This round-up covers what Microsoft changed between 29 October and 5 November 2026 in the areas the series covers. This week brings new retirement dates for two things you may be running, three features that are now generally available, four previews and one change to how you practise for Microsoft exams. One preview touches something the AZ-104 and AZ-700 guides say about Azure Firewall. For each item we show where the books, the glossary and the study notes cover it.
New in the series
Retirements
New retirement dates for gpt-4o and gpt-5.1 in Microsoft Foundry
Microsoft has changed the Microsoft Foundry model retirement schedule. gpt-4o version 2024-05-13 now retires on 14 January 2027, not 9 December 2026, and its named replacement is now gpt-5.1 (2025-11-13). Global Standard and Data Zone Standard deployments upgrade to gpt-5.1 automatically at retirement. Provisioned deployments don’t, so create replacement deployments and move your traffic before that date. gpt-4o versions 2024-08-06 and 2024-11-20, gpt-4o-mini and gpt-4.1-mini keep their 14 April 2027 date, which Microsoft now says applies to all their active base-model offers. gpt-5.1 and gpt-5-mini both move later, to 13 July 2027. Check the dates for the versions you deploy, and test the replacement with your own prompts.
Where we cover it: chapter 1, “Microsoft Foundry: models, resources and deployments”, of the AI-103 guide; chapter 2, “How generative AI models work and how to choose one”, of the AI-901 guide; glossary: GPT-4o, GPT-5 series, Model version upgrade policy, Global Standard, Data Zone Standard, Provisioned throughput. See also last week’s post on retirement dates for partner models.
Source: Microsoft Learn: Model retirement schedule
API keys for querying Application Insights: extended to 31 March 2027
Microsoft has extended the date on which API keys for querying Application Insights retire. It is now 31 March 2027, and the notice was updated on 4 November 2026. After that date, queries need Microsoft Entra ID authentication: register an app, give it the Application Insights API’s Data.Read permission, and grant it a role such as Reader on the resource. If a script or dashboard still queries with an API key, you have more time, but the move is still required.
Where we cover it: chapter 13, “Monitoring and instrumentation for DevOps”, of the AZ-400 guide; chapter 12, “Security and observability: Key Vault, App Configuration, OpenTelemetry and KQL”, of the AI-200 guide; chapter 4, “Monitoring and observability”, of the AZ-305 guide; glossary: Application Insights, Azure Monitor, Microsoft Entra ID.
Source: Azure Updates · Microsoft Learn: Microsoft Entra authentication for Application Insights
Now generally available
HTTP DDoS ruleset for Azure Front Door Premium WAF
On 29 October 2026, Microsoft made the HTTP DDoS ruleset for Web Application Firewall on Azure Front Door Premium generally available. It learns normal traffic for each profile and, when a surge breaches that baseline, acts on the offending clients, with no emergency tuning required. Two rules are generally available: one for clients sending unusually high request rates, and one for suspected bots identified by Microsoft Threat Intelligence. Two geo-based rules remain in preview. Rules start with the Log action and medium sensitivity, so review the logs before you change the action. The ruleset runs before your custom rules, and a custom Allow rule doesn’t bypass it: use a WAF exception for trusted traffic such as health probes and load tests.
Where we cover it: chapter 15, “Web Application Firewall”, chapter 11, “Azure Front Door”, and chapter 16, “Monitoring, DDoS protection and network security posture”, of the AZ-700 guide; chapter 12, “Securing App Service, Functions, Logic Apps, WAF and API Management”, of the SC-500 guide; glossary: Front Door Premium, WAF policy, WAF exception, DDoS. See also last week’s post on Front Door WAF policies.
Source: Azure Updates · Microsoft Learn: HTTP DDoS ruleset in Azure Front Door WAF
Route maps for Azure Route Server
Route maps for Azure Route Server became generally available in the Azure public cloud on 4 November 2026. They control the routes Route Server learns and advertises over its BGP peerings with network virtual appliances, its ExpressRoute and VPN gateway connections in the same virtual network, and its connections to peered spokes. You can summarise routes, drop routes you don’t want, change AS paths to make a route more or less preferred, and tag routes with BGP communities. A route that matches no rule is permitted unchanged. You can create route maps in the portal or Azure PowerShell, but applying them to gateway and spoke connections needs the portal.
Where we cover it: chapter 4, “Routing and outbound connectivity: UDRs, Route Server and NAT gateway”, of the AZ-700 guide; chapter 11, “Virtual networks and connectivity”, of the AZ-104 guide; chapter 8, “Network topology I: hub-spoke”, of the Azure Landing Zones guide; study note: Azure route selection and forced tunnelling; glossary: Azure Route Server, BGP, AS path, NVA.
Source: Azure Updates · Microsoft Learn: About route maps for Azure Route Server
Move Azure Database for PostgreSQL from VNet integration to private endpoints
Since 2 November 2026, you can change an Azure Database for PostgreSQL flexible server from virtual network integration in a delegated subnet to a configuration that supports private endpoints. Plan this one carefully, because it can’t be reversed. The change typically takes up to 20 minutes, and the server is typically unreachable for up to 10 of them. Backups taken before the change remain available. Public access is off afterwards, so the server stays unreachable until you add a private endpoint or enable public access with firewall rules. If you use logical replication or Terraform, Microsoft Learn lists extra steps to check first.
