This week in Azure

Dense week. AKS got four separate updates, networking got three, and two items buried near the end will cost people money if they miss them: symmetric keys in Key Vault, and the reservation exchange policy change taking effect in February 2027.

The headline for anyone building AI platforms is AI Gateway in API Management. It takes the pattern most of us have been assembling by hand and makes it a product feature.

AI

AI Gateway in Azure API Management (preview)

AI Gateway in Azure API Management is in public preview. It is the managed version of what teams building governed AI platforms have been constructing out of policies, custom rate limiting and homegrown token accounting.

If you have stood up APIM in front of model endpoints, you already know the shape: one place that fronts every model call, applies access control, enforces quota, and produces the audit trail. The value of it being a first-class capability rather than an assembly of policy fragments is that it stops being your code to maintain.

It is a dedicated gateway tier, and the MCP handling is the part worth looking at. You can federate several MCP servers so they present as one, and turn an existing set of REST operations into an MCP server without writing the server. Token usage surfaces through OpenTelemetry, so cost attribution comes out of the same pipe as everything else.

It is also not Microsoft-only. The models and MCP servers behind it can sit in AWS, Google, OpenAI or Anthropic — which is the whole point of a gateway, and the thing a Foundry-shaped answer would not give you.

I have written about building this by hand, and the assembly is not the hard part. Keeping it correct as the model catalogue moves underneath you is. Preview, so evaluate — but if you are about to build a gateway layer from scratch, look at this first.

Claude Opus 5

Claude Opus 5 landed across the stack: Microsoft Foundry, M365 Copilot including the desktop apps and Copilot Studio, GitHub Copilot, and Azure Databricks, where it reached GA on July 27th, 2026.

The number that matters is price. It sits roughly at half the cost of Fable 5, the tier above it, while being a substantial step up from Opus 4.8 on deep reasoning and long-horizon tasks. That combination puts it in the default-model conversation rather than the reach-for-it-occasionally one.

One caveat that survives the pricing: each surface carries its own data-handling and residency terms. A Foundry assessment does not automatically cover the Databricks deployment. Check them separately before the same model gets used two ways under one approval.

GPT-transcribe and GPT-live-transcribe

Two speech-recognition models arrived in Foundry, both audio in, text out, both aimed at accuracy rather than conversation.

GPT-transcribe handles completed files: meeting recordings, media, voicemail. GPT-live-transcribe is the low-latency streaming variant for voice assistants and live captioning.

The improvements are the unglamorous ones that decide whether transcription is usable: background noise, whispered or low-volume speech, mid-sentence language switching, and alphanumeric strings — which is where most transcription quietly falls apart, because nobody cares about a perfect transcript that gets the order number wrong.

Security

Azure Enclave (preview)

Azure Enclave is in public preview across Microsoft Azure, Azure Government, Azure Government Secret and Azure Government Top Secret. It streamlines deployment and management of isolated cloud environments for sensitive workloads.

The design is isolated virtual networking by default, with controls that require connections to be explicitly configured rather than assumed. You deploy from managed infrastructure and predefined architectural patterns instead of assembling the isolation yourself.

The Government-cloud framing will make most readers skip it. Don’t. “Isolated by default, connections explicit, predefined patterns” is the same problem statement as a regulated landing zone in Zurich or Frankfurt. Watch where this goes.

Symmetric keys on Key Vault Premium (preview)

Azure Key Vault Premium now supports symmetric keys in preview, using the oct-HSM key type with AES. You can encrypt, decrypt, wrap and unwrap directly in Key Vault under the usual managed security and compliance controls.

The line to notice: AES with 256-bit keys aligns with CNSA 2.0 requirements. That puts this squarely in post-quantum readiness territory rather than general key management. If you have been building a quantum-safe roadmap, symmetric key handling inside a managed HSM is a piece you previously had to solve elsewhere.

Kubernetes

AKS prepared image specification (preview)

Prepared image specification lets you define the node image state you want rather than accepting the default and patching afterwards. Preview.

The problem it addresses is real: every organisation with a hardened baseline ends up running a DaemonSet or a custom script to bring nodes to standard after they join. That is drift waiting to happen, and it runs after the node is already in the cluster.

Application routing with Gateway API (GA)

The AKS application routing add-on now supports the Gateway API, generally available. Gateway API is the successor to Ingress, with a cleaner separation between infrastructure and application concerns — the cluster operator defines the Gateway, application teams attach Routes.

This is not a preference. The ingress-nginx project is being retired, which makes Gateway API the path for standard layer 7 ingress rather than one option among several. If you are standing up a new cluster, start here. If you are running ingress-nginx today, this is a migration with a clock on it, not a modernisation you can defer indefinitely.

Fleet Manager: resource placement GA, maximum allowed failures preview

Azure Kubernetes Fleet Manager got two updates. Resource placement is generally available. Maximum allowed failures for update runs is in preview, letting you define how many clusters may fail before the run stops.

The second one is the operationally interesting one. A fleet update that halts on the first failure is annoying at ten clusters and unusable at a hundred; one that ignores failures entirely is dangerous. A configurable threshold is the right shape.

Networking

NAT64 on StandardV2 NAT Gateway (GA)

NAT64 on the StandardV2 NAT Gateway is generally available, translating IPv6 to IPv4 so IPv6-only workloads reach IPv4-only destinations.

This is the piece that makes IPv6-only subnets practical. The blocker was never IPv6 itself, it was the long tail of IPv4-only endpoints you still have to call. Combined with IPv6 on VPN Gateway from last week, the IPv6 story on Azure is materially better than it was a month ago.

