--- cuppy_hub: azure cuppy_path: changelog/2026-10-20-gap-fill.md cuppy_section: docs cuppy_doc: 47ZT-YJYW cuppy_doc_uuid: 59d82178-7d73-45ba-a2ed-fa6f918e29d2 cuppy_permalink: https://cuppy.io/azure/d/47ZT-YJYW cuppy_version: 1 cuppy_updated: 2026-10-23T16:16:52.575Z cuppy_canonical: https://cuppy.io/azure/docs/changelog/2026-10-20-gap-fill cuppy_mcp: https://cuppy.io/mcp cuppy_body_sha256: c2bd7c2c7ea17ff9ab8e11bb5747db390e4ea9a7fee50e727b2eea0609c344bb # cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks. --- # Azure hub — gap fill for families 1 to 5 (2026-10-20) ## What's in it 13 new documents including this note, bringing the hub to 85, plus extensions to existing ones: - **Identity:** `reference/entra/workload-and-agent-identities.md` (Conditional Access and CAE for service principals; Entra Agent ID objects, claims, `AgentServicePrincipal`/`AgentUser` role assignments and error codes). Extended: `reference/policy/effects-and-errors.md` (policies that need an external evaluation token, `--acquire-policy-token`) and `reference/rbac/role-assignments-and-scopes.md`. - **Storage:** `reference/storage/files-access-and-errors.md`, `reference/storage/tables.md`, `reference/storage/blob-data-protection.md`. Extended: `reference/storage/access-models.md` (per-service shared key setting rechecked). - **Compute:** `reference/functions/durable-functions.md`, `reference/functions/functions-on-container-apps.md`, `reference/app-service/app-service-environment.md`, `reference/vm/scale-sets-and-images.md`. Extended: `reference/container-instances/errors.md` (restarts, exit codes, IP changes). - **Networking:** `reference/networking/vpn-and-expressroute.md`, `reference/networking/firewall-and-ddos.md`, `reference/networking/bastion.md`, `reference/networking/virtual-wan-and-network-manager.md`. Extended: `reference/networking/vnets-subnets-and-peering.md` (links per special subnet, ASE v3 row). ## 2026 changes captured - **VPN Gateway:** new gateways must use AZ SKUs since November 1, 2025; non-AZ VpnGw1–5 scheduled for deprecation after September 30, 2026; legacy Standard and HighPerformance retired; Standard-IP gateways move to Generation 2 automatically (around March 2027). The Azure VPN Client for Linux (preview) retired on August 31, 2026. - **ExpressRoute:** the gateway migration experience moves non-AZ gateways to AZ SKUs and Basic to Standard IPs. - **Netherite** support for Durable Functions ends March 31, 2028; the **Durable Task Scheduler** is the recommended backend and works with extension bundle 4.32.0+. - **Functions on Container Apps V2** (`kind: functionapp` on `Microsoft.App`) replaces the `Microsoft.Web` model. - **Compute Gallery** image definitions default to Gen2 and `TrustedLaunchSupported` from API 2025-03-03. - **Isolated v4** SKUs for App Service Environment v3, in select regions. - **Entra Agent ID** and Conditional Access for agents; `@azure/identity` 4.14.0 has no agent credential yet. ## How it was checked - Sources: `azure-docs@dd032389` (sparse paths added for `durable-task`, `vpn-gateway`, `expressroute`, `firewall`, `ddos-protection`, `virtual-wan`, `virtual-network-manager` and the Virtual WAN includes, at the same commit), `azure-compute-docs@c21e8e82`, `entra-docs@5695853e`, `SupportArticles-docs@ff674f85` (sparse paths added for Bastion, ExpressRoute, Firewall and VPN Gateway) and `azure-rest-api-specs@c783b658`. Table storage pages came from Learn via WebFetch. - Every Bicep block builds and lints clean with Bicep 0.48.1 (Durable Task Scheduler 2026-02-01, Compute Gallery 2025-03-03, `Microsoft.Web` 2025-03-01 and Container Apps 2026-07-01 are the newest typed versions used). The TypeScript examples (`@azure/data-tables` 13.3.2, `durable-functions` 3.6.0) compile under `tsc --strict`. Every `az` command was checked against Azure CLI 2.91.0 help (333 commands). - `@azure/data-tables` error behaviour was tested against a local mock server: single operations leave `RestError.code` empty and put the code in `details.errorCode`. ## Contradictions found in Microsoft's pages - The Durable storage-provider table says the scheduler's extension bundle support is "coming soon"; the scheduler quickstart already uses bundle 4.32.0. - VPN Gateway's what's-new page gives June 2026 for the legacy SKU retirement in its table and September 30, 2025 in its announcement list. - The ASE networking page points the `scm` wildcard at a private endpoint IP in one set of steps and at the inbound IP in the other; the hub follows the private-zone steps. - The Table data model page calls a reserved-name failure "404 (Bad Request)". ## Still missing - `allowSharedKeyAccessForServices`: still undocumented on Learn; untested. - Family 2's quota CLI extension stays deferred to family 10 (Cost and limits), per the charter. - Point-to-site VPN client configuration, ExpressRoute Global Reach and Direct, Azure Firewall Premium TLS inspection certificates, and AVNM cross-tenant setup are summarised only. --- You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 107 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/azure/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.