Where we cover it: chapter 6, “Relational databases: Azure SQL, MySQL and PostgreSQL”, of the AZ-305 guide; chapter 12, “Private access: Private Link, private endpoints and service endpoints”, of the AZ-700 guide; chapter 4, “Azure relational database services”, of the DP-900 guide; study note: Private endpoints, service endpoints and DNS; glossary: Azure Database for PostgreSQL flexible server, Private endpoint, Azure Private Link.
Source: Azure Updates · Microsoft Learn: Change from virtual network integration to a private endpoint-capable network configuration
In preview
Application rules for IPv6 on Azure Firewall
On 4 November 2026, Microsoft announced a public preview of application rules for IPv6 on Azure Firewall, which brings layer 7 filtering to IPv6 HTTP and HTTPS traffic in dual-stack deployments. Dual-stack firewalls are themselves in preview, with limits: classic firewalls and virtual hub firewalls aren’t supported, IPv6 DNAT rules aren’t available yet, and threat intelligence, IDPS, Explicit Proxy and IP Groups don’t apply to IPv6. For now, you also can’t revert a dual-stack firewall to IPv4-only, so try it away from production first. The AZ-104 and AZ-700 guides say Azure Firewall public IP addresses must be IPv4, which remains true outside this preview. We’ll reflect this in the next update of the AZ-700 guide and the AZ-104 guide.
Where we cover it: chapter 14, “Azure Firewall and Firewall Manager”, and chapter 1, “Virtual networks and IP addressing”, of the AZ-700 guide; chapter 11, “Virtual networks and connectivity”, of the AZ-104 guide; glossary: Azure Firewall, Application rule, IPv6.
Source: Azure Updates · Microsoft Learn: Deploy Azure Firewall in dual stack mode
Private ingress, JWT validation and an MCP gateway for Application Gateway for Containers
On 3 November 2026, three public previews arrived together for Application Gateway for Containers. Private ingress gives a frontend no public IP address, so clients reach it only through approved private endpoints, including across subscriptions, tenants and regions. It needs an association resource created on or after 23 April 2026 and ALB Controller v1.13 or newer. JWT validation checks bearer tokens at the gateway through a new AuthPolicy resource and rejects bad requests before they reach the backend; your application still makes the authorisation decisions. The MCP gateway adds an MCPRoute resource that publishes one or several Model Context Protocol servers behind one endpoint. Preview APIs can change before general availability.
Where we cover it: chapter 10, “Containers”, and chapter 12, “Networking”, of the AZ-305 guide; chapter 5, “Deploying to Azure Kubernetes Service with manifests”, of the AI-200 guide; glossary: Application Gateway for Containers, Gateway API, Private endpoint, JWT, MCP.
Source: Azure Updates: private ingress · Azure Updates: JWT validation · Azure Updates: MCP gateway · Microsoft Learn: Private ingress · Microsoft Learn: JWT validation · Microsoft Learn: MCP capabilities
Locked immutability for Azure SQL point-in-time backups
On 3 November 2026, Microsoft announced a public preview that extends immutability for point-in-time restore backups on Azure SQL Database and Azure SQL Managed Instance. Default immutability protects up to the most recent seven days. You can now lock it to your configured retention, up to 35 days where your tier supports that. The lock is permanent: after it, you can only increase retention, never reduce it. It protects the backups but doesn’t stop anyone deleting the database. It isn’t available on the Hyperscale tier, and Managed Instance needs the Always-up-to-date or SQL Server 2025 update policy. Choose your retention before you lock it.
Where we cover it: chapter 6, “Relational databases: Azure SQL, MySQL and PostgreSQL”, of the AZ-305 guide, in “Azure SQL backup retention and geo-replication”; chapter 4, “Azure relational database services”, of the DP-900 guide; glossary: Automatic backups, Azure SQL Database, Azure SQL Managed Instance.
Source: Azure Updates · Microsoft Learn: Automatic backup immutability
Posture policies and recommendation exemptions in the Microsoft Defender portal
On 28 October 2026, Microsoft added a public preview of posture policies and recommendation exemptions to the Microsoft Defender portal for Azure environments. You can evaluate Azure resources against the Microsoft Defender for Cloud baseline policy, create your own posture policies, and manage accepted risks centrally with lifecycle tracking. If your team works mainly in the Defender portal, this is worth a look.
Where we cover it: chapter 14, “Managing security posture with Microsoft Defender for Cloud”, of the SC-500 guide; chapter 7, “Security management: Microsoft Defender for Cloud and Microsoft Sentinel”, of the SC-900 guide; study note: Foundational CSPM vs Defender CSPM; glossary: Microsoft Defender for Cloud, Microsoft Defender portal, CSPM, Secure score.
Source: Microsoft Learn: What’s new in Microsoft Defender for Cloud · Microsoft Learn: Exempt resources from recommendations
Other changes
A new Practice Assessment experience for Microsoft exams
Study guides on Microsoft Learn now point to a new Practice Assessment experience on AI Skills Navigator, which Microsoft says more closely aligns with the exam experience. You need to sign in to use it. The tip appears on the study guides for exams including AZ-104, AZ-305, AZ-400, AZ-700, SC-200, SC-300 and DP-700. Microsoft says the legacy Practice Assessments on Learn are no longer being updated, though you can still take them, and it strongly recommends the new one. If you’ve been relying on a legacy assessment, switch before your exam.
Where we cover it: our guides for these exams include the AZ-104 guide, the AZ-305 guide, the AZ-400 guide and the AZ-700 guide, each with free study notes on its book page.
Source: Microsoft Learn: Study guide for Exam AZ-104
Every term above is explained in the series glossary. To get next week’s round-up, follow the RSS feed.
Tony Rough
