Azure hub — gap fill for families 1 to 5 (2026-10-20)

What the gap-fill release adds before the Databases family — workload and agent identities, policy tokens for external evaluation, Azure Files, Table storage, blob data protection, Durable Functions, Functions on Container Apps, App Service Environment v3, scale sets and Compute Gallery, Container Instances runtime errors, VPN Gateway and ExpressRoute, Firewall and DDoS, Bastion, and Virtual WAN with Virtual Network Manager — with the 2026 changes, how it was checked and what is still missing.

markdownreferencev147ZT-YJYWarea: changelogchangelogrelease notesgap fill

Created 21 Oct 2026 · Modified 23 Oct 2026 · 1 version

What's in it

13 new documents including this note, bringing the hub to 85, plus extensions to existing ones:

  • Identity: reference/entra/workload-and-agent-identities.md (Conditional Access and CAE for service principals; Entra Agent ID objects, claims, AgentServicePrincipal/AgentUser role assignments and error codes). Extended: reference/policy/effects-and-errors.md (policies that need an external evaluation token, --acquire-policy-token) and reference/rbac/role-assignments-and-scopes.md.
  • Storage: reference/storage/files-access-and-errors.md, reference/storage/tables.md, reference/storage/blob-data-protection.md. Extended: reference/storage/access-models.md (per-service shared key setting rechecked).
  • Compute: reference/functions/durable-functions.md, reference/functions/functions-on-container-apps.md, reference/app-service/app-service-environment.md, reference/vm/scale-sets-and-images.md. Extended: reference/container-instances/errors.md (restarts, exit codes, IP changes).
  • Networking: reference/networking/vpn-and-expressroute.md, reference/networking/firewall-and-ddos.md, reference/networking/bastion.md, reference/networking/virtual-wan-and-network-manager.md. Extended: reference/networking/vnets-subnets-and-peering.md (links per special subnet, ASE v3 row).

2026 changes captured

  • VPN Gateway: new gateways must use AZ SKUs since November 1, 2025; non-AZ VpnGw1–5 scheduled for deprecation after September 30, 2026; legacy Standard and HighPerformance retired; Standard-IP gateways move to Generation 2 automatically (around March 2027). The Azure VPN Client for Linux (preview) retired on August 31, 2026.
  • ExpressRoute: the gateway migration experience moves non-AZ gateways to AZ SKUs and Basic to Standard IPs.
  • Netherite support for Durable Functions ends March 31, 2028; the Durable Task Scheduler is the recommended backend and works with extension bundle 4.32.0+.
  • Functions on Container Apps V2 (kind: functionapp on Microsoft.App) replaces the Microsoft.Web model.
  • Compute Gallery image definitions default to Gen2 and TrustedLaunchSupported from API 2025-03-03.
  • Isolated v4 SKUs for App Service Environment v3, in select regions.
  • Entra Agent ID and Conditional Access for agents; @azure/identity 4.14.0 has no agent credential yet.

How it was checked

  • Sources: azure-docs@dd032389 (sparse paths added for durable-task, vpn-gateway, expressroute, firewall, ddos-protection, virtual-wan, virtual-network-manager and the Virtual WAN includes, at the same commit), azure-compute-docs@c21e8e82, entra-docs@5695853e, SupportArticles-docs@ff674f85 (sparse paths added for Bastion, ExpressRoute, Firewall and VPN Gateway) and azure-rest-api-specs@c783b658. Table storage pages came from Learn via WebFetch.
  • Every Bicep block builds and lints clean with Bicep 0.48.1 (Durable Task Scheduler 2026-02-01, Compute Gallery 2025-03-03, Microsoft.Web 2025-03-01 and Container Apps 2026-07-01 are the newest typed versions used). The TypeScript examples (@azure/data-tables 13.3.2, durable-functions 3.6.0) compile under tsc --strict. Every az command was checked against Azure CLI 2.91.0 help (333 commands).
  • @azure/data-tables error behaviour was tested against a local mock server: single operations leave RestError.code empty and put the code in details.errorCode.

Contradictions found in Microsoft's pages

  • The Durable storage-provider table says the scheduler's extension bundle support is "coming soon"; the scheduler quickstart already uses bundle 4.32.0.
  • VPN Gateway's what's-new page gives June 2026 for the legacy SKU retirement in its table and September 30, 2025 in its announcement list.
  • The ASE networking page points the scm wildcard at a private endpoint IP in one set of steps and at the inbound IP in the other; the hub follows the private-zone steps.
  • The Table data model page calls a reserved-name failure "404 (Bad Request)".

Still missing

  • allowSharedKeyAccessForServices: still undocumented on Learn; untested.
  • Family 2's quota CLI extension stays deferred to family 10 (Cost and limits), per the charter.
  • Point-to-site VPN client configuration, ExpressRoute Global Reach and Direct, Azure Firewall Premium TLS inspection certificates, and AVNM cross-tenant setup are summarised only.

Read this document as markdown — the same bytes an agent receives.