Azure CLI release notes

August 11, 2026

Version 2.89.1

Core

• Allow SSH certificate flow in Cloud Shell

August 04, 2026

Version 2.89.0

ACR

• az acr import: Fix regional endpoint source resolution for multi-label sovereign suffixes
• az acr create/update: Add new parameter --writable-cache-repo to enable writable behavior for cache repositories within a registry

AKS

• az aks upgrade: Skip Machines mode agent pools during node image and Kubernetes version upgrade
• az aks identity-binding: Add command group to manage identity bindings (trust domain) for a managed cluster
• az aks update: Fix --outbound-type validation for userDefinedRouting and userAssignedNATGateway so BYO VNet clusters no longer require --vnet-subnet-id and managed VNet clusters get a clear error message
• az aks nodepool rollback: Fix false auto-upgrade warning when upgrade channels are disabled
• Vendor new SDK and bump API version to 2026-05-01

App Config

• Update CLI to use Audience and update to 1.8.0

• az appconfig: Increase retry resilience for data-plane operations to better handle transient server throttling (HTTP 429) and network errors

App Service

• az appservice plan: Remove preview flag for managed instance app service plans
• az appservice plan: Add Premium V3 SKU support (P0V3, P1-3V3, P1-5MV3) for managed instances
• az webapp troubleshoot status: Provide latest application startup attempt data

ARM

• az stack-whatif group/sub/mg: Add deployment stacks what-if commands

Backup

• Add support for cost management settings

Cognitive Services

• az cognitiveservices account compute: Support compute cluster resources management

Compute

• az vmss application set: Fix command silently failing to set gallery applications and remove leftover debug output

CosmosDB

• az cosmosdb: Revert API version from 2026-03-15 back to 2025-10-15

MySQL

• az mysql flexible-server mirroring: Add enable and disable commands to support Fabric Mirroring

MySQL Flexible Server

• az mysql flexible-server update: Add --maintenance-batch to set the batch (Default, Batch1, Batch2) of the custom-managed maintenance window; existing batch is preserved when omitted

NetAppFiles

• az netappfiles volume create: Add --breakthrough-mode to specify whether the volume operates in Breakthrough Mode

Network

• az network nat gateway: Add --nat64 to enable/disable NAT64 on StandardV2 NAT gateway
• az network private-endpoint-connection: Update provider Microsoft.HardwareSecurityModules/cloudHsmClusters
• az network virtual-appliance migration: Support migrating NVA to ILB architecture

PostgreSQL

• az postgres flexible-server backup create: Fix duplicate auto-generated backup names after deletions
• az postgres flexible-server create: Add example to create elastic cluster with custom database name
• az postgres flexible-server upgrade: Introduced --validate-only param for PVC

July 07, 2026

Version 2.88.0

ACR

• az acr create: Add --data-endpoint-enabled parameter to support enabling dedicated data endpoint for client firewall configuration
• az acr create: Add --endpoint-protocol parameter to support specifying the endpoint protocol for the registry
• az acr task logs: Align log streaming with the default TLS behavior used by the rest of Azure CLI commands
• az acr run/build: Align log streaming with the default TLS behavior used by the rest of Azure CLI commands
• az acr login: Harden binary resolution and credential passing

AKS

• az aks nodepool upgrade: Fix --max-unavailable being silently ignored
• az aks maintenanceconfiguration add/update: Add support for maintenanceWindow format in default maintenance configuration
• az aks check-acr: Support national/sovereign clouds where nodes report cloud=AzureStackCloud by pointing canipull at the on-node akscustom.json environment file
• az aks create: Add --enable-control-plane-metrics/--enable-cp-metrics to opt new clusters into Azure Monitor managed Prometheus control-plane metrics
• az aks update: Add --enable-control-plane-metrics/--enable-cp-metrics and --disable-control-plane-metrics/--disable-cp-metrics to toggle Azure Monitor managed Prometheus control-plane metrics on existing clusters
• az aks nodepool get-rollback-versions/rollback: Add commands to get rollback versions and roll back an agent pool to the most recently used configuration
• az aks create/update: Set principalType when creating role assignments to avoid PrincipalNotFound failures caused by Microsoft Entra ID replication delay

App Service

• az appservice plan create: Make default OS as Linux when --hyper-v is not specified explicitly
• az appservice plan create: Use --is-linux false to create a Windows app service plan
• az functionapp config ssl: Support site-scoped certificates for Flex consumption
• az functionapp flex-migration: Allow migrating Linux consumption apps with certificates
• az functionapp: Add warning for Linux consumption EOL and recommend migration to Flex consumption
• az functionapp create: Add warning for Linux consumption EOL and recommend using Flex consumption
• az appservice plan create: Add --enriched-errors parameter to see detailed failure log
• az webapp up/deploy: Add --enriched-errors false parameter to disable enriched deployment failure log

ARM

• az policy: Rewrite Azure Policy CRUD commands using auto-generation

Backup

• az backup: Add CRR config entries for Delos cloud regions

CDN

• Migrate the entire module to azure-cli-extensions

Compute

• az vm create/update/show: Support scheduled events profile via new parameters --scheduled-events-api-version and --enable-all-instance-down
• az vmss create/update/show: Support scheduled events profile via new parameters --scheduled-events-api-version and --enable-all-instance-down
• az availability-set create/show: Support scheduled events profile via new parameters --scheduled-events-api-version and --enable-all-instance-down
• az vm/vmss create/update: Update help message for --security-type
• az vmss update: Add new parameters --zone-placement-policy, --include-zones and --exclude-zones

Compute Fleet

• az compute-fleet: Add support for Launch mode public preview

Identity

• az identity create: Add new --resource-restriction parameter to support identity assignment restrictions
• az identity update: Add new command to support updating an identity

Key Vault

• az keyvault key show/list: Add AES key size to output
• az keyvault ekm-connection: Add command group to manage External Key Manager (EKM) connections for Managed HSM (Preview)
• az keyvault key create: Add --external-key-id to create EKM-backed external keys on Managed HSM (Preview)

NetAppFiles

• az netappfiles subvolumes: Add deprecation notice az netappfiles subvolume command group is being deprecated and will be removed in a future release
• az netappfiles volume create/update: Add deprecation notice --enable-subvolumes is being deprecated and will be removed in a future release

Network

• Fix #33502: az network vnet list: List all VNets without specifying --resource-group
• az network vpn-connection create: Fix --shared-key incorrectly required when --auth-type Certificate is used
• az network ddos-custom-policy: Support specifying frontend IP configuration associations
• az network traffic-manager profile create/update: Add --record-type parameter to support record type filtering
• az network private-endpoint-connection: Add provider Microsoft.HorizonDB/clusters

Packaging

• Support Python 3.14
• Bump embedded Python to 3.14.5

Policy

• az policy: Remove obsolete breaking change messages

PostgreSQL

• az postgres flexible-server create/restore/geo-restore/replica create: Add new arguments --federated-client-id and --backup-federated-client-id to support multi-tenant application registration
• az postgresql flexible-server maintenance-event list/show/apply-now/reschedule: Add commands for maintenance events

Resource

• az bicep: Add snapshot and run subcommands

Role

• az role deny-assignment create/delete: Add new commands

SSH

• az ssh: Restore explicit failure for unsupported managed identity and Cloud Shell SSH cert flows

June 02, 2026

Version 2.87.0

ACR

• [BREAKING CHANGE] az acr replication create/update: Remove deprecated --region-endpoint-enabled flag and use --global-endpoint-routing instead
• [BREAKING CHANGE] az acr config content-trust update: No longer accept the enabled status
• [BREAKING CHANGE] az acr check-health: Remove Notary client check due to Docker Content Trust deprecation
• az acr login: Make ACR audience customizable in AAD token acquisition
• az acr connected-registry resync: Add command to manually trigger a sync from the parent registry
• az acr update: Add --endpoint-protocol parameter to support specifying the endpoint protocol for the registry
• az acr login: Fix regional endpoint matching for registries with DNL suffix
• az acr config content-trust/show/update: Add deprecation labels and notices

AKS

• az aks add/update: Add --enable-artifact-streaming and --disable-artifact-streaming parameters

App Config

• az appconfig kv set-snapshot-reference: Add support to create a snapshot reference key-value
• az appconfig kv list: Add support to list key-values from a snapshot reference
• az appconfig create/update/network-security-perimeter-configuration: Add Network Security Perimeter (NSP) support

App Service

• [BREAKING CHANGE] az webapp list-runtimes: Change output from flat string list to structured list of dicts with keys: os, runtime, version, config, support, end_of_life
• az webapp list-runtimes: Add --runtime and --support filter parameters
• [BREAKING CHANGE] az webapp list-runtimes: Remove deprecated --linux and --show-runtime-details parameters
• az webapp log startup: Add commands to list and view Linux container startup logs
• az webapp create: Add --site-scoped-certs parameter to support enabling or disabling site-scoped certificates
• az webapp up: Add warning message for future deprecation
• az functionapp deployment source config-zip: Fix KeyError 'FUNCTIONS_WORKER_RUNTIME' for Go function apps on Flex Consumption
• az functionapp update-strategy config set: Add new command to set or update a function app's update strategy configuration
• az functionapp update-strategy config show: Add new command to get the details of a function app's update strategy configuration
• Fix #31394: az functionapp deployment source config-zip: Never ending loop on flex function app health check

Compute

• [BREAKING CHANGE] az vm create: Change default --size from Standard_DS1_v2 to Standard_D2s_v5
• [BREAKING CHANGE] az vmss create: Change default --vm-sku from Standard_DS1_v2 to Standard_D2s_v5
• az sig image-definition update: Add ability to update image-definition start version
• az vm create/update: Support zone-resilient VM with --zone-movement
• az vm update: Support cross-zone movement
• az vm deallocate: Support vm force deallocate with --force-deallocate
• az vm/vmss create: Support Ephemeral OS disk with full caching with --ephemeral-os-disk-enable-full-caching

Container app

• az containerapp: Fix typo in help message
• Fix #33369: az containerapp up: Resolve OS/Architecture models from correct SDK package

Cosmos DB

• az cosmosdb restore: Fix cross-region restore by preserving source region in top-level location

Key Vault

• az keyvault create: Fix keyvault create RequestDisallowedByPolicy error by explicitly setting enableSoftDelete in the request body

MySQL

• [BREAKING CHANGE] az mysql flexible-server backup create/restore/geo-restore/replica: Remove --storage-redundancy

NetAppFiles

• [BREAKING CHANGE] az netappfiles volume update: --remote-volume-resource-id has been deprecated
• [BREAKING CHANGE] az netappfiles volume create: --network-features default value has changed to Standard
• az netappfiles cache: Add new command group to manage Cache resources
• az netappfiles volume bucket: Add new command group to manage Bucket resources

Network

• az network vnet create/update: Add --summarized-gateway-prefixes to support summarized gateway prefixes
• az network application-gateway ssl-cert create/update: Add --hsm to support Managed HSM
• az network virtual-network-appliance create/update: Add --private-ip-address-version to support private ip address version

PostgreSQL

• [BREAKING CHANGE] az postgres flexible-server create/update: Remove --high-availability for preferred argument --zonal-resiliency
• [BREAKING CHANGE] az postgres flexible-server upgrade: Remove the enum for --version
• [BREAKING CHANGE] az postgres flexible-server create/update: Remove deprecated --cluster-option and update validation logic
• [BREAKING CHANGE] az postgres flexible-server index-tuning: Remove support for command group
• [BREAKING CHANGE] az postgres flexible-server backup create: Remove backup name requirement and implement automatic name generation for backups
• [BREAKING CHANGE] az postgres flexible-server create/geo-restore/restore/revive-dropped: Don't create or alter networking components like virtual network, subnet, or private DNS zone. Stop supporting --address-prefixes and --subnet-prefixes anymore
• [BREAKING CHANGE] az postgres flexible-server replica create: Don't create or alter networking components like virtual network, subnet, or private DNS zone. Stop supporting --address-prefixes and --subnet-prefixes anymore
• [BREAKING CHANGE] az postgres flexible-server backup/db/firewall-rule/long-term-retention/migration/replica create: Make consistent use of --name and --server-name across all commands
• [BREAKING CHANGE] az postgres flexible-server long-term-retention: Remove support for command group

Storage

• az storage account create/update: Support new value Smart for --access-tier
• az storage account create/update: Support --allowed-copy-scope
• az storage account blob-service-properties update: Add --enable-static-website, --index-document, --default-index-document-path, --error-document-404-path
• az storage account or-policy create/update: Add --tags-replication

May 05, 2026

Version 2.86.0

ACR

• az acr login: Support Podman for --name parameter
• az acr create: Add --regional-endpoints parameter to enable or disable regional endpoints for a container registry
• az acr update: Add --regional-endpoints parameter to enable or disable regional endpoints for an existing container registry
• az acr show-endpoints: Display regional endpoint host names when regional endpoints are enabled
• az acr login: Add --endpoint parameter to log in to a specific regional endpoint of a container registry
• az acr import: Support importing images using regional endpoint URIs as the source
• az acr network-rule: Update --ip-address help message to include ipv6 address

AKS

• az aks create, az aks nodepool add/update: Add option AzureContainerLinux to --os-sku parameter
• az aks check-acr: Fix command injection via unquoted tempfile path in subprocess call
• az aks update: Add --enable-azure-monitor-app-monitoring to support Azure Monitor Application Monitoring auto-instrumentation
• az aks create: Add parameters --system-node-subnet-id, --node-subnet-id and --enable-hosted-system to support BYO VNet for Automatic Managed System Pool clusters
• az aks mesh enable/proxy-redirection-mechanism: Add mesh Istio CNI commands
• az aks nodepool add: Add Windows2025 as a supported value for --os-sku
• az aks update: Fix --enable-azure-monitor-metrics failing with RoleAssignmentExists when Grafana role assignment already exists
• az aks create/update: Add --enable-gateway-api and --disable-gateway-api parameters to manage Managed Gateway API installation
• az aks create/update: Add --enable-app-routing-istio and --disable-app-routing-istio to manage App Routing Istio gateway implementation

App Service

• az webapp create: Add post-creation deployment guidance and startup command examples
• az webapp deploy: Add build automation guidance for Linux zip deployments
• az webapp up: Add logging for OS type, runtime auto-detection, and plan auto-generation
• Add warning for container image path when --container-image-name includes registry host
• az webapp delete: Add warning about App Service Plan deletion
• Fix #33180: az functionapp plan create: Simplify reserved parameter assignment in AppServicePlan
• az webapp sitecontainers convert: Add support for converting Docker Compose multi-container apps to Sitecontainers mode
• az webapp up/deploy: Add --enriched-errors parameter to see detailed deployment failure log
• az webapp create: Add error message that clearly lists all valid options and specifies how to discover available runtimes
• az appservice plan create: Make P0V3 as default SKU when --sku is omitted for linux webapp
• az appservice plan create: Add PREMIUM0V3 tier for elastic scale

Cloud

• Fix #33183: az cloud set: Typo correction on AZURE_BLEU_CLOUD active directory endpoint

Compute

• az sig create: Add new argument group "Managed Service Identity" to configure the service identity of a Shared Image Gallery (SIG)
• az sig show: Update command to display the managed service identity of a Shared Image Gallery (SIG)
• az sig identity: Add new command group to manage the service identity of a Shared Image Gallery (SIG)

Container app

• az containerapp create: Support other cloud for acr

Core

• Resolve CVE-2025-15467
• Resolve CVE-2025-69419
• Resolve CVE-2026-39892

Network

• az network express-route gateway: Support VWAN gateway resiliency APIs
• az network route-table create/update: Add --disable-peering-route to support disable peering route

PostgreSQL

• az postgres flexible-server create, replica create, restore, geo-restore, and revive-dropped: Add breaking change announcement for command behavioral change related to network resources
• az postgres flexible-server create: Announce breaking change deprecation of --cluster-option argument
• Fix #33090: az postgres flexible-server server-logs list: Command crashes with an AttributeError when listing log files
• az postgres flexible-server: Improve validation logic and style of error messages
• az postgresql flexible-server replica create: New argument --storage-type to select storage type as PremiumV2_LRS for read replica
• Fix #33205: az postgres flexible-server create: Update help text for --storage-auto-grow argument to reflect actual default value
• az postgres flexible-server update: Restart is no longer required for scaling storage size of Premium SSDv2 server
• az postgres flexible-server create/upgrade: Block SSDv2 creation for PG version earlier than 14

Profile

• az login: Add --subscription and --skip-subscription-discovery to filter subscriptions during login

Storage

• az storage account create/update: Update description for tls 1.3 being not yet available, remove breaking change warning to deprecate tls1.0, tls1.1
• az storage blob/container/share/file/queue/fs generate-sas: Add --user-delegation-tid to support cross tenant user delegated sas
• az storage advanced-platform-metric create/update/show/list/delete: Support Advanced Platform Metrics

April 07, 2026

Version 2.85.0

ACR

• az acr network-rule add: Add example of adding a rule to allow access for a specific virtual network
• az acr replication create/update: Add --global-endpoint-routing parameter and redirect --region-endpoint-enabled to it to avoid confusion with registry-level --regional-endpoints
• az acr cache create/update: Add --identity parameter to support using user-assigned managed identity for cache rules

AKS

• Fix #32957: az aks get-credentials: Surface user-friendly error instead of unexpected traceback
• az aks create/update: Add --acns-transit-encryption-type parameter to support configuring pod-to-pod transit encryption (WireGuard or None)
• az aks create/update Add support for ACNS performance
• az aks namespace update: Fix the location logic for managed namespace update operation
• az aks update: Add --enable-high-log-scale-mode parameter to enable/disable High Log Scale Mode for Container Logs
• az aks enable-addons: Fix monitoring addon key lookup to handle both omsagent and omsAgent API response variants
• az aks disable-addons: Add retry with exponential backoff for Log Analytics workspace creation conflicts
• az aks update: Add --disable-http-proxy and --enable-http-proxy parameters

API Management

• az apim backend: Add new command group to support backend services

App Config

• az appconfig create/update: Enable linking app insights resource to an app configuration store
• az appconfig feature set: Enable telemetry for a feature flag

App Service

• az webapp list-runtimes: Pre-announce breaking changes
• az logicapp create: Add parameter --domain-name-scope to support specifying the scope of uniqueness for the default hostname during resource creation
• az webapp update: Add parameter --platform-release-channel to support setting the platform release channel for the web app
• az appservice plan update: Remove preview flag for --elastic-scale and --max-elastic-worker-count parameters
• az webapp update: Remove preview flag for --minimum-elastic-instance-count and --prewarmed-instance-count parameters
• az webapp up: Add parameter --domain-name-scope to support specifying the scope of uniqueness for the default hostname during resource creation

Cloud

• Add Bleu to the Known Clouds list

Compute

• az vmss create: Add --zone-placement-policy parameter to enable automatic zone selection
• az vmss create: Add --include-zones parameter to support specifying availability zones that must be considered for placement when --zone-placement-policy is set to Auto
• az vmss create: Add --exclude-zones parameter to support specifying availability zones that must be excluded from placement when --zone-placement-policy is set to Auto
• az vmss create: Add --max-zone-count parameter to support specifying the maximum number of availability zones to use when --zone-placement-policy is set to Auto
• az vmss update: Add --max-zone-count parameter to support specifying the maximum number of availability zones to use for this scale set
• az vmss create/update: Add --value-max-instance-percent-per-zone parameter to support specifying the maximum percentage of virtual machine instances that can be allocated to a single availability zone in the virtual machine scale set
• az vmss create/update: Add --instance-percent-policy parameter to support specifying whether maximum percentage of virtual machine instances per zone policy should be enabled on the virtual machine scale set
• az vm run-command invoke: Fix --no-wait not working
• az restore-point collection create/update: Add parameter --instant-access
• az restore-point create: Add parameter --instant-access-duration

Container app

• az containerapp env workload-profile add: Simplify workload-profile creation with default profile name

Core

• Resolve CVE-2026-26007
• az *: Make --acquire-policy-token and --change-reference global arguments available by default, removing the need for core.enable_policy_token configuration
• Resolve CVE-2026-27448
• Resolve CVE-2026-27459
• Resolve CVE-2026-32597
• Resolve CVE-2026-25645
• Resolve CVE-2026-34073

Event Hubs

• Fix #31108, #32073: az eventhubs: Regex updated for commands with --namespace-name arguments

NetAppFiles

• az netapfiles volume create/update: Add paramter --desired-ransomware-protection-state to support advanced ransomware reports
• az netapfiles volume ransomware-report: Add command group to support advanced ransomware reports
• az netapfiles volume list-quota-report: Add command to list quota reports for volumes

Network

• az network private-endpoint-connection: Add provider Microsoft.DurableTask/schedulers
• az network private-endpoint create/update: Add parameter --ip-version-type to support IPv6

Packaging

• Add new ways (preview) to install azure-cli on macOS

PostgreSQL

• az postgres flexible-server long-term-retention: Add breaking change announcement for command group removal

Storage

• Fix #32852: az storage copy: Fix Azcopy download link to be using github release links

Synapse

• Upgrade azure-synapse-artifacts to 0.22.0

March 03, 2026

Version 2.84.0

AKS

• az aks create: Add --enable-container-network-logs parameter to enable container network logs
• az aks update: Add --enable-container-network-logs and --disable-container-network-logs parameters to enable and disable container network logs
• az aks enable-addons: Add support for default workspace creation in Bleu and Delos clouds

App Service

• az webapp create/config set: Fix vnet routing to use site-level outbound vnet routing property for API version 2024-11-01
• az webapp vnet-integration add: Fix vnet routing to use site-level outbound vnet routing property for API version 2024-11-01
• az functionapp create/vnet-integration add: Fix vnet routing to use site-level outbound vnet routing property for API version 2024-11-01
• az webapp config access-restriction show: Update to always return values in camel case
• az webapp list runtimes: Update logic to include missing Java versions and remove hardcoded lists
• az webapp create/update: Add --end-to-end-encryption-enabled parameter to support enabling or disabling end-to-end encryption between the front end and the workers
• az webapp create: Add --min-tls-version parameter to specify the minimum version of TLS
• az webapp create: Add --min-tls-cipher-suite parameter to specify the minimum TLS Cipher Suite

ARM

• az bicep decompile-params: Add new parameter --force to overwrite existing files
• az deployment: Fix the issue where the Bicep installation message is printed in the command output
• az stack group/sub/mg create/validate: Add --resources-without-delete-support parameter to support defining what happens to resources that do not support deletion when they are no longer managed by the stack
• az stack group/sub/mg create/validate: Add --validation-level parameter to support specifying validation level for the deployment stack
• az stack group/sub/mg delete: Add --resources-without-delete-support parameter to support defining what happens to resources that do not support deletion when they are no longer managed by the stack

Compute

• az vm create: Add parameters --data-disk-mbps and --data-disk-iops to support IOPS and MBPS

Container app

• az containerapp job create: Set default values to --parallelism and --replica-completion-count parameters

Cosmos DB

• az cosmosdb update: Add support for Microsoft Fabric workspace resource IDs in --network-acl-bypass-resource-ids
• Fix #32608: az cosmosdb restore: Fix "Database Account does not exist" error during polling

Maps

• az maps account create: Add default value for --sku

MySQL

• Fix #32217: az mysql flexible-server restore: Fix --no-wait flag

Network

• az network application-gateway ssl-cert: Support dedicated backend connection

PostgreSQL

• az postgres flexible-server migrate-network: Add new command to support migrating the network mode of a flexible server

SQL

• az sql server/db: Add support for versionless TDE keys
• az sql server create/update: Add --soft-delete-retention-days
• az sql server deleted-server show/list: Add new command
• az sql server restore: Add new command

Storage

• az storage share close-handle: Fix failing to close file handle when in delete pending state

February 03, 2026

Version 2.83.0

ACR

• az acr config content-trust update: Add breaking changes announcement that enabled status will no longer be accepted
• az acr check-health: Add breaking change announcement that Notary client check will be removed

AKS

• az aks create: Enable ACStor v2 without any storage options on a new cluster by --enable-azure-container-storage parameter
• az aks update: Enable the ephemeral disk storage option of ACStor v2 by --enable-azure-container-storage ephemeralDisk parameter
• az aks update: Disable the elastic SAN storage option of ACStor v2 by --disable-azure-container-storage elasticSan parameter
• az aks update: Disable ACStor v2 by --disable-azure-container-storage parameter

App Config

• az appconfig: Add option anonymous for --auth-mode parameter

App Service

• Fix #32290: az functionapp config appsettings set: Fix command failure when using --slot-settings parameter to update existing slot settings

Cognitive Services

• az cognitiveservices agent logs show: Add console log streaming for hosted agents
• az cognitiveservices agent create: Add --show-logs flag for deployment troubleshooting
• az cognitiveservices agent start: Add --show-logs and --timeout flags

Container app

• az containerapp env create: Update the error display for ConsumptionOnly environment creation

Core

• Resolve CVE-2025-69277
• Resolve CVE-2026-21441
• Resolve CVE-2025-12084
• Resolve CVE-2026-21226
• Replace GitHub URLs with AME Storage for network isolated requirements

MySQL

• az mysql flexible-server restore: Support restore server to different subscription
• az mysql flexible-server geo-restore: Support geo restore server to different subscription
• az mysql flexible-server replica create: Support create server replica to different subscription

Network

• az network vnet-gateway: Add identity-related parameters and subgroup
• az network vpn-connection: Add --auth-type and --cert-auth parameters
• az network virtual-network-appliance: Support Virtual Network Appliance feature
• az network ddos-custom-policy: Support DDoS Policy Customization

Packaging

• Optimize MSI upgrade performance by simplifying file replacement logic

PostgreSQL

• az postgres flexible-server create/georestore/replica: Allow SSDV2 servers to perform create replica and geo restore

