---
next_cursor: eyJzY29yZSI6MCwic2VxIjoxODE4LCJzaW5jZSI6bnVsbCwidG9vbCI6ImF6IiwidiI6MX0
has_more: true
next: https://sincecutoff.com/v1/changes.md?tool=az&score=0&cursor=eyJzY29yZSI6MCwic2VxIjoxODE4LCJzaW5jZSI6bnVsbCwidG9vbCI6ImF6IiwidiI6MX0
items: 10
---
# sincecutoff.com changes: az

## AKS node pool add and update support Ubuntu2404 OS SKU (az, 2026-01-13)
Published 2026-10-19
- slug: aks-node-pool-add-and-update-support-ubuntu2404-os-sku-29cb95f7f790
- score: 0.91

How to use it:

When adding or updating an AKS node pool, set `--os-sku Ubuntu2404` to choose Ubuntu 24.04. Supply the resource group, cluster name, and node pool name for the selected command.

Examples:

```
az aks nodepool add --resource-group <resource-group> --cluster-name <cluster-name> --name <node-pool-name> --os-sku Ubuntu2404
```

```
az aks nodepool update --resource-group <resource-group> --cluster-name <cluster-name> --name <node-pool-name> --os-sku Ubuntu2404
```

- why_it_matters: Choose the OS SKU when adding or updating an AKS node pool.
- sources: <https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli#january-13-2026>, <https://learn.microsoft.com/en-us/cli/azure/aks/nodepool?view=azure-cli-latest>
- gotchas: "Version: 2.82.0"; "--resource-group (required): Resource group containing the AKS cluster."; "--cluster-name (required): Name of the managed Kubernetes cluster."; "--name (required): Node pool name; the command syntax also accepts `--nodepool-name`."; "--os-sku (required): OS SKU for the agent node pool. `Ubuntu2404` is an accepted value."; "Docs conflict: The current Azure CLI reference lists additional OS SKU values beyond those in the January 2026 release note, including Ubuntu2604. It still documents Ubuntu2404 as accepted."

## az vmss adds instance resiliency status views (az, 2026-01-13)
Published 2026-10-19
- slug: az-vmss-adds-instance-resiliency-status-views-c8edb8ef4a15
- score: 0.90

How to use it:

To inspect resiliency status for every VM in a scale set, run `az vmss list-instances` with `--resiliency-view`. To inspect one VM, run `az vmss get-resiliency-view` with the scale set name, resource group, and instance.

Examples:

```
az vmss list-instances --resiliency-view --resource-group <resource-group> --subscription <subscription-id> --virtual-machine-scale-set-name <scale-set-name>
```

```
az vmss get-resiliency-view --resource-group <resource-group> --name <scale-set-name> --instance <instance-name-or-id>
```

- why_it_matters: Inspect resiliency status for instances in a virtual machine scale set.
- sources: <https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli#january-13-2026>, <https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/resilient-vm-create-delete>, <https://learn.microsoft.com/en-us/cli/azure/vmss?view=azure-cli-latest>
- gotchas: "Version: 2.82.0"; "--resiliency-view: Show resiliency status of each instance; defaults to false."; "--resource-group (required): Name of the resource group."; "--subscription: Subscription name or ID."; "--virtual-machine-scale-set-name (required): Name of the VM scale set."; "--name (required): Name of the VM scale set for `get-resiliency-view`."; "--instance (required): Instance name in Flexible orchestration mode; instance ID in Uniform orchestration mode."

## Storage SAS generation adds user delegation OID support across blob, container, file system, directory, share, file, and queue commands (az, 2026-01-13)
Published 2026-10-19
- slug: storage-sas-generation-adds-user-delegation-oid-support-across-blob-container-fi-83d5bfa4d5a0
- score: 0.92

How to use it:

When generating a SAS for a supported Azure Storage resource, add `--user-delegation-oid <user-object-id>` to that resource’s `generate-sas` command. For share, file, and queue SAS commands, use `--as-user` as well; the documented `--as-user` option requires `--expiry` and `--auth-mode login`.

