Introduction: a dense week for the Azure ecosystem
This edition of the Azure review covers several significant developments affecting backup, storage, databases, artificial intelligence and post-quantum cryptography. Whether you administer cloud infrastructures, develop AI applications or plan your security strategies, these updates deserve your attention.
Good to know
This review is accompanied by a dedicated video on usage-based billing for Microsoft 365 Copilot within Copilot Co-work and Work IQ — a key topic for organizations looking to control their AI costs.
Azure Backup: instant restore of application-consistent snapshots
How application consistency works
Azure Backup now offers instant restore of application-consistent snapshots upon creation, without waiting for replication to hierarchical storage tiers.
This application consistency is based on two distinct mechanisms depending on the operating system:
- Windows: use of Volume Shadow Copy Service (VSS) to flush write buffers and temporarily freeze disk operations before taking the snapshot.
- Linux: execution of customizable pre- and post-scripts to ensure a consistent disk state before and after the operation.
Operational benefit
Before this update, teams had to wait for the snapshot to be replicated in the background to cold storage before initiating a restore. Now, as soon as the consistent snapshot is created, it is immediately available for restore, drastically reducing RTO (Recovery Time Objectives).
Tip
For critical workloads (databases, ERP, Active Directory), this instant restore capability combined with consistent snapshots enables recovery objectives well below what traditional approaches allowed.
Azure Storage: enhanced integrity and migration from Google Cloud
CRC64 NVMe integrity verification
The latest versions of Azure Storage SDKs now integrate support for CRC64 NVMe integrity verification. This checksum mechanism provides enhanced assurance that data transmitted to a storage account has not suffered any bit-level corruption in transit.
Concretely, this means that every byte written to the storage account can be validated on the client side before confirmation. This option is particularly relevant for scenarios where data integrity is non-negotiable: regulatory archives, financial data, critical backups.
Azure Storage Mover now supports Google Cloud Storage
Azure Storage Mover can now migrate data from Google Cloud Storage buckets to Azure Blob Storage. This integration leverages the S3-compatible endpoint exposed natively by Google Cloud Platform.
Notable points of this integration:
- Support for private endpoints (not just public endpoints)
- Compatibility with secure network architectures via Private Link
- Direct migration to Azure Blob Storage without data transformation
Good to know
Azure Storage Mover already supports migration from AWS S3, on-premises NAS and file shares. The addition of Google Cloud Storage significantly completes the table of supported sources for multi-cloud migrations to Azure.
Database: new PowerShell module for PostgreSQL Flexible Server
The PowerShell module dedicated to Azure Database for PostgreSQL Flexible Server is now in general availability (GA). This module brings notably:
- Support for PostgreSQL version 18
- Management of elastic clusters
- Automation of common administration operations via PowerShell
Here is an example of connecting and listing PostgreSQL Flexible servers via PowerShell:
1# Module installation (if not present)2Install-Module -Name Az.PostgreSql -Repository PSGallery -Force3 4# Connect to Azure5Connect-AzAccount6 7# List PostgreSQL Flexible Server servers8Get-AzPostgreSqlFlexibleServer -ResourceGroupName "my-resource-group"9 10# Get details of a specific server11Get-AzPostgreSqlFlexibleServer -ResourceGroupName "my-resource-group" -Name "my-pg-server"AI & Foundry: Toolboxes in general availability
What is a Toolbox in Azure AI Foundry?
Announced at Microsoft Build, Foundry Toolboxes are now in GA. They are part of the Model Context Protocol (MCP) ecosystem, the emerging standard for communication between AI applications and capability servers.
MCP operates on the principle of automatic discovery:
- The AI application (MCP client) queries an MCP server: "What can you do?"
- The server exposes its capabilities in a standardized format
- The application passes these capabilities directly to the underlying LLM or SLM
- The model selects and invokes the relevant tools
The context overload problem
When a Toolbox exposes a large number of tools, it can saturate the model's context window, generating:
- Confusion in tool selection
- An increase in costs (more tokens consumed)
- A degradation of performance of the agent
The solution integrated into Toolboxes is a mechanism for semantic tool search: the agent can first query the Toolbox to identify the relevant tool before invoking it, thus avoiding loading the entire catalog into the context.
Integration with Fabric and Foundry governance
Toolboxes can expose not only classical tools, but also Skills and Work Foundry Fabric capabilities. Azure AI Foundry natively manages:
- Authentication of MCP calls
- The lifecycle of tools and skills
- The governance and auditability of interactions
Skills become first-class Foundry resources, discoverable as MCP resources.