Profile

• az login: For managed identity authentication, no longer retrieve the FQDN of the machine, bypassing hanging or error caused by misconfigured network setup

Storage

• Fix #32503: az storage file list: Fix listing files when using Oauth without Reader access
• az storage account file-service-properties update: Add --require-smb-encryption-in-transit and --require-nfs-encryption-in-transit
• az storage account create/update: Add --publish-ipv6-endpoint
• az storage account network-rule add/remove: Add --ipv6-address
• az storage account create/update: Set --min-tls-version to tls1_2 if the value provided is tls1_0 and tls1_1

January 13, 2026

Version 2.82.0

ACR

• az acr login: Enforce using acr audience in aad token acquisition

AKS

• Fix #15932: az aks install-cli: Add --gh-token parameter to allow authentication when downloading kubelogin
• az aks nodepool update: Add GPU driver install options install and none for --gpu-driver parameter
• az aks nodepool add/update: Add option Ubuntu2404 to --os-sku parameter

App Service

• az appservice list-locations: Add --managed-instance-enabled parameter for managed instances

Cognitive Services

• az cognitiveservices agent create: Add ability to create and deploy hosted agent in AI Foundry

Compute

• az vmss list-instances: Add new argument --resiliency-view to show resiliency status of each instance
• az vmss get-resiliency-view: Add new command to show resiliency status of each instance
• az sig image-version create/update: Add warning message for Azure Compute Gallery resources from api-version 2026-03-03

Container app

• az containerapp env create: Add parameter --infrastructure-resource-group to support specifying name for resource group that will contain infrastructure resources
• Fix #32594: az containerapp compose create: Fix TypeError when docker-compose file include env_file without environment

Core

• Resolve CVE-2025-66418
• Resolve CVE-2025-66471

Cosmos DB

• az cosmosdb fleet: Add new fleet feature
• az cosmosdb create/update: Add support for --disable-local-auth
• az cosmosdb restore: Fix for cross region restore for cosmosdb

Identity

• az identity create: Add new --isolation-scope parameter to support identity isolation scope
• az identity update: Add new command to support updating an identity

Key Vault

• az keyvault key create/import: Add --default-data-disk-policy to support new default SKR policy

Monitor

• az monitor dashboard: Support dashboard with Grafana

MySQL

• az mysql flexible-server backup delete: Support deletion of on-demand backup

Network

• az network application-gateway settings: Support enableL4ClientIpPreservation property via --enable-l4-client-ip
• az network application-gateway probe: Support enableProbeProxyProtocolHeader property via --enable-proxy-header
• az network application-gateway waf-policy managed-rule rule-set: Support disabled rules by default
• az network virtual-appliance: Add --nva-interface-configurations parameter
• az network watcher flow-log: Add --record-types parameter
• az network private-endpoint-connection: Add provider Microsoft.Maps/accounts

Packaging

• Pin pywin32 to version 310 to resolve the MSI upgrade issue

RDBMS

• az postgres flexible-server update/fabric-mirroring: Allow high availability enabled servers to start fabric mirroring if PG version 17+
• az postgres flexible-server create/update: Show high availability feature with zonal resiliency argument
• az postgres flexible-server create/update: Enable support for High Availability on servers with PremiumV2_LRS storage type
• az postgres flexible-server index-tuning: Deprecate and redirect to az postgres flexible-server autonomous-tuning command group
• az postgres flexible-server autonomous-tuning list-index-recommendations/list-table-recommendations: Support listing index recommendations and table recommendations
• az postgres flexible-server update: Fix bug for using argument --standby-zone when enabling high availability
• az postgres flexible-server upgrade: Allow major version upgrade to PostgreSQL Version 18
• az postgres flexible-server create: Add database name field for create with cluster
• az postgres flexible-server backup/db/firewall-rule/identity/long-term-retention/microsoft-entra-admin/migration/parameter/replica list: Allow --ids use for list commands
• az postgres flexible-server create: Change database name field to default to None
• az postgres flexible-server replica create: Add --name argument to specify read replica name

SQL

• az sql mi create/update: Add memory size in gb parameter

Storage

• az storage blob/container/fs generate-sas: Add --user-delegation-oid
• az storage fs file generate-sas: Add command and support --user-delegation-oid
• az storage fs directory generate-sas: Add --user-delegation-oid
• az storage share/file/queue generate-sas: Add --as-user and --user-delegation-oid

December 02, 2025

Version 2.81.0

AKS

• az aks safeguards: Add --pss-level parameter to support Pod Security Standards
• az aks safeguards create: Add validation to prevent duplicate resource creation

ARM

• Fix #32098: az bicep install: Fix a bug where the installation was skipped when --version was specified unless bicep.use_binary_from_path was explicitly set to false

Compute

• az vm/vmss application set: Add new parameter --enable-automatic-upgrade to support enabling application automatic upgrade

NetAppFiles

• az netappfiles volume-group create: Add --network-features parameter for volume groups
• az netappfiles volume replication list: Add --exclude parameter to exclude deleted replications

November 18, 2025

Version 2.80.0

AKS

• [BREAKING CHANGE] az aks create: Make --no-ssh-key default behaviour
• az aks namespace add/update/show/list/delete/get-credentials: Add namespace command to support managed namespace feature
• az aks create: Add KataVmIsolation option for --workload-runtime parameter
• az aks nodepool add: Add KataVmIsolation option for --workload-runtime parameter
• az aks mesh enable-egress-gateway/disable-egress-gateway: Add commands to manage Azure Service Mesh egress gateway
• az aks nodepool add/update: Add parameter --localdns-config to config local dns profile for the nodepool
• az aks upgrade: Update user confirmation prompt of --control-plane-only parameter

App Service

• az appservice plan: Add features for managed instance app service plans
• az functionapp plan create: Add elastic premium as supported SKU for zone redundency

Batch

• [BREAKING CHANGE] az batch pool create: Remove deprecated argument --target-communication and --resource-tags
• [BREAKING CHANGE] az batch pool reset/set: Remove deprecated argument --target-communication

Cognitive Services

• az cognitiveservices account connection: Add AI Foundry account connection management
• az cognitiveservices account project: Add AI Foundry account project management
• az cognitiveservices account project connection: Add AI Foundry account project connection management
• az cognitiveservice agent: Add command group

Compute

• az vm/vmss create/update: Support --add-proxy-agent-extension parameter to specify whether to implicitly install the ProxyAgent Extension

Container app

• az containerapp env: Remove --min-replicas/max-replicas from premium ingress

DMS

• az dms project create: Change location parameter to be optional

NetAppFiles

• [BREAKING CHANGE] az netappfiles volume create/update: Remove deprecated argument --endpoint-type, this property is readOnly

Network

• az network application-gateway http-settings: Support dedicated backend connection and certificate validation
• az network application-gateway waf-policy managed-rule: Support Microsoft_HTTPDDoSRuleSet rule set
• az network application-gateway waf-policy: Remove option None for WAF rule sensitivity
• az network private-endpoint-connection: Add provider Microsoft.Security/privateLinks

Packaging

• Drop Python 3.9 support

RDBMS

• [BREAKING CHANGE] az postgres server/db/server-logs: Remove single server commands
• [BREAKING CHANGE] az postgres flexible-server create: Remove default value to --version and remove arguments --create-default-database and --database-name

Service Fabric

• [BREAKING CHANGE] az sf managed-application update: Remove argument options --service-type-policy, --upgrade-replica-set-check-timeout, --max-porcent-unhealthy-partitions, --max-porcent-unhealthy-replicas, --max-porcent-unhealthy-services, --max-porcent-unhealthy-apps to fix --help formatting
• [BREAKING CHANGE] az sf application update: Remove argument options --service-type-policy, --upgrade-replica-set-check-timeout, --instance-close-duration, --consider-warning-as-error, --max-percent-unhealthy-partitions. --max-percent-unhealthy-replicas, --max-percent-unhealthy-replicas, --max-percent-unhealthy-deployed-applications to fix --help formatting

Storage

• az storage account failover: Add Unplanned to --failover-type for Planned failover GA
• Fix #32399: az storage file list: Fix not showing additional info when listing files without set protocol

November 04, 2025

Version 2.79.0

ACR

• az acr create/update: Remove preview flag for --role-assignment-mode
• az acr check-health: Remove preview flag for --repository
• az acr task create/update: Remove preview flag for --source-acr-auth-id
• az acr build/run: Remove preview flag for --source-acr-auth-id
• az acr config content-trust: Add deprecation notice
• az acr config content-trust show/update: Add deprecation notice

AKS

• az aks update: Add support to remove existing certificates by setting the value of --custom-ca-trust-certificates to an empty file
• az aks create/update: Add --acns-advanced-networkpolicies parameter to support enabling advanced networking policies (None, L7 or FQDN)

ARM

• az resource list: Include provisioningState property in table output

Backup

• az backup vault deleted-vault: Implementing List and Undelete for Deleted Backup Vaults

Compute

• az vm availability-set update: Add new parameter --enable-all-instance-down to support setting scheduled events profile
• az vm availability-set update: Add new parameter --scheduled-events-api-version to support setting scheduled events profile

Container app

• az containerapp: Update Api-version to 2025-07-01
• az containerapp env http-route-config: Add command group to manage environment level http routing
• az containerapp env premium-ingress: Add command group to configure premium ingress settings for the environment
• Fix #32107: az containerapp registry show: Fix NoneType error when container app doesn't have any registry server

Core

• Resolve CVE-2025-9230
• Resolve CVE-2025-9232

HDInsight

• az hdinsight create: Support creating Entra-enabled clusters and creating clusters with WASB + MSI
• az hdinsight credentials update: Update cluster credentials
• az hdinsight credentials show: Show current cluster credentials

Network

• az network application-gateway create/update: Add parameter --enable-fips

SQL

• az sql db update: Prevent overwrite of SLO when updating from serverless to provisioned
• az db ltr-backup/ltr-policy: Remove preview tag for time-based immutability

Storage

• az storage account network-security-perimeter-configuration list/show/reconcile: Add support for network-security-perimeter
• az storage file list: Fix file list for nfs shares, as --include is not supported
• az storage account create/update: Add --enable-blob-geo-priority-replication to support Geo SLA
• az storage account or-policy create/update: Add --priority-replication to support OR SLA

October 14, 2025

Version 2.78.0

ACS

• az aks create: Pre-announce --no-ssh-key default behaviour breaking change

AKS

• az aks nodepool add/update: Add option AzureLinux3 to --os-sku parameter
• az aks create/update: Fix handling for --container-storage-version parameter
• az aks create: Fix the issue where enabling v1 container storage does not fail if the VM SKU field is left empty
• az aks get-credentials: Convert device code mode kubeconfig to Azure CLI token format to bypass conditional access login blocks

App Config

• az appconfig kv export: Escape keys only when exporting to properties file
• az appconfig kv set/import: Add support for JSON comments

App Service

• Fix #32044: az functionapp deployment source config-zip: Fix uploaded blob not containing content
• az functionapp create: Remove preview from Flex Consumption parameters
• az functionapp create: Add the --domain-name-scope support
• az webapp config appsettings set: Fix SyntaxWarning invalid decimal literal
• az appservice plan create/update: Add async scaling parameter --async-scaling-enabled
• az webapp deploy: Encode target path parameter
• az webapp deploy: Change the token retrieval function to use the App Service Audience
• az webapp create: Include regional site name availability check for DNL site creations

ARM

• az deployment: Fix bicep template size inflation with differential template handling
• Fix #31581: az deployment group create: Fix error message being hidden when template validation fails

Backup

• az backup protection reconfigure: Add new command to support reconfiguring backup to an alternate vault

Batch

• Fix #32086, #32090: az batch application package create: Fix blob not being uploaded

Cognitive Services

• az cognitiveservices account create: Add --allow-project-management argument
• az cognitiveservices account update: Add --kind argument for OpenAI<->AIServices account

Compute

• Fix #31198: az sig image-version: Fix --no-wait not working
• Fix #31929: az vm/vmss update: Fix --wire-server-profile-id and --imds-profile-id update
• az vm disk attach: Add new parameter --new-names-of-source-snapshots-or-disks to support setting the name of create new disk from a snapshot or another disk
• az vm disk attach: Add new parameter --new-names-of-source-disk-restore-point to support setting the name of create new disk from a disk restore point
• az vm availability-set: Add new command to support validating migration from availability sets to VMSS
• az vm availability-set: Add new command to support starting migration from availability sets to VMSS
• az vm availability-set: Add new command to support canceling migration from availability sets to VMSS
• az vm availability-set: Add new command to support converting availability sets to VMSS
• az vm: Add new command migrate-to-vmss to support migratiing VM to VMSS
• az disk create/update: Add new parameter --supported-security-option to support setting supported security option
• az disk create/update: Add new parameter --action-on-disk-delay to support setting disk availability policy

Key Vault

• az keyvault create: Support --network-acls-ips while creating Managed HSM
• az keyvault network-rule add/remove/list/wait: Support ip rule configuration for Managed HSM

MySQL

• az mysql flexible-server create/update: Support Accelerated Logs for GeneralPurpose

NetAppFiles

• az netappfiles volume splitclonefromparent: Add new command to split clone volume from parent volume
• az netappfiles volume create: Add parameter --grow-pool-clone-split
• az netappfiles pool create: Add new Enum value Flexible for ServiceLevel
• az netappfiles volume create: Add new Enum value Flexible for ServiceLevel
• az netappfiles pool create: Add parameter --custom-throughput-mibps

Network

• az network nat gateway create: Support --sku to accept standardv2
• az network public-ip create: Support --sku to accept standardv2
• az network vnet-gateway create: Remove public IP requirement in gateway creation

SQL

• az sql server create: Add --tags parameter to supply tags
• az sql db ltr-backup: Add new commands for LTR immutability support

Storage

• az storage account or-policy create/update: Add --enable-metrics to support object replication metrics
• Fix #32048: az storage blob sync: Fix using azcopy with account-key without login into azcli
• az storage account create/update: Support --enable-smb-oauth to allow managed identities to access SMB shares using OAuth
• az storage sku list: Support listing storage skus
• az storage file symoblic-link create/show: Support NFS fileshare symbolic link
• az storage account create/update: Add --zones and --zone-placement-policy to support setting zones and availability zone pinning policy

September 02, 2025

Version 2.77.0

ACR

• az acr task create: Fix error message when --context is not provided

AKS

• az aks create: Change description for --os-sku parameter
• az aks create/update: Support installing latest version of acstor on the cx cluster by --enable-azure-container-storage parameter
• az aks create/update: Support specifying installation version of acstor by --container-storage-version when setting --enable-azure-container-storage
• az aks update: Support uninstalling acstor from the cx cluster by --disable-azure-container-storage regardless of the installed version
• az aks create/update: Add --sku parameter to support automatic feature
• az aks update: Fix typo on validation error for disabling Azure Container Storage

App Config

• az appconfig kv import: Support importing key-values from AKS ConfigMap

App Service

• az webapp deploy: Add --enable-kudu-warmup parameter to support warm-up Kudu before making deployment
• az functionapp flex-migration: Add commands to support migrating CV1 apps to Flex

ARM

• az ts: Capture subscription id from template resource id

Backup

• az backup restore restore-azurefileshare: Fix a bug where the source storage account is deleted and the required sourceResourceId property is missing from the restore request payload

Compute

• Fix #31885: az vm encryption: Fix request body serialization
• az disk create/grant-access: Support Confidential VM OS Disks
• az snapshot create: Add new parameter --instant-access-duration-minutes to support creating instant access snapshot for premium SSD v2 and ultra disk

Container app

• Fix #31762: az containerapp job list: Fix bug only 20 items are returned
• az containerapp job update: Fix --min-executions and --max-executions not accepting 0 values

Core

• Resolve CVE-2025-4517
• Add global policy arguments --acquire-policy-token and --change-reference to support Change Safety feature

IoT

• az iot hub devicestream: Mirgate this command group to azure-iot extension

MySQL

• az mysql flexible-server upgrade: Add new option 8.4 for --version

Network

• az network nat gateway: Support Standard V2 SKU and Public IP (Prefixes) V6
• az network public-ip: Support Standard V2 SKU
• az network public-ip prefix: Support Standard V2 SKU
• az network vnet show/list: Support defaultPublicNatGateway output for StandardV2 NAT Gateway
• Fix #31954: az network application-gateway waf-policy custom-rule: Deserialization errors within computedDisabledRules
• az network vnet-gateway: Support VNET Gateway insights
• az network vnet-gateway: Support VNET Gateway failover

Packaging

• Support Python 3.13
• Bump embedded Python to 3.13.7

Profile

• az account get-access-token: Specifying --tenant with the current tenant is now allowed for Cloud Shell and managed identity account
• az login: Support --claims-challenge in device code flow

RDBMS

• az postgres flexible-server create/update/restore: Premium SSD V2 is no longer supported with Burstable compute tier
• az postgres flexible-server update: Bypass fabric mirroring validation to allow updating high availability status for PG11 and PG12 servers

Service Fabric

• az sf managed-application update: Add breaking change pre-announcement warnings for argument option removal
• az sf managed-application-type version update: Add breaking change pre-announcement warnings for required argument --package-url
• Fix #5338: az sf cluster create: Fix the bug where key-vault not placed in location specifed by --location
• Fix #5180: az sf cluster create: Change behavior to read cluster_name from parameters file if provided

August 05, 2025

Version 2.76.0

ACR

• Fix #31572: az acr check-health: Fix crashes when the registry is not found
• az acr create: Fix domain name label suffix validation

AKS

• az aks machine show/list: Add zones to table output
• az aks: Support Virtual Machines node pools in AKS commands
• az aks update: Support VMAS to VMS agent pool migration in AKS commands
• az aks create/update: Add new parameter --enable-ai-toolchain-operator to enable Kaito addon
• az aks create/update: Add --node-provisioning-mode and --node-provisioning-default-pools parameters
• az aks safeguards: Add command group to manage deployment safeguards
• az aks create: Support the Azure Monitor metrics and logs addon functionality
• az aks create: Add new parameter --disable-run-command to disable run command feature for the cluster
• az aks update: Add new parameters --disable-run-command and --enable-run-command to toggle the run command feature on or off
• az aks update: Support updating load balancer sku from basic to standard

App Config

• az appconfig create/update: Add support for setting key value revision retention period
• az appconfig feature list/delete/set: Support filtering by tags

App Service

• az webapp create: Add --domain-name-scope parameter to support DNL scopes during site creation
• az webapp sitecontainers convert: Add a command to switch between sitecontainers and classic

ARM

• az group export: Add --export-format to specify the format of the exported template
• Fix #31709: az deployment: Fix the content for this response was already consumed error when create resource
• az deployment create/validate/what-if: Expose --validation-level parameter at all scopes

Backup

• az backup restore restore-disks: Add new parameter --cvm-os-des-id to specify the Disk Encryption Set ID to use for OS disk encryption

Cloud

• Change active_directory_graph_resource_id endpoint of AZURE_US_GOV_CLOUD to https://graph.microsoftazure.us/

Compute

• az sig in-vm-access-control-profile: Add command group to manage in VM access control profile
• az sig in-vm-access-control-profile-version: Add command group to manage in VM access control profile version
• az vm disk attach: Add new parameters --source-snapshots-or-disks --source-disk-restore-point to support implicit disk creation from snapshot and disk restore points
• az vmss create: Add new parameter --enable-automatic-repairs to support setting automatic repairs policy
• Fix #31685: az vm/vmss update: Fix error with NoneType object has no attribute mode when update wireserver profile
• az vm disk attach: Add support for setting disk size and sku of implicit disk creation from snapshot and disk restore points
• az compute-recommender spot-placement-score: Add new command to replace original command az compute-recommender spot-placement-recommender

Container

• az container create: Remove default values for container group to support standby pool reuse scenario

Core

• Resolve CVE-2024-47081
• Provide actionable error recommendation when a command fails because of Multi-Factor Authentication (MFA) policy violation

Cosmos DB

• az cosmosdb restore: Remove restore validations which would cause timeouts for large restore and incorrect error messages

DMS

• az dms project create: Add breaking change warning

Eventhub

• az eventhubs namespace: Add nsp-configuration show and nsp-configuration list

MySQL

• az mysql flexible-server create/update: Update --storage-redundancy parameter and add --backup-interval

Network

• az network application-gateway waf-policy: Support computedDisabledRules read-only property
• az network application-gateway waf-policy custom-rule create: Support GeoLocationXffHeader, ClientAddrXffHeader for groupByVariables
• Fix #31727: az network private-link-service create: Support multiple IP configurations

Packaging

• Support RHEL 10 and CentOS Stream 10

Profile

• az login: Add --claims-challenge argument to support interactive authentication with claims challenge

RDBMS

• az postgres flexible-server replica create/promote: Enable replica operations for elastic cluster operations
• az postgresql flexible-server create: Handle failed IP address check

Service Fabric

• az sf managed-cluster network-security-rule: Add new parameter --source-addr-prefix to specify the CIDR or source IP range
• az sf managed-cluster network-security-rule: Add new parameter --dest-addr-prefix to specify the destination port or range
• az sf managed-cluster network-security-rule: Add new parameter --source-port-range to specify the CIDR or source IP range
• az sf managed-cluster network-security-rule: Add new parameter --dest-port-range to specify the destination address prefix
• az sf cluster create: Add more options for parameter --vm-os
• az sf managed-node-type update: Add parameters --vm-size and --tags

SQL

• az sql ltr-policy set: Remove ltr backup policy unused parameter --access-tier
• az sql failover-group create: Add support for multiple partner failover groups

July 01, 2025

Version 2.75.0

ACR

• az acr connected-registry create: Fix for enabling dedicated endpoint on container registry resource when user confirms during creation
• az acr login: Fix login status code when command fails

AKS

• az aks create: Simplify logic and enable correct recording rule groups for managed prom
• az aks: Allow LongRunningOperation to show poller status
• az aks update: Add option --assignee-principal-type to specify the principal type when using --attach-acr
• az aks create: Add --enable-static-egress-gateway parameter to support static egress gateway feature
• az aks update: Add --enable-static-egress-gateway parameter to support static egress gateway feature
• az aks nodepool add: Add option Gateway to --mode parameter and --gateway-prefix-size parameter to support static egress gateway feature
• az aks create: Add --pod-ip-allocation-mode parameter to support Azure CNI Static Block Allocation
• az aks nodepool add: Add --pod-ip-allocation-mode parameter to support Azure CNI Static Block Allocation

App Config

• az appconfig kv export/import/list/delete: Support filtering by tags
• az appconfig restore: Support filtering by tags
• az appconfig revision list: Support filtering by tags
• az appconfig kv import/export/restore: Add new parameter --dry-run to support dry-run feature

ARM

• az deployment what-if: Show potential changes in pretty-printed what-if result
• az deployment what-if: Display warnings and diagnostic messages in pretty-printed what-if result

ARO

• az aro update: Fix credential refresh to handle clusters with invalid machinesets

Cloud

• az cloud register/update: Add --endpoint-microsoft-graph-resource-id to support configuring Microsoft Graph endpoint
• az cloud register/update: Add --skip-endpoint-discovery to allow skipping cloud endpoints' auto discovery

Compute

• [BREAKING CHANGE] az vmss create/update: Remove too long argument option --scheduled-event-additional-publishing-target-event-grid-and-resource-graph to fix help message issue

Consumption

• az consumption usage list: Fix usage list returns data with replace None string to null value

Container app

• az containerapp update: Modify --yaml template handling to fix runningStatus error
• Fix #31480: az containerapp revision copy: Only return containerapp does not exist when got 404

Core

• Resolve CVE-2025-50181
• Resolve CVE-2025-50182

Identity

• Fix #31598: Fix regression in az identity federated-credential create by defaulting audience

Key Vault

• az keyvault secret download: Add --overwrite flag

Network

• az network nat gateway: Support Standard V2 SKU
• az network public-ip: Support Standard V2 SKU
• az network public-ip prefix: Support Standard V2 SKU
• az network application-gateway waf-policy managed-rule exception: Support exception feature in application gateway
• az network vnet subnet create/update: Support IPAM pool allocation

Packaging

• Drop Azure Linux (Mariner) 2.0 support

RDBMS

• az postgres flexible-server create: Extend EOL to PG 11 and 12

Service Fabric

• Fix #18358: az sf client-certificate add: Fix the bug that command fails with remove not defined

SQL

• az sql db replica create: Add partner subscription id for cross-subscription GeoDr

Storage

• az storage account create/update: Add --sas-expiration-action to sas policy
• az storage file upload-batch/download-batch: Add OAuth login support

June 03, 2025

Version 2.74.0

ACR

• az acr login: Add refreshToken and username fields to the output after using --expose-token parameter
• az acr create: Fix logs for domain name label
• az acr connected-registry: Remove private preview message

AKS

• az aks nodepool add/update/upgrade: Add new parameter --undrainable-node-behavior to specify whether nodes can be cordoned during upgrade
• az aks create/enable-addons: Remove preview flag for --enable-high-log-scale-mode parameter
• az aks nodepool add/update/upgrade: Add --max-unavailable to specify he maximum number or percentage of nodes that can be simultaneously unavailable during upgrade

App Config

• Fix #30619: az appconfig feature set: Fix invalid value for --requirement-type
• Fix #30619: az appconfig kv import: Fix invalid value for --requirement-type

App Service

• az appservice plan create: Update the description of --zone-redundant parameter
• az webapp config set: Remove number of workers validation

ARM

• az policy: Add breaking change pre-announcement

Backup

• az backup container/item/policy/protection: Add support for ASE backup operations
• az backup: Add support for HANA Snapshot

