Az

Author(s)

• Microsoft Corporation

Tags

Azure ARM ResourceManager Linux AzureAutomationNotSupported

PSEditions

Core Desktop

Dependencies

• • Az.Accounts (>= 5.5.3)
  • Az.Advisor (= 3.0.0)
  • Az.Aks (= 7.2.1)
  • Az.AnalysisServices (= 1.3.0)
  • Az.ApiManagement (= 4.2.0)
  • Az.App (= 2.0.1)
  • Az.AppConfiguration (= 2.2.0)
  • Az.ApplicationInsights (= 3.0.0)
  • Az.ArcResourceBridge (= 2.0.0)
  • Az.ArizeAI (= 1.0.0)
  • Az.Attestation (= 3.1.0)
  • Az.Automanage (= 2.0.0)
  • Az.Automation (= 1.12.1)
  • Az.Batch (= 4.1.1)
  • Az.Billing (= 2.3.0)
  • Az.Cdn (= 6.2.0)
  • Az.CloudService (= 3.0.0)
  • Az.CognitiveServices (= 1.17.1)
  • Az.Compute (= 11.9.0)
  • Az.ConfidentialLedger (= 2.0.0)
  • Az.ConnectedMachine (= 1.1.1)
  • Az.ContainerInstance (= 5.0.0)
  • Az.ContainerRegistry (= 5.1.0)
  • Az.CosmosDB (= 1.22.0)
  • Az.DataBoxEdge (= 1.3.0)
  • Az.Databricks (= 2.0.0)
  • Az.DataFactory (= 1.20.1)
  • Az.DataLakeAnalytics (= 1.2.0)
  • Az.DataLakeStore (= 1.6.0)
  • Az.DataMigration (= 1.1.1)
  • Az.DataProtection (= 3.0.1)
  • Az.DataShare (= 1.2.0)
  • Az.DataTransfer (= 1.0.0)
  • Az.DesktopVirtualization (= 6.0.0)
  • Az.DevCenter (= 3.0.0)
  • Az.DeviceRegistry (= 1.0.0)
  • Az.DevTestLabs (= 1.2.0)
  • Az.Dns (= 2.2.0)
  • Az.DnsResolver (= 2.0.0)
  • Az.ElasticSan (= 1.7.0)
  • Az.EventGrid (= 2.2.0)
  • Az.EventHub (= 5.6.0)
  • Az.Fabric (= 1.0.0)
  • Az.FileShare (= 1.0.0)
  • Az.FirmwareAnalysis (= 1.0.0)
  • Az.FrontDoor (= 2.3.0)
  • Az.Functions (= 5.0.1)
  • Az.HDInsight (= 6.5.0)
  • Az.HealthcareApis (= 3.0.0)
  • Az.HealthDataAIServices (= 1.0.0)
  • Az.IotHub (= 2.9.2)
  • Az.KeyVault (= 6.6.1)
  • Az.Kusto (= 3.0.0)
  • Az.LambdaTest (= 1.0.0)
  • Az.LoadTesting (= 2.0.0)
  • Az.LogicApp (= 1.7.0)
  • Az.MachineLearning (= 1.3.0)
  • Az.MachineLearningServices (= 2.0.0)
  • Az.Maintenance (= 1.6.0)
  • Az.ManagedServiceIdentity (= 2.0.0)
  • Az.ManagedServices (= 4.0.0)
  • Az.MarketplaceOrdering (= 2.2.0)
  • Az.Migrate (= 3.0.0)
  • Az.Monitor (= 8.0.0)
  • Az.MySql (= 2.0.0)
  • Az.NetAppFiles (= 1.4.1)
  • Az.Network (= 8.2.0)
  • Az.NetworkCloud (= 3.0.0)
  • Az.Nginx (= 2.0.0)
  • Az.NotificationHubs (= 1.3.0)
  • Az.OperationalInsights (= 3.4.1)
  • Az.Oracle (= 2.0.0)
  • Az.PolicyInsights (= 2.0.0)
  • Az.PowerBIEmbedded (= 2.2.0)
  • Az.PrivateDns (= 1.3.0)
  • Az.RecoveryServices (= 7.14.1)
  • Az.RedisCache (= 1.12.0)
  • Az.RedisEnterpriseCache (= 2.0.0)
  • Az.Relay (= 3.0.0)
  • Az.ResourceGraph (= 1.3.0)
  • Az.ResourceMover (= 2.0.0)
  • Az.Resources (= 10.2.0)
  • Az.Security (= 1.10.0)
  • Az.SecurityInsights (= 4.0.0)
  • Az.ServiceBus (= 4.3.0)
  • Az.ServiceFabric (= 5.2.0)
  • Az.SignalR (= 3.0.0)
  • Az.Sql (= 7.1.0)
  • Az.SqlVirtualMachine (= 3.0.0)
  • Az.StackHCI (= 3.0.0)
  • Az.StackHCIVM (= 2.0.0)
  • Az.Storage (= 9.7.2)
  • Az.StorageAction (= 2.0.0)
  • Az.StorageDiscovery (= 1.0.0)
  • Az.StorageMover (= 2.1.0)
  • Az.StorageSync (= 2.6.0)
  • Az.StreamAnalytics (= 3.0.0)
  • Az.Support (= 2.1.0)
  • Az.Synapse (= 3.3.0)
  • Az.TrafficManager (= 1.4.0)
  • Az.Websites (= 4.1.0)
  • Az.Workloads (= 2.0.0)

