This round-up covers what Microsoft changed between 15 and 22 October 2026 in the areas the series covers. This week there is one retirement to plan for, six features that are now generally available and two previews. Networking had a busy week, and two of the changes alter what the AZ-700 guide says. For each item we show where the books, the glossary and the study notes cover it.
New in the series
Our published books are free to read with Kindle Unlimited.
Retirements
Microsoft-provided SMS and voice authentication: bring your own telephony provider from 30 October
On 21 October 2026, Microsoft announced that Microsoft Entra ID will make Choose Your Own Telephony Provider available from 30 October 2026. It lets an organisation keep SMS and voice authentication by contracting with a supported telephony provider through Microsoft Security Store. Soprano and Telesign are the first providers. The deadline behind it is the retirement of Microsoft-provided SMS and voice: on 1 February 2027 for all users except Global Administrators and external users (internal guests are included), and on 1 July 2027 for Global Administrators and external users. After the relevant date, users whose only MFA method is SMS or voice must register a passkey before they can sign in. The retirement also covers self-service password reset. A provider can keep SMS and voice going for MFA, but not SMS as a primary sign-in method. You configure one provider per channel and deploy a routing function in your own Azure subscription. Microsoft’s advice is to move users to passkeys or another phishing-resistant method, and to use a telephony provider only where there’s a documented business, regulatory or technical need.
Where we cover it: chapter 5, “Authentication methods, MFA, SSPR and passwords”, of the SC-300 guide, which already gives the 30 October 2026 and 1 February 2027 dates; chapter 3, “Authentication: methods, MFA and passwords”, of the SC-900 guide; study note: Security defaults vs per-user MFA vs Conditional Access; glossary: SMS, SMS and voice call verification, Passkey, Registration campaign, Authentication methods policy.
Source: Azure Updates · Microsoft Learn: Choose a telephony provider for SMS and voice authentication · Microsoft Learn: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication
Now generally available
Standard service endpoint
Standard service endpoint, part of the Azure Private Link family, became generally available on 15 October 2026. It fixes the scale problem of ordinary service endpoints, where every subnet needs its own virtual network rule on every PaaS resource. Instead, you give the service endpoint on a subnet a network identifier: a public IP address that only identifies the traffic and isn’t used for routing. You can reuse the same public IP across subnets, virtual networks and subscriptions in the same tenant and region. You then put the PaaS resources in a network security perimeter and add an inbound access rule for that IP. Supported services are Azure Storage, Key Vault, Azure SQL Database and Azure Cosmos DB, generally available in all regions. It is a paid feature.
Where we cover it: chapter 12, “Private access: Private Link, private endpoints and service endpoints”, of the AZ-700 guide; chapter 12, “Securing virtual networks: NSGs, Bastion and private access”, of the AZ-104 guide; chapter 5, “Securing Azure Storage”, of the SC-500 guide; study note: Azure Storage firewall: IP rules, virtual network rules and trusted services; glossary: Service endpoint, Service endpoint policies, Public IP address. For how service endpoints compare with private endpoints, see Private endpoint vs service endpoint.
Source: Azure Updates · Microsoft Learn: What is a standard service endpoint?
Automatic zone balance for Virtual Machine Scale Sets
Automatic zone balance for Virtual Machine Scale Sets became generally available on 15 October 2026. It watches a scale set spread across availability zones and, when one zone ends up with more VMs than another, moves instances one at a time. It creates a VM in the under-provisioned zone, waits for it to report healthy, then deletes one from the over-provisioned zone. It respects instance protection, defers Autoscale scale-in while it works and waits 60 minutes after other scale set operations. You need at least two zones, only zonal instances and application health monitoring, and enabling it also turns on automatic instance repairs by default. Instance IDs, networking and disks aren’t kept when a VM moves, so it suits stateless workloads, and it temporarily needs quota for one extra VM. Microsoft Learn notes that it isn’t a recovery mechanism for a zone outage.