Compute

• az vm/vmss create: Add warning log for changing the default value of VM size

Core

• Resolve CVE-2024-13176
• Resolve CVE-2024-9143

Cosmos DB

• az cosmosdb sql container: Add Full Text Policy support

Identity

• az identity federated-credential create/update: Add support for claims matching expressions

Monitor

• az monitor action-group: Support --incident-receivers, --mi-user-assigned and --mi-system-assigned(#31205)

MySQL

• az mysql flexible-server create: Change default storage redundancy for BC SKU to local redundancy

NetAppFiles

• az netappfiles volume-group create: Add support for Oracle in ANF Volume Groups

Network

• az network vnet-gateway create: Add --enable-high-bandwith-vpn-gateway parameter
• az network vpn-connection show: Support new properties output with virtual network gateway
• az network vnet-gateway migration: Support vpn gateway migration feature
• az network private-endpoint-connection: Add provider Microsoft.FluidRelay/fluidRelayServers
• az network network-watcher packet-capture: Support for packet capture includes a ring buffer
• az network private-endpoint-connection: Add provider Microsoft.VideoIndexer/accounts

RDBMS

• az postgres flexible-server create/db: Fix for --database-name validation

May 20, 2025

Version 2.73.0

ACR

• az acr connected-registry create/update: Add new parameter --gc-enabled which enables or disables garbage collection on a connected registry
• az acr connected-registry create/update: Add new parameter --gc-schedule which uses cron expression to set a collection interval
• az acr create/update: Add a new optional parameter --role-assignment-mode to specify the role assignment mode for new or existing registries. This parameter allows customers to enable or disable Attribute-Based Access Control (ABAC)
• az acr check-health: Add a new optional parameter --repository to check read, write, and delete permissions for a specific repository
• az acr task create/update: Add a new optional parameter --source-acr-auth-id to specify the managed identity used for authentication with the source registry
• az acr build: Add a new optional parameter --source-acr-auth-id to specify the identity used for authentication with the source registry
• az acr run: Add a new optional parameter --source-acr-auth-id to specify the identity used for authentication with the source registry
• az acr create: Remove preview flag from --allow-trusted-services

AKS

• [BREAKING CHANGE] az aks create: Change default value of option --node-vm-size to ""
• [BREAKING CHANGE] az aks nodepool add: Change default value of option --node-vm-size to ""
• az aks create/update: Add support for apiserver vnet integration feature
• az aks create/approuting: Add default NIC config for app routing
• Fix #31265: az aks enable-addons: Fix UnboundLocalError when setting specific dataCollectionSettings

App Service

• [BREAKING CHANGE] az appservcie ase create/update/delete: Remove support for ASEv2
• az webapp list-runtimes: Update API response filter logic
• az functionapp plan update: Add zone redundant update support for Flex

Backup

• [BREAKING CHANGE] az backup protection enable-for-vm: Support for protecting TVM with standard policy

Cloud

• [BREAKING CHANGE] az cloud register/update: No gallery endpoint returned if use endpoint discovery with --endpoint-resource-manager
• az cloud register/update: Support data plane endpoints auto discovery with --endpoint-resource-manager

Compute

• [BREAKING CHANGE] az sig image-definition list-community/list-shared: Replace pagination parameters with new parameters --max-items and --next-token
• [BREAKING CHANGE] az sig image-version list-community/list-shared: Replace pagination parameters with new parameters --max-items and --next-token
• az vm/vmss create: Fix missing auxiliary tokens
• az vmss create/update: Add new parameter --enable-automatic-zone-balancing to support setting automatic zone rebalancing policy
• az vmss create/update: Add new parameter --automatic-zone-balancing-strategy to support setting automatic zone rebalancing policy
• az vmss create/update: Add new parameter --automatic-zone-balancing-behavior to support setting automatic zone rebalancing policy
• az vmss create/update: Add new parameter --skuprofile-rank to specify a list of ranks to use with VMSS instance mix SKU profile VM sizes

Core

• [BREAKING CHANGE] Remove Azure Stack profiles 2020-09-01-hybrid, 2019-03-01-hybrid, 2018-03-01-hybrid and 2017-03-09-profile
• Use MSAL for managed identity authentication

DMS

• az dms project task create: Add ability to use a lockless option for ensuring data consistency

Key Vault

• az keyvault key get-attestation: Support getting a MHSM key's attestation

Monitor

• az monitor log-analytics workspace failover/failback: Add new commands for supporting activating and deactivating workspace failover

NetAppFiles

• az volume-group create: Parameter --proximity-placement-group is no longer required
• az netappfiles account create: Add new parameter --federated-client-id for Cross Tennant CMK
• az netappfiles account create: Add new parameter --nfs-v4-id-domain. Domain for NFSv4 user ID mapping
• az netappfiles account update: Add new parameter --federated-client-id for Cross Tennant CMK
• az netappfiles account update: Add new parameter --nfs-v4-id-domain. Domain for NFSv4 user ID mapping
• az netappfiles usage list: Add new command to list current subscription usages
• az netappfiles usage show: Add new command to show current subscription usages

Network

• Fix #31294: az network vnet update: Refine processing logic of --address-prefixes

Packaging

• Bump Python to 3.12 on RHEL and CentOS Stream
• [BREAKING CHANGE] Drop Ubuntu 20.04 support

Profile

• [BREAKING CHANGE] az login: --username no longer accepts user-assigned managed identity ID. Explicitly specify --client-id, --object-id or --resource-id instead

RDBMS

• [BREAKING CHANGE] az postgres flexible-server create: Set the default value of parameter --create-default-database to Disabled
• [BREAKING CHANGE] az postgres flexible-server create: Set default PG version to 17 on create
• [BREAKING CHANGE] az postgres flexible-server stop-replication: Remove deprecated command, use az postgres flexible-server replica promote instead
• [BREAKING CHANGE] az postgres flexible-server create/upgrade: Remove support of PG12 which has officially ended
• [BREAKING CHANGE] az postgres flexible-server create/update/ad-admin: Rename deprecated references to Microsoft Entra
• [BREAKING CHANGE] az postgres flexible-server create: Set the default value of parameter --create-default-database to Disabled
• [BREAKING CHANGE] az postgres flexible-server create: Set default PG version to 17 on creation
• [BREAKING CHANGE] az postgres flexible-server update: Add user confirmation on certain update operations
• az postgres flexible-server create: BUG FIX, Set public access network to disabled if None argument is passed in
• az postgres flexible-server create/db create: Add validation for database name
• az postgres flexible-server create: Set default sku to be coming from location capability API

Role

• az role assignment list: Drop --include-classic-administrators argument

Service Connector

• az webapp connection create mongodb-atlas: Add mongodb-atlas target service support

Storage

• [BREAKING CHANGE] az storage account migration start: Add confirmation for storage account migration between redundancy options

May 06, 2025

Version 2.72.0

ACR

• Fix #31130: az acr task show: Fix extra version line in encodedTask created by file
• az acr create/check-name: Add parameter --dnl-scope for domain name label hash

AKS

• az aks update: Make specified version to match current version when turning off autoupgrade
• az aks nodepool add/update: Add option Ubuntu2204 to --os-sku parameter
• az aks create: Add --custom-ca-trust-certificates parameter to support custom CA trust feature
• az aks nodepool add: Add --custom-ca-trust-certificates parameter to support custom CA trust feature
• az aks nodepool add: Add GPU driver install options --gpu-driver install and --gpu-driver none

App Config

• az appconfig create/update: Add developer sku support
• az appconfig feature set: Update feature name documentation

App Service

• Fix #20983: az webapp config ssl import: Make web app a non-required parameter
• az appservice plan create: Add Pv4/Pmv4 ASP support
• Fix #20209: az webapp create-remote-connection: Add ssh command to output

ARM

• az deployment: Fix issue where Bicep is not found in CI environments
• Fix #31188: az lock delete: Fix the case sensitivity of --namespace parameter validation

ARO

• az aro update: Ensure that refreshing cluster service principal credentials is successful when the cluster has an invalid or missing subnet in its resource definition

Compute

• [BREAKING CHANGE] az sig image-version: Change the --os-vhd-storage-account parameter mapping to the properties.storageProfile.osDiskImage.source.storageAccountId property
• [BREAKING CHANGE] az sig image-version: Change the --data-vhds-storage-accounts parameter mapping to the properties.storageProfile.dataDiskImages.source.storageAccountId property
• az vm create: Add new parameter --zone-placement-policy to support setting vm placement to create a zonal VM
• az vm create: Add new parameter --include-zones to support setting vm placement to create a zonal VM
• az vm create: Add new parameter --exclude-zones to support setting vm placement to create a zonal VM
• az vm create/update: Add new parameter --align-regional-disks-to-vm-zone to support setting regional disks attached to the VM to be converted to zonal
• az sig image-version create/update: Rename shorter alias for --block-deletion-before-end-of-life parameter
• az vm create/update: Add new parameters --wire-server-mode and --wire-server-access-control-profile-reference-id to support setting wireserver endpoint settings
• az vmss create/update: Add new parameters --wire-server-mode and --wire-server-access-control-profile-reference-id to support setting wireserver endpoint settings
• az vm create/update: Add new parameters --imds-mode and --imds-access-control-profile-reference-id to support setting IMDS endpoint settings
• az vmss create/update: Add new parameters --imds-mode and --imds-access-control-profile-reference-id to support setting IMDS endpoint settings
• az vm create/update: Add new parameter --key-incarnation-id to support setting key incarnation id
• az vmss create/update: Add new parameter --key-incarnation-id to support setting key incarnation id
• az vm/vmss create/update: Set --security-type to Standard only if explicitly set by end user

Consumption

• az consumption usage list: Enhance handling of usageStart and usageEnd when missing

Microsoft Entra ID

• az ad sp create-for-rbac: Add --service-management-reference argument
• az ad sp create-for-rbac: Add --create-password argument. Use --create-password false to disable creating password credential

MySQL

• az mysql flexible-server create: Add --backup-interval parameter to enable setting backup interval
• az mysql flexible-server restore: Add --faster-restore parameter to open auto-iops-scaling when restore
• az mysql flexible-server replica create: Add --faster-provisioning parameter to open auto-iops-scaling when create replica

Network

• Fix #31129: az network vnet-gateway create/update: Refine the logic of --root-cert-data
• az network application-gateway waf-policy managed-rule rule-set: Support rule set type Microsoft_DefaultRuleSet

Profile

• Fix #29030: az login: During interactive login, fall back to tenantId if tenantDisplayName is missing

RDBMS

• az postgres flexible-server upgrade: Add server capability API check to the --version parameter and allow user to upgrade to PG17 when it is available

Role

• az role assignment list: Add --fill-principal-name argument. Use --fill-principal-name false to omit principalName property and bypass Microsoft Graph query
• az role assignment list: Add --fill-role-definition-name argument. Use --fill-role-definition-name false to omit roleDefinitionName property and bypass the role definitions query
• az role assignment list/delete: Add --assignee-object-id argument. Use this argument instead of --assignee to bypass Microsoft Graph query

Service Connector

• az webapp connection create: Clarify that system identity is a flag

April 01, 2025

Version 2.71.0

ACR

• az acr create: Fix a bug where creating cache rule without credential set would fail

AKS

• az aks: Fix error message when outbound type validation failed
• az aks create/update: Update recording rule group create logic for managed prometheus addon
• az aks create/update: Add --bootstrap-artifact-source parameter to configure artifact source when bootstraping the cluster
• az aks create/update: Add --bootstrap-container-registry-resource-id parameter to configure container registry resource ID
• az aks create/update: Add new option none for --outbound-type parameter

App Config

• az appconfig: Fix managed identity auth for --auth-mode login parameter

App Service

• az webapp deploy: Add --enable-kudu-warmup parameter to support warm-up Kudu before making deployment
• Fix #27724: az webapp config appsettings set: Remove redaction warning message from output
• Fix #26920: az webapp deployment slot create: Make the created new slot has same VNet integration settings of source slot as Portal behavior
• Fix #30908: az webapp snapshot restore: Fix the error "no resource group found" when trying to restore a snapshot backup to a paired region
• Fix #29512: az webapp config backup update: Fix str object has no attribute name
• Fix #21721: az webapp config storage-account add: Add validation for non-existent FileShare
• az functionapp list-flexconsumption-locations: Add --details and --runtime parameters to provide more details

ARM

• Fix #29809: az deployment/stack/bicep: Fix an issue where the commands mistakenly check for the latest Bicep version, even when use_binary_from_path is true and check_version is false
• Fix #29435: az bicep install/upgrade: Fix an issue where the command downloads the x64 binary instead of the ARM binary on aarch64 machines

ARO

• az aro create: Update VM SKU to align with best practices

Backup

• az backup protection enable-for-vm: Update in warning message while protecting Trusted Launch virtual machines

Cloud

• az cloud register/update: Add upcoming breaking change announcement

Compute

• az sig image-definition list-shared: Mark --marker and --show-next-marker as deprecated and will be removed in the upcoming breaking change window
• az sig image-version list-shared: Mark --marker and --show-next-marker as deprecated and will be removed in the upcoming breaking change window
• az sig image-definition list-community: Mark --marker and --show-next-marker as deprecated and will be removed in the upcoming breaking change window
• az sig image-version list-community: Mark --marker and --show-next-marker as deprecated and will be removed in the upcoming breaking change window
• az disk config update: Add new command to support updating disk size gb by PATCH method
• az vm/vmss create/update: Add support for setting security type to Standard
• Fix #30976: az sig image-version create: Fix missing auxiliary tokens
• az sig image-version create/update: Add new parameter --block-deletion-before-end-of-life to support blocking deletion if the end of life has not expired
• az vm list-sizes: Mark the command as deprecated

Container app

• Fix #30828: az containerapp job stop: Fix TypeError when --job-execution-name is not specified

Core

• PREVIEW: Support managed identity authentication with MSAL. Run az config set core.use_msal_managed_identity=true or set environment variable AZURE_CORE_USE_MSAL_MANAGED_IDENTITY=true to enable it

Key Vault

• az keyvault create: Support C SKU family for MHSM creation

MySQL

• [BREAKING CHANGE] az mysql flexible-server create: Change default values for --auto-scale-iops, --version for MySQL

Network

• az network virtual-appliance: Add command get-boot-diagnostic-log to support getting boot diagnostic logs
• Fix #31003: az network vpn-connection create: Pass auxiliary authorization header for referenced resource IDs
• az network vnet-gateway create: Add --enable-high-bandwith-vpn-gateway parameter
• az network vpn-connection show: Support new properties with virtual network gateway

Profile

• az login: Add upcoming breaking change announcement for --username

RDBMS

• az postgres flexible-server update: Fix bug for not updating geo backup data encryption properties
• az postgres flexible-server fabric-mirroring: Fix for space separated list of databases during start and update-databases
• az postgres flexible-server create: Support adding admin during creation if --active-directory-auth is Enabled and no longer generate password when --password-auth is Disabled

Role

• az role assignment list: Add upcoming breaking change announcement for --include-classic-administrators
• az role assignment list: Include role assignments inherited from management groups

Service Connector

• az * connection create neon-postgres: Add command for Neon Postgres Serverless

Storage

• az storage share/directory/file: Support NFS FileShares
• az storage file hard-link create: Support creating hard-links for NFS files
• az storage share create: Support --enable-snapshot-virtual-directory-access

March 04, 2025

Version 2.70.0

AKS

• az aks create/az aks nodepool add: Emit error message when using --asg-ids alone without --allowed-host-ports
• az aks nodepool upgrade: Fix --node-soak-duration cannot be set to 0
• az aks machine list: Add command to fetch list of machines in an agentpool
• az aks machine show: Add command to fetch information about a specific machine in an agentpool
• az aks nodepool delete: Add --ignore-pod-disruption-budget option for ignoring PodDisruptionBudget
• az aks create: Add --message-of-the-day parameter to support message of the day
• az aks nodepool add: Add --message-of-the-day parameter to support message of the day

App Config

• az appconfig kv import/export: Fix bug when importing feature flag with percentile allocation property
• az appconfig: Add support for custom token audience to --auth-mode login parameter

App Service

• az functionapp create: Check if storage account is network restricted
• az functionapp create: Refactor EOL message
• Fix #28104: az webapp config storage-account: Remove windows limitation notes
• Fix #28374: az webapp create: Improve error message for globally unique name for new app create
• az webapp sitecontainers: Add new commands for linux web app sitecontainers
• az webapp up: Add --enable-kudu-warmup parameter to support warm-up Kudu before making deployment
• az webapp deploy: Add --enable-kudu-warmup parameter to support warm-up Kudu before making deployment
• az webapp deployment source config-zip: Add --enable-kudu-warmup parameter to support warm-up Kudu before making deployment
• Fix #29493: az webapp create: Update basic-auth parameter description

ARM

• az bicep: Fix installation check for concurrent usages

Backup

• az backup restore restore-disks: Support NoZone as a valid target zone for --target-zone parameter

Compute

• az vm available-set create/update: Add --additional-scheduled-events parameter to support setting scheduled event policy
• az vm available-set create/update: Add --enable-user-reboot-scheduled-events parameter to support setting scheduled event policy
• az vm available-set create/update: Add --enable-user-redeploy-scheduled-events parameter to support setting scheduled event policy

Container app

• az containerapp create: Fix to make --registry-username value to be DNS1123 compliant

Core

• Resolve CVE-2024-12797
• Drop Track 1 SDK authentication
• aaz: Add cross tenants control for AAZResourceIdArgFormat
• aaz: Support Any type with full value shorthand syntax allowed

Cosmos DB

• az cosmosdb offline-region: Add new command to support offline region for cosmosdb account

IoT

• az iot hub update: Add --min-tls-version parameter to allow updating min tls version in a cleaner way

NetAppFiles

• az netappfiles account: Add new command change-key-vault to change KeyVault/Managed HSM that is used for encryption of volumes under NetApp account
• az netappfiles account: Add new command get-key-vault-status to get KeyVault information. Response from this command can be used for transitiontocmk
• az netappfiles account: Add new command transitiontocmk to transition all volumes in a VNet to a different encryption key source (Microsoft-managed key or Azure Key Vault). Operation fails if targeted volumes share encryption sibling set with volumes from another account
• az netappfiles volume create/update: Add parameter --cool-access-tiering-policy

Network

• az network nic ip-config create/update: Add --private-ip-address-prefix-length to support setting private ip address prefix length

RDBMS

• az postgres flexible-server index-tuning: Support tuning options operations

Service Connector

• az containerapp connection create redis: Add --system-identity paramter
• az webapp connection create fabric-sql: Fix interactive mode & allow new parameters --fabric-workspace-uuid and fabric-sql-db-uuid

Storage

• az storage account create: Add new --sku StandardV2_LRS/StandardV2_ZRS/StandardV2_ZRS/StandardV2_ZRS/PremiumV2_LRS/PremiumV2_ZRS for provisioned v2 support
• az storage account file-service-usage: Support getting file-service usage for storage account
• az storage share-rm create/update: Add --paid-bursting-enabled, --paid-bursting-max-bandwidth-mibps, --paid-bursting-max-iops for provisioned v1, add --provisioned-bandwidth-mibps, --provisioned-iops for provisioned v2 accounts

February 11, 2025

Version 2.69.0

ACR

• az acr manifest list-metadata: Update help messages for untagged manifests

AKS

• az aks create/update/delete: Add parameters --if-match and --if-none-match to support etag functionality for concurrency

App Config

• az appconfig kv import/export: Support microsoft feature management schema
• az appconfig kv export: Introduce a new environment variable called AZURE_APPCONFIG_FM_COMPATIBILE when exporting to a file for backward compatibility for users
• az appconfig feature show/list: Support microsoft feature management schema
• az appconfig kv restore/show/list: Update datetime validation to accept timezone offset
• az appconfig revision list: Update datetime validation to accept timezone offset
• az appconfig export: Update export help message for environment variable

App Service

• az functionapp create: Refactor EOL implementation and sort based on runtime EOL date
• az functionapp list-flexconsumption-locations: Check if flex region is enabled for subscription
• az functionapp deployment slot create: Add --https-only parameter for slot creation command
• az webapp list-runtimes: Remove the JBoss _byol entries from the output for webapps with Linux OS

Backup

• az backup: Add support for new AFS Vault Standard Policies

Batch

• [BREAKING CHANGE] az batch certificate create/list/show/delete: Remove deprecated commands
• [BREAKING CHANGE] az batch node reimage/remote-desktop: Remove deprecated commands
• [BREAKING CHANGE] az batch pool create: Remove --application-licenses, --certificate-references , --os-family and --os-version deprecated parameters
• [BREAKING CHANGE] az batch pool set/reset : Remove --certificate-references deprecated parameter
• az batch job create: Add parameters --job-manager-task-application-package-references and --on-all-tasks-complete
• az batch job disable: Add parameter --json-file
• az batch job-schedule create: Add parameters --job-manager-task-application-package-references, --job-metadata, and --job-manager-task-environment-settings
• az batch job-schedule set/reset: Add parameters --job-max-task-retry-count and --job-max-wall-clock-time
• az batch node reboot: Add parameter --json-file
• az batch node scheduling disable: Add parameter --json-file
• az batch pool autoscale evaluate: Add parameter --json-file
• az batch pool create: Add parameters --start-task-environment-settings and --start-task-max-task-retry-count
• az batch pool reset: Add parameters --start-task-resource-files and --target-node-communication-mode

Compute

• [BREAKING CHANGE] az sig gallery-application create/update: Output field supportedOsType changed to supportedOSType
• az vm list-sizes: Remove unused parameter --ids
• az vmss create/update: Add new paramter --zone-balance to support setting zone balance
• az vm/vmss create: Install guest attestation extension when security type set to ConfidentialVM
• az vmss scale: Add new logic to support scaling VMSS in edge zone
• az vmss create: Add --encryption-identity parameter to use managed identity for Azure disk encryption
• az vmss encryption enable: Add --encryption-identity parameter to update or set encryption identity for Azure disk encryption

Container app

• Fix #28047: az containerapp compose create: Upgrade pycomposefile version to split environment variables on the first equal sign instead of every equal sign

DevTest Labs

• az lab vm: Add hibernate command group

Key Vault

• az keyvault update/update-hsm: Fix --bypass overriding by default when specifying --default-action Deny

Network

• az network lb create: Refine --frontend-ip-zone to support multiple zones
• az network private-endpoint-connnection: Add Microsoft.HealthDataAiservices/deidservices for private endpoint connections
• az network routeserver create/update: Add --auto-scale-config
• az network virtual-appliance reimage: Allow reimage of virtual machines associated with a network virtual appliance

Profile

• az login: Passing the managed identity ID with --username is deprecated and will be removed in a future release. Please use --client-id, --object-id or --resource-id instead

RDBMS

• az postgres flexible-server geo-restore: Add --restore-time parameter
• az postgres flexible-server fabric-mirroring start/stop/update-databases: Disable fabric mirroring on HA server
• az postgres flexible-server update: Fix for scaling up node count on an elastic cluster

Redis

• az redis create/update: Add --zonal-allocation-policy to support the way of selecting zones for cache instance

Role

• az role definition show: New command to support showing specific role definition

Service Connector

• az webapp connection create redis: Add parameter --system-identity

January 14, 2025

Version 2.68.0

ACR

• az acr agentpool: Fix delete polling
• az acr create: Add validation for registry name to support domain name label

AKS

• az aks command invoke: Add progress spinner
• az aks create/update: Add --enable-acns parameter to support enabling advanced networking functionalities on a cluster
• az aks create/update: Add --disable-acns-observability parameter to disable advanced networking observability features when enabling advanced networking features with --enable-acns
• az aks create/update: Add --disable-acns-security parameter to disable advanced networking security features when enabling advanced networking features with --enable-acns
• az aks update: Add --disable-acns parameter to support disabling advanced networking functionalities on a cluster
• az aks update: Add --ip-families to support updating cluster network
• az aks create/update: Add --nrg-lockdown-restriction-level parameter to support specifying restriction level on the managed node resource group

App Config

• az appconfig kv import: Fix import mode all bug

Compute

• [BREAKING CHANGE] az disk: Refine output fields to align with backend service
• [BREAKING CHANGE] az snapshot: Refine output fields to align with backend service
• Fix #30009: az vm install-patches: Fix errors due to typos in install_vm_patches function
• az vm/vmss create: Fix help message for --public-ip-address parameter
• Fix #30565: az vm create: Fix creating VM with --patch-mode parameter
• Fix #30564: az vm create: Fix creating VM with --enable-auto-update parameter
• az vm create: Add --encryption-identity parameter to use that managed identity for Azure disk encryption
• az vm encryption enable: Add --encryption-identity parameter to update or set encryption identity for Azure disk encryption
• az vmss create/update: Add new parameter --security-posture-reference-is-overridable to support setting security posture reference overridable
• az vmss create/update: Change existing parameter --security-posture-reference-exclude-extensions to receive string list
• az vm create/update: Add new parameter --additional-scheduled-events to support setting scheduled event policy
• az vm create/update: Add new parameter --enable-user-reboot-scheduled-events to support setting scheduled event policy
• az vm create/update: Add new parameter --enable-user-redeploy-scheduled-events to support setting scheduled event policy

Container

• az container exec: Fix exception when stdin is not a tty

Container app

• az containerapp exec: Fix ResourceNotFound error
• az containerapp ingress enable: Fix issue about labels being deleted
• Fix #29238: az containerapp secret set: Add description about identityref for parameter --secrets

Cosmos DB

• az cosmosdb create/update: Add --enable-prpp-autoscale to enable/disable burst capacity feature

Key Vault

• az keyvault key sign/verify: Fix --digest to accept base64 encoded string

Microsoft Entra ID

• az ad app create/update: Add --requested-access-token-version argument

MySQL

• az mysql flexible-server create/restore/replica create/geo restore: Add --storage-redundancy parameter to support HA storage with zone redundancy

Network

• az network vnet-gateway create/update: Add parameter --resiliency-model
• az network vnet create/update: Add parameter --ipam-pool-prefix-allocations
• Fix #30535: az network lb address-pool address add: Address level may not have virtual network property

Profile

• Drop support for old-style managed identity account created by Azure CLI <= 2.0.50. If you upgrade from one of these versions, please run az login --identity again.