Tip
For AI architects, Foundry Toolboxes represent a standardized approach to exposing complex business capabilities (access to Fabric data, API calls, document search) to AI agents without having to develop proprietary integrations.
Anthropic Claude models now hosted on Azure
General availability of Claude models on Azure
Anthropic's Claude models are now executed directly in Microsoft Azure data centers, in general availability. This development is strategic: the entire AI application flow remains within the Microsoft governance and security boundary.
Two deployment options are available:
- Global data zone: international distribution
- US data zone: data processed and stored exclusively in the United States
The Claude models hierarchy
| Model | Tier | Strengths | Use cases |
|---|---|---|---|
| Claude Opus | Former flagship | Deep reasoning | Complex tasks |
| Claude Fable (Opus 5) | New flagship | Better overall performance | Complex tasks, advanced reasoning |
| Claude Sonnet 4.5 | Mid-tier | Enhanced coding & agentic performance | AI agents, development, Opus 4 replacement at lower cost |
| Claude Haiku | Entry-level | Speed and low cost | Simple interactions, minimal context |
Claude Sonnet 4.5 deserves special attention: its performance in coding and agentic context allows it, in many scenarios, to advantageously replace Opus 4.8 with a much better cost/performance ratio.
Good to know
The principle of model selection becomes an architectural competency in its own right: we no longer systematically seek the most powerful model, but the model best suited to the complexity/cost/latency ratio of each use case.
These models are also available in GitHub Copilot and Azure Databricks.
Kimik K2.7 in GitHub Copilot
The open-weight model Kimik K2.7 is now available in GitHub Copilot. Positioned as a low-cost option, it offers interesting capabilities for development scenarios that do not require premium models.
Post-quantum cryptography: Microsoft accelerates
Why quantum urgency is real
Microsoft has achieved a major breakthrough with the Majorana chip, multiplying qubit longevity by 2,000 (from milliseconds to seconds). If a fully operational quantum computer is still estimated to be years away, current asymmetric algorithms (RSA, ECC) will be vulnerable to certain quantum algorithms like Shor.
A recent U.S. executive order accelerates migration timelines to post-quantum cryptographic standards, which led Microsoft to strengthen its Quantum-Safe Program (QSP).
The QSP program axes
- TLS 1.3 adoption: use of cipher suites not vulnerable to quantum attacks
- Update of encryption data at rest: evolution of encryption algorithms for stored data
- Modernization of cryptographic trust chains: revision of PKIs and signature mechanisms
Warning
Organizations managing long-lived data (healthcare data, government data, industrial secrets) must now inventory their cryptographic dependencies. Data encrypted today with RSA and stored by an adversary could potentially be decrypted in a few years with a quantum computer — this is the scenario known as "harvest now, decrypt later".
To learn more, NIST finalized its first post-quantum standards in 2024 (FIPS 203, 204, 205). Microsoft's roadmap aligns with these standards.
Reference: NIST Post-Quantum Cryptography Standards
Azure AI Language: enhanced PII detection and redaction
The Azure AI Language playground now integrates a set of curated samples for detecting and redacting personally identifiable information (PII). This playground allows you to concretely evaluate detection capabilities on real cases including:
- Names and surnames
- Postal addresses
- Financial identifiers
- Social security numbers
- Other regulated identifiers
Results include both the location of detected entities and their automatic redaction, which facilitates evaluation before integration into GDPR-compliant or other regulatory document processing pipelines.
Reference: Azure AI Language - PII Detection
Summary of updates
- ✅ Azure Backup: instant restore of consistent snapshots (VSS/scripts)
- ✅ Azure Storage SDK: CRC64 NVMe integrity verification
- ✅ Azure Storage Mover: migration from Google Cloud Storage (S3 compatible)
- ✅ PostgreSQL Flexible Server: new PowerShell module in GA (PG18 support)
- ✅ Foundry Toolboxes: GA — MCP tool exposure with context management
- ✅ Claude on Azure: GA — Fable 5 and Sonnet 4.5 (global and US zones)
- ✅ Kimik K2.7: available in GitHub Copilot
- ✅ Quantum-Safe Program: acceleration — TLS 1.3, post-quantum cryptography
- ✅ Azure AI Language: enriched PII samples in the playground
