https://securitynews.ms/products/azure-security/Azure security news and documented product changes, each linked to Microsoft's own source.enWed, 11 Nov 2026 18:18:27 +0000https://azure.microsoft.com/updates?id=580155https://azure.microsoft.com/updates?id=580155Wed, 11 Nov 2026 18:18:27 +0000Azure UpdatesAnnouncing the public preview of rate limit grouping for Azure Web Application Firewall (WAF) on Azure Front Door Premium. By default, a rate limit rule counts requests separately for each client IP address. Distributed attacks get around this by spreadinhttps://azure.microsoft.com/updates?id=577668https://azure.microsoft.com/updates?id=577668Thu, 05 Nov 2026 23:19:48 +0000Azure UpdatesAzure Front Door now supports configurable TLS key exchange policies, including hybrid post-quantum key exchange, to help you prepare for evolving cryptographic threats while meeting your security and client compatibility requirements. Choose a predefinedhttps://azure.microsoft.com/updates?id=579280https://azure.microsoft.com/updates?id=579280Thu, 05 Nov 2026 17:11:31 +0000Azure UpdatesWAF Insights for Azure Application Gateway Web Application Firewall (WAF) is now generally available. WAF Insights is a built-in experience in the WAF policy that brings WAF logs and metrics together in interactive dashboards, so you can investigate blockhttps://azure.microsoft.com/updates?id=579507https://azure.microsoft.com/updates?id=579507Wed, 04 Nov 2026 18:09:43 +0000Azure UpdatesAzure Firewall now supports application rules in IPv6 Public Preview, enabling layer 7 filtering for IPv6 HTTP and HTTPS traffic. The enhancement extends application-level controls to IPv6 and dual-stack deployments, helping customers maintain consistenthttps://techcommunity.microsoft.com/t5/azure-network-security-blog/addressing-php2shell-cve-2026-109618-and-cve-2026-109619-upgrade/ba-p/4566623https://techcommunity.microsoft.com/t5/azure-network-security-blog/addressing-php2shell-cve-2026-109618-and-cve-2026-109619-upgrade/ba-p/4566623Wed, 04 Nov 2026 15:56:30 +0000Azure Network Security BlogWritten in collaboration with yuvalpery and Gunjan Jain Introduction Today, two critical remote code execution (RCE) vulnerabilities were disclosed in PHP. We strongly recommend that customers upgrade to a patched version of PHP as soon as possible. Upgrading is the only way…https://azure.microsoft.com/updates?id=576382https://azure.microsoft.com/updates?id=576382Tue, 03 Nov 2026 21:17:08 +0000Azure UpdatesApplication Gateway for Containers now supports centralized JSON Web Token validation through the AuthPolicy custom resource. Teams can validate a token signature, issuer, lifetime, and configured audience by using signing keys retrieved from a trusted HThttps://azure.microsoft.com/updates?id=576388https://azure.microsoft.com/updates?id=576388Tue, 03 Nov 2026 21:16:36 +0000Azure UpdatesApplication Gateway for Containers now supports Model Context Protocol routing through the new MCPRoute custom resource. Platform teams can publish MCP servers behind a stable hostname and path while centralizing TLS, JWT validation, Web Application Firewhttps://azure.microsoft.com/updates?id=576393https://azure.microsoft.com/updates?id=576393Tue, 03 Nov 2026 21:15:46 +0000Azure UpdatesApplication Gateway for Containers now supports private frontends that are reachable only through approved Azure Private Link private endpoints. This enables organizations to keep internal applications, shared services, and cross-cluster traffic on privathttps://techcommunity.microsoft.com/t5/azure-network-security-blog/protect-against-brotli-cve-2026-111497-with-azure-web/ba-p/4567288https://techcommunity.microsoft.com/t5/azure-network-security-blog/protect-against-brotli-cve-2026-111497-with-azure-web/ba-p/4567288Mon, 02 Nov 2026 18:53:26 +0000Azure Network Security BlogGoogle Brotli versions 1.0.3 through 1.2.0 contain a buffer overflow vulnerability in the Brotli decoder, according to the recently published CVE-2026-111497 . A remote, unauthenticated