RDBMS

• az postgres flexible-server create: Create elastic cluster by setting --cluster-option to ElasticCluster
• az postgres flexible-server list: Add --show-cluster argument to list elastic clusters
• az postgres flexible-server fabric-mirroring/identity: Support system assigned managed identity and fabric mirroring of databases
• az postgres flexible-server update: Add --node-count argument to scale up elastic clusters

Role

• [BREAKING CHANGE] az role assignment delete: Stop deleting all role assignments by default

SQL

• az sql db ltr-policy: Remove preview tag

Storage

• az storage account migration: Add warning for long wait, will require confirmation in the future
• Fix #28554: az storage blob service-properties update: Support cases where --static-website false and index and 404 documents were already set
• Fix #29929: az storage copy: Fix when wildcard * is in --source-file-path

November 19, 2024

Version 2.67.0

AKS

• [BREAKING CHANGE] az aks create/update: Remove --uptime-sla and --no-uptime-sla parameters
• [BREAKING CHANGE] az aks create: Remove --aad-client-app-id, --aad-server-app-id and --aad-server-app-secret parameters
• [BREAKING CHANGE] az aks trustedaccess rolebinding create: Remove deprecated '-r' options
• az aks create/update: Fix storage pool name validation for Azure Container Storage
• az aks enable-addon: Update AGIC addon to use Network Contributor instead of Contributor

App Config

• az appconfig create/update: Add new parameters --arm-auth-mode and --enable-arm-private-network-access to support data plane proxy settings

Compute

• az vm disk attach/detach: Add new parameter --disk-ids to support setting multiple disks by disk ids

Compute Fleet

• az compute-fleet: Add create/update/show/delete/list/list-vmss commands for manage Azure Compute Fleet

Container

• az container container-group-profile: Add new command group to manage Azure Container Instance Container Group Profile

Core

• PREVIEW: Support managed identity on Azure Arc-enabled Windows server

DataLake

• [BREAKING CHANGE] az dla: Remove dla module since it has been deprecated

DLS

• [BREAKING CHANGE] az dls account network-rule: Remove this command group as no server support anymore

Eventhub

• az eventhubs eventhub: Add new parameters --timestamp-type and --min-compaction-lag-in-mins
• az eventhubs namespace replica: Add new commands to support adding/removing replicas

Extension

• [BREAKING CHANGE] az extension add/update: Set default --allow-preview value from True to be False for extensions installation and remain True for extensions without stable releases

Kusto

• [BREAKING CHANGE] az kusto: Remove kusto from CLI as it has been moved to CLI extensions

Network

• [BREAKING CHANGE] az network public-ip ddos-protection-statu: Remove misspelled command group

Packaging

• Drop Python 3.8 support

Profile

• [BREAKING CHANGE] az login: --password no longer accepts a service principal certificate. Use --certificate to pass a service principal certificate

RDBMS

• az postgres flexible-server long-term-retention start/pre-check/list/show: New commands to support long-term-retention backups on PostgreSql Flex Server
• az postgres flexible-server create: Support provisioning postgres flexible servers with version 17

Service Connector

• az connection create mysql-flexible: Add --private-endpoint parameter

SQL

• [BREAKING CHANGE] az sql mi link create: Rename input from --source-endpoint to --partner-endpoint, --primary-availability-group-name to --partner-availability-group-name, --secondary-availability-group-name to --instance-availability-group-name, --target-database to --databases
• [BREAKING CHANGE] az sql mi link create/show/list/update: Rename output from targetDatabase, primaryAvailabilityGroupName, secondaryAvailabilityGroupNamesourceEndpoint, sourceReplicaId, targetReplicaId, linkState, lastHardenedLsn to databases, partnerAvailabilityGroupName, instanceAvailabilityGroupName, partnerEndpoint, distributedAvailabilityGroupName, instanceLinkRole, partnerLinkRole, failoverMode, seedingMode
• [BREAKING CHANGE] az sql failover-group create: Change default failover policy to manual
• az sql mi link failover: Support performing requested failover type in this Managed Instance link

Upgrade

• [BREAKING CHANGE] az upgrade: Set default --allow-preview value from True to be False for extensions installation and remain True for extensions without stable releases

November 05, 2024

Version 2.66.0

AKS

• az aks create: Add Trusted Launch options --enable-vtpm and --enable-secure-boot
• az aks nodepool add/update: Add Trusted Launch options --enable-vtpm and --enable-secure-boot
• az aks create/update: Update the VM SKU details from backend for validations during Azure Container Storage operations

App Service

• az functionapp create: Add --zone-redundant parameter to support zone redundant for Functions Flex SKU
• az functionapp plan update: Do not show warning message with --set in command

ARM

• az bicep publish: Remove preview flag from --with-source parameter
• az data-boundary show: Add command to support getting the data boundary at a specified scope
• az data-boundary show-tenant: Add command to support getting the data boundary at a tenant level
• az data-boundary create: Add command to support creating tenant to data boundary
• az bicep generate-params: Fix the help message for --include-params parameter
• az bicep/deployment/stack: Conditionally enable invariant globalization for Bicep running inside the Azure CLI docker image

Backup

• az backup restore restore-disks: Add support for enabling Disk access settings for managed VM restores

Compute

• az vmss create/update: Add new parameter --skuprofile-vmsizes to specify a list of VM sizes to use with VMSS Instance Mix
• az vmss create/update: Add new parameter --skuprofile-allocation-strategy to update the allocation strategy for VMSS Instance Mix

Container app

• Fix #30053: az containerapp update: Fix polling
• az containerapp env create: Hide --dapr-instrumentation-key parameter
• az containerapp env update: Support to update --dapr-connection-string

Core

• aaz: Support managed identity
• Resolve CVE-2024-6119
• Resolve CVE-2024-5535
• Resolve CVE-2024-4741
• Resolve CVE-2024-4603
• Resolve CVE-2024-2511
• Use MSAL for Cloud Shell authentication

Extension

• az extension add/update: Pre-announcement default value change from true to false for --allow-preview

MySQL

• az mysql flexible-server create/update: Add --maintenance-policy-patch-strategy
• az mysql flexible-server create/restore: Add --database-port
• az mysql flexible-server replica create: Add --database-port

NetAppFiles

• [BREAKING CHANGE] az netappfiles volume create: Parameters backup-id and snapshot-id now accept only full Azure ResourceIds and no longer support GUIDs
• [BREAKING CHANGE] az netappfiles account create: Parameter --kdc-ip now only accepts a single ip address not a list
• [BREAKING CHANGE] az netappfiles account update: Parameter --kdc-ip now only accepts a single ip address not a list
• [BREAKING CHANGE] az netappfiles account ad add: Parameter --kdc-ip now only accepts a single ip address not a list
• [BREAKING CHANGE] az netappfiles account ad update: Parameter --kdc-ip now only accepts a single ip address not a list
• az netappfiles volume create: Fix a bug where parameter --allowed-clients was not passed along in the request
• az netappfiles check-file-path-availability: Add new parameter --availability-zone
• az netappfiles volume replication: Add new commands peer-external-cluster, authorize-external-replication, perform-replication-transfer, finalize-external-replication
• az netappfiles volume create: Add new parameters --external-host-name ,--external-server-name, --external-volume-name
• az netappfiles volume update: Add new parameters --external-host-name ,--external-server-name, --external-volume-name
• az netappfiles volume update: Parameters --backup-id and --snapshot-id now accept only full Azure ResourceIds and no longer support GUIDs

Network

• az network vnet: Add --private-endpoint-vnet-policies parameter
• az network private-link-service: Add --destination-ip-address parameter
• az network application-gateway waf-policy managed-rule rule-set add/update: Support sensitivity for --rule parameter
• az network private-dns link vnet: Support resolution policy for virtual network link
• az network application-gateway waf-policy managed-rule rule-set add/update: Add allowed value 1.1 for --version
• Fix #29911: az network public-ip update: IP tags crash with AttributeError

Profile

• az login: Passing the service principal certificate with --password is deprecated and will be removed in version 2.67.0. Please use --certificate instead.

RDBMS

• az postgres flexible-server replica create: Add support for --tags parameter
• az postgres flexible-server replica create: Allow read replica create from storage auto-grow enabled primary server flexible server
• az postgres flexible-server backup create/delete: New commands to support creating and deleting backups on PostgreSql Flex Server

Service Bus

• az servicebus namespace replica: Add new command group to manage servicebus namespace replicas

Service Connector

• az aks connection create appconfig: Add --use-appconfig-extension
• az webapp connection create fabric-sql: Add fabric sql target support

SignalR

• az signalr start/stop: Add signalr command start or stop an existing SignalR service
• az signalr replica start/stop/restart: Add signalr command start, stop or start an existing SignalR service
• az signalr network-rule ip-rule add/remove: Add signalr command add or remove ip-rule of an SignalR service
• az signalr update client-cert-enabled/disable-local-auth/region-endpoint-enabled: Toggle clientCertificate, disableLocalAuth, enableRegionEndpoint
• az signalr replica update region-endpoint-enabled/unit-count: Toggle enableRegionEndpoint and change unitCount

SQL

• az sql geo-backup: Remove preview tag
• az sql failover-group create/update: Add parameter --secondary-type to support geo/standby replica on partner server

Storage

• az storage blob copy start/start-batch: Fix --auth-mode login

Upgrade

• az upgrade: Pre-announcement default value change from true to false for --allow-preview

October 01, 2024

Version 2.65.0

ACR

• Fix #21900: az acr task identity remove: Fix incorrect operation_group setting
• az acr credential-set: Improve help message

AD

• az ad app create/update: Add --service-management-reference argument

AKS

• az aks nodepool delete-machines: Add support to delete specific machines in an agent pool

App Config

• az appconfig: Add premium SKU support

App Service

• az functionapp config set: Map parameters explicitly for the internal update_site_configs function call

Compute

• az vm/vmss create: Add --ssh-key-type parameter to support generating Ed25519 SSH keys
• az vm image list: Expose ImageDeprecationStatus property in output

Container app

• Fix #29849: az containerapp job stop: Fix stop execution response
• Fix #29166: az containerapp compose create: Support image with tag and support get ACR from image

Cosmos DB

• az cosmosdb restore: Add --disable-ttl to support for Restore with Time-To-Live Disabled

DataLake

• az dla: Deprecate datalake analytics

HDInsight

• az hdinsight update: Add parameter --assign-identity-type to allow to update to SystemAssigned identity.

Monitor

• az monitor action-group create: Adjust formatting of --actions help message
• az monitor action-group update: Adjust formatting of --add-actions help message
• az monitor action-group notification create: Adjust formatting of --add-actions help message

MySQL

• az mysql flexible-server create/update: Add --accelerated-logs to support configuring accelerated logs for Business Critical tier

NetAppFiles

• az netappfiles volume create: Fix subnet id as resource id

Network

• az network vnet peering: Refine command interface of subnet peering

Packaging

• Release Docker image based on Azure Linux 3.0
• Include jq in Azure Linux docker image
• Drop Debian 10 support
• Use Azure Linux 3.0 (mcr.microsoft.com/azurelinux/base/core:3.0) as the base image for docker image tag latest and 2.65.0

Profile

• az login: Fall back to device code flow in GitHub Codespaces

RDBMS

• az postgres flexible-server update: Support case-insensitive input for --tier, --performance-tier, --sku, and --maintenance-window
• az postgres flexible-server migration create: Add AWS_AURORA as a migration source type for PostgreSql

SQL

• az sql elastic-pool create: Set min_capacity to None for non-serverless SKUs
• az sql mi create/update: Add gpv2 parameter and iops parameter

September 03, 2024

Version 2.64.0

ACR

• az acr helm: Improve deprecation message

AKS

• az aks nodepool update: Add --enable/disable-fips-image flags for GA mutable fips
• az aks create/update: Support UserAssigned Managed Identity for grafana linking in managed prometheus
• az aks create/update: Update the VM SKU regex validation to include larger set of VMs for Azure Container Storage

App Service

• az staticwebapp create/update: Add Dedicated as supported SKU
• az webapp config set: Add MinTlsCipherSuite support
• az webapp config access-restriction add/remove: Allow skipping service tag validation

ARM

• az ts create: Fix incorrect handling of whitespace in string values

ARO

• az aro create: Add feature for adding Multiple Public IPs on cluster load balancer
• az aro update: Add feature for adding/removing Multiple Public IPs on cluster load balancer

Compute

• az vm update: Add support of Gen1 VM to trusted launch upgrade
• az capacity reservation: GA command group

Container app

• Fix #28998: az containerapp env workload-profile add/update: Fix NoneType object is not iterable error when environment doesn't enable workload profile
• az containerapp create/up: Make --target-port optional
• az containerapp env create: Deprecate unused argument --docker-bridge-cidr
• az containerapp job stop: Deprecate option to stop list of given job executions
• Fix #29711: az containerapp logs show: Fix JSON escaping by default or with --format json

HDInsight

• az hdinsight create: Support setting IP tags when creating HDInsight cluster
• az hdinsight update: Support updating the managed identity of the cluster
• az hdinsight azure-monitor-agent show: Support getting the managed identity of the cluster
• az hdinsight azure-monitor-agent enable: Enable the Azure Monitor Agent logs integration on an HDInsight cluster
• az hdinsight azure-monitor-agent disable: Disable the Azure Monitor Agent logs integration on an HDInsight cluster

MySQL

• az mysql flexible-server maintenance: New command group for managing maintenance of MySQL flexible server
• az mysql flexible-server update: Remove storage passing for server update

NetAppFiles

• az netappfiles volume create/update: Update max for --usage-threshold

Network

• Fix #29565: az network nat gateway create: Add --tags parameter

Packaging

• Support Python 3.12
• Release Azure Linux 3 RPM package
• [BREAKING CHANGE] Use CBL-Mariner 2.0 (mcr.microsoft.com/cbl-mariner/base/core:2.0) as the base image for docker image tag latest and 2.64.0

Redis

• az redis create/update: Add --disable-access-keys to support disabling auth through access keys

SQL

• az sql mi create/update: Add --authentication-metadata to support auth metadata configuration

Storage

• az storage account create/update: Support account cold-tier
• az storage copy/remove: Add --auth-mode login support
• az storage share delete: Add include-leased for --delete-snapshots

August 06, 2024

Version 2.63.0

ACR

• az acr login: Support optional resource group argument to skip subscription resource scan

AKS

• az aks create: Not set the --network-plugin based on the default from the Python SDK
• az aks create/update: Support in place param updates for managed Prometheus
• az aks create/update: Add validations for PremiumV2 disk
• az aks upgrade: Support tier switch with AKS upgrade
• az aks create/update: Add --network-policy none option to command
• az aks create: Remove unsupported scenario command in help message

App Config

• az appconfig import/export/restore: Add correlation request id to bulk operations

App Service

• az webapp list-runtimes: Add parameter --show-runtime-details to show detailed runtime stacks and update the format of java related stacks listed
• az webapp create: Add parameter --acr-identity to allow users to choose user assigned identity for ACR image pull
• az webapp config set: Add parameter --acr-use-identity and --acr-identity to allow users update ACR image pull related configs

ARM

• az stack group/sub/mg create: Minor improvements to the confirmation message when updating an existing stack

CDN

• Fix #28717: az afd secret: Change the way to access parameter
• az cdn portal-migration: Add command group for classic CDN profile migration

Compute

• az sig create/update: Hide --soft-delete parameter in help messages
• Fix #29006: az ssh: Fix the Permissions 0644 for '...' are too open error
• az vmss update: Add new parameter --enable-auto-os-upgrade to support updating automatic OS upgrade policy argument
• az vmss update: Add new parameter --upgrade-policy-mode to support updating upgrade policy mode

Container app

• Fix #26688: az containerapp up: Fix logic about updating an existing containerapp
• az containerapp job stop: Return custom message for stop job execution
• Fix #29330: az containerapp auth update: Fix split logic for --set

Core

• Resolve CVE-2024-39689
• Resolve CVE-2024-6345
• Support az config set extension.dynamic_install_allow_preview for extension dynamic installation configuration
• az logout: Remove service principal access tokens from token cache

Cosmos DB

• az cosmosdb delete: Support --no-wait

MySQL

• az mysql flexible-server import stop-replication: Stop replication between source single server and target flexible server

NetAppFiles

• az netappfiles account create: Change --key-vault-resource-id to be optional

Network

• az network custom-ip prefix create: Add parameter --is-parent
• az network network-watcher connection-monitor: Support to create connection monitor v2
• az network vnet peering: Support virtual network subnet peering

Packaging

• Drop Alpine Docker image

RDBMS

• [BREAKING CHANGE] az postgres flexible-server create: Update default value of PG version to be 16
• Fix #27422: az postgres flexible-server create: Bug fix for using existing subnet while creating pg flex server
• az postgres flexible-server restore: Bug fix when using resource id as value for source-server argument

Role

• az role assignment list: Add warning for classic administrators retirement

Service Connector

• az containerapp connection create containerapp: Support ACA2ACA connection

SQL

• az sql midb move/copy: Add destination subscription Id for managed database move/copy
• az sql mi create: Add --dns-zone-partner optional parameter

Storage

• az storage fs directory upload/download: Add back --auth-mode login as AzCopy supports Oauth now
• az storage blob sync: Add back --auth-mode login as AzCopy supports Oauth now

Synapse

• az synapse spark job submit: Add optional --python-files argument to support job submission

July 09, 2024

Version 2.62.0

ACR

• az acr build/task: Highlight the difference between arguments in the description

AKS

• az aks create/update: Update AMW resource.location to only accept alphanumeric characters
• az aks create/update: Add Azure Managed Grafana support for managed prometheus addon in usnat
• az aks create/update: Ephemeral disk additional support for Azure Container Storage
• az aks create/update: Add and fix existing validations for ephemeral disk support for Azure Container Storage

App Config

• az appconfig: Update help message for App Configuration store
• az appconfig kv import: Update the help message for ignore-match

App Service

• az webapp deploy: Disable deploymentstatus API for deployments to app slots
• az webapp deployment source config-zip: Disable deploymentstatus API for deployments to app slots
• Fix #29041: az webapp config access-restriction add: Fix edge case validating service tags
• az functionapp create: Avoid throwing exception when endOfLifeDate not passed from stacks API

ARM

• az stack mg create: Validate MG stacks automatically before creation
• az bicep restore: Fix typos in help messages

Backup

• az backup restore restore-disks/restore-azurewl/restore-azurefiles/restore-azurefileshare: Add --tenant-id for cross-tenant MUA protection, otherwise allows restore when protected by a resource guard
• az backup vault encryption update: Add support for MUA for CMK operations

CDN

• Fix #28721: az afd origin-group create: Add parameter to support session affinity state
• Fix #28824: az cdn profile: Add default location
• Fix #28733: az cdn endpoint update: Add support to update an existing endpoint

Compute

• az vmss update: Add new parameter --zones to support setting vmss zonal expansion
• az vm install-patches: Add new parameter --max-patch-publish-date to support setting max patch publish date
• az vmss reimage: Add new parameter --force-update-os-disk-for-ephemeral to support updating the base OS disk
• az vmss create/update: Add new parameter --scheduled-event-additional-publishing-target-event-grid-and-resource-graph to support setting scheduled event policy
• az vmss create/update: Add new parameter --enable-user-reboot-scheduled-events to support setting policy for rebooting scheduled event
• az vmss create/update: Add new parameter --enable-user-redeploy-scheduled-events to support setting policy for redeploying scheduled event
• az vmss update: Add an option Standard to --security-type parameter
• az vmss create: Support set upgrade policy mode to automatic during flexible VMSS creation
• az sig image-definition create: Fix default value of security type

Container app

• az containerapp env create/update: Support peer-to-peer traffic encryption with --enable-peer-to-peer-encryption
• az containerapp job update: Fix poll logic and --no-wait
• az containerapp show-custom-domain-verification-id: Show verification id used for binding custom domain
• az containerapp env update: Fix logs configuration about removing destination with --logs-destination none
• az containerapp list-usages: Support list-usages in subscription
• Fix #28983: az containerapp job registry: Support commands for modifying the job's registries
• az containerapp auth: Support Token Store with --token-store, --sas-url-secret, --sas-url-secret-name, --yes
• Fix #29128: az containerapp env certificate: Support managed certificate
• Fix #29172: az containerapp secret set: Remove the limit of length for secret name

Core

• Fix #28997: Fix error "User cancelled the Accounts Control Operation" when logging in with WAM as Administrator
• Resolve CVE-2024-37891
• Resolve CVE-2024-35195
• aaz: Add argument completer support

Cosmos DB

• az service create: Add --gateway-type to support multiple dedicated gateway types

MySQL

• az mysql flexible-server update: Support replica resource group different with primary server
• az mysql flexible-server detach-vnet: New command to support converting a vnet azure mysql server to a non-vnet server
• az mysql flexible-server deploy/update: Add warning message for HA enabled and input validator

Network

• az network application-gateway waf-policy custom-rule update: Add parameter --js-cookie-exp-time
• az network cross-region-lb address-pool: Add parameter -- admin-state
• az network application-gateway rewrite-rule: Add --request-header-configurations and --response-header-configurations
• az network virtual-appliance restart: Allow restart of virtual machines associated with a network virtual appliance
• az network virtual-appliance inbound-security-rule: Support of GET operation for NVA Inbound Security Rule
• az network vnet subnet: Add parameter --endpoints

RDBMS

• az postgres flexible-server restore: Add capability to restore to new server using Premium SSD v2 Disks by setting Storage Type to "PremiumV2_LRS"
• az postgres flexible-server migration create: Fix bugs while passing in MigrationRuntimeResourceId to Migration Parameters, now need to be provided within properties json file
• az postgres flexible-server firewall-rule create: Correct firewall rule name and ip range validators
• az postgres flexible-server update: Add argument to enable or disable public-access
• az postgres flexible-server create: Add argument --create-default-database to support disabling default database creation
• az postgres flexible-server upgrade: Unblock MVU for Burstable from CLI
• az postgres flexible-server update: Correct setting --maintenance-window to be disabled

SignalR

• az signalr upstream update: Remove the empty location string when updating resource

SQL

• az sql db update: Add --manual-cutover and --perform-cutover arguments

Storage

• az storage container policy: Fix cases where permission and expiry are both null
• az storage account create/update: Support TLS 1.3, update recommended --min-tls-version to be 1.2

May 21, 2024

Version 2.61.0

AKS

• [BREAKING CHANGE] az aks create: Specifying --enable-managed-identity and --service-principal/--client-secret at the same time will cause a MutuallyExclusiveArgumentError
• [BREAKING CHANGE] az aks create: Change the default value of option --enable-managed-identity from True to False
• az aks mesh upgrade rollback/complete: Add --yes parameter to support not prompting the users to confirm the operation
• az aks create/update: Add SecurityPatch option to --node-os-upgrade-channel parameter
• az aks create/update: Add new parameter --enable-cost-analysis to enable exporting Kubernetes namespace and deployment details to the Cost Analysis views
• az aks create: Backfill the value of --enable-managed-identity to True when options --service-principal and --client-secret are not specified at the same time
• az aks nodepool update: Add option --os-sku to support updating os sku in place
• az aks create: Add --ampls-resource-id and --enable-high-log-scale-mode optional parameters for Monitoring Addon
• az aks enable-addons: Add --ampls-resource-id and --enable-high-log-scale-mode optional parameters

App Service

• [BREAKING CHANGE] az webapp deploy: Use deployment status API for deployment output for Linux Web Apps
• [BREAKING CHANGE] az webapp up: Use deployment status API for deployment output for Linux Web Apps
• [BREAKING CHANGE] az webapp deployment source config-zip: Use deployment status API for deployment output for Linux Web Apps
• az functionapp scale config always-ready: Set alwaysReady property to empty array if it is null
• az functionapp: Update messaging for flex function apps
• az functionapp deployment source config-zip: Allow users with no Microsoft.Web/serverFarm read privileges to deploy function apps
• az webapp list: Fix the bug --show-details fails while resource group name is not specified
• az webapp list-runtimes/create/up: Add Java 21 support
• az functionapp create: Use stacks API netFrameworkVersion value instead of the default value from the Python SDK
• az functionapp create: The linuxFxVersion for dotnet-isolated linux consumption apps will no longer be left empty
• az functionapp: Not block execution of command when runtime cannot be detected, and omit showing warning for runtime when not applicable (e.g. centauri apps, apps running a docker image)
• az appservice plan create/update: Add IsolatedV2 memory intensive SKU support
• az functionapp create: If customers do not provide an image when creating a Centauri function app, we use the updated default Centauri image

ARM

• [BREAKING CHANGE] az stack group/sub/mg create/delete: Remove the deprecated --delete-all, --delete-resources, and --delete-resource-groups flags. Use the --action-on-unmanage/--aou parameter instead
• az group delete: Add new option Microsoft.Databricks/workspaces for --force-deletion-types parameter
• az deployment: Support inline parameters with .bicepparam in single --parameters argument
• az stack group/sub/mg validate: Add new validate command to preform preflight validation on a stack deployment
• az stack group/sub create: Validation of a stack will now occur before a stack is created or updated
• az stack group/sub/mg create/delete: Action on unmanage behavior for stack managed management groups can now be configured
• az stack group/sub/mg create: The correlation ID of the create operation is now returned as a property of the stack
• az stack group/sub/mg create/delete: Add new flag --bypass-stack-out-of-sync-error/--bse that will bypass errors related to the resource list of a stack being out of sync