HTTP header insertion in Azure Firewall (GA)

Azure Firewall can insert HTTP headers, generally available. Useful where an application expects a header for access or identification — Azure Virtual Desktop, VDI, tenant restrictions and similar access controls — and for tagging traffic with its origin, which is the missing context in most egress investigations.

The catch: modifying HTTPS headers requires TLS inspection, and TLS inspection requires the premium SKU. On standard you are limited to HTTP.

Route maps for Azure Route Server (preview)

Route maps for Azure Route Server are in public preview, giving inbound and outbound control over routes across BGP peerings with NVAs, ExpressRoute gateways and VPN gateways in the same virtual network.

Three capabilities: route summarisation for on-premises networks arriving over ExpressRoute or VPN, route control in both directions, and path selection by modifying BGP attributes such as AS-PATH.

If you run a hybrid topology with NVAs, this is the control you have been approximating with UDRs. Prototype it.

Storage and data

Azure Monitor Logs mirroring into Microsoft Fabric (preview)

Azure Monitor Logs can now be mirrored into Microsoft Fabric, landing in OneLake as Delta Parquet without duplication and with near real-time availability. All tiers are supported: Analytics, Basic and Auxiliary.

Once the data is in Fabric you can query it with Eventhouse, Power BI and Spark alongside operational and business data. The use case Microsoft leads with is correlating telemetry against ERP or CRM context to understand the business impact of an operational event.

Open format, no copy, all tiers. If you have been exporting Log Analytics to a lake on a schedule, delete that pipeline.

Azure NetApp Files: SMB oplocks configuration (preview)

Azure NetApp Files now exposes SMB opportunistic locking configuration on SMB and dual-protocol volumes. Oplocks improve client caching and are enabled by default; you can now configure them on new volumes or change them on existing ones, and a cross-region replication destination can differ from its source.

Platform and cost

Reservation exchanges ending for savings-plan services

Read this one properly. Starting February 1st, 2027, reservation exchanges will no longer be available for Azure services covered by savings plans.

The affected list is not small. Compute: Virtual Machines, including exchanges between non-premium and premium storage, Dedicated Host, and App Service. Databases: PostgreSQL, MySQL, DocumentDB, Cosmos DB, SQL Database and SQL Managed Instance.

Every active reservation for an impacted service purchased before February 1st, 2027 keeps the right to one final exchange after that date. One. Not one per year.

The practical consequence: reservation purchases get less forgiving. Exchange has been the safety net for buying a three-year reservation on a SKU you were not certain about, and that net is being removed for exactly the services people most often get wrong. Tighten your sizing before you commit, and use the final exchange deliberately rather than burning it on a small correction.

Where the environment is genuinely dynamic, the answer Microsoft is steering you toward is a savings plan instead. It covers all regions and a range of services against a committed spend rather than a specific SKU in a specific region, so there is nothing to exchange when needs move. You pay for that flexibility with a somewhat smaller discount than a reservation’s, which is the trade you are now being asked to make explicitly.

New cloud region in India (GA), single-click SaaS purchase (GA)

Microsoft Azure is available from a new cloud region in India South. Separately, Azure Database for PostgreSQL flexible server is now deployable in India South Central.

Marketplace also simplified purchasing: eligible public SaaS offers now complete in a single page in the Azure portal covering plan, billing, resource group, contacts and terms. Offers using a custom purchase flow are excluded.

Final thoughts

The reservation exchange change is the item to act on, and it is the one least likely to get attention because February 2027 sounds far away. It is not a deadline you meet with a migration, it is a deadline that changes how you should be buying right now. If you have a reservation renewal in the next six months, size it as though you cannot exchange it, because soon you cannot.

AI Gateway in API Management deserves a prototype this week if you are anywhere near an AI platform. The hand-built version works, but every policy fragment you own is a fragment you maintain.

And if you run IPv6-only subnets or want to, NAT64 plus last week’s VPN Gateway support removes the last two structural excuses. Plan the pilot.

Sources

  1. John Savill, “Azure Update 31st July 2026,” YouTube, https://www.youtube.com/watch?v=565Oh4RH_Nc
  2. “Reservation exchange policy changes,” Microsoft Learn, https://learn.microsoft.com/en-us/azure/cost-management-billing/reservations/reservation-exchange-policy-changes
  3. “Exchange and refund Azure reservations,” Microsoft Learn, https://learn.microsoft.com/en-us/azure/cost-management-billing/reservations/exchange-and-refund-azure-reservations
  4. “Route maps for Azure Route Server,” Microsoft Learn, https://learn.microsoft.com/azure/route-server/route-maps-about
  5. “SMB volumes in Azure NetApp Files,” Microsoft Learn, https://learn.microsoft.com/en-us/azure/azure-netapp-files/azure-netapp-files-create-volumes-smb
  6. “Azure Key Vault keys,” Microsoft Learn, https://learn.microsoft.com/en-us/azure/key-vault/keys/about-keys-details
  7. “Azure Monitor data in Microsoft Fabric,” Microsoft Learn, https://aka.ms/Azure-Monitor-Data-In-Fabric-Mirrored
  8. “Azure Enclave documentation,” Microsoft, https://aka.ms/ae/docs
  9. “Purchase a SaaS offer in the Azure portal,” Microsoft Learn, https://learn.microsoft.com/en-us/marketplace/purchase-saas-offer-in-azure-portal
  10. “Azure Database for PostgreSQL regions,” Microsoft Learn, https://learn.microsoft.com/azure/postgresql/flexible-server/overview