Where we cover it: chapter 8, “Virtual machines and scale sets”, of the AZ-104 guide; chapter 9, “Compute: virtual machines, App Service, Functions and HPC”, of the AZ-305 guide; study note: Availability sets vs availability zones in Azure; glossary: VM scale set, Availability zones. See also Availability sets vs availability zones vs scale sets, and automatic zone placement in our round-up for 1 October.
Source: Azure Updates · Microsoft Learn: Automatic zone balance for Virtual Machine Scale Sets
External key management for Key Vault Managed HSM
External key management for Azure Key Vault Managed HSM became generally available in all Azure public regions on 16 October 2026. It’s for organisations that must keep physical control of their key-encryption keys. Azure services that support customer-managed keys with Managed HSM can use a key held in a hardware security module you run outside Microsoft’s infrastructure. Managed HSM sends key wrap and unwrap requests to a proxy you (or your HSM vendor) operate, over mutual TLS, and the external key never leaves your HSM. You need your Microsoft account team to enable it. The connection to the proxy over the public internet is generally available, while Azure Private Link for it is in preview. The external HSM, proxy and network are outside the Managed HSM SLA, and geo-replication isn’t supported for external keys.
Where we cover it: chapter 3, “Azure Key Vault”, of the SC-500 guide; chapter 3, “Keys, secrets and API protection”, of the AZ-305 guide; glossary: Managed HSM, Customer-managed keys, Key encryption key, DEK, HSM.
Source: Azure Updates · Microsoft Learn: What is Managed HSM external key management?
Azure DNS records linked directly to Traffic Manager
On 19 October 2026, Traffic Manager linked records in Azure DNS became generally available. You link a DNS record set (A, AAAA or CNAME) straight to a Traffic Manager profile, so you no longer need a CNAME pointing to trafficmanager.net. Azure DNS resolves the profile itself and returns the endpoint addresses directly. That removes a DNS lookup, works at the zone apex, keeps trafficmanager.net out of the response and keeps the chain of trust in a DNSSEC-signed zone. The record always takes its TTL from the Traffic Manager profile. Microsoft Learn now recommends linked records over alias records for Traffic Manager, and a profile can have up to 50 linked records. We’ll reflect this in the next update of the AZ-700 guide, which says a Traffic Manager custom domain needs a CNAME to trafficmanager.net.
Where we cover it: chapter 9, “Load balancing with Azure Load Balancer and Traffic Manager”, and chapter 2, “Name resolution with Azure DNS”, of the AZ-700 guide; chapter 12, “Networking”, of the AZ-305 guide; study note: Choosing an Azure load-balancing service; glossary: Traffic Manager, Azure DNS, Alias record, CNAME, DNSSEC. See also Choosing an Azure load balancer.
Source: Azure Updates · Microsoft Learn: Traffic Manager Linked Records overview
Since 20 October 2026, Web Application Firewall custom rules on Azure Front Door Premium can match a client address against an Azure service tag, and this is generally available. Use the ServiceTagMatch operator with the SocketAddr or RemoteAddr match variable. Microsoft keeps each tag’s address ranges up to date, so you can allow a monitoring service, block an Azure service you never expect traffic from, or rate-limit one without maintaining IP lists. Microsoft Learn recommends SocketAddr, because RemoteAddr comes from the X-Forwarded-For header, which callers can set. Use the narrowest tag you can: a tag covers every customer of that service, so it isn’t an identity check. Start the rule in Log mode or Detection mode before you block.
Where we cover it: chapter 15, “Web Application Firewall”, and chapter 11, “Azure Front Door”, of the AZ-700 guide; chapter 12, “Securing App Service, Functions, Logic Apps, WAF and API Management”, of the SC-500 guide; glossary: WAF custom rules, Service tag, SocketAddr, RemoteAddr, Front Door Premium. See also NSG vs Azure Firewall vs WAF, and WAF exceptions in our round-up for 15 October.
Source: Azure Updates · Microsoft Learn: What is service tag matching for Azure Front Door?