Compute

• [BREAKING CHANGE] az sig image-definition create: Set the default values for Hyper-V generation and Security Type
• az vmss create/update: Add new parameters --enable-resilient-creation and --enable-resilient-deletion to support Resiliency Policy on VMSS
• az vm create/update: Add new option NvmeDisk for --ephemeral-os-disk-placement parameter
• az vmss create/update: Add new option NvmeDisk for --ephemeral-os-disk-placement parameter
• az vm create: Add new parameters --source-snapshots-or-disks and --source-snapshots-or-disks-size-gb to support implicit disk creation from snapshot and disk
• az vm create: Add new parameters --source-disk-restore-point and --source-disk-restore-point-size-gb to support implicit disk creation from disk restore point
• az vmss update: Add new parameter --ephemeral-os-disk to support in-place mutual migration of VMSS from ephemeral to non-ephemeral OS disk
• az vmss update: Add new parameter --ephemeral-option to support setting ephemeral disk setting

Compute Diagnostic

• az compute-recommender spot-placement-recommender: Add new command to support generating placement scores for Spot VM SKU

Container app

• az containerapp create/update: Fix --scale-rule-tcp-concurrency for TCP scale rule
• az containerapp compose create: Fix issue where the environment's location is not resolved from --location
• Fix #28864: az containerapp ingress update: Fix updating transport from http to tcp with --transport tcp
• az containerapp compose create: Fix variable mixing issue when --compose-file-path contains multiple services
• Fix #28380: az containerapp ingress access-restriction set: Fix KeyError when name not exists

Core

• Resolve CVE-2024-34064
• [BREAKING CHANGE] az login: Use WAM as the default authentication method on Windows. For more details, see https://go.microsoft.com/fwlink/?linkid=2271136
• aaz: Support extended values in AAZArgEnum
• Add tenantDefaultDomain and tenantDisplayName properties to login contexts (shown by az account list)
• Prompt for interactive authentication for all silent authentication failures

Key Vault

• [BREAKING CHANGE] az keyvault create: Default --enable-rbac-authorization to true
• az keyvault key create: Update the release policy used for --default-cvm-policy

NetAppFiles

• [BREAKING CHANGE] az account backup: Replace backup commands with backup-vault commands
• [BREAKING CHANGE] az volume backup status: Remove volume backup status command, replace with az netappfiles volume latest-backup-status show
• az netappfiles account backup-vault: Add backup vault command group
• az netappfiles volume latest-backup-status show: Add command to get latest backup status
• az netappfiles volume latest-restore-status show: Add command to get latest backup status
• az netappfiles resource region-info list: Add command to list region specific information
• az netappfiles resource region-info default show: Add command to get storage to network proximity and logical zone mapping information

Network

• [BREAKING CHANGE] az network dns zone: Deprecate --zone-type, registration-vnets and resolution-vnets
• az network vnet subnet: Add parameter --sharing-scope
• az network private-endpoint-connnection: Add Microsoft.App/managedEnvironment for private endpoint connections
• Fix #28615: az network application-gateway address-pool update: Race condition in concurrent scenario
• Fix #28705: az network lb rule: Authentication token not being generated

Packaging

• Add Ubuntu 24.04 Noble Numbat support
• [BREAKING CHANGE] Drop Ubuntu 18.04 support

Profile

• az login: Introduce login experience v2. For more details, see https://go.microsoft.com/fwlink/?linkid=2271236

RDBMS

• az postgres flexible-server migration create: Add private endpoint support for migrations by providing migration runtime resource ID as command line argument

Security

• [BREAKING CHANGE] az security contact create: Deprecate --alerts-admins and --email
• [BREAKING CHANGE] az security setting update: Deprecate --enabled

Service Connector

• az aks connection list/show: Add kubernetes resource name
• az source connection create cognitiveservices: Support OpenAI/AIServices/CognitiveServices as target
• az webapp connection list: Fix interactive input

Storage

• [BREAKING CHANGE] az storage account update: Prompt user for possible charge increases when changing --access-tier, add --upgrade-to-storagev2
• [BREAKING CHANGE] az storage container set-permission/get-permission and az storage container policy: Remove --auth-mode login and --sas-token for container access policy commands as only shared key authorization is supported on server side

April 30, 2024

Version 2.60.0

ACR

• [BREAKING CHANGE] az acr connected-registry create: Mode default value change from ReadWrite to ReadOnly
• az acr connected-registry create: If data-endpoint disabled ask for confirmation to enable it instead of throwing an error

AKS

• az aks create/update: Prompt warning during disablement about CR deletion
• az aks create/update: Udpate RP registration code to work on azure monitor subscription
• az aks create/update: Update to add default region for workspace creation in air gapped cloud
• az aks nodepool add: Add parameter --disable-windows-outbound-nat to add a Windows agent pool which the Windows OutboundNAT is disabled

App Service

• az webapp config container set: Remove docker prefix and rename container related parameters
• az webapp create and az webapp deployment slot create: Rename --docker-registry-server-user and --docker-registry-server-password to --container-registry-user and --container-registry-password
• az webapp create and az webapp deployment slot create: Add parameters --container-image-name and container-registry-url to deprecate --deployment-container-image-name
• az webapp create and az logicapp create: Update help message
• az webapp config set: Add new parameter --runtime to allow users to update their stack by using single parameter
• az functionapp create: Remove unnecessary app settings for flex function apps
• Fix #28588: az webapp config access-restriction add: Check for null before getting values
• az webapp config access-restriction set: Add new parameter --default-action to configure default action for main site
• az webapp config access-restriction set: Add new parameter --scm-default-action to configure default action for scm site
• az webapp list: Add parameter --show-details to include detailed site configuration of listed webapps in output
• az functionapp create: Will validate that the provided runtime is supported by flex when creating a flex function app
• az functionapp list-flexconsumption-runtimes: Add support for this new command so that it provides the list of supported flex runtimes when provided the --location and --runtime

ARM

• az bicep install: Support additional process architectures with Bicep CLI
• az deployment: Return better message on incorrect bicepparam file path
• az bicep format: Replace --newline with --newline-kind
• az bicep publish: Replace --documentationUri with --documentation-uri

Backup

• az backup vault update: Take --tenant-id as input for resolving cross-tenant resource guard scenarios. Vault Immutability feature also has resource guard protection now, and support for the same has been added.
• az backup protection disable: Take --tenant-id as input for resolving cross-tenant resource guard scenarios. Stop protection feature also has resource guard protection now, and support for the same has been added.

Batch

• az batch pool create: Add --upgrade-policy-mode argument to support automatic OS upgrade
• az batch pool create: Add --enable-auto-os-upgrade argument to enable automatic OS upgrade
• az batch pool create: Add --disable-auto-rollback argument to disable OS image rollback feature
• az batch pool create: Add --defer-os-rolling-upgrade argument to defer OS upgrades on the TVMs if they are running tasks
• az batch pool create: Add --use-rolling-upgrade-policy argument to support OS rolling upgrade policy
• az batch pool create: Add --enable-cross-zone-upgrade argument to support cross zone OS upgrade
• az batch pool create: Add --max-batch-instance-percent argument to set the maximum percent of total VMs that will be upgraded in one batch
• az batch pool create: Add --max-unhealthy-instance-percent argument to set the maximum percentage of the total VMs can be simultaneously unhealthy
• az batch pool create: Add --max-unhealthy-upgraded-instance-percent argument to set the maximum percentage of upgraded VMs that can be found to be in an unhealthy state
• az batch pool create: Add --pause-time-between-batches argument to set the wait time between batches in rolling OS upgrade
• az batch pool create: Add --prioritize-unhealthy-instances argument to support upgrade all unhealthy VMs first
• az batch pool create: Add --rollback-failed-instances-on-policy-breach argument to enable rollback failed instances to previous model if the Rolling Upgrade policy is violated

Compute

• az vmss create: Add support of configure the rolling mode upgrade policy during VMSS creation
• az vmss update: Add new parameter --max-surge to support updating rolling upgrade policy max surge
• az capacity reservation group list: Add new parameter --resource-ids-only to support retrieving the capacity reservation group resource ids
• az capacity reservation group create: Change --sharing profile to support unsharing subscriptions by passing nothing

Containerapp

• az containerapp env create: Support --dapr-connection-string to set application insights connection string used by Dapr to export service to service communication telemetry
• Fix #28553: az containerapp exec: Fix the error of inappropriate ioctl for device

Core

• Fix #28737: Fix token cache for service principal authentication
• Resolve CVE-2023-3651

Monitor

• az monitor log-analytics workspace update: Add parameter --sku-name

NetAppFiles

• az netappfiles volume-group create: Add --zones argument to set Availability Zone for volume group volumes
• az netappfiles volume create/update: Update maximum value for --usage-threshold to support large volumes

Network

• az network virtual-appliance inbound-security-rule: Support for Permanent Inbound Security Rule

RDBMS

• az postgres flexible-server upgrade: Add capability to perform major version upgrade to PG16

Service Connector

• az aks connection: AKS support for Service Connector
• az webapp/containerapp/spring connection create/update: Store configurations in App Config
• az source connection create: Support auth opt out

Service Fabric

• az sf managed-cluster network-security-rule: Add new network security rule commands

SQL

• az sql server create/update: Add 1.3 to minTLSEnum and make TLS 1.2 as default

April 02, 2024

Version 2.59.0

ACR

• Fix #14768: az acr login: Add environment variable for docker command

ACS

• az aks create: Add flag --enable-app-routing to enable app routing
• az aks approuting: Add command group to handle enable/disable/update of the app routing addon
• az aks approuting zone: Add command group to handle add/delete/update/list actions of DNS zone resources associated to the approuting addon
• az aks create/update: Introduce changes for Azure container storage in ACS CLI

AD

• az ad: Rename Azure Active Directory to Microsoft Entra ID

AKS

• az aks create: Add optional parameter --revision to set revision for the Azure Service Mesh addon while creating AKS cluster
• az aks mesh get-upgrades: Fix command failure with a traceback if ASM addon is disabled
• az aks create/update: Enable mooncake support for managed prometheus addon
• az aks create/update: Block Azure Managed Grafana for managed prometheus addon in air gapped cloud
• az aks create: Correct use of "comma-separated" in help

App Config

• az appconfig feature filter update: GA command
• az appconfig kv export: GA parameter --export-as-reference

App Service

• az functionapp create: Add support for Node 20 for Flex function apps
• az functionapp create: Make Node 20 the default for node flex function apps and Python 3.11 the default for python flex function apps
• az functionapp create: Add support for SystemAssignedIdentity and UserAssignedIdentity as the deployment storage authentication type
• az webapp update: Add new parameter --elastic-web-app-scale-limit and scaling parameter options
• az appservice plan update: Add new parameter --elastic-web-app-scale-limit and scaling parameter options
• az webapp deployment source config-zip: Mark this command as deprecated, recommend using the az webapp deploy command instead of it

ARM

• az stack group create: Deprecate the --delete-resources, --delete-resource-groups and --delete-all options and redirect to the new --action-on-unmanage argument
• az stack group delete: Deprecate the --delete-resources, --delete-resource-groups and --delete-all options and redirect to the new --action-on-unmanage argument
• az stack sub create: Deprecate the --delete-resources, --delete-resource-groups and --delete-all options and redirect to the new --action-on-unmanage argument
• az stack sub delete: Deprecate the --delete-resources, --delete-resource-groups and --delete-all options and redirect to the new --action-on-unmanage argument
• az stack mg create: Deprecate the --delete-resources, --delete-resource-groups and --delete-all options and redirect to the new --action-on-unmanage argument
• az stack mg delete: Deprecate the --delete-resources, --delete-resource-groups and --delete-all options and redirect to the new --action-on-unmanage argument
• az deployment: Treat nullable parameters as non-required for Bicep deployment

ARO

• az aro create/validate: Fix bug in permissions validation that was preventing cluster creation in cases where the invoking user had the necessary permissions

CDN

• az afd profile: Add parameter --identity

Compute

• az snapshot grant-access: Add parameter --file-format to support specifying file format when making request for SAS on a VHDX file format snapshot
• az vmss create: Add --enable-auto-os-upgrade parameter to support automatic OS Upgrade while creating VMSS
• az sig image-definition create: Add warning message for Hyper-V generation and Security Type
• az vmss create/update: Add parameters to specify the security posture to be used for all virtual machines in the scale set
• az capacity reservation group create/update: Add new parameter --sharing-profile to support sharing capacity reservation group across subscriptions
• az snapshot create: Add parameter --bandwidth-copy-speed to allow a snapshot to be copied at a quicker speed

DataBoxEdge

• az databoxedge device: Add command group share to support managing device share
• az databoxedge device: Add command group user to support managing device user
• az databoxedge device: Add command group storage-account to support managing device storage account
• az databoxedge device: Add command group storage-account-credential to support managing device storage account credential
• az databoxedge device: Add command get-extended-information to support getting extended information

MySQL

• az mysql flexible-server advanced-threat-protection-setting show: Show server's advanced threat protection setting
• az mysql flexible-server advanced-threat-protection-setting update: Update server's advanced threat protection setting using --state as Enabled/Disabled
• az mysql flexible-server import create: Add support for online migration for single to flex

NetAppFiles

• az netappfiles check-file-path-availability: Add new command to check if a file path is available
• az netappfiles check-name-availability: Add new command to check if a resource name is available
• az netappfiles check-quota-availability: Add new command to check if a quota is available
• az netappfiles query-network-sibling-set: Add new command to describe a network sibling set
• az netappfiles update-network-sibling-set: Add new command to update the network features of a network sibling set
• az netappfiles quota-limit: Add new command group to manage quota limits
• az netappfiles volume populate-availability-zone: Add new command to populate availability zone information for a volume
• az netappfiles volume replication re-initialize: Add new command to re-establish a previously deleted replication between 2 volumes that have a common ad-hoc or policy-based snapshots

Network

• az network virtual-appliance connection: Add update command for NVA connection
• az network dns record-set: Add --traffic-management-profile for TMLink recordset feature
• az network application-gateway waf-policy: Change default rule set from CRS3.0 to DRS2.1
• az network virtual-appliance: Add --internet-ingress-ips and --network-profile

March 05, 2024

Version 2.58.0

ACR

• az acr: Update registry and webhook example names to be lowercase
• az acr create/update: Add new argument --allow-metadata-search to enable the metadata-search feature for the registry

AKS

• Add monitoring addon to support default workspace in AGC
• az aks get-versions: Show extra column on supportPlan
• az aks create/update: Update region map for default region creation with new Azure Monitor Workspace regions
• az aks update: Zero can be set to outbound-ports,outbound-ip-count in loadbalancer profile and outbound-ip-count in natgateway profile in AKS

API Management

• az apim api export: Add command to export an API Management API

App Service

• az webapp up/create/update: Add new parameter --basic-auth to allow users to enable and disable basic auth

ARM

• Fix #27855: az bicep generate-params: Bicep install messages sent to stdout

Backup

• [BREAKING CHANGE] az backup item set-policy: Add warning prompt for migration from Standard to Enhanced Policy

Batch

• az batch pool create: Add new parameter --resource-tags to support specifying resource tags for the pool. Any resource created for the pool will then also be tagged by the same resource tags
• az batch pool create: Add new parameters --security-type, --encryption-at-host, --secure-boot-enabled, and --v-tpm-enabled to support Trusted Launch Security Type for VMs/VMSS deployments
• az batch pool create: Add new parameters --caching, --disk-size-gb, --write-accelerator-enabled, and --storage-account-type to support Batch Node Agent temp disk-less SKUs

CDN

• Fix #28240: az afd rule create: Cannot create without condition
• Fix #28223: az afd route create: Cannot create without --content-types-to-compress
• Fix #27744: az afd origin-group: Add parameter --enable-health-probe

Compute

• az vmss nic: Update help messages to guild users to specific commands for Flexible VMSS
• az vm host redeploy: Add command to redeploy the dedicated host
• Fix #28397: az vm create: Fix creating VM with --security-type Standard
• az vmss application set: Fix updates to the purchase plan are not supported when updating VMSS
• az vmss update-domain-walk: Add new command to support updating vm in a service fabric vmss

Containerapp

• az containerapp revision copy: Fix --from-revision bug for inheriting a specific revision contains scale rules
• az containerapp update: Fix TypeError: Argument of type 'NoneType' is not iterable
• Fix #28226: az containerapp job update: Update existing scale rules if --scale-rule-name is passed

Core

• [BREAKING CHANGE] az login: Replace allow_broker with enable_broker_on_windows (#27726)

Cosmos DB

• az cosmosdb sql database/container restore: Fix support for restore of deleted database resource in the same SQL account
• az cosmosdb mongodb database/collection restore: Fix support for restore of deleted database resource in the same MongoDB account
• az cosmosdb gremlin database/graph restore: Fix support for restore of deleted database resource in the same gremlin account
• az cosmosdb table restore: Fix support for restore of deleted table resource in the same account

MySQL

• az mysql flexible-server import create: Change the default progress message from starting to running

Network

• az network virtual-appliance connection: Add show and list commands for NVA connection
• az network vnet-gateway: Add parameters --allow-remote-vnet-traffic and --allow-vwan-traffic
• az network express-route gateway: Add parameter --allow-non-vwan-traffic

RDBMS

• Fix #27713: az postgres flexible-server list-skus -o table: Fix table output from list-skus command

Security

• az security api-collection: Manage Azure API Management API connections to Microsoft Defender for APIs
• az security security-connector: Manage cloud security posture management (CSPM) and cloud workload protection (CWP) across multicloud resources

SQL VM

• Fix #27300: az sql vm group create: --cluster-subnet-type should only be passed into WsfcDomainProfile

Storage

• Fix #28356: az storage account or-policy update: Fix -p @policy.json to allow passing in json files
• az storage blob upload-batch: Support --tags, make --overwrite non-preview

February 06, 2024

Version 2.57.0

AKS

• az aks upgrade: Add forceupgrade settings to aks stable cli
• az aks mesh: Add az aks mesh commands to manage Azure Service Mesh in given cluster
• az aks nodepool add/update/upgrade: Add new parameter --node-soak-duration to wait after draining a node and before reimaging it and moving on to next node

App Service

• az functionapp create: Use app insights connection string instead of instrumentation key
• az webapp create: Add new parameter --acr-use-identity to configure pull image from ACR using MSI when creating a container web app
• az webapp up: Add --track-status arg to use deploymentstatus API
• az webapp deployment source config-zip: Add --track-status arg to use deploymentstatus API
• az functionapp create: Only allow apps with functions version 4

Backup

• az backup restore restore-disks: Add support for disk restore in edge-zone backups
• az backup restore restore-disks: Support for Taiwan North and Taiwan North-West Cross region restore

Billing

• az billing account: Add new command list-invoice-section to support listing invoice section
• az billing account: Add new command group invoice-section to support managing account invoice section
• az billing: Add new command enrollment-account to support managing enrollment account
• az billing invoice section: Add new command initiate-transfer to support intiating transfer
• az billing profile: Add new command reservation list to support managing reservation
• az billing: Add new command group transfer to support managing transfer

Compute

• az image builder error-handler: Add group to manage error handling options upon a build failure
• az sshkey create: Add parameter --encryption-type to specify the encryption type of SSH keys to be generated
• az vm monitor log show: Deprecate azure-loganalytics and apply azure-monitor-query
• az vm/vmss create: Support Trusted Launch as default deployment option

Consumption

• Fix #20995 #23825: Update az consumption API version

Containerapp

• az containerapp update: Fix issue for minReplicas in --yaml or --min-replicas is not set when the value is 0
• az containerapp up: Fix issue when registry creds are provided for ACRs using containerapp up command

Key Vault

• az keyvault create: Add warning for upcoming breaking change that --enable-rbac-authorization will default to true
• az keyvault secret set-attributes: Fix 'Datetime with no tzinfo will be considered UTC' warning

Monitor

• az monitor metrics: Add list-sub and list-sub-definition
• az monitor metrics list: Fix --top help message

MySQL

• az mysql flexible-server import create: Add support for operation progress estimated completion time for import from physical backup from azure blob to flexible server

Network

• az network vnet-gateway create/update: Add parameter --enable-private-ip
• Fix #28131: az network vnet-gateway list: Conflict key when apply client flatten
• az network express-route port authorization: Support to manage authorization with express route port
• az network private-link-service list-auto-approved: Support to list all auto-approved private link services
• az network public-ip ddos-protection-statu show: Support to get the DDoS protection status of public IP address
• az network vnet-gateway: Support ExpressRoute SKU
• az network lb create: Support cross-subscription resource ID

Packaging

• Support Windows ZIP package (Preview)

RDBMS

• az postgres flexible-server private-endpoint-connection: Add support for private endpoint connection commands like list, show, approve, reject, delete for PostgreSQL flexible server
• az postgres flexible-server private-link-resource: Add support for private link resource commands like list, show for PostgreSQL flexible server
• az postgres flexible-server replica stop-replication: Stop replication to a read replica and make it a read/write server. This command is deprecated. Use az postgres flexible-server replica promote instead.

Redis

• az redis flush: Add support for flush operation
• az redis create: Add support for Microsoft Entra Authentication
• az redis access-policy/access-policy-assignment: New command groups to manage access policy

Service Connector

• az webapp/containerapp/spring connection create/update app-insights: Support App Insights as target service
• az webapp connection create sql: Support auto install for serviceconnector-passwordless extension
• az webapp/functionapp/containerapp/springapp connection: Support Microsoft Entra ID auth types for table storage
• az webapp/containerapp/spring connection create/update: Support opt out action for configurationInfo and publicNetwork

SQL

• az sql db ltr-policy/ltr-backup: Add support for backup storage access tier
• az sql db ltr-policy set: Add the make-backups-immutable parameter to ltr policy
• az mi create/update: Add optional parameter --database-format and --pricing-model for SQL Managed Server resource
• az sql mi refresh-external-governance-status: Add a new command for Azure SQL Managed Instance refresh external governance status

Storage

• az storage file copy start: Fix when copying between two storage accounts and source file has no parent directory
• Fix #28202: az storage container policy create: Fix creating an access policy would delete public access permission
• az storage container set-permission: Fix failing when updating public access permission with an existing access policy
• Fix #21876: az storage blob upload-batch/download-batch/delete-batch: Add double quotes to --pattern value for unix shell

January 09, 2024

Version 2.56.0

AKS

• az aks create/update: Add new parameter --load-balancer-backend-pool-type to define the Load Balancer backend pool type of managed inbound backend pool
• az aks create: Add parameter --node-public-ip-tags to specify the ipTags of the node public IPs
• az aks nodepool: Add parameter --node-public-ip-tags to specify the ipTags of the node public IPs
• az aks create and az aks nodepool add: Add crg-id option to create nodepool with Capacity Reservation Group
• az aks stop: Add warning when private link cluster is stopped
• az aks trustedaccess role: Add new command group to manage trusted access roles
• az aks trustedaccess rolebinding: Add new command group to manage trusted access role bindings
• az aks trustedaccess rolebinding list: Add new command to list all the trusted access role bindings
• az aks trustedaccess rolebinding show: Add new command to get the specific trusted access role binding according to binding name
• az aks trustedaccess rolebinding create: Add new command to create a new trusted access role binding
• az aks trustedaccess rolebinding update: Add new command to update an existing trusted access role binding
• az aks trustedaccess rolebinding delete: Add new command to delete a trusted access role binding according to name
• az aks update: Add parameter --network-plugin to update the network plugin of the AKS cluster

App Config

• az appconfig feature set: Add requirement type to feature command

App Service

• az functionapp create: Add DAPR support for Centauri apps
• az functionapp create: Remove workarounds for Centauri
• az webapp deploy: Add --track-status arg to use deploymentstatus API
• az functionapp create: Add workload profile support for Centauri apps

ARM

• az bicep publish: Add optional parameter --with-source to publish source code with the module (experimental)
• az lock delete: Fix the case sensitive comparison issue for resource group name

Compute

• az vmss create: Change --orchestration-mode to support only uniform for old profile
• az vm/vmss create/update: Add new parameters --enable-proxy-agent and --proxy-agent-mode to support azure metadata security protocol
• az vm/vmss create: Add new option NonPersistedTPM for parameter --os-disk-security-encryption-type to support creating Intel TDX based Confidential VM

Containerapp

• az containerapp job update: Fix bug for minExecutions in --yaml is not set when the value is 0
• az containerapp hostname bind: Fix an issue about parsing the environment's resource group when the --environment is a resource id

Cosmos DB

• az cosmosdb sql database restore: Add support for restore of deleted database resource in the same SQL account
• az cosmosdb sql container restore: Add support for restore of deleted container resource in the same SQL account
• az cosmosdb mongodb database restore: Add support for restore of deleted database resource in the same MongoDB account
• az cosmosdb mongodb collection restore: Add support for restore of deleted collection resource in the same MongoDB account
• az cosmosdb gremlin database restore: Add support for restore of deleted database resource in the same gremlin account
• az cosmosdb gremlin graph restore: Add support for restore of deleted graph resource in the same gremlin account
• az cosmosdb table restore: Add support for restore of deleted table resource in the same account

Eventhub

• az eventhubs georecovery-alias create: Name parameter is required

Extension

• az extension: Enable extension semantic versioning and join experimental into preview
• az extension add/update: Add --allow-preview to distinguish stable-only installation with preview-included installation

Key Vault

• az keyvault create/update-hsm: GA --mi-user-assigned
• az keyvault backup/restore start: GA --use-managed-identity

Monitor

• az monitor log-analytics workspace: Add list-link-target and list-available-service-tier