Examples:

```
az storage blob generate-sas --account-name <storage-account> --container-name <container> --name <blob> --permissions <permissions> --expiry <date-time> --auth-mode login --as-user --user-delegation-oid <user-object-id>
```

```
az storage fs file generate-sas --file-system <file-system> --path <file-path> --https-only --permissions <permissions> --expiry <date-time> --user-delegation-oid <user-object-id>
```

```
az storage share generate-sas --name <share> --account-name <storage-account> --https-only --permissions <permissions> --expiry <date-time> --auth-mode login --as-user --user-delegation-oid <user-object-id>
```

- why_it_matters: Generate a user delegation SAS for a supported Azure Storage resource.
- sources: <https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli#january-13-2026>, <https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blob-user-delegation-sas-create-cli>, <https://learn.microsoft.com/en-us/cli/azure/storage/fs/file?view=azure-cli-latest>, <https://learn.microsoft.com/en-us/cli/azure/storage/share?view=azure-cli-latest>, <https://learn.microsoft.com/en-us/cli/azure/storage/blob?view=azure-cli-latest>
- gotchas: "Version: 2.82.0"; "--user-delegation-oid <user-object-id>: Entra ID of the user authorized to use the resulting SAS URL; that URL must be used with an Entra ID token issued to that user."; "--as-user: Return a SAS signed with the user delegation key. Requires `--expiry` and `--auth-mode login`."; "--auth-mode {key, login}: Select authentication mode; `login` uses login credentials. Required with `--as-user`."; "--expiry <date-time>: SAS expiration time; required with `--as-user`."; "--name <blob> (required): Blob name for `az storage blob generate-sas`."; "--container-name <container>: Container containing the blob; required unless another documented resource locator is used."; "--file-system <file-system> (required): ADLS Gen2 file system name."; "--path <file-path> (required): File path in the file system."; "--name <share> (required): File share name."; "--permissions <permissions>: Permissions granted by the SAS; accepted permission values depend on the resource."; "--https-only: Allow requests only over HTTPS."; "Prerequisite: Sign in to Azure CLI with Microsoft Entra credentials; the CLI user needs an Azure RBAC role containing `Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action`."; "Prerequisite: The cited Azure CLI guide specifies Azure CLI version 2.0.78 or later for creating a user delegation SAS."; "`az storage fs file generate-sas` is added as a command."; "`--as-user` is stated for the share, file, and queue SAS commands."

## az network vnet-gateway adds identity parameters and subgroup (az, 2026-02-03)
Published 2026-10-19
- slug: az-network-vnet-gateway-adds-identity-parameters-and-subgroup-55116605c902
- score: 0.94

How to use it:

When a deployment workflow needs identity settings on an existing virtual network gateway, assign them with `az network vnet-gateway identity assign`.

Examples:

```
az network vnet-gateway identity assign --resource-group <resource-group> --name <gateway-name> --mi-system-assigned
```

```
az network vnet-gateway identity assign --resource-group <resource-group> --name <gateway-name> --mi-user-assigned <identity-resource-id>
```

- why_it_matters: Configure a virtual network gateway in a repository deployment workflow that uses identity settings.
- sources: <https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli#february-03-2026>, <https://learn.microsoft.com/en-us/cli/azure/network/vnet-gateway/identity?view=azure-cli-latest>
- gotchas: "Version: 2.83.0"; "--name / -n (required): Name of the VNet gateway."; "--resource-group / -g (required): Name of the resource group."; "--mi-system-assigned / --system-assigned: Set the system managed identity."; "--mi-user-assigned / --user-assigned: Set user managed identities; supports shorthand, JSON-file, and YAML-file syntax."

## az aks create/update container network logs (az, 2026-03-03)
Published 2026-10-19
- slug: az-aks-create-update-container-network-logs-de97a3882d1f
- score: 0.92

How to use it:

For an AKS cluster, use `az aks create` or `az aks update` with `--enable-container-network-logs` to enable container network log collection. Use `az aks update` with `--disable-container-network-logs` to disable it.

Examples:

```
az aks create --resource-group <resource-group> --name <cluster-name> --location <location> --enable-container-network-logs
```

```
az aks update --resource-group <resource-group> --name <cluster-name> --enable-container-network-logs
```

```
az aks update --resource-group <resource-group> --name <cluster-name> --disable-container-network-logs
```

- why_it_matters: Enable container network logs when creating or updating an AKS cluster.
- sources: <https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli#march-03-2026>, <https://learn.microsoft.com/en-us/cli/azure/aks?view=azure-cli-latest>, <https://learn.microsoft.com/en-us/azure/aks/how-to-configure-container-network-logs>
- gotchas: "Version: 2.84.0"; "--resource-group (required): Resource group containing the cluster."; "--name (required): AKS cluster name."; "--location (required): Azure location for the cluster being created."; "--enable-container-network-logs: Enables container network log collection; automatically enables `--enable-high-log-scale-mode`."; "--disable-container-network-logs: Disables container network log collection. The enable and disable options are opposing choices."; "Prerequisite: Azure CLI installed and signed in; an Azure account with an active subscription. The container-network-logs guide says ACNS must be enabled on the cluster and a `ContainerNetworkLog` custom resource must be applied to start collection."

