# Azure in the First Half of 2026 The [Azure updates](https://azure.microsoft.com/updates) feed had over 400 entries in the first half of 2026. Most of them won't change your week. This is my pick of the ones that might: changes in default behavior, governance, Bicep, identity, Functions and testing, the wave of MCP servers, and the retirements worth putting in a calendar. ## Changes in default behavior These are the ones that change what happens without you doing anything, so they deserve to go first. **New virtual networks no longer get default outbound access.** Since [March 31, 2026](https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/default-outbound-access), subnets in newly created virtual networks are private by default: a VM without a public IP no longer gets implicit internet access. Outbound traffic now needs an explicit method — a NAT gateway, load balancer outbound rules, a public IP, or a firewall. Existing virtual networks aren't affected. For templates it depends on the API version: private-by-default comes with the Microsoft.Network API versions released after March 31, so a Bicep or Terraform deployment that creates a *new* VNet may, once you bump the API version, give you VMs that can't reach Windows Update or a package feed. **Azure Policy assignments take effect within about five minutes.** Assignments in Resource Manager mode are now [enforced within roughly five minutes](https://azure.microsoft.com/updates?id=558102), instead of the "up to 30 minutes" that used to be the rule of thumb. The old trick of signing out and back in to speed things up was removed on April 30. If you work with policy as code (I wrote about [Azure Policy management](/2025-03-16-azure-policy-management-done-right/) last year), the feedback loop just got a lot shorter. ## Governance: Blueprints has a new end date The [Azure Blueprints retirement moved](https://azure.microsoft.com/updates?id=564806) from July 11, 2026 to **January 31, 2027**, but in phases: | Date | What stops | |---|---| | July 31, 2026 | Creating new blueprint definitions and versions | | October 31, 2026 | Editing definitions and creating new assignments | | December 31, 2026 | Editing assignments | | January 31, 2027 | The API, CLI and PowerShell stop working; definitions and assignments you haven't exported are deleted | So the real deadline for "we'll just add one more" is the end of this month. The migration path is [template specs and deployment stacks](https://learn.microsoft.com/en-us/azure/governance/blueprints/blueprint-retirement). ## Bicep Five minor releases (v0.40 to v0.44, see the [Bicep releases](https://github.com/Azure/bicep/releases)), with a few things that went GA: - **Multi-line interpolated strings** (`$'''…'''`) — v0.40 - **`bicep snapshot`** — v0.41, for seeing what a template will deploy without deploying it - **The Bicep console** — v0.42, a REPL for trying out expressions and functions - **Extendable `.bicepparam` files** — v0.44, so a parameter file can extend a shared base file instead of copy-pasting common values across environments Alongside that, the Bicep MCP server kept growing (decompile, format, diagnostics, build), which fits the theme from my [Azure ARM MCP server post](/2026-05-11-azure-arm-mcp-server/). ## Identity and security - **Mandatory MFA, phase 2** — enforcement of MFA at the Azure Resource Manager layer, which covers Azure CLI, Azure PowerShell, the REST API and infrastructure-as-code tools, [started in October 2025](https://azure.microsoft.com/blog/azure-mandatory-multifactor-authentication-phase-2-starting-in-october-2025/), and the option to postpone it ran out on July 1, 2026. If you still run automation as a *user* account, now is the time to move it to a workload identity (managed identity or a service principal with federated credentials) — those aren't affected. Microsoft recommends at least Azure CLI 2.76 and Az PowerShell 14.3. - **Azure Files** — [managed identity support for SMB](https://azure.microsoft.com/updates?id=562350) and [Entra-only identities](https://azure.microsoft.com/updates?id=562359) went GA, so you no longer need a domain-joined setup to use identity-based access - **Azure SQL Database** — [Microsoft Entra server principals](https://azure.microsoft.com/updates?id=565154) are GA - **Application Insights** — querying data with API keys is on its way out; [switch to Entra ID authentication](https://azure.microsoft.com/updates?id=transition-to-azure-ad-to-query-data-from-azure-monitor-application-insights-by-31-march-2026) by September 30, 2026 ## Compute, containers and networking The short list: - **New VM generations** — the Intel-based [Dl/D/E v7 series](https://azure.microsoft.com/updates?id=560734) went GA in May, and the Arm-based [Cobalt 200 VMs](https://azure.microsoft.com/updates?id=564451) were announced in private preview at Build - **AKS** — [Ubuntu 24.04](https://azure.microsoft.com/updates?id=548096) is GA (and the default OS from Kubernetes 1.35), and [Azure Container Linux](https://azure.microsoft.com/updates?id=564537), an immutable OS based on Flatcar, is GA on AKS - **[StandardV2 NAT Gateway](https://azure.microsoft.com/updates?id=547772)** — zone-redundant, up to 100 Gbps. Relevant given the default outbound change above - **Higher network limits** — [2,000 rules per NSG and 1,000 routes per route table](https://azure.microsoft.com/updates?id=562695) - **[Site-to-site