Network

• az network application-gateway waf-config list-dynamic-rule-sets: Support to get the WAF dynamic manifest
• az network nsg rule list: Fix ranges and prefixes disappeared with -o table option
• az network vnet subnet: Add --private-endpoint-network-policies and --private-link-service-network-policies

RDBMS

• az postgres flexible-server virtual-endpoint: Add support for virtual endpoints for PostgreSQL flexible server
• az postgres flexible-server replica promote: Add capability to stop replication and promote to primary or standalone server with the selection of planned/force data syncs.
• az postgres flexible-server server-logs list: List server log files for PostgreSQL flexible server
• az postgres flexible-server server-logs download: Download server log files for PostgreSQL flexible server
• az postgres flexible-server create: Add capability to set storage type to PremiumV2_LRS and provide values for IOPS and Throughput during creation
• az postgres flexible-server update: Add capability to update the values of IOPS and Throughput during update
• az postgres flexible-server migration create: Add migration option like Migrate, Validate and ValidateAndMigrate using parameter --migration-option and json file for Migration configuration to support additional properties like sourceType and sslMode

Redis

• az redis import/export: Add --storage-subscription-id support while importing/exporting data

Service Bus

• az servicebus georecovery-alias create: Name parameter is required

Storage

• [BREAKING CHANGE] az storage account create: Server change default value for --allow-blob-public-access and --allow-cross-tenant-replication to False for security concerns

Upgrade

• az upgrade: Add --allow-preview to distinguish stable-only extension installation with preview-included extension installation

December 05, 2023

Version 2.55.0

ACR

• az acr login: Allow registry names with hyphen
• Fix #27487: az acr check-health: Fix DOCKER_PULL_ERROR when acr check-health for Mac OS

AKS

• az aks update: Update outbound ip description and remove limitation
• az aks create: Add arguments --asg-ids and --allowed-host-ports
• az aks nodepool add/update: Add arguments --asg-ids and --allowed-host-ports

App Service

• Fix #27189: az webapp log tail: Catch exception when scm connection is lost

Billing

• az billing period list: Fix --top does not work as expected
• az billing invoice download: Fix command does not work
• az billing invoice list: Fix --period-end-date and --period-start-date help message error

Compute

• az disk create: Add new parameter --optimized-for-frequent-attach to improve reliability and performance of data disks that are frequently attached
• az disk/snapshot create: Add new parameter --elastic-san-resource-id to support creating through the ARM id of elastic san volume snapshot

Containerapp

• az containerapp ingress cors enable: Only update arguments --allow-headers, --allow-credentials, --allow-methods, --expose-methods, --max-age when the value is not None
• az containerapp: Change the container-app name and container-app job name in the example to legal names

Key Vault

• az keyvault backup start: Add status in output

Monitor

• az monitor activity-log alert: Upgrade api-version to 2020-10-01 to include any-of query condition
• az monitor activity-log alert: Expose parameter all-of to enable user modifying query condition specifically

Network

• az network private-endpoint-connection: Add provider Microsoft.DBforPostgreSQL/flexibleServers
• az network public-ip prefix: Add parameter --tier

RDBMS

• az postgres flexible-server replica create: Add support for parameters like --tier, --sku-name, --storage-size during replica creation
• az postgres flexible-server update: Add support for custom IOPS update for flexible server using --performance-tier
• az postgres flexible-server advanced-threat-protection-setting show: Show advanced threat protection setting
• az postgres flexible-server advanced-threat-protection-setting update: Update advanced threat protection setting using --state as Enabled/Disabled

Service Connector

• az containerapp connection create: Enable Key Vault Reference in Container Apps

SQL

• az instance-pool create/update: Add optional parameter --maintenance-configuration-id for SQL Instance Pool resource
• az mi create/update: Add optional parameter --instance-pool-name for SQL Managed Server resource

Storage

• az storage blob upload: Increase max_block_size for append/block blobs of size >= 8mb to 8mb instead of 4mb
• az storage blob upload: Change default max_connections for append blob to 1
• az storage file upload/upload-batch: Fix --allow-trailing-dot breaking --connection-string usage
• Fix #27899: az storage account create: Run check_name_availability() first and throw a warning when an existing account with the name is found

November 14, 2023

Version 2.54.0

ACR

• az acr artifact-streaming: Add new group to include a subgroup operation and the commands create/show/update
• az acr artifact-streaming operation: Add new group to help the user manage the artifact streaming creation with the commands cancel/show
• az acr login: Add additional parameter validation to check registry name is valid
• az acr cache: Add optional --resource-group parameter
• az acr credential-set: Add optional --resource-group parameter

AKS

• [BREAKING CHANGE] az aks create: Make container log V2 as default and remove region dependency
• az aks create/update: Support custom ips/ipprefixes and managed ips being assigned to aks cluster outbound resources together
• az aks nodepool add/update/upgrade: Add new parameter --drain-timout to slow down the upgrade
• az aks update: Fix bug where supportPlan can be reset to None
• az aks nodepool add: Fix incorrectly specified property name for option --drain-timeout
• az aks create/update: Enable Grafana support in US Government clouds
• az aks create/update: Update region map for default region creation with new Azure Monitor Workspace regions
• az aks create/update: Add cluster scope to recording rule groups created during Managed Prometheus onboarding
• az aks update: Add --network-policy to support updating the mode of a network policy

APIM

• az apim api create: Make --authorization-scope parameter optional for setting auth server

App Config

• [BREAKING CHANGE] az appconfig kv export: Add validations to snapshot kv export to App Service
• [BREAKING CHANGE] az appconfig kv import/export: Add skip-features and skip-keyvault restriction for snapshots
• az appconfig snapshot: GA snapshot related features

App Service

• [BREAKING CHANGE] az functionapp: Redact key value output on keys set
• [BREAKING CHANGE] Redact output on deployment source config
• [BREAKING CHANGE] az webapp config: Redact webapp config connection-string and storage-account values
• [BREAKING CHANGE] az functionapp/webapp deployment source update-token: Redact tokens output on deployment source update-token
• [BREAKING CHANGE] az appservice ase create: Update the default App Service Environment to V3
• az appservice list-locations: Add --hyperv-workers-enabled parameter to get regions which support hosting web apps on windows container workers
• az functionapp deployment source config-zip: Add the deployer information to improve telemetry
• az webapp up: Fix --logs arg fails with an exception
• az functionapp create: Add new parameter --workspace to support creating workspace-based app insights components

ARM

• [BREAKING CHANGE] az stack mg create: Not supplying --deployment-scope will no longer default the underlying deployment to the current subscription scope, but to the mg scope of the deployment stack.
• az stack sub create: Add no wait support
• az stack mg create: Add no wait support
• az stack group create: Add no wait support
• az bicep lint: Add new command to lint a bicep file
• az deployment group create: Support supplemental parameters when used with .bicepparam parameter file
• az deployment: Add support for determining type of parameters whose definition uses a $ref

ARO

• az aro create: Add new --enable-preconfigured-nsg parameter, allowing users to enable or disable preconfigured NSGs
• az aro create: Add network contributor to the NSG resource for the cluster SP and FP SP
• az aro update: Add network contributor to the NSG resource for the cluster SP and FP SP, if not already when preconfigured NSG is enabled

Backup

• az backup vault create: Allow updates to immutability for vaults with Managed Identity set
• az backup vault update: Add new command to support updating vault properties without the --location parameter

Batch

• az batch keys renew: Update help with security warning
• az batch keys list: Update help with security warning
• az batch account identity show: Update help with security warning

Compute

• [BREAKING CHANGE] Remove unversioned image aliases
• [BREAKING CHANGE] az vm/vmss identity assign: Remove the default value Contributor of parameter --role
• [BREAKING CHANGE] az disk create: Support creating disk with Gen2 and TLVM as default
• [BREAKING CHANGE] az vm/vmss create: Disable integrity monitoring by default
• [BREAKING CHANGE] az disk/snapshot create: Change the default value of --hyper-v-generation from V1 to None
• [BREAKING CHANGE] az vm create: Change default value to Standard for LB options
• [BREAKING CHANGE] az vmss create: Change default value to Standard for LB options
• [BREAKING CHANGE] az vmss create: Change the default value of --orchestration-mode from uniform to flexible
• [BREAKING CHANGE] az vm/vmss create: Support Trusted Launch as default deployment option when creating vm/vmss with marketplace image
• [BREAKING CHANGE] az vm/vmss create: Support Trusted Launch as default deployment option when creating vm/vmss from existing disk or image
• [BREAKING CHANGE] az vm/vmss create: Support Trusted Launch as default deployment option when creating vm/vmss with minimal inputs
• Fix #27446: az vm encryption enable: Fix using incorrect client when --key-encryption-key is specified
• Fix #27451: az vmss list-instances: Fix API profile to resolve no registered resource provider found error
• az vm create: Format the notification message of recommendation region
• az restore-point create: Add new parameters --source-os-resource, --os-restore-point-encryption-set and --os-restore-point-encryption-type to support encryption OS disk
• az restore-point create: Add new parameters --source-data-disk-resource, --data-disk-restore-point-encryption-set and --data-disk-restore-point-encryption-type to support encryption data disk
• az disk create: Add new parameter --optimized-for-frequent-attach to improve reliability and performance of data disks that are frequently attached
• az disk/snapshot create: Add new parameter --elastic-san-resource-id to support creating through the ARM id of elastic san volume snapshot
• az disk create: Revert new parameter --optimized-for-frequent-attach
• az disk/snapshot create: Revert new parameter --elastic-san-resource-id

Containerapp

• [BREAKING CHANGE] az containerapp env workload-profile update: Remove --workload-profile-type as it does not work in server side
• [BREAKING CHANGE] az containerapp env create: Update the default value of --enable-workload-profiles to True
• az containerapp job create: Fix AttributeError when --trigger-type is None
• az containerapp compose create: Fix bug where environment's resource group is not resolved from --environment when the input value is a resource id
• az containerapp env workload-profile delete: Fix issue when deleting wp for env with custom domain
• az containerapp update: Fix appending to NoneType object bug for --secret-volume-mount
• az containerapp create/update: Hide environment variables, scale rules metadata
• az containerapp job create/update: Hide environment variables, scale rules metadata
• az containerapp compose create: Fix containerapp invalid memory resource
• az containerapp job create: Fix problem of parsing parameters minExecutions and maxExecutions from --yaml

Cosmos DB

• az cosmosdb create/update: Add support for minimum allowed TLS version and burst capacity configuration

Eventhub

• [BREAKING CHANGE] az eventhubs georecovery-alias update: This command is removed.

Key Vault

• [BREAKING CHANGE] az keyvault storage: Remove this command group since service doesn't maintain anymore
• az keyvault create/update-hsm: Add --mi-user-assigned to support MHSM managed identity
• az keyvault backup/restore start: Add --use-managed-identity to exempt SAS token
• az keyvault key: Add hsm platform info in response

Monitor

• [BREAKING CHANGE] az monitor activity-log alert create: Change default value from resourceGroupId to subscriptionId for parameter --scope
• [BREAKING CHANGE] az monitor metrics alert: Change datetime output to be consistent with native response
• [BREAKING CHANGE] az monitor log-analytics workspace table search-job create: Remove schema wrapper for searchResults in api response
• az monitor log-analytics workspace create: Add --identity-type and --user-assigned arguments
• az monitor log-analytics workspace update: Add --identity-type and --user-assigned arguments
• az monitor log-analytics workspace table: Enable --retention-time to be workspace retention when setting as -1
• az monitor log-analytics workspace table: Enable --total-retention-time to be workspace retention when setting as -1
• az monitor log-analytics workspace table search-job: Add new command cancel
• az monitor autoscale update: Fix update failure with empty notification

MySQL

• az mysql flexible-server gtid reset: Remove geo-backup check

Network

• [BREAKING CHANGE] az network public-ip create: Change default value of --sku to standard
• [BREAKING CHANGE] az network lb create: Change default value of --sku to standard
• az network private-dns record-set a add-record: Fix record cannot be added when record set is empty
• az network lb address-pool: Add parameter --sync-mode
• az network application-gateway listener: Add parameter --host-names
• az network private-endpoint-connection: Add provider Microsoft.DocumentDB/mongoClusters
• Fix #27508: az network private-dns zone import: Import fails when zone already exists
• az network virtual-appliance: Add parameter --identity
• Fix #27735: az network vnet-gateway show: Conflict key when apply client flatten

Packaging

• [BREAKING CHANGE] Remove unnecessary packages in docker image
• Support Python 3.11
• Bump embedded Python version to 3.11.5
• Add Azure Linux docker image
• Fix #22741: az upgrade: This command becomes non-blocking on Windows

Profile

• az account get-access-token: Return expires_on as POSIX timestamp

RDBMS

• az postgres flexible-server geo-restore: Add cross subscription geo-restore support for PostgreSQL flexible server
• az postgres flexible-server restore: Add cross subscription restore support for PostgreSQL flexible server
• az postgres flexible-server upgrade: Add MVU support for PG version 15

Role

• [BREAKING CHANGE] az role assignment create: --scope is now a required argument.
• [BREAKING CHANGE] az role assignment create: Remove --resource-group argument.

Search

• az search service create: Add --semantic-search argument.

Security

• az security pricing create: Support subplan and extensions parameters
• az security pricing get: Support extensions in the return result

Service Bus

• [BREAKING CHANGE] az servicebus georecovery-alias update : This command is removed.
• [BREAKING CHANGE] az servicebus migration update: This command is removed.

Service Connector

• [BREAKING CHANGE] az spring connection: Remove default value of --deployment to support spring app connection

SignalR

• az signalr replica create/list/show/delete: Add replica command group for az signalr

SQL

• az sql db create/update: Add --use-free-limit and --free-limit-exhaustion-behavior to support free limit database

Storage

• az storage file/directory: Add --disallow-trailing-dot
• az storage share list-handle/close-handle: Add --disallow-trailing-dot
• az storage file copy start/start-batch: Add --disallow-source-trailing-dot
• Fix #27590: az storage fs directory download: Check user system PATH for azcopy and use CLI config directory for new install
• az storage account blob-inventory-policy create: Add support for new filter creationTime.lastNDays in json
• az storage account migration start/show: Support customer initiated migration between replication options
• [BREAKING CHANGE] az storage container-rm update: Remove --default-encryption-scope and --deny-encryption-scope-override as they should only be specified during create

October 24, 2023

Version 2.53.1

AKS

• Hotfix: az aks update: Fix bug where supportPlan can be reset to None

App Service

• [BREAKING CHANGE] Redact appsettings output on set/delete commands

September 26, 2023

Version 2.53.0

ACR

• az acr token create: Fix random order of repo valid actions and gateway valid actions in the help message

AKS

• az aks update: Add new parameter --private-dns-zone to support private DNS zone for AKS private cluster
• az aks update: Add new parameter --disable-windows-gmsa to support disabling Windows gMSA in an AKS cluster
• az aks update: Add forceupgrade settings to aks stable cli

App Config

• az appconfig kv import/export: Remove skip-features and skip-keyvault restriction for snapshots

App Service

• az functionapp create: Enable distributed tracing for non consumption apps

ARM

• az deployment group create: Make --template-file parameter optional when used with .bicepparam parameter file
• az account list-locations: Add new parameter --include-extended-locations to support listing extended locations

Backup

• az backup backup-properties: Add option for setting --soft-delete-feature-state to "AlwaysOn", and --soft-delete-duration with values between 14 to 180 (inclusive)
• az backup vault list-soft-deleted-containers: List all soft-deleted containers in a backup vault

Compute

• az vm/vmss extension set: Enable auto upgrade by default for CodeIntegrityAgent extension
• az vm create: Add warning message for Basic option removal
• az vmss create: Add warning message for Basic option removal

Containerapp

• az containerapp: Move containerapp from CLI extension to core CLI
• az containerapp env create: Add --enable-workload-profiles to specify if the environment is enabled to have workload profiles
• az containerapp env dapr-component create: Fix the sample link for --yaml parameter

Cosmos DB

• az cosmosdb postgres: GA Cosmos DB for PostgreSQL

MySQL

• az mysql flexible-server replica create: Add new parameters to support replica creation

NetAppFiles

• az netappfiles volume: Add new command get-groupid-list-for-ldapuser to Get Group Id List for LDAP User
• az netappfiles account update: Add parameter --identity-type
• az netappfiles volume update: Add parameter --snapshot-dir-visible. If enabled (true) the volume will contain a read-only snapshot directory which provides access to each of the volume's snapshots (defaults to true)

Network

• az network virtual-appliance: Add parameter --additional-nics
• az network vnet subnet: Add parameter --default-outbound-access
• az network public-ip create: Add warning message for Basic option removal
• az network lb create: Add warning message for Basic option removal

RDBMS

• az postgres flexible-server create/update: Add capability to enable/disable storage auto-grow during creation and update

Service Connector

• az spring connection: Add deprecated message for --deployment breaking change
• az webapp connection: Add new parameter --slot to support webapp slot connection

SQL

• az sql failover-group set-primary: Add parameter --try-planned-before-forced-failover to support hybrid geo-failover

Storage

• Fix #26732: az storage blob copy start-batch: Add --rehydrate-priority to batch copy
• Fix #27052: az storage blob delete-batch: Use utc as default timezone to remove "Datetime with no tzinfo will be considered UTC." warning

September 05, 2023

Version 2.52.0

AKS

• az aks create/update: Add new parameter --enable-vpa to support enabling vertical pod autoscaler for cluster
• az aks update: Add new parameter --network-dataplane to specify the network dataplane used in the Kubernetes cluster
• az aks create/update: Add new parameter --node-os-upgrade-channel to specify which OS on your nodes is updated
• az aks update: Retain value in network profile in mc object only when decorator is in update mode
• az aks update: Outbound ip/outbound ipprefix and managed outbound ip should be mutually exclusive

App Config

• az apponfig kv import: Add new parameter --import-mode to specify whether to overwrite already existing key-values or ignore matching keys
• az appconfig kv export: Add new parameter --snapshot to support exporting all key values from a snapshot of the source configuration
• az appconfig kv import: Add new parameter --src-snapshot to support importing all key values from a snapshot of the source configuration

App Service

• Fix #26736: az logicapp create: Add --runtime-version and --functions-version optional parameters
• az webapp config connection-string set: Allow users to use json file to set the connection string

ARM

• Fix #26112: az deployment group create: Fix the warning log mode is not a known attribute of class TemplateLink
• az bicep build-params: Support generating parameters.json file from the given bicepparam file with the --file argument
• az bicep decompile-params: Support generating parameters.bicepparam file from the given parameters.json file with the --file argument
• az bicep generate-params: Support generating main.parameters.json with the parameters that doesn't have default values in the given .bicep file
• az bicep generate-params: Add new parameter --output-format to support generating parameter file in bicepparam and json formats
• az bicep generate-params: Add new parameter --include-params to support generating parameter file with all the parameters in the given bicep file, or with only parameters that doesn't have default values in the given bicep file

ARO

• az aro create: Add new --outbound-type parameter, allowing users to select "Loadbalancer" (default) or "UserDefinedRouting"
• az aro create: Perform pre-flight validation of prerequisite permissions before creation
• az aro validate: New command to perform explicit validation of prerequisite permissions

Backup

• az backup restore restore-azurefileshare: Add --target-rg-name parameter to specify the resource group of the destination storage account

Batch

• az batch: Fix batch cloud console authentication issue

Cognitive Services

• az cognitiveservices account deployment create: Add --model-source parameter

Compute

• az vmss create/update: Add --enable-hibernation parameter to enable hibernation capability on VMSS
• az vmss update: Add --security-type parameter to enable Trusted Launch on existing VMSS
• az vmss deallocate: Add --hibernate parameter to support hibernating a VM while deallocating
• az ppg update: Add new parameter --type to support setting proximity placement group type

Cosmos DB

• az cosmosdb restore: Support enabling/disabling public network access

Key Vault

• Fix #27220: az keyvault certificate import: Fix invalid policy issue when no content_type provided
• az keyvault storage: Announce deprecation since keyvault service doesn't maintain this since long ago

MySQL

• az mysql flexible-server parameter set-batch: Add new command to support updating multiple parameters
• az mysql flexible-server export create: Add Export Backup CLI implementation

Network

• az network private-endpoint-connection: Add provider Microsoft.EventGrid/namespaces and Microsoft.EventGrid/partnerNamespaces
• Fix #27066: az network vnet list: Fix -o table cannot be used
• az network express-route port delete: Add confirmation while deleting
• az network application-gateway waf-policy custom-rule: Add an example of using --group-by-user-session
• az network express-route update: Fix properties.SeriveProviderProperties unexpected null
• Fix #26730: az network public-ip update: --ip-tags cannot be correctly parsed
• az network application-gateway waf-policy managed-rule rule-set: Support Microsoft_BotManagerRuleSet version 1.0
• az network vnet peering create: Mark --remote-vnet as required

Redis

• az redis update: Fix public network access default value issue

Storage

• az storage file upload-batch: Allow uploading files in parallel to improve performance
• Fix #27202: az storage entity insert: Fix case when using sas token with only add permission

Upgrade

• az upgrade: Support upgrading with 64-bit MSI

August 01, 2023

Version 2.51.0

AKS

• az aks nodepool snapshot update: Add aks nodepool snapshot update command
• az aks create: Add new parameter --k8s-support-plan to support LTS onboarding, also add new tier enum premium
• az aks update: Support enabling/disabling LTS via new parameter --k8s-support-plan
• az aks create: Add node taint support when create cluster use az aks command
• az aks update: Add update node taint support on cluster level use az aks command
• az aks enable-addons: Fix the default value of option --enable-msi-auth-for-monitoring being overwritten to False when specified
• az aks update: Add new parameter --outbound-type to support cluster outbound type.
• az aks maintenanceconfiguration list: Add new command to list all maintenance windows in a cluster
• az aks maintenanceconfiguration show: Add new command to display a specific maintenance window of a cluster
• az aks maintenanceconfiguration add: Add new command to add a new maintenance window configuration for a cluster
• az aks maintenanceconfiguration update: Add new command to update an existing maintenance window configuration of a cluster
• az aks maintenanceconfiguration delete: Add new command to delete an existing maintenance window configuration of a cluster
• az aks update: Fix aks network profile update error

App Config

• az appconfig kv delete/set/set-keyvault: Add key validations for null or empty space keys
• az appconfig kv export/import/restore: Update key-value diffing and preview
• az appconfig snapshot: Remove status code property from snapshot object
• az appconfig snapshot list: Use enums for status parameter

App Service

• Fix #26214: az webapp show: Fix the bug caused by missing leading slash causes web app and plan commands to fail for s-clouds
• Fix #26214: az appservice plan show: Fix the bug caused by missing leading slash causes web app and plan commands to fail for s-clouds
• Fix #26601: az functionapp create: Throw error for consumption function app created with vnet
• Fix #21133: az webapp/functionapp config ssl bind/unbind: Search for matching certificates in the subscription by App Service Plan Id

ARM

• az stack: Fix the bug that the required --deny-settings-mode parameter should not return None (should be a string)
• az stack: Fix the bug that the --deny-settings-excluded-principals parameter was accidentally reset

Batch

• az batch job/pool all-statistics: Remove no longer worked commands
• az batch pool create: Add new parameter --enable-accelerated-networking to determine whether this pool should enable accelerated networking

Cognitive Services

• az cognitiveservices account deployment create: Add --sku-name and --sku-capacity parameters
• az cognitiveservices usage: Add new command list
• az cognitiveservices model: Add new command list

Compute

• az vm/vmss create: Enable auto upgrading of guest attestation extension by default for Trusted Launch enabled VMs and VMSS
• az vm/vmss create: Add new parameter --disable-integrity-monitoring-autoupgrade to support disabling auto upgrading of guest attestation extension for Trusted Launch enabled VMs and VMSS
• az sig image-version undelete: Add new command to support softdeleted image recovery
• az vm/vmss/disk create: Add new option Standard for --security-type for backward compatibility
• az sig image-definition create: Add new option Standard for --security-type for backward compatibility

Cosmos DB

• az cosmosdb restore: Add --assign-identity and --default-identity to allow PITR restoring with identity
• az cosmosdb postgres: Add new command groups to support Cosmos DB for PostgreSQL

Key Vault

• az keyvault restore start: Add --key-name to support selective key restoring
• az keyvault key sign/verify: Add new commands to support signing with keyvault key and verify the signature

MySQL

• az mysql flexible-server ad-admin set: Enable AAD for replica

Network

• az network nic create/update: Add parameters --auxiliary-mode and --auxiliary-sku to support setting auxiliary mode and sku
• az network public-ip: Add parameter --dns-name-scope to specify different options
• az network private-endpoint-connection: Add provider Microsoft.ElasticSan/elasticSans

Packaging

• Drop Python 3.7 support
• Support x86 and x64 MSI builds

Resource

• az resource invoke-action: Add new parameter --no-wait to support not waiting the long-running operation to finish

Role

• az ad sp create-for-rbac: Add alias --json-auth for --sdk-auth

Service Connector

• az functionapp connection: Add new command group to support service connector on Function App
• az spring connection: Enable new auth types for Spring Boot and Cosmos SQL connection

SQL

• az sql mi start/stop/start-stop-schedule: Add SQL MI manual and scheduled start stop

Storage

• az storage container-rm update: --default-encryption-scope and --deny-encryption-scope-override should not be specified during updating
• Fix #22704: az storage account create: --encryption-key-type-for-queue and --encryption-key-type-for-table no longer remove other settings
• Fix #26587: az storage file upload: Add --file-url to support supplying the url instead of share/file name

July 04, 2023

Version 2.50.0

AKS

• az aks get-versions: Both json payload and table format changed
• az aks create: Add condition to disable --enable-msi-auth-for-monitoring for service principle

APIM

• az apim graphqlapi resolver create: Add new command to create gql api resolver
• az apim graphqlapi resolver show: Add new command to show gql api resolver
• az apim graphqlapi resolver list: Add new command to show gql api resolver list
• az apim graphqlapi resolver delete: Add new command to delete gql api resolver
• az apim graphqlapi resolver policy create: Add new command to create resolver policy
• az apim graphqlapi resolver policy show: Add new command to show resolver policy
• az apim graphqlapi resolver policy list: Add new command to list resolver policies
• az apim graphqlapi resolver policy delete: Add new command to delete a policy

App Config

• az appconfig feature: Improve error handling for invalid feature flags
• az appconfig snapshot create: Add new command to support creating a snapshot
• az appconfig snapshot show: Add new command to support showing the properties of an app configuration snapshot
• az appconfig snapshot list: Add new command to support listing snapshots of a given app configuration
• az appconfig snapshot archive: Add new command to support archiving a snapshot
• az appconfig snapshot recover: Add new command to support recovering an archived snapshot

App Service

• Fix #21168: az webapp deploy: Call OneDeploy through ARM proxy if --src-url is provided
• Fix #26647: az webapp show: Remove duplicate IPs from outbound addresses
• Fix #25497: az webapp deploy: Fix extension parsing if src-path has multiple '.'s

ARM

• az managedapp definition create/update: Add new parameter --deployment-mode to support setting deployment policy
• az resource move: Add help example for moving multiple resources
• az stack: Add new command group to support deployment stacks
• az stack mg: Add new command group to manage deployment stack at management group scope
• az stack sub: Add new command group to manage deployment stack at subscription scope
• az stack group: Add new command group to manage deployment stack at resource group scope

ARO

• az aro get-admin-kubeconfig: Add new command to download an admin kubeconfig for a created ARO cluster

Backup

• az backup vault create: Add parameter --cross-subscription-restore-state to set the CSR state of the vault at the time of creation as well as updating
• az backup recoveryconfig show: Add parameter --target-subscription-id to provide the target subscription as the input while triggering cross subscription restore for SQL or HANA workloads
• az backup protection backup-now: Allow --enable-compression to be set to true for SAPHANA Workloads
• az backup recoveryconfig show: Add new parameter --target-instance-name to specify the target instance name for the restore operation

Compute

• az vmss update: Add new parameter --custom-data to support updating custom data
• az image builder optimizer: Add subgroup to manage image template optimizer
• az image builder create: Add parameter --validator to specify the type of validation to be used on the Image
• az vm update: Add parameter --security-type to support VM Gen2 to Trusted Launch conversion
• az sig image-definition create: Add examples for TrustedLaunchSupported and TrustedLaunchAndConfidentialVmSupported
• az capacity: Fix short summaries for groups
• Fix #26516: az vm create: Fix warning log for public IP even when no public IP is being created

Eventhub

• az eventhubs eventhub: Enum value for cleanup_policy change to compact from compaction
• az eventhubs namespace list: Support list command without mandatory resource_group parameter
• az eventhubs eventhub create/update: Event Hubs Capture MSI feature added to eventhub entity

IoT

• az iot hub route: Hide the deprecated command, please use az iot hub message-route instead of it.
• az iot hub routing-endpoint: Hide the deprecated command, please use az iot hub message-endpoint instead of it.

