Transcription
Hey everyone, welcome to this week's Azure update. It's the 7th of February.
Um, quite a few updates this week with some really interesting things on networking, AI, and the Entra site, so we'll go through all of those.
New videos this week again really continue on updating the Azure master class. The storage module has a key focus on the Azure storage account, all of its capabilities, and a lot of things that build on top of that. So we go through all of that information.
On to what's new on the compute side. We have the AKS enhanced insights. This is a new experience that's really all built around a new streamlined view that we use when we use insights, and it is available for both the free and the detailed insights. Remember, the detailed insights also use the Prometheus metrics and logging to get us even more information into our environment.
On the working side, Azure DNS public zone DNSSEC has gone GA. Remember, this is for the public zones, and with DNSSEC, I can enhance the security of the various domain records, the domain names, by protecting them from things like DNS spoofing. It helps ensure the integrity of your DNS data.
So really, some of the key benefits when we think of DNSSEC are enhanced security. It's going to protect you against that DNS spoofing, person-in-the-middle type attacks. It helps ensure the integrity of the records because those DNS responses you're going to get are guaranteed to be authentic and have not been tampered with in some way.
One of the common attacks is to mess around with the DNS record. You go and look up some name, and it points you to some bad actor server, which then captures data, authentication tokens, whatever that is. So this helps stop that, and all of that really builds a trustworthy deal.
DNSSEC helps you build trust with your users because you have this secure and reliable DNS infrastructure.
Azure Front Door supports new origin types in preview. Remember, Azure Front Door is our public-facing global Anycast solution. Anycast means the IP address associated with the service is available through all of the Microsoft points of presence all over the world.
So if I'm a client, I can talk to that closest point of presence. It's very resilient because there are all these POPs around the world, and I get a really nice low-latency connection.
It’s split TCP, so I establish my TCP session to that close point, I establish my TLS session to that close point, then it serves me up nice chunks of layer seven type workloads.
So origins are where it's actually going to talk to on the back end to fetch the content that it then delivers to me. What's really nice now is those origins can be private link enabled, specifically private link enabled App Gateway, private link enabled API management, and private link enabled container apps that can now be origins for Front Door premium deployments.
Remember, the whole point of private link is that the particular instance of a service has an IP address in a virtual network. Now that can only be used by things that have connectivity to that virtual network, and it doesn't have a public address that can be spoken to from the public internet.
On the database side, the Azure SQL free database offer has been expanded. So yes, 100,000 vCore seconds per month. This is a SQL serverless database, 32 GB of data, 32 GB of backup storage, but I now get 10 of those per subscription, and this is for the lifetime of the subscription.
So this is really good for testing, for learning, for trying out some kind of proof of concept. I can apply this to an existing SQL database by clicking the apply offer button.
Now, obviously, if you hit the limit of that free amount, it will either auto-pause or you start paying for that additional use. So you get to control what you want it to do when you hit your free limit.
Azure Databricks is now available in a new region, Mexico Central, in GA. Azure Databricks also now supports clean rooms in GA.
So think of a clean room as providing a safe environment for collaboration between different organizations while still maintaining the privacy of each organization's individual data.
The way this works is one organization will create this clean room, and they can then invite other organizations as collaborators. Now, all of the parties involved can then pick specific tables, volumes, views, and notebooks via Delta sharing to bring into that clean room.
But the key point here is the different collaborators can't see each other's data. What they can do is those approved notebooks we put in the clean room can operate over all of the data, and then we can see the output tables generated from those notebooks.
So imagine a scenario where different organizations collect data about some entities, and what they would like to do is be able to get a summary of the status of these entities over all their organizations, but without sharing the specific details about what their customers have with them.
So this solution is a great way to collaborate while maintaining each organization's privacy for the data they have.
Azure Monitor logs simple mode is now GA. Remember, Azure Monitor logs provides a really nice powerful store for all of your logging data. Think signals is everything these days.
I can bring in all of the signals from Azure systems, Entra, and other clouds, and on-prem, you name it, I can bring it into this store. Normally, we then interact and perform analysis using the Kusto Query Language (KQL), but that requires obviously some knowledge on our part of KQL.
Simple mode makes the data more like a spreadsheet. It's a point-and-click interaction. I just select the table that I want, and then I can apply various filters on it. So it's a much nicer experience, and they are exposing a lot of functionality with that.
Azure Data Studio is being retired at the end of February 2026. So in a year, really, this is so the development effort can be focused more around VS Code.
Now I can take my existing database projects from ADS and open them directly in VS Code without any migration. Additionally, most of the Azure Data Studio extensions are available in VS Code.
Now, obviously, if I'm dealing with Microsoft SQL, I will make sure I install the MS SQL extension from the VS Code Marketplace. If I'm using PostgreSQL, I will install the PostgreSQL extension. If I'm using Cosmos, for example, I use the Azure Databases extension.
So depending on the specific technology I'm using, there's a particular extension I'll install in VS Code. But hey, those are just available now.
