Azure Local 2610: what’s new in the latest release

Microsoft has released Azure Local 2610 (solution version 12.2610.1004.50), the October 2026 feature build. This release extends support for disaggregated SAN deployments, brings Confidential VMs with AMD SEV-SNP to general availability, introduces combined OS and SBE updates through Cluster-Aware Updating, and reworks the security baseline with customization and broader coverage. It also includes various reliability improvements and bug fixes.

Platform components

• OS build: all new and existing deployments run OS 26100.33650. A driver compatible with 26100.33650 or with Windows Server 2025 is required.
• .NET: 8.0.32 and 10.0.13 for .NET Runtime and ASP.NET Core.
• PowerShell: this build uses PowerShell 7.6.6, built on .NET 10.

Integrated System and Premier solution hardware from the Azure Local Catalog ships with the OS preinstalled, so coordinate with your OEM to get a compatible OS image and drivers.

Storage and SAN deployments

Disaggregated architectures get the largest share of new capabilities in this release:

• Rack aware clusters with SAN (preview): support for disaggregated SAN deployments spread across two rooms, with synchronized storage replication and independent management of compute and storage. This protects workloads even if an entire room fails.
• Disk witness for SAN deployments: the disk witness can now be configured directly in the Azure portal deployment wizard.
• Per-node iSCSI configuration: iSCSI settings can be defined for each node in the same portal wizard.
• SANDiagnostics log-filtering role: a new role for log collection that gathers SAN diagnostics, including MPIO, Fibre Channel and iSCSI initiators, disks, volumes, Cluster Shared Volumes, iSCSI target reachability, event logs, and cluster logs.

Connectivity changes after deployment

Three preview features make it possible to change the network choices of an existing Azure Local instance:

• Update proxy settings (preview): two options to change how the instance routes outbound traffic.
• Enable Azure Arc gateway after deployment (preview): the Azure Arc gateway can now be enabled on an instance that was deployed without it.
• Move to private path (preview): outbound connectivity can be moved from the public path to the private path architecture.

Security

• Confidential VMs with AMD SEV-SNP (GA): after the preview in 2607, confidential VMs are now generally available on AMD Genoa platforms, providing memory encryption and workload attestation.
• Expanded security baseline: evaluated settings grow from 408 to 429, extending CIS and DISA STIG coverage. The new baseline applies to new deployments and to systems updated to 2610.
• Customizable baseline with drift control: baseline settings can now be customized, and drift control keeps enforcing the customized values. Guardrails define which changes are allowed, and settings critical to system integrity stay protected. Previously, only a small set of toggles could be adjusted.
• App Control for Business cmdlets: the Application Control cmdlets were renamed to match the App Control for Business name (formerly Windows Defender Application Control). Existing scripts keep working.
• Built-in RBAC roles for infrastructure (preview): Azure RBAC can now be used to manage access to infrastructure resources. For now, the roles apply only to GPU infrastructure, so GPU administration can be separated from workload administration.

Updates and lifecycle

• Combined OS and SBE CAU updates: the operating system and the OEM Solution Builder Extension (firmware and drivers) can be updated in a single coordinated Cluster-Aware Updating (CAU) run, reducing update time and workload disruption.
• Security updates aligned with Patch Tuesday: starting November 2026, the OS latest cumulative update (LCU) and .NET updates ship in the same week as Patch Tuesday. On the latest Azure Local release they behave as security-only updates. On an applicable older release, they also apply the Azure Local security updates required to reach the target security release. These updates are available only through supported update paths.
• Composed ISO cadence: composed ISO releases now follow a semiannual cadence, aligned with OEM validation and release cycles.

Other changes worth knowing

• Azure Migrate for Azure Local: migrations from VMware and Hyper-V can now reuse the existing Azure Arc-enabled server resources of the source VMs. Tags, RBAC assignments, Azure Policy configurations, monitoring settings, and VM extensions carry over to the Azure Local VM. Azure Migrate ships on its own cadence, so this does not depend on 2610.
• Azure Government Arizona (preview): Azure Local can now be deployed and managed in US Gov Arizona in addition to US Gov Virginia, with support up to Impact Level 5 (IL5).
• Get-SolutionHealthSummary: a new PowerShell command that returns a short summary of the most recent solution health check, highlighting critical and important issues.
• Provisioned Machine resources: the Azure portal automatically creates a Provisioned Machine resource for each Arc-enabled server in the cluster, using the same resource name.

⚠️ Important: Provisioned Machine resources are created and managed automatically. No action is required, and they should not be deleted.

• HciSvc2 replaces HciSvc: starting with 2610, Azure Local uses the HciSvc2 service. Microsoft doesn’t expect any impact.

⚠️ Important: do not start the legacy HciSvc service manually.

Conclusion

Azure Local 2610 adds no single headline feature. Instead, it closes several operational gaps. SAN customers get rack aware clusters, portal-driven witness and iSCSI configuration, and a dedicated diagnostics role. Existing instances can change their proxy, Arc gateway, and outbound path after deployment. Combined CAU runs and Patch Tuesday-aligned security updates make patching more predictable. With confidential VMs now GA and a baseline that can be customized without losing drift control, the platform is easier to run in regulated environments. Before updating, check the known issues page and confirm OS driver compatibility with your OEM.