Key Vault

• Fix #26527: az keyvault certificate show: Show policy.x509CertificateProperties.subjectAlternativeNames correctly

Monitor

• az monitor metrics alert create: Add () into --condition grammar

MySQL

• az mysql flexible-server import create: Add new command to facilitate migrations from mysql single to flexible servers
• az mysql flexible-server restore/geo-restore/replica cerate: Support --tags

NetAppFiles

• az netappfiles volume replication resume: Add warning on action to re-sync replication volumes that if destination volume has quota rules they will be overwritten by the source volumes quota rules.

Network

• az network dns zone import: Fix alias records cannot be imported
• Fix #26438: az network vnet peering sync: Doesn't work in cross-tenant scenario
• az network application-gateway waf-policy policy-setting update: Add support for log scrubbing
• az network application-gateway waf-policy policy-setting update: Add support for inspection limit
• az network application-gateway waf-policy custom-rule: Support rate limit in WAF policy
• Fix #24695: az network traffic-manager: Add command context
• Fix #26638: az network traffic-manager endpoint: Declare --min-child-endpoints, --min-child-ipv4 and --min-child-ipv6 as integer type
• az network dns: Support DNSSEC configuration and DS/TLSA record set

Packaging

• Add Debian Bookworm support

RDBMS

• az postgres flexible-server migration update: Remove unsupported update parameters --db-names and --overwrite-dbs
• az postgres flexible-server migration create: Add support for tags and location using --tags and --location
• az postgres flexible-server revive-dropped: Add support to revive a dropped PostgreSQL flexible server
• az postgres flexible-server create: Add support to create PostgreSQL flexible server with data encryption enabled for geo-backup enabled server by pasing parameters --geo-redundant-backup, --backup-key and --backup-identity
• az postgres flexible-server show-connection-string: Add support to pass --pg-bouncer in connection strings for cmd and programming languages with PgBouncer enabled for PostgreSQL flexible server. Updated connection strings to show port as well as database
• az postgres flexible-server update: Add support for parameter --private-dns-zone during update operation, to update private DNS zone for a VNET enabled PostgreSQL flexible server

Service Bus

• az servicebus namespace list: Support list command without mandatory resource_group parameter

Service Fabric

• az sf managed-cluster network-security-rule add: Add network security rule to managed cluster

SQL

• az sql midb move/copy: Add new commands for Managed Database Move/Copy feature

SQL VM

• Fix #2442969: az sql vm enable-azure-ad-auth/validate-azure-ad-auth: Workaround Graph API bug by using client side filtering upon failure
• az sql vm update: Add configuration options for new SQL Assessment pre-requisites MMA->AMA migration

Storage

• az storage blob upload(-batch)/set-tier/copy start(-batch): Cold Tier GA, add new tier type --tier cold
• az storage blob download-batch: When matching pattern, list blobs with prefix to reduce the number of list calls
• Fix #26673: az storage account or-policy create: Now throw server error that was previous silently ignored.

Synapse

• az synapse workspace create/update: Support workspace encryption and user-assignment management identity

May 23, 2023

Version 2.49.0

ACR

• az acr create: Remove Classic from sku option

AKS

• [BREAKING CHANGE] az aks create: Specify --pod-cidr with Azure CNI will return an error instead of logging a warning when not use overlay mode
• [BREAKING CHANGE] az aks create: Change the default value of --enable-msi-auth-for-monitoring to true and add check for airgap clouds
• az aks update: Support updating user assigned control plane identity for parameter --assign-identity
• az aks install-cli: Add validation for installation path and update help message for parameters --install-location and --kubelogin-install-location
• Fix #26353: az aks install-cli: Fix incorrect architecture detection on Darwin/arm64
• az aks create/update: Add parameter --enable-azure-monitor-metrics to enable managed prometheus (Azure Monitor Metrics Addon)
• az aks create/update: Add parameter --azure-monitor-workspace-resource-id to store metrics for the managed prometheus addon
• az aks create/update: Add parameter --grafana-resource-id to link the Azure Monitor Workspace with a Grafana instance for viewing metrics and dashboards
• az aks create/update: Add parameter --enable-windows-recording-rules to enable windows recording rule groups on the Azure Monitor Workspace (by default they get created but are disabled)
• az aks create/update: Add parameter --ksm-metric-labels-allow-list to support the additional Kubernetes label keys that will be used in the resource's labels metric
• az aks create/update: Add parameter --ksm-metric-annotations-allow-list to support the Kubernetes annotations keys that will be used in the resource's labels metric
• az aks update: Add parameter --disable-azure-monitor-metrics to disable the Azure Monitor Metrics addon
• az aks create and az aks nodepool add: Add warning message when specifying --os-sku to Mariner or CBLMariner

App Config

• [BREAKING CHANGE] az appconfig feature: Update feature name validation to disallow the colon character
• [BREAKING CHANGE] az appconfig kv import: Update feature name validation. Invalid feature flags will be skipped during import
• [BREAKING CHANGE] az appconfig: Update default connection string resolution logic

App Service

• az functionapp create: Add new parameter --min-replicas and --max-replicas to support minimum and maximum replicas
• az functionapp create: Add new parameter --registry-server to support Centauri function app
• az functionapp create: Update the default image to mcr.microsoft.com for Centauri
• Fix #26445: az webapp deploy: Fix deployment failing with HTTP 400

ARM

• Fix #26216: az bicep format: Fix the TypeError expected str, bytes or os.PathLike object, not bool
• Fix #26256: az bicep publish/restore/generate-params: Fix version checks without bicep installed
• az bicep publish: Add new parameter --force to allow overwriting existing module
• Fix #26352: az ts create: Fix for the TypeError string indices must be integers

Backup

• az backup: Add support for HANA HSR workload

Compute

• az vm create: Support new license type UBUNTU_PRO and UBUNTU
• az vm extension set: Enable auto-upgrade by default for GuestAttestation extension
• az image builder trigger: Add subgroup to manage image builder template trigger
• az image builder output versioning: Add subgroup to manage image builder template output versioning
• az image builder output add: Add parameter --versioning to support describing how to generate new x.y.z version number for distribution
• az image builder output add: Add parameter --vhd-uri to support specifying storage uri for the distributed VHD blob

Container

• az container create: Add new parameters for container security context for confidential ContainerGroupSku

Cosmos DB

• [BREAKING CHANGE] az cosmosdb create/update: Rename --enable-public-network true/false to --public-network-access ENABLED/DISABLED/SECUREDBYPERIMETER
• az cosmosdb create/update: Add --continuous-tier to support continuous backup tier
• az cosmosdb create/update: Enable Partition Merge feature for CosmosDB

Eventhub

• [BREAKING CHANGE] az eventhubs namespace network-rule: This command group is removed and replaced by az eventhubs namespace network-rule-set
• [BREAKING CHANGE] az eventhubs namespace network-rule add: This command is removed and replaced by az eventhubs namespace network-rule-set ip-rule/virtual-network-rule add
• [BREAKING CHANGE] az eventhubs namespace network-rule remove: This command is removed and replaced by az eventhubs namespace network-rule-set ip-rule/virtual-network-rule remove
• [BREAKING CHANGE] az eventhubs eventhub create/update: Remove --message-retention parameter, it is replaced by --retention-time-in-hours
• [BREAKING CHANGE] az eventhubs namespace application-group policy remove: Rename --throttling-policy-config to --policy and remove metric-id and rate-limit-threshold properties in it
• az eventhubs eventhub create/update: Add --cleanup-policy, --retention-time-in-hours and --tombstone-retention-time-in-hours to support Retention-Description feature

IoT

• az iot hub create/update/delete: Fix poller issues

Key Vault

• [BREAKING CHANGE] az keyvault create: --retention-days becomes required for MHSM creation
• [BREAKING CHANGE] az keyvault backup start: The output will only contain folderUrl
• [BREAKING CHANGE] az keyvault restore start: Nothing will return for successful run
• [BREAKING CHANGE] az keyvault role assignment delete: Nothing will return for successful run
• [BREAKING CHANGE] az keyvault certificate show/set-attributes/import: No longer return x509CertificateProperties.basicConstraints, pending
• [BREAKING CHANGE] az keyvault certificate contact delete: Return an empty list instead of the deleted contact for consistency if the operation would remove the last contact
• [BREAKING CHANGE] az keyvault certificate issuer create: organizationDetails.zip is no longer returned by serivce, use 0 as the default
• az keyvault security-domain upload: Fix sd warpping keys with passwords
• az keyvault setting: New command group to manage MHSM settings

Monitor

• az monitor: Add new subgroup account to support managing monitor workspace
• az monitor log-analytics workspace table create/update: Max --total-retention-time changed from 2555 to 2556

NetAppFiles

• [BREAKING CHANGE] az netappfiles volume create: Remove optional parameter --vault-id as this is not longer needed
• [BREAKING CHANGE] az netappfiles vault list: Remove command vault list as this is not longer needed
• az netappfiles account create: Add optional parameter --identity-type
• az netappfiles account ad add: Add optional parameter --preferred-servers-for-ldap-client
• az netappfiles volume create: Add optional parameter --is-large-volume
• az netappfiles volume account create: Add optional parameter --identity-type
• az netappfiles volume quota-rule update: Add optional parameter --tags
• az netappfiles volume: Add new command break-file-locks to break all the file locks on a volume

Network

• [BREAKING CHANGE] az network cross-region-lb rule: Remove parameters --enable-tcp-reset and --idle-timeout
• [BREAKING CHANGE] az network application-gateway http-settings update: Use null instead of "" to detach
• [BREAKING CHANGE] az network application-gateway settings update: Use null instead of "" to detach
• [BREAKING CHANGE] az network application-gateway url-path-map update: Use null instead of "" to detach
• [BREAKING CHANGE] az network nic update: Use null instead of "" to detach
• [BREAKING CHANGE] az network nic ip-config update: Use null instead of "" to detach
• [BREAKING CHANGE] az network nsg rule update: Use null instead of "" to detach
• [BREAKING CHANGE] az network vnet update: Use null instead of "" to detach
• [BREAKING CHANGE] az network vnet subnet update: Use null instead of "" to detach
• [BREAKING CHANGE] az network application-gateway client-cert remove: Deprecate the output of command
• [BREAKING CHANGE] az network application-gateway ssl-profile remove: Deprecate the output of command
• [BREAKING CHANGE] az network private-endpoint dns-zone-group remove: Deprecate the output of command
• [BREAKING CHANGE] az network private-endpoint ip-config remove: Deprecate the output of command
• [BREAKING CHANGE] az network private-endpoint asg remove: Deprecate the output of command
• [BREAKING CHANGE] az network nic ip-config address-pool remove: Deprecate the output of command
• [BREAKING CHANGE] az network nic ip-config inbound-nat-rule remove: Deprecate the output of command
• [BREAKING CHANGE] az network lb address-pool tunnel-interface remove: Deprecate the output of command
• [BREAKING CHANGE] az network cross-region-lb address-pool address remove: Deprecate the output of command
• az network private-endpoint-connection: Add provider Microsoft.HardwareSecurityModules/cloudHsmClusters
• Fix #26248: az network dns record-set cname set-record: Declare TTL as integer type
• Fix #26326: az network vnet subnet update: --nat-gateway cannot be set to null
• Fix #26318: az network vnet subnet create: --nsg and --route-table cannot be used as name from Azure Stack

RDBMS

• [BREAKING CHANGE] az mysql/postgres flexible-server create/update: Deprecate Enabled for --high-availability argument
• az mysql flexible-server restore/georestore/replica create: Add --public-access parameter for restore, replication and georestore

Service Bus

• [BREAKING CHANGE] az servicebus georecovery-alias fail-over: Remove --parameters argument
• [BREAKING CHANGE] az servicebus namespace network-rule: This command group is removed and replaced by az servicebus namespace network-rule-set
• [BREAKING CHANGE] az servicebus namespace network-rule add: This command is removed and replaced by az servicebus namespace network-rule-set ip-rule/virtual-network-rule add
• [BREAKING CHANGE] az servicebus namespace network-rule remove: This is removed and replaced by az servicebus namespace network-rule-set ip-rule/virtual-network-rule remove
• [BREAKING CHANGE] az servicebus queue update: Remove deprecated parameters --enable-partitioning, --enable-session and --duplicate-detection

Service Connector

• az spring connection create: Enable user-assigned managed identity for spring apps and deprecate Postgresql single server

SQL

• [BREAKING CHANGE] az sql mi link create: Remove --replication-mode argument
• az sql elastic-pool: Add --preferred-enclave-type argument
• az sql mi link update: Fix update command to use PATCH api

Storage

• az storage account blob-service-properties cors-rule: Add new command group to manage blob cors rules

April 25, 2023 - 2

Version 2.48.1

App Service

• Hotfix: Use basic auth with SCM sites if supported, else use AAD auth

April 25, 2023

Version 2.48.0

App Service

• Fix #25642: az functionapp deployment user show: Fix the AttributeError 'function' object has no attribute 'metadata'
• az staticwebapp appsettings: Add --environment-name parameter to allow app setting operation on preview environments
• az functionapp create: Update 'kind' attribute for Centauri function apps

Compute

• Fix #26118: az vm list-ip-addresses: Fix the KeyError when attributes missing in public IP address
• Fix #26164: az vmss update: Fix unexpected error while running the update instance protection command on VMSS flex instances
• Fix #26185: az sig update: Fix issues that is_soft_delete_enabled may not exist
• az vm host resize: Add new command to support resizing dedicated host
• az vm host list-resize-options: Add new command to support getting possible resize options

DMS

• az dms project tack create: Add support for database schema migration

Eventhub

• az eventhubs namespace application-group policy remove: Add upcoming breaking change notification

Network

• az network nic update: Add --ip-configurations to support shorthand syntax
• az network public-ip prefix create: Add parameter --ip-tags
• az network cross-region-lb rule create: Set default value for --enable-tcp-reset and --idle-timeout

RDBMS

• az mysql flexible-server create/update/gtid reset: Add GTID reset and fix public-access

SQL

• az sql midb ledger-digest-uploads: Support SQL Ledger
• az sql mi server-configuration-option: New command group to manage server configuration options

SQL VM

• az sql vm enable-azure-ad-auth/validate-azure-ad-auth: Single mode improvement

Storage

• az storage file/directory: Add --auth-mode login and --backup-intent to support OAuth
• az storage blob sync: Add positional argument extra_options to pass through options to azcopy

April 04, 2023

Version 2.47.0

AKS

• az aks create/update: Add --tier argument will specify the sku tier that customer wants
• az aks nodepool operation-abort: Add new command to support aborting last running operation on nodepool
• az aks operation-abort: Add new command to support aborting last running operation on managed cluster
• az aks create: Raise a ClientRequestError when creating the same cluster again
• az aks create/update: Add new parameter --enable-image-cleaner to enable Image Cleaner service
• az aks create/update: Add new parameter --image-cleaner-interval-hours to set Image Cleaner scanning interval
• az aks create: Add new parameter --network-plugin-mode to support creating Azure CNI Overlay clusters
• az aks create/update: Add new parameter --enable-workload-identity to support enabling workload identity addon
• az aks create: Add new parameter --network-dataplane to support creating Cilium clusters
• az aks update: Add prameter --network-plugin-mode to update the mode of a network plugin
• az aks update: Add prameter --pod-cidr to update the pod CIDR for a cluster

App Config

• az appconfig import/export: Add warning log info to output even when --yes flag is set
• az appconfig kv import: Ensure the case of imported boolean values does not change for string conversion from file

App Service

• Fix #25375: az functionapp deployment source config-zip: Fix the Could not find a 'AzureWebJobsStorage' application setting error
• Fix #25876: az webapp config ssl import: Fix the UnboundLocalError local variable 'cert_name' referenced before assignment
• az functionapp create: Support container app deployments
• az functionapp delete: Add a validation to check whether Azure Functions is not in the Azure Container app environments

ARM

• az deployment group create: Support deployment with bicepparam files
• az resource patch: Add new command to support updating resource by PATCH request
• Fix #25706: az bicep format: Fix the TypeError ensure_bicep_installation() missing 1 required positional argument 'cli_ctx'
• Fix #25715: az bicep install/upgrade: Fix the configparser.NoSectionError: No section: 'bicep'

Compute

• az vm reimage: Add new command to support reimaging a virtual machine
• az vm/vmss create: Deprecate image alias UbuntuLTS and Win2008R2SP1. Please use the image alias including the version of the distribution you want to use. For example: Please use Ubuntu2204 instead of UbuntuLTS

Cosmos DB

• az cosmosdb identity assign: Allow refreshing user assigned identities if they're reassigned to an account

Extension

• az extension add: Add actionable message for extension not found error

Key Vault

• az keyvault region: GA MHSM region commands

Monitor

• az monitor activity-log alert: Adjust help message

NetAppFiles

• az netappfiles volume update: Patch assign snapshotpolicyID

Network

• [BREAKING CHANGE] az network: Clean up irrelevant commands in azure-stack profiles.
• [BREAKING CHANGE] az network application-gateway waf-policy custom-rule: Rename output property applicationGatewayIpConfigurations to applicationGatewayIPConfigurations to keep consistent with the name in API
• az network routeserver create/update: Add parameter --hub-routing-preference
• Drop azure-mgmt-network SDK
• Fix #25784: az network private-link-service update: --lb-frontend-ip-configs cannot be used

RDBMS

• [BREAKING CHANGE] az postgres flexible-server replica create: Fix the behavior of AZ selection in case zone is not passed as parameter
• Fix #368903181: Fix zone selection during creation of replica
• az mysql flexible-server restore/geo-restore: Add parameters to enhance PITR
• az mysql flexible-server replica create: Add parameters to support cross region paired vnet

Service Bus

• az servicebus namespace/topic/queue authorization-rule keys renew/list: Add -n option for --authorization-rule-name to create auth rule

SQL

• az sql server refresh-external-governance-status: New command for refreshing external governance status
• az sql db geo/ltr-backup restore: Add more parameters to geo restore and ltr restore

Storage

• az storage blob copy start: Fix auth issue when providing source uri containing sas token
• az storage container/blob list: Fix MemoryError when service returns less num than requested
• az storage account create: GA partition DNS account support

Synapse

• az synapse spark pool create/update: Update --node-size-family and --node-size allowed values

March 07, 2023

Version 2.46.0

ACR

• az acr token\scope-map: Tokens and Scope-Maps are Generally Available
• az acr manifest: Support oci image index
• az acr cache: Add new command group to manage cache rules
• az acr credential-set: Add new command group to manage credential sets
• Fix #24886: az acr: Improve the 429 error handling for CONNECTIVITY_REFRESH_TOKEN_ERROR

AKS

• az aks check-acr: Fix mariner node missing cert
• Fix #25521: az aks nodepool upgrade: Fix the crashes when the version passed in through the parameter --kubernetes-version is the same as the cluster version
• Fix #25530: az aks nodepool upgrade: Fix agent pool property name used for fetching current k8s version
• az aks create: Add new parameter --pod-cidrs for setting the IP ranges used to allocate IPs to pods
• az aks create: Add new parameter --service-cidrs for setting the K8s service IPs
• az aks create: Add new parameter --ip-families for setting the IP types that should be used in a cluster (IPv4 or IPv6)
• az aks create: Add new parameter --load-balanacer-managed-outbound-ipv6-count for setting the number of IPv6 outbound IPs that AKS should managed for a cluster with IPv6 enabled
• az aks update: Support changing the load balancer managed outbound IPv6 count property
• Fix #22321: az aks get-credentials: Fix path separator for Windows when finding kubeconfig_path

APIM

• Fix #25168: az apim update: Fix the bug that --public-network-access doesn't work to disable public network access

App Service

• az webapp deleted restore: Add new parameter --target-app-svc-plan to support setting app service plan for new azure web app
• Fix #14729: az webapp config ssl upload: Refine error handling for OpenSSL.crypto.Error when obtaining the certificate's thrumbprint failed
• az functionapp create: Add new parameter --environment to support setting the name of container app environment
• az webapp config ssl bind/unbind: Allow user to specify hostname to (un)bind with --hostname
• az webapp config ssl create/upload/import: Allow user to specify certificate name with --certificate-name
• az functionapp create: Add new parameter --environment to support setting the name of container app environment

ARM

• az bicep publish: Update command to support new optional parameter --documentationUri
• Fix #25510: az bicep: Set bicep.use_binary_from_path to false when installed using Azure CLI
• az bicep format: Add new command to support formatting a Bicep file

ARO

• az aro create: Rename the create install-version parameter to version

Compute

• az vmss reimage: Fix the bug that all instances will be reimaged after using --instance-id and add new parameter --instance-ids to replace --instance-id
• az vm create: Support recommending more suitable regions through warning log when creating VM
• az vm/vmss identity assign: Add warning and modify help message for --role: Please note that the default value of --role will be removed in the breaking change release of the fall of 2023, so please specify --role and --scope at the same time when assigning a role to the managed identity.