If you do find, hey, there's some very specific feature that isn't supported, well then, for example, if it was SQL, maybe I go and use SQL Server Management Studio for that.
The 03 mini model has been released. This is really an update. Remember, the O model is all about complex reasoning. They have an internal chain of thought.
So this is an update to the reasoning model that can now tackle those difficult problems, and it also gives you the ability to have some control over how that's working.
Now it supports structured outputs. It's very good at math, coding, and science. But one of the great things about the 03 mini model is I can actually tell it the amount of that reasoning effort I want it to use, and I can set that as low, medium, or high.
So that's the time it's going to spend working on the problem before it goes and gives out its output. I can say, hey, I just want a quicker answer, so I could do a low reasoning effort, or I want a more thorough and complete answer. I'm going to say use a higher reasoning effort.
Now, the higher that reasoning effort, the longer the response is going to take, and also it will use more of those hidden reasoning tokens that you still pay for. But you are in control of how this is going to actually work.
Then we have the GPT-40 audio in preview. This is the latest audio completions model that enables audio generation, and it can really support pretty much any combination of audio and/or text in to audio and/or text out.
For example, it could generate a spoken summary of some text, but it has dynamic variation in that voice. So it's not just very monotone talking; it actually makes it engaging, and you want to listen to it.
If I give it an audio recording, it can detect the sentiment. That might be really useful. Imagine we always throw up a help desk that says, "Hey, we record these calls for training purposes."
Well, it could listen to those calls and understand the sentiment of the customer and those overall interactions. So hey, the customer is very happy, or this customer hates us and only wants bad things for us.
So it would be able to detect that. It can be used as an asynchronous voice-in, voice-out type interaction. So maybe I've got some kind of hands-free operation. I'm talking to something, I give it a command, it goes and does that, and then it could give me a response back.
Now, there is also a real-time version. This is the same underlying model, but it's been optimized for low latency. So think of those real-time audio interactions.
That would be a more conversational type capability. Entra ID now has hard deletions as a protected action.
So protected actions, remember, are higher privilege permissions that I can associate with an authentication context and then associate that with a conditional access policy.
So it can enforce more specific requirements. For example, to be able to do this protected action, I have to be on a privileged access workstation or I've used phishing-resistant authentication.
A hard deletion is normally when I delete an object, it goes to a recycled bin of sorts for 30 days, so I can restore it. Now what I can do is go into the deleted items and delete it from there.
That's a hard delete, and obviously, if I do that, it now can't be restored. With this capability, I could now go in and add that protected action to then say I need additional requirements to be fulfilled before you can go and delete things from deleted items.
This applies to users, M365 groups, and applications. Actually, we could jump over and see this really quick.
So here I'm in my roles and admins area of Entra. I'm looking at protected actions, and the key part now is we have this ability to have the Microsoft directory deleted items delete, and I can now associate that with an authentication context.
Then I would go and create a conditional access policy for that authentication context to go and lock down additional requirements. So it really just helps me add in some additional checks and things I want before I can go and do that.
Also on Entra, we now have real-time password spray detection. So someone is just firing a stack of passwords at an entry identity to try and log in.
What this now does is it detects those password spray attempts in real time. So what that means is it will stop the attacker from ever getting a token in the first place.
Instead of a really complicated post-spray remediation because they got an account, well now it's going to stop the attack while they're still trying to perform the sign-in flow.
Now this is part of identity protection, which means it's a P2 feature. The nice thing here is this will now show, because it's real-time, as a sign-in risk, which I could now respond to in my conditional access policies under the sign-in risk area.
And Advisor now has a service retirement workbook in preview. Now ordinarily in service health alerts, we'll see retirements coming up, but we don't get for those retirement things today impacted resources.
What this does is it will give us the impacted resources. Now, not all services are onboarded today, but the product group is making a lot of efforts around this. Expect it to grow massively over the next couple of months.
So I'm in Advisor, I'm looking at workbooks, and I have this service retirement workbook. If I go into this, it actually shows me a few different things.
But the first tab is really nice; it shows me impacted services and all the different retirements that it knows about. If I keep scrolling down, it's actually showing me my resources and the specific resources themselves that are impacted by this retirement.
So I could then actually scroll over, see the exact resource name, and go and select it. It gives me the exact action that I then need to go and take to make it healthy.
So this is a really nice place to now go and get resource-level information. Again, not every service is covered today, but this is definitely growing.
There's also the ability to go and just kind of see all services that have had any kind of retirement, and I can see ones that have already retired.
So it's a really nice place to go because there are a lot of retirements going on at the moment, mainly because of things like TLS 1.0 and 1.1 going away. We want TLS 1.2 and above.
Things like the Azure Service Manager, the old Red Dog front end control plane for Azure, that's essentially being unsupported, so I need to move to Azure Resource Manager.
So there's a lot of different retirements, so it's really good to not be surprised by those things. So check out your service health alerts, and then for the workload supported, and it's growing, go and check out the services retirement workbook in Azure Advisor to get even more details on it.
And that was it. As always, I hope this is useful. Until next video, you take care.