## az stack create/validate/delete behavior for resources without delete support (az, 2026-03-03)
Published 2026-10-19
- slug: az-stack-create-validate-delete-behavior-for-resources-without-delete-support-876ff16471f8
- score: 0.93

How to use it:

When creating, validating, or deleting a deployment stack, set `--resources-without-delete-support` to choose how to handle resources that lack delete support when they are no longer managed by the stack. The documented values are `detach` and `fail`.

Examples:

```
az stack group create --name <stack-name> --resource-group <resource-group> --template-file <template-file> --action-on-unmanage <deleteAll|deleteResources|detachAll> --deny-settings-mode <denyDelete|denyWriteAndDelete|none> --resources-without-delete-support <detach|fail>
```

```
az stack sub validate --name <stack-name> --template-file <template-file> --location <location> --action-on-unmanage <deleteAll|deleteResources|detachAll> --deny-settings-mode <denyDelete|denyWriteAndDelete|none> --resources-without-delete-support <detach|fail>
```

```
az stack mg delete --name <stack-name> --management-group-id <management-group-id> --action-on-unmanage <deleteAll|deleteResources|detachAll> --resources-without-delete-support <detach|fail>
```

- why_it_matters: Create, validate, or delete a deployment stack that manages resources without delete support.
- sources: <https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli#march-03-2026>, <https://learn.microsoft.com/en-us/cli/azure/stack/group?view=azure-cli-latest>, <https://learn.microsoft.com/en-us/cli/azure/stack/sub?view=azure-cli-latest>, <https://learn.microsoft.com/en-us/cli/azure/stack/mg?view=azure-cli-latest>
- gotchas: "Version: 2.84.0"; "--resources-without-delete-support, --rwd: Selects what happens to resources without delete support when no longer managed by the stack. Allowed values: `detach`, `fail`."; "--action-on-unmanage, --aou (required): Sets what happens to resources no longer managed after the stack is updated or deleted. Values: `deleteAll`, `deleteResources`, `detachAll`."; "--deny-settings-mode, --dm (required): Sets denied operations on managed resources. Values: `denyDelete`, `denyWriteAndDelete`, `none`."; "--name, -n (required): Deployment stack name."; "--resource-group, -g (required): Resource group containing the stack; required for group-scope create/validate."; "--template-file, -f: Path to a template or Bicep file."; "--location, -l (required): Location to store the deployment stack; required for subscription-scope validate."; "--management-group-id, -m (required): Management group ID; required for management-group-scope delete."

## az webapp create minimum TLS version (az, 2026-03-03)
Published 2026-10-19
- slug: az-webapp-create-minimum-tls-version-8785b225dfce
- score: 0.95

How to use it:

When creating a web app, set its minimum TLS version with `--min-tls-version` (for example, `1.2`).

Examples:

```
az webapp create -g <resource-group> -p <app-service-plan> -n <app-name> --min-tls-version 1.2
```

- why_it_matters: Set the minimum TLS version when creating a web app.
- sources: <https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli#march-03-2026>, <https://learn.microsoft.com/en-us/cli/azure/webapp?view=azure-cli-latest>
- gotchas: "Version: 2.84.0"; "--name (-n) (required): Name of the new web app; alphanumeric characters and hyphens only, cannot start or end with a hyphen, and under 64 characters."; "--plan (-p) (required): App Service plan name or resource ID."; "--resource-group (-g) (required): Resource group name."; "--min-tls-version: Minimum TLS version required for SSL requests; documented examples: 1.0, 1.1, 1.2."

## az network private-endpoint create/update adds IPv6 support (az, 2026-04-07)
Published 2026-10-19
- slug: az-network-private-endpoint-create-update-adds-ipv6-support-a5d0181a9e7c
- score: 0.91

How to use it:

When creating or updating a private endpoint with IPv6, set `--ip-version-type IPv6`.