attacker can send a crafted Brotli-compressed stream to corrupt decoder memory, expose sensitive memory contents, cause a…https://azure.microsoft.com/updates?id=578681https://azure.microsoft.com/updates?id=578681Thu, 29 Oct 2026 17:09:49 +0000Azure UpdatesAnnouncing the general availability of the HTTP DDoS ruleset for Azure Web Application Firewall (WAF) on Azure Front Door Premium. HTTP-layer DDoS attacks remain a leading cause of application downtime, and static controls such as IP filters and fixed rathttps://azure.microsoft.com/updates?id=578153https://azure.microsoft.com/updates?id=578153Tue, 27 Oct 2026 16:58:04 +0000Azure UpdatesAnnouncing the general availability of profile and route level policies for Azure Web Application Firewall (WAF) on Azure Front Door Premium. WAF policies are no longer limited to individual domains: you can now apply broad baseline protection across an ehttps://techcommunity.microsoft.com/t5/azure-network-security-blog/azure-waf-custom-rules-for-php2shell-mitigation/ba-p/4566684https://techcommunity.microsoft.com/t5/azure-network-security-blog/azure-waf-custom-rules-for-php2shell-mitigation/ba-p/4566684Mon, 26 Oct 2026 19:00:38 +0000Azure Network Security BlogWritten in collaboration with Gunjan Jain and yuvalpery As described in our earlier blog, Addressing PHP2Shell CVE-2026-109618 and CVE-2026-109619: upgrade guidance and Azure WAF mitigations , we strongly recommend upgrading to a patched version of PHP as soon as possible. Upgrading PHP…https://azure.microsoft.com/updates?id=577156https://azure.microsoft.com/updates?id=577156Tue, 20 Oct 2026 16:57:35 +0000Azure UpdatesAnnouncing the general availability of the service tag match condition for Azure Web Application Firewall (WAF) custom rules on Azure Front Door Premium. Service tags represent groups of IP address prefixes used by Azure services, and Microsoft updates thhttps://azure.microsoft.com/updates?id=577130https://azure.microsoft.com/updates?id=577130Tue, 20 Oct 2026 16:55:59 +0000Azure UpdatesAzure Application Gateway now supports keyless TLS termination using certificates whose private keys stay in Azure Key Vault Managed HSM. Each TLS handshake signature is performed inside the HSM, and the private key is never exported to the gateway. Thishttps://azure.microsoft.com/updates?id=574296https://azure.microsoft.com/updates?id=574296Fri, 16 Oct 2026 16:50:27 +0000Azure UpdatesExternal key management for Azure Key Vault Managed HSM is now generally available in all Azure public regions. For organizations with regulatory or sovereignty requirements to retain physical control of key-encryption keys, it lets Azure services that suhttps://azure.microsoft.com/updates?id=570313https://azure.microsoft.com/updates?id=570313Fri, 09 Oct 2026 20:27:17 +0000Azure UpdatesThe Azure Key Vault Secrets Provider Extension for Azure Arc-enabled Kubernetes will be retired on October 9, 2027.Customers currently using the extension should plan to migrate to the Azure Key Vault Secret Store Extension before the retirement date. Thehttps://azure.microsoft.com/updates?id=574343https://azure.microsoft.com/updates?id=574343Thu, 08 Oct 2026 17:29:30 +0000Azure UpdatesAnnouncing the general availability of exceptions for Web Application Firewall on Azure Application Gateway and Azure Front Door.Azure Web Application Firewall (WAF) helps protect your web applications from common threats and attacks. In some cases, WAF mhttps://azure.microsoft.com/updates?id=573861https://azure.microsoft.com/updates?id=573861Mon, 05 Oct 2026 17:41:41 +0000Azure UpdatesAnnouncing the Public Preview of IPv6 support for Application Gateway WAF.Application Gateway Web Application Firewall (WAF) now supports inspection and enforcement for IPv6 traffic in Public Preview, marking a major step forward in modernizing the platfohttps://azure.microsoft.com/updates?id=571783https://azure.microsoft.com/updates?id=571783Tue, 29 Sep 2026 17:57:36 +0000Azure UpdatesAzure Database for PostgreSQL Flexible