, CVE-2026-80098 Copilot Studio, and CVE-2026-70178 Microsoft Fabric.
• Libraries — CVE-2026-69854 Spring Cloud Azure elevation of privilege, which like the CLI advisory is yours to patch, not Microsoft's.

The split worth internalising: eleven of these are platform-side and remediated for you, but the Azure CLI RCE and the Spring Cloud Azure advisory are in code you ship and run. Those two need a version bump, not an acknowledgement.

Beyond the announcements

A thin announcement week, but an unusually strong week on the security blog — four posts, and two of them are about attacks that specifically target the identity assumptions this series has been writing about:

• Passkey-themed social engineering leads to identity and cloud compromise — the most useful read of the week. Passkeys are the recommended endpoint of most Entra hardening advice; this is the account of attackers going after the enrolment flow around them rather than the credential itself.
• Threat matrix: mapping threats across cloud web applications — a structured matrix rather than an incident write-up, which makes it the one to keep.
• AI-assisted executive impersonation and invoice fraud, and detect and disrupt AI-themed attacks with Microsoft Defender.

On the engineering blogs: the storage team's own write-up of user-bound SAS, automatic zone placement for scale sets in preview, building on AI landing zones with the Citadel architecture, and SQL Data Sync entering the final phase of retirement — a retirement that never appeared in the announcement feed at all, which is exactly why the blogs get read too.

Also this week: releases from AKS, Azure CLI 2.90.0, Bicep v0.47.16 and Terraform AzureRM v5.5.0. Given the Azure CLI advisory above, that CLI release is worth treating as the patch rather than as a feature drop.

What I would act on

1. Patch the Azure CLI in your build images. An RCE in the tool your pipelines run as a privileged identity is the single most actionable item this week, and it is the one nobody fixes for you. Version 2.90.0 shipped the day before the advisory.
2. Put the two AKS dates in the calendar, and plan for December. 10 December 2026 stops patches; 10 March 2027 breaks scaling and reimage. Treating March as the deadline means spending three months on unpatched nodes for no reason — the in-place upgrade path is available now.
3. Find out whether your SAS-minting service knows who it is minting for. User-bound user delegation SAS costs nothing extra and turns a leaked URL into a useless one, but only if the identity of the requester reaches the code that builds the token.
4. Check local disk headroom before enabling full ephemeral OS caching. It takes twice the OS disk size out of local capacity, and the workloads it is aimed at are the ones most likely to already be using that space.
5. Re-read your passkey enrolment flow. The security blog spent this week on social engineering aimed at the process around the credential rather than the credential. If enrolment can be initiated by a helpdesk call, that is the control to look at.

Complete inventory — all 8

Every announcement Azure published between 7 and 11 September 2026, from the release communications archive. Nothing summarised away.

Official Azure references

• User-bound user delegation SAS for Azure Storage
• Retirement: Azure Linux with OS Guard in Azure Kubernetes Service
• Azure Ephemeral OS Disk with full caching for VM/VMSS
• Agentless migration of on-premises SMB file shares to Azure Files
• TLS/SSL certificate and end-to-end TLS encryption for Azure Functions Flex Consumption
• Azure Developer CLI (azd) Extension Framework
• Azure Copilot Troubleshooting Agent
• Playwright Workspaces in Australia East, Japan East, and Switzerland North