Release Notes

16.3.0 - September 2026
Az.Accounts
* Fixed 'Get-AzSubscription' to throw a clear error instead of returning nothing when '-TenantId' does not match the current Managed Service Identity (MSI) context. [#25710]

Az.Cdn
* Added ChangeSafety Support

Az.Compute
* Added '-WireServerUseLocalFileRules' and '-ImdsUseLocalFileRules' to 'Set-AzVMProxyAgentSetting' and 'Set-AzVmssProxyAgentSetting' to configure local file rules for Virtual Machine (VM) and Virtual Machine Scale Set (VMSS) host endpoints. [#30055]
* Updated ComputeRP, DiskRP, and GalleryRP cmdlets to API versions 2026-04-01, 2026-03-02, and 2025-12-03, respectively.
* Added '-ProcessorMode' to VM and VMSS create and update cmdlets: 'New-AzVMConfig', 'New-AzVM', 'Update-AzVM', 'New-AzVmssConfig', 'New-AzVmss', and 'Update-AzVmss'. [#30012]
* Added '-ForceDeallocate' to 'Stop-AzVM' to force deallocate a VM during stop; it cannot be used with '-Hibernate', '-StayProvisioned', or '-SkipShutdown'.
* Added '-ReservationType' to 'New-AzCapacityReservationGroup' and 'Update-AzCapacityReservationGroup' for 'Open' capacity reservation groups, and exposed 'ReservationType' in output.
* Added '-DisableCapacityReservationAssignment' to 'New-AzVM', 'New-AzVMConfig', and 'Update-AzVM' to opt a VM out of capacity reservation.
* Added 'CapacityReservationType' to 'Get-AzVM -Status' instance views.
* Added '-DisableCapacityReservationAssignment' to 'New-AzVmss', 'New-AzVmssConfig', and 'Update-AzVmss' to opt VMSS instances out of capacity reservation.
* Added 'CapacityReservation' property to 'Get-AzVmssVM' output and 'CapacityReservationType' property to its '-InstanceView' output.

Az.CosmosDB
* Regenerated the Cosmos DB management SDK with stable API version 2026-03-15.

Az.IotHub
* Fixed 'New-AzIotHubKey' to generate secure shared access keys during primary or secondary key rotation.

Az.KeyVault
* Upgraded the Key Vault control plane API version to '2026-02-01'.
   - Earlier API versions retire on 27 February 2027; this upgrade keeps 'Az.KeyVault' working afterward.
   - No action or cmdlet behavior change is required. 'New-AzKeyVault' has created vaults with RBAC (Role-Based Access Control) enabled by default since Az.KeyVault 6.0.0 and sends this setting explicitly, so the new service default does not affect it. Use 'DisableRbacAuthorization' for access policies.