Server now supports cross-tenant customer-managed keys (CMK). You can encrypt your data using keys stored in an Azure Key Vault or Azure Managed HSM that resides in a different Microsoft Entra tenant than your Postgrhttps://azure.microsoft.com/updates?id=569804https://azure.microsoft.com/updates?id=569804Wed, 02 Sep 2026 17:00:51 +0000Azure UpdatesAzure Front Door’s Web Application Firewall (WAF) now supports profile and route level WAF policy associations in public preview. This gives you more flexibility to apply broad baseline protection across an Azure Front Door profile while using targeted pohttps://azure.microsoft.com/updates?id=570474https://azure.microsoft.com/updates?id=570474Tue, 01 Sep 2026 17:10:38 +0000Azure UpdatesAzure Firewall’s auto-learn SNAT routes is now generally available, automatically learning registered and private destination prefixes periodically and applying them as No-SNAT ranges to preserve original source IPs and simplify SNAT management.Learn morehttps://azure.microsoft.com/updates?id=570020https://azure.microsoft.com/updates?id=570020Wed, 26 Aug 2026 16:57:56 +0000Azure UpdatesAzure Bastion shareable link expiration is now generally available. When creating a shareable link, administrators can specify the date and time when the link should expire. After the configured expiration time, the link can no longer be used to connect thttps://azure.microsoft.com/updates?id=570025https://azure.microsoft.com/updates?id=570025Wed, 26 Aug 2026 16:56:29 +0000Azure UpdatesAzure Bastion support for IPv4 and IPv6 dual-stack configurations is now available in public preview. Customers can configure a newly created Bastion deployment with both IPv4 and IPv6 public IP addresses. IPv6 is supported for connections between the usehttps://azure.microsoft.com/updates?id=570030https://azure.microsoft.com/updates?id=570030Wed, 26 Aug 2026 16:55:25 +0000Azure UpdatesAzure Bastion integration with Azure Kubernetes Service is now generally available. Customers can establish a secure tunnel from their local machine through Azure Bastion to an AKS cluster API server. The integration enables customers to use standard Kubehttps://azure.microsoft.com/updates?id=569504https://azure.microsoft.com/updates?id=569504Mon, 24 Aug 2026 17:25:03 +0000Azure UpdatesAnnouncing the General Availability of custom block response code and body for WAF integrated with Application Gateway Azure WAF integrated with Application Gateway now supports customizable response status codes and bodies for blocked requests, enablinghttps://azure.microsoft.com/updates?id=569520https://azure.microsoft.com/updates?id=569520Tue, 18 Aug 2026 17:25:30 +0000Azure UpdatesAzure Firewall now supports IPv6 in public preview, enabling customers to configure Azure Firewall and Firewall Policy in dual-stack mode for both IPv4 and IPv6 traffic. This preview allows native IPv6 network-rule filtering and DNS Proxy support, helpinghttps://azure.microsoft.com/updates?id=569251https://azure.microsoft.com/updates?id=569251Wed, 12 Aug 2026 17:01:19 +0000Azure UpdatesMutual TLS, also known as client certificate authentication, enables Azure Front Door to authenticate clients using X.509 certificates before requests reach an application. It helps protect sensitive applications and APIs across business-to-business, Intehttps://azure.microsoft.com/updates?id=569256https://azure.microsoft.com/updates?id=569256Tue, 11 Aug 2026 17:26:51 +0000Azure UpdatesAzure Firewall Premium now delivers up to 22 Gbps throughput with TLS inspection and IDPS in Deny mode, a 120% increase from 10 Gbps, and up to 600 Mbps per TCP connection with IDPS enabled in either Alert or Deny mode (doubled…https://azure.microsoft.com/updates?id=568825https://azure.microsoft.com/updates?id=568825Wed, 05 Aug 2026 14:54:08 +0000Azure UpdatesAzure Firewall explicit proxy is now generally available. Explicit proxy enables customers to configure applications and browsers to send HTTP and HTTPS traffic directly to Azure Firewall