Container

• az container create: Add new parameters --priority, --sku and --cce-policy for container group

Cosmos DB

• az cosmosdb container create: GA Client Side Encryption feature
• az cosmosdb container update: Fix updates failure for containers with client encryption policy
• az cosmosdb restore: Add --gremlin-databases-to-restore, --tables-to-restore parameters to support restore of gremlin and table accounts
• az cosmosdb gremlin restorable-resource list: New command that list restorable gremlin resources
• az cosmosdb gremlin restorable-database list: New command that list restorable gremlin databases
• az cosmosdb gremlin restorable-graph list: New command that list restorable graphs under a gremlin database
• az cosmosdb gremlin retrieve-latest-backup-time: New command that retrieve latest backup time for a graph under a database
• az cosmosdb table restorable-resource list: New command that list restorable table resources
• az cosmosdb table restorable-table list: New command that list restorable tables
• az cosmosdb table retrieve-latest-backup-time: New command that retrieve latest backup time for a table

Deployment Manager

• [BREAKING CHANGE] az deploymentmanager: Remove command module since it is no longer maintained by service

Key Vault

• az keyvault create/update-hsm: Add --public-network-access for MHSM creating or updating

Network

• [BREAKING CHANGE] az network lb address-pool create/update: Replace preview argument --backend-addresses-config-file and --config-file by --backend-addresses which supports Json, files and shorthand syntax formats
• [BREAKING CHANGE] az network lb address-pool: Output properties privateIpAddress, privateIpAddressVersion, privateIpAllocationMethod, publicIpAddress and publicIpPrefix are renamed by privateIPAddress, privateIPAddressVersion, privateIPAllocationMethod, publicIPAddress and publicIPPrefix to keep consistent with the name in API
• [BREAKING CHANGE] az network cross-region-lb probe: Deprecate command group as probes are not supported for global load balancer
• [BREAKING CHANGE] az network nic create/update: Rename output property enableIpForwarding to enableIPForwarding to keep consistent with the name in API
• [BREAKING CHANGE] az network nic create/update: Rename output property privateIpAllocationMethod to privateIPAllocationMethod to keep consistent with the name in API
• [BREAKING CHANGE] az network nic create/update: Rename output property publicIpAddress to publicIPAddress to keep consistent with the name in API
• [BREAKING CHANGE] az network lb: Update output property names in 2017-03-09-profile, 2018-03-01-hybrid, 2019-03-01-hybrid and 2019-03-01-hybrid profiles to keep consist with the latest profile.
• [BREAKING CHANGE] az network cross-region-lb: Remove in 2017-03-09-profile, 2018-03-01-hybrid, 2019-03-01-hybrid and 2019-03-01-hybrid profiles.
• [BREAKING CHANGE] az network nic ip-config: Rename output property privateIpAddress to privateIPAddress to keep consistent with the name in API
• [BREAKING CHANGE] az network nic ip-config: Rename output property privateIpAllocationMethod to privateIPAllocationMethod to keep consistent with the name in API
• [BREAKING CHANGE] az network local-gateway: Update output property names in 2017-03-09-profile, 2018-03-01-hybrid, 2019-03-01-hybrid and 2019-03-01-hybrid profiles to keep consist with the latest profile.
• [BREAKING CHANGE] az network vpn-connection: Update output property names in 2017-03-09-profile, 2018-03-01-hybrid, 2019-03-01-hybrid and 2019-03-01-hybrid profiles to keep consist with the latest profile.
• [BREAKING CHANGE] az network vnet-gateway: Update output property names in 2017-03-09-profile, 2018-03-01-hybrid, 2019-03-01-hybrid and 2019-03-01-hybrid profiles to keep consist with the latest profile.
• [BREAKING CHANGE] az network nic: Update output property names in 2017-03-09-profile, 2018-03-01-hybrid, 2019-03-01-hybrid and 2019-03-01-hybrid profiles to keep consist with the latest profile
• [BREAKING CHANGE] az network watcher flow-log: Remove the deprecated command configure
• [BREAKING CHANGE] az network vrouter: Deprecate vrouter and use routeserver instead
• [BREAKING CHANGE] az network watcher connection-monitor endpoint add: Remove deprecated parameters filter-item and filter-type
• az network nsg rule list: Fix -o table cannot be used
• az network private-endpoint-connection: Add provider Microsoft.Monitor/Accounts
• az network express-route gateway connection create/update: Add parameters --inbound-route-map and --outbound-route-map to support route map
• Fix #25408: az network application-gateway rule create: Creation fails with --redirect-config when there are multiple pools
• az network private-endpoint-connection: Add provider Microsoft.DBforMySQL/flexibleServers

Packaging

• Remove openssl1.1-compat and use openssl-dev in docker image
• Support ARM64 on Linux

PolicyInsights

• Fix #25538: az policy remediation create: Fix the Required property 'policyAssignmentId' not found in JSON error

RDBMS

• az postgres flexible-server migration: Use Cloud supplied URL's rather than hardcoded management URL's
• az mysql flexible-server replica create: Add --location to support specifying replica location
• az mysql flexible-server update: Fix --storage-auto-grow parameter unable to be set

Role

• az role assignment create: Show warning if --scope argument is not specified: --scope argument will become required for creating a role assignment in the breaking change release of the fall of 2023. Please explicitly specify --scope.
• Migrate azure-mgmt-authorization SDK to Track 2 and bump API version to 2022-04-01

Service Bus

• az servicebus namespace: Add --premium-messaging-partitions to support ServiceBus Namespace ScaleSet

Service Connector

• az connection create: Add new param --customized-keys

SQL

• az sql instance-failover-group: Add --secondary-type parameter to create and update commands
• az sql midb restore: Add tags parameter
• az sql mi create/update: Add --zone-redundant to support zone redundancy
• az sql db tde-key revalidate/revert: New commands to revert and revalidate the TDE protector key for the database and SQL server
• az sql db create/update/show: Add --keys, --encryption-protector, --assign-identity, --user-assigned-identity-id parameters to support Per DB CMK

SQL VM

• az sql vm create/update: Deprecate --sql-mgmt-type argument
• az sql vm update: Update no longer requires the mode to be sent as full
• az sql vm enable-azure-ad-auth/validate-azure-ad-auth: New commands for Sqlvm Azure AD authentication

Storage

• az storage blob copy start-batch: Add --destination-blob-type and --tier
• Fix #25402: az storage account network-rule: Support adding and removing multiple IPs

February 07, 2023

Version 2.45.0

ACR

• [BREAKING CHANGE] acr manifest list-referrers: Support OCI reference types and remove ORAS artifact reference types
• az acr check-name: Make command work with different profile

AKS

• Make ContainerInsights DataCollectionRuleName consistent with Portal and other onboarding clients
• az aks upgrade: Show warning if the Kubernetes version isn't supplied
• az aks create: Deprecate parameters --aad-client-app-id, --aad-server-app-id and --aad-server-app-secret
• az aks update-credentials: Deprecate parameters --reset-aad, --aad-client-app-id, --aad-server-app-id and --aad-server-app-secret

App Service

• az webapp create-remote-connection: Update the host address of SSH tunnel from 0.0.0.0 to 127.0.0.1
• Add support to create ASPs with Memory Optimized Workers
• Fix #17720: az functionapp function: Add new command to list functions in a function app
• Fix #24285: az webapp config access-restriction add: Fix the bug that it does not support more than one Front Door ID in X-Azure-FDID
• Fix #23603: az functionapp config set: Add new parameter to set PowerShell version
• az webapp config appsettings: Register settings as deployment slot setting anytime when using --slot-settings
• az webapp config backup delete: Add new command to delete a backup of the webapp

ARM

• az bicep: Add configuration bicep.use_binary_from_path. Possible values include if_running_in_ci (default) and Booleans
• az bicep: Add configuration bicep.check_version that accepts Boolean values. If set to False, version checks for Bicep CLI will be disabled
• az deployment what-if: Fix an issue where formatting nested array changes throws an exception
• Fix #25022: az resource tag: Fix the issue of the serializedData field is missing or null when updating tag for Microsoft.insights/workbooks

ARO

• az aro create/update: Add NetworkContributor role to NAT Gateways in Cluster Resource Group when creating or updating clusters
• az aro create: Change --pull-secret parameter to no longer require @ prefix on filenames

Backup

• az backup vault: Add new parameter --public-network-access to support enabling public network access for the backup vault
• az backup vault create: Add new parameter --immutability-state to support configuring immutability settings for the backup vault

Batch

• Fix #24007: az batch pool create: Fix bug that caused 'MissingRequiredProperty' error when parameter --encryption-key-identifier is used

Compute

• az image builder identity assign: Add this command to add managed identity to an existing image builder template
• az image builder identity remove: Add this command to remove managed identity from an existing image builder template
• az image builder identity show: Add this command to display managed identity of an existing image builder template
• az vmss reimage: Let --instance-id support multiple ids
• Fix #25308: az disk create: Fix help message for creating a standard disk for uploading blobs
• az vmss create/update: Add new parameter --enable-osimage-notification to support enabling OS image scheduled event
• az vmss create: Add new parameter --max-surge to support enabling rolling upgrade policy max surge

Cosmos DB

• az managed-cassandra datacenter update: Add support to update --sku

DMS

• az dms project task create: Update DMS MySQL API to support new migration types

Feedback reference

• Stop including error messages in the feedback body

IoT

• az iot hub wait: Add wait commands
• az iot hub delete: Fix functionality issue for parameter --no-wait

Key Vault

• az keyvault security-domain restore-blob: Support restoring blob offline
• az keyvault security-domain upload: Add --restore-blob to prevent exposing keys in online environment

NetAppFiles

• az netappfiles volume update: Fix volume patch dataprotection props

Network

• [BREAKING CHANGE] az network application-gateway ssl-profile: Rename output property verifyClientCertIssuerDn to verifyClientCertIssuerDN to keep consistent with the name in API
• [BREAKING CHANGE] az network cross-region-lb frontended-ip: Rename output properties with publicIp prefix to publicIP prefix to keep consistent with the names in API response
• [BREAKING CHANGE] az network lb frontended-ip: Rename output properties with publicIp prefix to publicIP prefix to keep consistent with the names in API response
• [BREAKING CHANGE] az network lb frontended-ip: Rename output properties with privateIp prefix to privateIP prefix to keep consistent with the names in API response
• [BREAKING CHANGE] az network lb inbound-nat-pool: Rename output property enableFloatingIp to enableFloatingIP to keep consistent with the name in API
• [BREAKING CHANGE] az network lb inbound-nat-pool: Rename output property frontendIpConfiguration to frontendIPConfiguration to keep consistent with the name in API
• [BREAKING CHANGE] az network lb inbound-nat-rule: Rename output property enableFloatingIp to enableFloatingIP to keep consistent with the name in API
• [BREAKING CHANGE] az network lb inbound-nat-rule: Rename output property frontendIpConfiguration to frontendIPConfiguration to keep consistent with the name in API
• [BREAKING CHANGE] az network lb rule: Rename output property enableFloatingIp to enableFloatingIP to keep consistent with the name in API
• [BREAKING CHANGE] az network lb rule: Rename output property frontendIpConfiguration to frontendIPConfiguration to keep consistent with the name in API
• [BREAKING CHANGE] az network cross-region-lb rule: Rename output property enableFloatingIp to enableFloatingIP to keep consistent with the name in API
• [BREAKING CHANGE] az network cross-region-lb rule: Rename output property frontendIpConfiguration to frontendIPConfiguration to keep consistent with the name in API
• [BREAKING CHANGE] az network lb outbound-rule: Rename output property frontendIpConfigurations to frontendIPConfigurations to keep consistent with the name in API
• [BREAKING CHANGE] az network cross-region-lb address-pool: Rename output property loadBalancerFrontendIpConfiguration to loadBalancerFrontendIPConfiguration to keep consistent with the name in API
• [BREAKING CHANGE] az network cross-region-lb address-pool create: Replace preview argument --backend-addresses-config-file --config-file by --backend-addresses which supports Json, files and shorthand syntax formats
• [BREAKING CHANGE] az network bastion: Move Azure Bastion to Azure CLI Extension bastion
• Fix #25130: az network list-usages: -o table cannot be used
• Fix #25124: az network vnet-gateway create: Active-Active gateway fails with insufficient IP configurations
• az network dns zone export: Fix the export to emit all ALIAS records for a particular record set name
• az network public-ip create: Add parameter --ddos-protection-plan to link a DDoS protection plan to public IP
• Fix #25181: az network nsg rule create: Use * as default value for protocol
• az network cross-region-lb address-pool update: Add new command to update an address-pool

PolicyInsights

• az policy attestation: Add new command groups to manage resource policy attestation

RDBMS

• az mysql flexible-server create/update: Add --auto-scale-iops to enable or disable autoscale of iops
• az mysql flexible-server start/stop: Add no-wait support
• az postgres flexible-server start/stop: Add no-wait support
• az postgres flexible-server migration: Change behavior of cancel/cutover and added Offline Flag for FMS based migrations

Service Bus

• az servicebus topic subscription rule create/update: Add --correlation-filter to support custom filters

SQL

• az sql midb recover: Add support for managed database recover creation option
• az sql recoverable-midb show: Add support for getting geo replicated backup
• az sql recoverable-midb list: Add support for listing geo replicated backups
• az sql db geo-backup restore/show/list: New commands to manage geo redundant backups
• az sql db threat-policy: Change expiration version for cmd group to 2.49.0
• az sql mi dtc: Add managed instance DTC commands
• az sql midb restore: Add support for cross-subscription restore
• az sql db geo/ltr-backup restore: Add service objective parameter to ltr restore and geo restore

Storage

• az storage account create: Ongoing breaking change warning for disallowing blob public access by default
• az storage container immutability-policy create: Allow user to not specify --resource-group

January 11, 2023

Version 2.44.1

Network

• Hotfix: Fix #25086: az network lb probe: Expose parameter --probes

January 10, 2023

Version 2.44.0

ACR

• az acr manifest: Support oci artifact manifest

AKS

• az aks create: Add new parameter --data-collection-settings to support for AKS Monitoring Addon in MSI auth mode
• az aks install-cli: Automatically add the installation directories to system path on windows
• az aks create/update: Add support for KEDA workload auto-scaler

APIM

• az apim api create: Parse URL to detect Protocol and API type

App Service

• Fix #23488: az appservice plan create: Fix zone redundant ASP creation fails for ASEv3
• Fix #24858: Support for new isolated v2 (I4v2, I5v2, I6v2) SKUs
• az appservice ase upgrade/send-test-notification: Add new commands for ASE to support ASE upgrade and sending test notifications
• az appservice ase update: Add --allow-incoming-ftp-connections to allow incoming FTP connections
• az appservice ase update: Add --allow-remote-debugging to allow remote debugging
• Fix #19893: az appservice plan create: Fix the bug that cannot create app plan in a different subscription for ASEv3
• Fix #16478: az functionapp cors credentials: Add enable/disable CORS creds commands
• Fix #22934: az functionapp delete: Add new parameter --keep-empty-plan to support keeping empty app service plan
• Fix #19469: az functionapp vnet-integration add: Add consumption plan validation
• az staticwebapp functions link: Add new parameter --environment-name to support setting the environment name of static site

ARM

• Fix #24810: Support ARM64 architecture for Bicep installation

Batch

• az batch pool create/set: Add new parameter --target-communication to support setting the desired node communication mode for the pool

Compute

• Fix #24896: az vm create: Fix the bug that the VM cannot be created from ACG image to other resource group
• az disk create: Add new parameter --performance-plus to support boosting the performance target
• az vm list: Add new paramter --vmss to support querying VM instances in a specific VMSS
• az sig image-version create/update: Add parameters --target-edge-zone-encryption and --target-edge-zones to support edge zones

Container

• az container export: Fix export when identity is set

Key Vault

• az keyvault key create: Support OKP key and Ed25519 curve

Monitor

• [BREAKING CHANGE] az monitor action-group test-notifications create: Remove notification in resource group and subscription level
• az monitor diagnostic-settings create: Create with resource id and export without workspace

NetAppFiles

• az volumes qouta-rule create: Add volume quota rule create command
• az volumes qouta-rule show: Add volume quota rule show command
• az volumes qouta-rule list: Add volume quota rule list command
• az volumes qouta-rule update: Add volume quota rule update command
• az volumes qouta-rule delete: Add volume quota rule delete command

Network

• az network vnet-gateway create: Add parameter --edge-zone-vnet-id for local gateway
• Fix #24853: az network nsg rule create: --destination-asgs and --source-asgs cannot be used
• Fix #24883: az network application-gateway stop/start: Add missed parameter --ids
• az network watcher packet-capture create: Resolve local path issue for Linux VM
• az network lb update: Expose parameter --tags

Redis

• az redis import/export: Add new optional parameter --preferred-data-archive-method
• az redis server-link: Linked server has two new properties: geoReplicatedPrimaryHostName and primaryHostName

Security

• az security alert update: --status now support resolve and inprogress

Service Connector

• az connection: Support local connection which allows local environment to connect Azure resource
• Fix #24806: az webapp connection create mysql-flexible: Fix mysql connection command with --system-identity

SQL

• az sql server/db/mi/midb advanced-threat-protection-setting show/update: Support advanced-threat-protection-setting commands
• az sql db threat-policy: Declare deprecation of this command group in version 2.45.0
• az sql db: Add --preferred-enclave-type argument

Storage

• az storage blob copy start: Fix --tier to support setting blob tier when copying

December 06, 2022

Version 2.43.0

Core

• aaz: Fix has_value function for list, dict and object arg types (#24625)
• aaz: Support argument preview and experimental (#24637)
• aaz: Add registered property for AAZBaseArg (#24640)
• aaz: Add aazlist and aazdict args transform help functions (#24690)
• aaz: Support camel case key in AAZObjectType (#24771)
• Disable removing and updating system extension in Cloud Shell (#24361)

AKS

• az aks enable-addons: Add --enable-syslog parameter to monitoring addon
• az aks nodepool: Unify the option names used to specify the nodepool name and cluster name. For nodepool name, option names are --nodepool-name, --name and -n. For cluster name, option name is --cluster-name
• az aks nodepool add: Support the new SKU Mariner for parameter --os-sku

App Config

• az appconfig: Update raised errors in app config command module

App Service

• az staticwebapp backends link: Link an backend to a static webapp. Also known as "Bring your own Backend."
• az staticwebapp backends unlink: Unlink backend from a static webapp
• az staticwebapp backends show: Show details on the backend linked to a static webapp
• az staticwebapp backends validate: Validate an backend for a static webapp
• az webapp config snapshot restore: Fix the AttributeError str object has no attribute get
• az appservice plan create/update: Add new environment SKU for parameter --sku
• az staticwebapp create: Add new parameter --login-with-ado to create azure dev ops token automatically
• Fix #24506: az functionapp keys set/delete: Update the wrong accepted parameter value systemKey to systemKeys for --key-type
• az webapp create: Add --public-network-access parameter to support enabling public access
• az staticwebapp hostname show: Fix dns-txt-token validation command to show command
• Fix #24620: az webapp create: Improve the error message to show that the az webapp list-runtimes command depends on the specified runtime

ARM

• az deployment mg create: Add new parameter --mode to support setting the mode for deploying resources
• az group lock list: Mark the --resource-group as required in help message
• az bicep install: Address issue installing bicep on non-musl default systems with musl

Backup

• az backup restore restore-disks: Allow --disk-encryption-set-id for cross region restore

Compute

• Fix #24624: az sig image-version create: Fix the error that the --os-vhd-storage-account must be a managed disk or snapshot

IoT

• Fix #22257: az iot dps linked-hub create: Improve error handling for linked hubs
• az iot hub create/delete: Add --no-wait parameter to support no wait operation

Key Vault

• az keyvault: Add check-name command, support Security Domain Properties

Monitor

• az monitor diagnostic-settings: Add --marketplace-partner-id parameter

Network

• az network bastion rdp: Allow rdp session customization
• az network private-endpoint-connection: Enable private link support for provider Microsoft.DesktopVirtualization/hostpools and Microsoft.DesktopVirtualization/workspaces
• az network application-gateway: Support OCSP revocation check on client certificate
• az network traffic-manager endpoint: Add --always-serve to manage the health check on endpoints
• az network public-ip create: Fix --ip-tags cannot be used
• az network private-endpoint-connection: Add Provider Microsoft.MachineLearningServices/registries

RDBMS

• az postgres flexible-server geo-restore/replica: Introduce read replicas and geo-restore
• az postgres flexible-server upgrade: Add major version upgrade for PostgreSQL flexible server
• az postgres flexible-server create/update/restore/replica: Postgres flex byok
• az postgres flexible-server identity: Add user managed identity operations for PostgreSQL flexible server
• az postgres flexible-server create/update/ad-admin: Add Azure Active Directory Administrator operations for PostgreSQL flexible server

Service Connector

• az webapp/spring/containerapp connection create mysql: Deprecate mysql single server connection command

SQL

• az sql server ipv6-firewall-rule: Add new command group for AZ SQL server IPv6 firewall rule

SQL VM

• az sql vm update: Deprecate the --yes prompt to upgrade SqlIaaSAgent extension to full mode
• az sql vm create/update: Add --least-privilege-mode to take minimal permissions on their SQL Server
• az sql vm group create/update: Add --cluster-subnet-type to support High Availability configuration

Storage

• Fix #23893, #24528: az storage account show-connection-string/keys renew: Fix resource group auto completion
• Fix #23216: az storage file upload-batch: Fix --dryrun to show correct file paths
• az storage blob copy start: Add --destination-blob-type to allow switching between blob types when copying
• az storage account encryption-scope list: Add --filter, --include, --maxpagesize to support advanced list
• az storage account failover: Add --failover-type to support planned failover

November 01, 2022

Version 2.42.0

ACR

• az acr task update: Fix logic issue for updating encoded task

AKS

• Fix #24188: az aks list: Fix pagination handling error ContainerServiceClientConfiguration object has no attribute api_version when there are many list results
• Fix #24188: az aks nodepool list: Fix pagination handling error ContainerServiceClientConfiguration object has no attribute api_version when there are many list results
• az aks create/update: Add new parameters --enable-blob-driver and --disable-blob-driver to enable/disable Blob CSI Driver
• az aks create/update: Add new parameter --enable-oidc-issuer to support enabling oidc issuer feature
• az aks oidc-issuer rotate-signing-keys: Add new command to support rotating oidc issuer service account signing keys

APIM

• az apim create/update: Add --public-network-access to support specifying whether or not public endpoint access is allowed for this API management service
• az apim create/update: Add --disable-gateway to support disabling gateway in the master region

App Config

• az appconfig: Update raised errors in app config command module

App Service

• Fix #23050: az functionapp deployment source config-zip: Fix the bug that zip deployment will fail if app settings contain any values of null

Backup

• az backup restore restore-disks: Update Cross Zonal Restore behaviour for ZRS vaults and primary region CRR scenarios
• az backup job show: Change subtask start/end time from minimum value to null for ongoing or yet-to-start operation

Compute

• az vm run-command create/update: Change help messages and add examples for --output-blob-uri parameter to illustrate that --output-blob-uri must be SAS URI
• Fix #24187: az vm list: Fix the AttributeError 'ComputeManagementClientConfiguration' object has no attribute 'api_version'
• az vm extension list: Add new parameter --ids to support listing extensions by VM id
• az sig image-version create/update: Add --allow-replicated-location-deletion to support removing gallery image version from replicated regions
• Fix #24263: az snapshot create: Fix the KeyError 'IMPORT_ENUM' when creating snapshot from source blob uri
• az sig image-version update: Support excludeFromLatest for --add parameter to exclude this image version when using the latest version of image definition
• az sig image-version update: Support safetyProfile.allowDeletionOfReplicatedLocations for --set parameter to allow users to remove the gallery image version from replicated regions

HDInsight

• [BREAKING CHANGE] az hdinsight create: Remove the enum value 1.0 and 1.1 from the --minimal-tls-version, HDInsight doesn't support TLS version which is less than 1.2 now.

IoT

• az iot hub create: Enforce data residency property on hubs created in qatarcentral

NetAppFiles

• az netappfiles account renew-credentials: Add renew-credentials command to renew identity credentials that are used to authenticate to key vault, for customer-managed key encryption

Network

• az network public-ip: Add alias --ddos-protection-mode to --protection-mode
• az network custom-ip prefix: Add parameters --asn, --geo, --no-internet-advertise and so on
• Fix #21551: az network nic ip-config update: ASGs update with multiple IP configurations
• Fix #24169: az network application-gateway waf-policy managed-rule exclusion rule-set remove: Remove exclusion with different matchers
• Fix #24377: az network public-ip create: Derive Public IPs in different resource group from Public IP Prefix
• az network lb probe: Support probe threshold via --probe-threshold

RDBMS

• [BREAKING CHANGE] az postgres flexible-server migration show: Remove --level parameter
• [BREAKING CHANGE] az postgres flexible-server migration delete: Remove this command. Deleting a migration is not supported for now.
• [BREAKING CHANGE] Change az postgres flexible-server migration update --cutover to az postgres flexible-server migration update --cutover db1 db2 db3
• az postgres flexible-server migration create: Add --migration-mode to support offline and online(with CDC) migrations. Default mode when --migration-mode not passed will be offline.
• Add az postgres flexible-server migration update --cancel db1 db2 db3 to cancel a migration.

Resource

• az resource delete: Add new parameter --no-wait to support not waiting the long-running operation to finish

Role

• az role assignment create: Support bring-your-own role assignment name
• az role assignment delete: If --ids is provided, ignore other arguments, instead of raising error

SQL

• az sql midb log-replay start: Add --storage-identity parameter

Storage

• az storage account show-connection-string/keys renew: Update options for --key parameter
• az storage account create/update: GA --key-vault-federated-client-id

Synapse

• az synapse workspace create: Add parameter --managed-resource-group-name
• az synapse spark pool: Add parameter --enable-dynamic-executor-allocation

October 11, 2022

Version 2.41.0

Core

• Support Continuous Access Evaluation
• PREVIEW: Support Web Account Manager (WAM) login on Windows. To opt in, run az config set core.allow_broker=true
• Revert #23514: Rename entry script az.ps1 to azps.ps1
• aaz: Support yaml file as value for compound arguments
• aaz: Fix recursion depth exceeded for to_serialized_data of AAZObject
• aaz: Support customized life cycle callback functions for AAZCommand
• aaz: Fix two AAZObjects or AAZDicts comparison

ACS

• [BREAKING CHANGE] az acs: Remove the deprecated command group

AD

• Support special characters in user principal name

AKS

• Fix #23779: az aks install-cli: Support determining the arch of binaries based on system information

APIM

• Fix #20863: az apim api import: Fix the issue to import GraphQL API's using graphqllink

App Config

• [BREAKING CHANGE] az appconfig kv import: Add validation to JSON file import to ensure that only valid JSON objects are imports
• [BREAKING CHANGE] az appconfig kv export: Update the array conversion logic to prevent dropping keys during export
• az appconfig kv export: Fix MemoryError while exporting large stores
• az appconfig replica: New command group to support geo-replication
• az appconfig kv export: Support exporting app configuration settings as references to App Service
• az appconfig kv import: Ensure app configuration references are not imported from App Service
• az appconfig feature filter update: Add new command to support updating functionality for feature filters

App Service