Examples:

```
az network private-endpoint create --connection-name <connection-name> --name <endpoint-name> --private-connection-resource-id <resource-id> --resource-group <resource-group> --subnet <subnet> --ip-version-type IPv6
```

```
az network private-endpoint update --name <endpoint-name> --resource-group <resource-group> --ip-version-type IPv6
```

- why_it_matters: Create or update a private endpoint with IPv6.
- sources: <https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli#april-07-2026>, <https://learn.microsoft.com/en-us/cli/azure/network/private-endpoint>
- gotchas: "Version: 2.85.0"; "--connection-name (required): Name of the private link service connection."; "--name (required): Name of the private endpoint. For update, use this with `--resource-group`, or use `--ids`."; "--private-connection-resource-id (required): Resource ID of the private endpoint to connect to."; "--resource-group (required): Resource group name. For update, use with `--name`, or use `--ids`."; "--subnet (required): Subnet for the private endpoint."; "--ids: For update, one or more complete resource IDs; use this or the other resource ID arguments."; "--ip-version-type: Private IP version type; accepted values are `DualStack`, `IPv4`, and `IPv6`. Defaults to `IPv4`."; "The parameter supports IPv6."

## az vmss create supports automatic availability-zone placement controls (az, 2026-04-07)
Published 2026-10-19
- slug: az-vmss-create-supports-automatic-availability-zone-placement-controls-b825223d1bb4
- score: 0.94

How to use it:

When creating a VM scale set with automatic zone placement, set `--zone-placement-policy Auto`; optionally constrain eligible zones or their maximum count. `--include-zones` and `--exclude-zones` cannot be used together.

Examples:

```
az vmss create --resource-group <resource-group> --name <scale-set-name> --image Ubuntu2204 --admin-username azureuser --generate-ssh-keys --instance-count 3 --zone-placement-policy Auto
```

```
az vmss create --resource-group <resource-group> --name <scale-set-name> --image Ubuntu2204 --admin-username azureuser --generate-ssh-keys --instance-count 3 --zone-placement-policy Auto --include-zones 1 2
```

- why_it_matters: Create a VM scale set with automatic zone placement constrained by selected zones and a zone count.
- sources: <https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli#april-07-2026>, <https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-zone-placement>, <https://learn.microsoft.com/en-us/cli/azure/vmss>
- gotchas: "Version: 2.85.0"; "--resource-group (required): Name of an existing resource group."; "--name (required): Scale set name."; "--image (required): OS image name, URN, custom image name or ID, or VHD blob URI; required unless using `--attach-os-disk`."; "--zone-placement-policy: Set to `Auto` to enable automatic availability-zone placement."; "--include-zones: Availability zones to consider; if omitted, all regional zones are considered. Mutually exclusive with `--exclude-zones`."; "--exclude-zones: Availability zones to exclude; if omitted, no zones are excluded. Mutually exclusive with `--include-zones`."; "--max-zone-count: Maximum number of availability zones to use with automatic placement; if omitted, all available regional zones may be used."; "--admin-username (required): Administrator username for the example Linux VM."; "--generate-ssh-keys: Generate SSH key files if missing; stores them in `~/.ssh`."; "--instance-count: Number of VMs in the scale set; default is 2."; "Prerequisite: Register the `Microsoft.Compute/VmssAutomaticZonePlacement` feature for the subscription. The feature is marked Preview in the official documentation."; "Prerequisite: The resource group must already exist."; "`--include-zones`, `--exclude-zones`, and `--max-zone-count` apply when `--zone-placement-policy` is set to `Auto`."; "Docs conflict: `--include-zones` and `--exclude-zones` cannot both be configured on the same scale set; the card's optional-flag wording could be read as allowing both together."

## az webapp update sets the platform release channel (az, 2026-04-07)
Published 2026-10-19
- slug: az-webapp-update-sets-the-platform-release-channel-aefbe934e822
- score: 0.92

How to use it:

When setting a web app’s platform release channel, run `az webapp update` with `--platform-release-channel` and the app’s name and resource group.

Examples:

```
az webapp update --platform-release-channel <Latest|Standard|Extended> --name <app-name> --resource-group <resource-group>
```

- why_it_matters: Set the platform release channel for a web app.
- sources: <https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli#april-07-2026>, <https://learn.microsoft.com/en-us/cli/azure/webapp?view=azure-cli-latest>, <https://learn.microsoft.com/en-us/azure/app-service/overview-patch-os-runtime>
- gotchas: "Version: 2.85.0"; "--platform-release-channel (required): Release channel to set. Allowed values: `Latest`, `Standard`, `Extended`."; "--name: Web app name; may be omitted if a default is configured."; "--resource-group: Resource group name; may be omitted if a default is configured."; "Prerequisite: Platform Release Channel is available for Linux App Service only."

Next: https://sincecutoff.com/v1/changes.md?tool=az&score=0&cursor=eyJzY29yZSI6MCwic2VxIjoxODE4LCJzaW5jZSI6bnVsbCwidG9vbCI6ImF6IiwidiI6MX0
Save `next_cursor`; next visit, pass it to get only what was published since.
<!-- end of page -->