Az.NetAppFiles
* Added deprecation notices to Azure NetApp Files subvolume cmdlets
* Added breaking change notices for removing 'EnableSubvolume' and the 'EnableSubvolumes' volume output property
* Fixed the output type of 'Get-AzNetAppFilesVolumeQuotaRule' from 'PSNetAppFilesVolume' to 'PSNetAppFilesVolumeQuotaRule'

Az.Network
* Added 'Get-AzExpressRouteLag', 'New-AzExpressRouteLag', 'Set-AzExpressRouteLag', 'Remove-AzExpressRouteLag', 'New-AzExpressRouteLagLOA', 'Get-AzExpressRouteLagLink', and 'Get-AzExpressRouteLagMember' for 'ExpressRouteLag' resources (Microsoft.Network 2025-09-01 API).
   - The cmdlets support CRUD operations, letter of authorization generation, and link and member retrieval.
   - Added 'New-AzExpressRouteLagIdentity', 'Get-AzExpressRouteLagIdentity', 'Set-AzExpressRouteLagIdentity', and 'Remove-AzExpressRouteLagIdentity' for the user-assigned managed identity on an 'ExpressRouteLag'.
* Added 'Get-AzAddressPrefixSet', 'New-AzAddressPrefixSet', 'Set-AzAddressPrefixSet', and 'Remove-AzAddressPrefixSet' to manage IPv4 and IPv6 CIDR (Classless Inter-Domain Routing) prefixes for application security groups.
* Added 'Move-AzVirtualNetworkIpConfiguration' to move secondary private IP configurations between network interfaces in a virtual network, and 'New-AzMoveIpConfigurationItem' to create source and target pairs. Supports '-AsJob'.
* Added '-AddressPrefixV6' to 'New-AzVirtualHub' and 'Update-AzVirtualHub', and '-EnableOnlyIpv6Peering' to 'New-AzVirtualHubVnetConnection'.
* Added support for managing Kube Selector Groups on a firewall policy.
   - 'Get-AzFirewallPolicyKubeSelectorGroup', 'New-AzFirewallPolicyKubeSelectorGroup', 'Set-AzFirewallPolicyKubeSelectorGroup', 'Remove-AzFirewallPolicyKubeSelectorGroup'.
   - Added 'New-AzFirewallPolicyKubeLabelSelector' and 'New-AzFirewallPolicyLabelSelectorExpression' for pod and namespace label selectors.
* Exposed read-only AFC (Azure Firewall for Containers) properties: 'AfcManaged' on 'Get-AzFirewallPolicy' and the 'AfcConfiguration.ServiceEndpoint' control-plane endpoint on 'Get-AzFirewall'. The endpoint cannot be set through 'New-AzFirewall' or 'Set-AzFirewall'.
* Upgraded Network SDK to API version '2025-09-01'; added 'DisableDefaultServerHeaderInResponse' to 'Get-AzApplicationGateway' output and '-DisableDefaultServerHeaderInResponse' to 'New-AzApplicationGateway'.
* Added read-only 'UpgradedToV2' output to 'Get-AzPublicIpAddress' and 'Get-AzPublicIpPrefix' for Standard-to-StandardV2 SKU upgrades.
* Added 'Get-AzInterconnectGroup' to retrieve one or more InterconnectGroups, and 'New-AzInterconnectGroup', 'Set-AzInterconnectGroup', and 'Remove-AzInterconnectGroup' to create, update, and delete them.
   - Added 'Get-AzInterconnectGroupSubgroup' to retrieve one or all subgroups and 'Get-AzInterconnectGroupNodeAvailability' to retrieve node availability.
* Added '-DdosCustomPolicyId' and '-RemoveDdosCustomPolicy' to 'Set-AzPublicIpAddress' to add or remove DDoS custom policy (DCP) associations on supported Public IP address attachments, without requiring a specific DDoS protection mode.
* Added 'New-AzFirstPartyServiceTag', 'Get-AzFirstPartyServiceTag', 'Set-AzFirstPartyServiceTag', and 'Remove-AzFirstPartyServiceTag' to create, retrieve, update, and remove First Party Service Tags, and association support to 'New-AzPublicIpTag'.
* Added 'Get-AzVirtualNetworkGatewayEffectiveRoute' for Virtual Network Gateway effective routes.
* Added '-Mode' and '-Scope' to 'New-AzLoadBalancer'. Use '-Mode Advanced' with '-Scope Public' or '-Scope Private' to create an advanced (Banksy-based) Standard SKU load balancer; the mode cannot be changed afterward.
* Added the '-EnableConnectionTracking' switch to 'New-AzLoadBalancerFrontendIpConfig', 'Add-AzLoadBalancerFrontendIpConfig', and 'Set-AzLoadBalancerFrontendIpConfig'.
   - Enables UDP (User Datagram Protocol) flow tracking for the frontend IP configuration so packets in the same flow consistently reach the same backend instance, taking precedence over rule-level settings. Requires a load balancer created with '-Mode Advanced' and '-Scope'.
* Added multi-cloud ExpressRoute circuit support with the 'MultiCloud' value for '-SkuTier', and '-PartnerAccountId' and '-ActivationKey' on 'New-AzExpressRouteCircuit'.
   - Exposed 'PartnerAccountId', 'ActivationKey', and 'ResiliencyLevel' on 'PSExpressRouteCircuit'.
* Added 'RoutingConfiguration', 'VirtualHubVnetConnection', and 'VirtualHubVnetConnectionId' parameters to 'Add-AzRouteServerPeer' and 'Update-AzRouteServerPeer'.
   - Supports inbound and outbound route maps and a hub virtual network connection by object or resource ID.
* Added 'RoutingConfiguration' parameter to 'New-AzVirtualNetworkGatewayConnection' and 'Set-AzVirtualNetworkGatewayConnection'.
   - Supports inbound and outbound route maps.

