This round-up covers what Microsoft changed between 8 and 15 October 2026 in the areas the series covers. This week there are two retirements to plan for, three features that are now generally available and one preview. For each item we show where the books, the glossary and the study notes cover it.
Retirements
Azure Deployment Environments retires on 22 February 2027
Azure Deployment Environments (ADE) retires on 22 February 2027. Its closing-down period began on 14 September 2026. Microsoft Learn says that from the retirement date, create, deploy, redeploy and other write operations are expected to be blocked. Read, log and delete operations should stay available for a limited clean-up period. There’s no one-to-one replacement. Microsoft points to deploying ARM templates or Bicep directly, Azure Verified Modules, and Azure DevOps or GitHub workflows. Start by listing your environments, definitions, catalogs and role assignments. Microsoft Dev Box shares dev centers with ADE but retires later, so don’t delete a shared dev center while any Dev Box resources still use it. Deleting an environment doesn’t always delete everything it deployed, so check Cost Management afterwards.
Where we cover it: chapter 10, “Infrastructure as code and configuration management”, of the AZ-400 guide, which already gives the 22 February 2027 date; glossary: Azure Deployment Environments, Deployment environment, Azure Verified Modules, Bicep.
Source: Azure Updates · Microsoft Learn: Azure Deployment Environments retirement guide
Microsoft Dev Box retires on 18 September 2028
Microsoft Dev Box retires at 17:00 UTC on 18 September 2028. It is now in maintenance mode: its closing-down period began on 14 September 2026, and no new features are planned. Existing deployments are still supported during the transition. Microsoft recommends Windows 365 for cloud developer workstations, but says it isn’t a one-to-one replacement and that there’s no automated migration tool. Plan to provision Cloud PCs, recreate policies, redeploy apps and move user data before the deadline. Learn says to expect any Dev Box workloads still left after the retirement date to be deleted.
Where we cover it: chapter 10, “Infrastructure as code and configuration management”, of the AZ-400 guide, where Dev Box comes up as the service that shares dev centers and projects with Deployment Environments; glossary: Windows 365 Enterprise.
Source: Azure Updates · Microsoft Learn: Microsoft Dev Box retirement guide
Now generally available
WAF exceptions on Application Gateway and Front Door
Exceptions for Web Application Firewall on Application Gateway and Azure Front Door became generally available on 8 October 2026. An exclusion only removes one named header, cookie or argument from inspection. An exception goes further: requests that match it skip WAF inspection for a rule, a rule group or a whole managed rule set. You match requests by request URI, remote IP address, or a request header name and value. That means you can now exempt a known source IP from specific managed rules, which exclusions can’t do. You need the next-generation WAF engine with CRS 3.2 or DRS 2.1 or later, and on Front Door the Premium tier. A WAF policy can hold up to 60 exceptions, and so can each gateway or Front Door profile in total. Keep each exception as narrow as you can. Some Learn pages, such as the Application Gateway security guidance and the layer 7 DDoS protection page, still describe exceptions as a preview.
Where we cover it: chapter 15, “Web Application Firewall”, of the AZ-700 guide, in the section on what exclusions can and can’t do; chapter 12, “Securing App Service, Functions, Logic Apps, WAF and API Management”, of the SC-500 guide; study note: Choosing an Azure load-balancing service; glossary: Web Application Firewall, WAF exclusion, WAF policy, WAF custom rules, Front Door Premium. For where WAF fits among the other network filters, see NSG vs Azure Firewall vs WAF.
Source: Azure Updates · Microsoft Learn: Azure Application Gateway WAF exceptions list · Microsoft Learn: Azure Front Door WAF exceptions list
AKS managed NAT gateway now defaults to StandardV2
As of 8 October 2026, Azure Kubernetes Service (AKS) can create and manage a StandardV2 NAT gateway for clusters on an AKS-managed virtual network, and this is generally available. From API version 2026-06-01, StandardV2 is the default for new clusters that use the managedNATGateway outbound type, in regions where it’s available. Other regions still get Standard. StandardV2 is zone-redundant by default, gives higher throughput and supports IPv6 outbound addresses, but customer-supplied outbound IPs must be StandardV2 public IPs. An existing cluster can move from a managed Standard NAT gateway, or from a load balancer, to StandardV2. You can’t move back to Standard, and the cluster’s outbound IP addresses change. Update any firewall rules and API server authorised IP ranges before you switch. The managedNATGatewayV2 outbound type from the preview is replaced by managedNATGateway with an explicit SKU.
Where we cover it: chapter 4, “Routing and outbound connectivity: UDRs, Route Server and NAT gateway”, of the AZ-700 guide, for the Standard and StandardV2 SKUs; chapter 9, “Containers: registries, instances, Container Apps and AKS”, of the AZ-104 guide; glossary: StandardV2 NAT gateway, StandardV2 public IP, NAT gateway, AKS.
Source: Azure Updates · Microsoft Learn: Create a managed or user-assigned NAT gateway for your AKS cluster
Site Recovery protects Arc-enabled Windows VMware VMs and physical servers
Since 14 October 2026, Azure Site Recovery supports disaster recovery for Windows VMware virtual machines and on-premises physical servers that are also Azure Arc-enabled. According to Microsoft’s feature updates page, these machines could previously run into compatibility problems. Site Recovery now detects the Arc services on the source machine and keeps the existing Arc configuration when you enable protection. You can therefore use Site Recovery for disaster recovery and keep Arc for governance, inventory, monitoring and management.
Where we cover it: chapter 15, “Backup and disaster recovery”, and chapter 8, “Virtual machines and scale sets”, of the AZ-104 guide, for replicating VMware VMs with Site Recovery; chapter 13, “Backup and disaster recovery”, of the AZ-305 guide; chapter 5, “Hybrid management with Azure Arc and Azure services”, of the AZ-802 guide; glossary: Azure Site Recovery, Azure Arc-enabled servers, Recovery Services vault.
Source: Azure Updates · Microsoft Learn: Site Recovery feature updates
In preview
Microsoft Agent 365 governs MCP servers through API Management
On 8 October 2026, Microsoft put the integration between Microsoft Agent 365 and Azure API Management into public preview. Once a tenant administrator gives consent, Agent 365 discovers API Management gateways and the MCP servers registered in them and adds them to a central inventory. Administrators can then block or unblock a server from the Microsoft 365 admin center, and API Management enforces that decision at runtime by inserting a managed policy, so calls to a blocked server get HTTP 403. API Management v2 tiers support the inventory and server-level blocking. The AI Gateway tier, also in preview, adds blocking of individual tools, tool activity monitoring and tool threat protection with Microsoft Defender and Microsoft Purview. Tool-level control needs a static list of allowed tools on each MCP server. V1 tiers aren’t supported. Agent 365 doesn’t route agents through the gateway automatically: point agents at the gateway’s MCP endpoint and restrict direct access to the MCP servers.
Where we cover it: chapter 13, “Securing AI workloads and agents”, of the SC-500 guide, for Agent 365, MCP tool requests under Agents > Tools and the AI gateway in API Management; glossary: Microsoft Agent 365, AI gateway in Azure API Management, MCP, API Management.
Source: Azure Updates · Microsoft Learn: Govern tools with Microsoft Agent 365 and Azure API Management (preview)
Every term above is explained in the series glossary. To get next week’s round-up, follow the RSS feed.
Tony Rough