Keyless TLS on Application Gateway with Managed HSM
On 20 October 2026, keyless TLS termination on Application Gateway became generally available. The gateway uses a certificate whose private key stays in Azure Key Vault Managed HSM: the HSM signs each TLS handshake and the key is never exported to the gateway. It needs Application Gateway v2, a user-assigned managed identity with the Managed HSM Crypto User role on the key, and listeners on TLS 1.2 or later with the AppGwSslPolicy20220101, AppGwSslPolicy20220101S or CustomV2 policy. You still upload the certificate’s public part. It doesn’t support the Application Gateway Ingress Controller, WebSockets, the layer 4 TCP/TLS proxy, FIPS mode or EC keys. We’ll reflect this in the next update of the AZ-700 guide, which says Managed HSM can’t be used with Application Gateway’s Key Vault integration. That remains true for ordinary Key Vault certificates, but keyless TLS is now a separate, supported way to use Managed HSM.
Where we cover it: chapter 10, “Azure Application Gateway”, of the AZ-700 guide; chapter 3, “Azure Key Vault”, of the SC-500 guide; glossary: Application Gateway v2, TLS termination, Managed HSM, Key Vault integration, User-assigned managed identity.
Source: Azure Updates · Microsoft Learn: What is keyless TLS for Azure Application Gateway and Azure Key Vault Managed HSM?
In preview
Disable peering route propagation on a route table
On 20 October 2026, Microsoft put a route-table setting to disable peering routes into public preview. With disablePeeringRoute set to All, Azure stops adding the system virtual network peering routes to subnets that use the route table, while the peering itself stays in place. This matters in large hub-and-spoke networks. Azure picks routes by longest prefix match, so a peering route for a spoke beats a summarised user-defined route, and traffic bypasses the firewall. With peering routes suppressed, one summarised UDR can send traffic through Azure Firewall or another NVA. The setting doesn’t create the replacement routes, so add your UDRs first. During the preview, the firewall or NVA next hop must be in the same virtual network as the source workload, and you register the AllowDisablePeeringRoutes feature. The announcement also mentions Virtual Network Manager routing rule collections, but Microsoft Learn says to manage the setting through the route table during the preview; we’ve followed Learn.
Where we cover it: chapter 4, “Routing and outbound connectivity: UDRs, Route Server and NAT gateway”, and chapter 3, “Connecting virtual networks: peering, gateway transit and Virtual Network Manager”, of the AZ-700 guide; chapter 11, “Virtual networks and connectivity”, of the AZ-104 guide; study notes: How Azure selects routes: longest prefix match, UDRs and forced tunnelling, Gateway transit in hub-and-spoke networks; glossary: Virtual network peering, UDR, Route table, Longest prefix match, Hub and spoke, NVA.
Source: Azure Updates · Microsoft Learn: Azure virtual network peering, disable peering route propagation (preview)
Defender for Cloud plan management moves to the Defender portal
Microsoft’s release notes list cloud security plan management in the Microsoft Defender portal as a public preview for Azure commercial environments from 20 October 2026. You connect Azure subscriptions and management groups to cloud security in the Defender portal, then turn Microsoft Defender for Cloud plans on and off there, for everything at once or for chosen management groups and subscriptions. The same page shows estimated costs and offers a 30-day free trial for eligible plans. Once plan management moves for a subscription, plan settings become view-only in the Azure portal, and the subscription moves to billing in Defender Workload Units. The same day, the Defender server security experience added onboarding guidance for Azure, Arc-enabled and on-premises servers.
Where we cover it: chapter 14, “Managing security posture with Microsoft Defender for Cloud”, and chapter 10, “Securing servers and virtual machines”, of the SC-500 guide; chapter 7, “Security management: Microsoft Defender for Cloud and Microsoft Sentinel”, of the SC-900 guide; glossary: Microsoft Defender for Cloud, Defender plans, Microsoft Defender portal, Azure Arc-enabled servers. The single server security experience was in our round-up for 8 October.
Source: Microsoft Learn: What’s new in Defender for Cloud features · Microsoft Learn: Microsoft Defender for Cloud in the Microsoft Defender portal
Every term above is explained in the series glossary. To get next week’s round-up, follow the RSS feed.
Tony Rough