using proxy settings, providing an alternative to route-based traffic steering and enabling more granular control…https://azure.microsoft.com/updates?id=566746https://azure.microsoft.com/updates?id=566746Thu, 30 Jul 2026 18:57:18 +0000Azure UpdatesWe’re announcing post-quantum resilient symmetric keys on Azure Key Vault Premium are now available in public preview. This preview enables customers and partners to evaluate symmetric encryption capabilities using the oct-HSM key type and the Advanced Encryption Standard (AES) algorithm directly within…https://azure.microsoft.com/updates?id=568115https://azure.microsoft.com/updates?id=568115Mon, 27 Jul 2026 16:54:36 +0000Azure UpdatesAzure Firewall now supports HTTP header insertion, enabling organizations to add or overwrite HTTP/HTTPS request headers directly from Azure Firewall application rules. This capability helps customers enforce security controls, support tenant restriction scenarios, integrate with backend services, and simplify…https://azure.microsoft.com/updates?id=568063https://azure.microsoft.com/updates?id=568063Thu, 23 Jul 2026 16:47:24 +0000Azure UpdatesAzure DDoS Protection custom policy is now in public preview. This capability provides per-resource control over DDoS mitigation thresholds for protected Standard Load Balancer frontend IP configurations. Customers can configure fixed inbound detection thresholds for TCP, UDP, and TCP SYN traffic. Thresholds…https://techcommunity.microsoft.com/t5/azure-network-security-blog/secure-native-access-to-azure-kubernetes-service-aks-private/ba-p/4535123https://techcommunity.microsoft.com/t5/azure-network-security-blog/secure-native-access-to-azure-kubernetes-service-aks-private/ba-p/4535123Mon, 13 Jul 2026 07:37:52 +0000Azure Network Security BlogWritten in Collaboration with AvirupChat ShabazShaik Mohit_Kumar YuriDiogenes Introduction: As organizations move toward containerized workloads such as Azure Kubernetes Service (AKS), secure access to cluster resources becomes critical. Making the Kubernetes API server private, therefore, significantly reduces the…https://techcommunity.microsoft.com/t5/azure-network-security-blog/azure-ddos-protection-azure-waf-a-layered-defense-for-modern/ba-p/4523745https://techcommunity.microsoft.com/t5/azure-network-security-blog/azure-ddos-protection-azure-waf-a-layered-defense-for-modern/ba-p/4523745Thu, 09 Jul 2026 21:33:51 +0000Azure Network Security BlogIntroduction: The Need for Layered DDoS Defense Organizations today operate in an environment where Distributed Denial of Service (DDoS) attacks continue to evolve across both network and application layers. To help organizations build resilient, internet-facing applications and services, Microsoft Azure provides a…https://azure.microsoft.com/updates?id=567218https://azure.microsoft.com/updates?id=567218Tue, 07 Jul 2026 17:42:50 +0000Azure UpdatesAzure Web Application Firewall (WAF) helps protect your web applications from common threats and attacks. In some cases, WAF may block requests that are safe and expected for your application. Existing exclusions help reduce false positives by omitting specific request attributes, such…https://techcommunity.microsoft.com/t5/azure-network-security-blog/designing-cloud-landing-zones-by-traffic-flow-a-defence-in-depth/ba-p/4524280https://techcommunity.microsoft.com/t5/azure-network-security-blog/designing-cloud-landing-zones-by-traffic-flow-a-defence-in-depth/ba-p/4524280Wed, 17 Jun 2026 12:17:58 +0000Azure Network Security BlogAs enterprises adopt Microsoft Azure for large‐scale and regulated workloads, security architecture must be driven by traffic trust boundaries and inspection intent, not connectivity alone. Regulatory frameworks consistently require a clear separation between Internet‐untrusted and private enterprise traffic,…https://techcommunity.microsoft.com/t5/azure-network-security-blog/a-deep-dive-into-azure-bastion-session-recording/ba-p/4527583https://techcommunity.microsoft.com/t5/azure-network-security-blog/a-deep-dive-into-azure-bastion-session-recording/ba-p/4527583Thu, 