VPN with certificate authentication](https://azure.microsoft.com/updates?id=562705)**, with the certificate stored in Key Vault - **[Bulk restore for Azure VMs](https://azure.microsoft.com/updates?id=561373)** (preview, May) — Azure Backup can now restore up to 100 VMs in one operation, with a restore point and common settings per VM and one place to track progress. ## Functions, Logic Apps and testing - **[Managed connectors in Azure Functions](https://azure.microsoft.com/updates?id=562442)** (preview, June) — the same 1,400+ connectors Logic Apps and Power Platform use (Office 365, Teams, SharePoint, Salesforce and so on) are now available as triggers and operations in Functions. It's the mirror image of the Logic Apps vs. Azure Functions dilemma from my [Logic Apps and PowerShell](/2025-05-04-logic-apps-finally-love-powershell/) post: there, Logic Apps got PowerShell; here, Functions get the connectors. [Docs](https://aka.ms/connectors-with-functions-docs) and [samples](https://aka.ms/connectors-with-functions-samples) are available - **[Reporting in Playwright Workspaces](https://azure.microsoft.com/updates?id=550379)** (GA, January) — Playwright Workspaces, part of Azure App Testing, runs your [Playwright](https://playwright.dev/) browser tests as a managed service. The new reporting adds an integrated reporting experience for debugging failed tests, with the test artifacts stored in your own storage account. [More on reporting](https://aka.ms/pww-reporting) > **Update (October 2026):** I've since written about [testing my own site with Playwright MCP](/2026-07-19-navigating-my-own-ai-revolution/). And for PowerShell folks: [PowerShell 7.6 support in Azure Functions](https://azure.microsoft.com/updates?id=567651) went into preview on July 17 and [became GA](https://azure.microsoft.com/updates?id=572219) on September 21 — just as well, with [PowerShell 7.4 support ending on November 10](/2026-10-30-powershell-7-4-7-5-end-of-support/). ## MCP servers everywhere If one thing showed up in almost every product group's announcements this half year, it's the [Model Context Protocol (MCP)](https://modelcontextprotocol.io/): the standard way to give an AI assistant access to tools and data. A selection of what Azure added: - **Azure Functions** — [MCP resource triggers](https://azure.microsoft.com/updates?id=559981) (GA, April) and [hosting MCP apps](https://azure.microsoft.com/updates?id=562099) (GA, June), so you can build your own MCP server on Functions - **[Azure Logic Apps MCP server](https://azure.microsoft.com/updates?id=562868)** (GA, June) — your workflows as tools for an AI agent - **[SQL MCP Server](https://azure.microsoft.com/updates?id=564734)** (preview in March, GA in June) - **[AKS MCP server](https://azure.microsoft.com/updates?id=557223)** with unified tooling (preview, February) - **[MCP toolkit for Azure Cosmos DB](https://azure.microsoft.com/updates?id=563032)** (GA, June) - **[API Center data plane MCP server](https://azure.microsoft.com/updates?id=562914)** (GA, June) — for discovering the APIs and AI assets in your organization - **[API Management content safety for MCP and A2A APIs](https://azure.microsoft.com/updates?id=562880)** (GA, June, A2A being agent-to-agent) — once you expose MCP servers, you'll want a gateway in front of them - **Bicep** — the Bicep MCP server mentioned above And for Azure Resource Manager itself, see my [Azure ARM MCP server post](/2026-05-11-azure-arm-mcp-server/). ## AI and Foundry Build (June 2–3) was heavy on agents. The highlights: the [next-generation Foundry Agent Service](https://azure.microsoft.com/updates?id=557141) went GA in March, [Microsoft Agent Framework 1.0](https://azure.microsoft.com/updates?id=560982) in April, and at Build [hosted agents](https://azure.microsoft.com/updates?id=563596) and [Foundry IQ](https://azure.microsoft.com/updates?id=563222) went GA. API Management also gained an AI gateway for more model providers. Who could've guessed, Build pushing AI, agents and agentic working... if only there was anything else but AI, but alas... ## Retirements to put in your calendar | Retirement | Date | |---|---| | [Functions runtime v3 on Linux Consumption](https://azure.microsoft.com/updates?id=559311) | September 30, 2026 | | [App Service support for .NET 8](https://azure.microsoft.com/updates?id=558033) | November 10, 2026 | | [Managed NGINX ingress in AKS App Routing](https://azure.microsoft.com/updates?id=555839) — security patches end | November 30, 2026 | | Azure Blueprints (see above) | January 31, 2027 | | [TLS 1.0/1.1 on App Service, Functions and Logic Apps](https://azure.microsoft.com/updates?id=557852) | May 31, 2027 | | [AKS on Ubuntu 22.04](https://azure.microsoft.com/updates?id=557928) | June 30, 2027 | And one that's about money rather than features: [reserved instances are no longer sold](https://azure.microsoft.com/updates?id=560948) for a list of older VM series from July 1, 2026 — one-year reservations for series like Av2, Dv2 and Fsv2, and both one- and three-year for Dv3 and Ev3. Reservations set to auto-renew won't renew, so those VMs quietly fall back to pay-as-you-go pricing. Time to plan a move to a newer series. ## Wrap If you only act on two things: check any template that creates a new virtual network for an explicit outbound path, and stop creating new Blueprints before July 31. The rest can wait for your next planning session.