Az.RecoveryServices
* Added Cross Region Restore for Azure File Share backups through 'Get-AzRecoveryServicesBackupItem -UseSecondaryRegion', 'Get-AzRecoveryServicesBackupRecoveryPoint -UseSecondaryRegion', and 'Restore-AzRecoveryServicesBackupItem -RestoreToSecondaryRegion'.
* Refined soft delete behavior for Azure File Share backup items
   - 'Undo-AzRecoveryServicesBackupItemDeletion' now errors unless the item is soft-deleted ('ToBeDeleted'), avoiding an invalid undelete request.
   - Corrected 'DateOfPurge' to use the remaining deferred-delete window returned by the service instead of a fixed 14 days.

Az.Resources
* Updated Policy cmdlets to use '2026-01-01' API
* Added 'Get-AzPolicyEnrollment', 'New-AzPolicyEnrollment', 'Remove-AzPolicyEnrollment', and 'Update-AzPolicyEnrollment' for Policy Enrollments.
* Added a template deployment what-if notice for generally available Deployment Stacks What-If to reduce result noise.
* Renamed 'DenySettingsApplyToChildScope' to 'DenySettingsApplyToChildScopes' for deployment stack WhatIfResult cmdlets, retaining an alias.
* Added 'ResourcesWithoutDeleteSupport' and tag support to deployment stack WhatIfResult cmdlets and output.

Az.Security
* Added SQL Vulnerability Assessment cmdlets for the 2026-04-01-preview API:
   - 'Get-AzSecuritySqlVulnerabilityAssessmentSetting', 'New-AzSecuritySqlVulnerabilityAssessmentSetting', 'Update-AzSecuritySqlVulnerabilityAssessmentSetting', and 'Remove-AzSecuritySqlVulnerabilityAssessmentSetting'.
   - 'Get-AzSecuritySqlVulnerabilityAssessmentBaselineRule', 'New-AzSecuritySqlVulnerabilityAssessmentBaselineRule', 'Add-AzSecuritySqlVulnerabilityAssessmentBaselineRule', and 'Remove-AzSecuritySqlVulnerabilityAssessmentBaselineRule'.
   - 'Get-AzSecuritySqlVulnerabilityAssessmentScan', 'Get-AzSecuritySqlVulnerabilityAssessmentScanRuleResult', and 'Invoke-AzSecurityInitiateSqlVulnerabilityAssessmentScan'. The per-rule name avoids a collision with legacy 'Get-AzSecuritySqlVulnerabilityAssessmentScanResult'.

Az.Sql
* Added multi-database Managed Instance links through 'LinkMode' on 'New-AzSqlInstanceLink' and database membership updates on 'Update-AzSqlInstanceLink'.
* Enhanced 'Get-AzSqlDeletedServer' subscription-level queries by making location optional and adding 'ScheduledPurgeTime' and 'Location' output.

Az.Websites
* Added App Service Environment plan create and update support for Isolated v4 and memory-optimized Isolated v4 SKUs.