11 Jun 2026 19:38:25 +0000Azure Network Security BlogIf you’ve worked with Azure Bastion’s Premium SKU, you’ve likely encountered one of its most powerful security features: graphical session recording. Capturing RDP and SSH sessions end to end strengthens compliance, supports forensic investigations, and improves operational accountability. How you configure session…https://techcommunity.microsoft.com/blog/azurenetworksecurityblog/become-an-azure-network-security-ninja/2356101https://techcommunity.microsoft.com/blog/azurenetworksecurityblog/become-an-azure-network-security-ninja/2356101Wed, 27 May 2026 19:31:50 +0000Azure Network Security BlogBecome an Azure Network Security Ninja! We have gathered essential materials, from foundational to advanced concepts, to help you master network...https://learn.microsoft.com/en-us/azure/key-vault/general/whats-new#supported-control-plane-api-versionshttps://learn.microsoft.com/en-us/azure/key-vault/general/whats-new#supported-control-plane-api-versionsSun, 01 Mar 2026 00:00:00 +0000Azure security · Microsoft LearnUse the latest stable version for production workloads. Preview versions are for early testing only and aren't covered by Azure support SLAs. Each link points to the API specification in the azure-rest-api-specs repository. Stable API versions. 2026-02-01 (recommended) 2025-05-01 2024-11-01…https://learn.microsoft.com/en-us/azure/key-vault/general/whats-new#private-endpoint-limit-enforcementhttps://learn.microsoft.com/en-us/azure/key-vault/general/whats-new#private-endpoint-limit-enforcementSun, 01 Mar 2026 00:00:00 +0000Azure security · Microsoft LearnAzure Key Vault is enforcing limits on the number of private endpoints per vault. Customers exceeding these limits may need to reduce usage or request an exception through Azure support. For more information on private endpoint limits, see Azure Key…https://learn.microsoft.com/en-us/azure/key-vault/general/whats-new#preview-api-version-deprecationhttps://learn.microsoft.com/en-us/azure/key-vault/general/whats-new#preview-api-version-deprecationSun, 01 Mar 2026 00:00:00 +0000Azure security · Microsoft LearnAzure Key Vault is deprecating older preview control plane API versions in accordance with Azure guidelines. All preview API versions except 2026-04-01-preview will be deprecated with a 90-day notice period. Customers using preview API versions should plan to migrate to…https://learn.microsoft.com/en-us/azure/key-vault/general/whats-new#new-control-plane-api-versionshttps://learn.microsoft.com/en-us/azure/key-vault/general/whats-new#new-control-plane-api-versionsSun, 01 Mar 2026 00:00:00 +0000Azure security · Microsoft LearnNew Azure Key Vault control plane API versions (2026-02-01 and 2026-03-01-preview) are now available across public Azure regions, with availability extended to Mooncake and Fairfax clouds.https://learn.microsoft.com/en-us/azure/key-vault/general/whats-new#control-plane-sdk-releaseshttps://learn.microsoft.com/en-us/azure/key-vault/general/whats-new#control-plane-sdk-releasesSun, 01 Mar 2026 00:00:00 +0000Azure security · Microsoft LearnAll five Azure Key Vault control plane management SDKs supporting API version 2026-02-01 are now released. Control plane management SDKs that use older API versions will stop working when those API versions retire on February 27, 2027. Upgrade to the…https://learn.microsoft.com/en-us/azure/key-vault/general/whats-new#azure-rbac-is-the-default-access-control-model-for-new-vaultshttps://learn.microsoft.com/en-us/azure/key-vault/general/whats-new#azure-rbac-is-the-default-access-control-model-for-new-vaultsSun, 01 Mar 2026 00:00:00 +0000Azure security · Microsoft LearnAzure Key Vault API version 2026-02-01 introduces Azure RBAC as the default access control model for newly created key vaults when using this API version. Existing vaults continue using their current access model unless explicitly updated. Both Azure RBAC and…