ACR

• az acr network-rule add: Add example of adding a rule to allow access for a specific virtual network
• az acr replication create/update: Add --global-endpoint-routing parameter and redirect --region-endpoint-enabled to it to avoid confusion with registry-level --regional-endpoints
• az acr cache create/update: Add --identity parameter to support using user-assigned managed identity for cache rules

AKS

• Fix #32957: az aks get-credentials: Surface user-friendly error instead of unexpected traceback
• az aks create/update: Add --acns-transit-encryption-type parameter to support configuring pod-to-pod transit encryption (WireGuard or None)
• az aks create/update Add support for ACNS performance
• az aks namespace update: Fix the location logic for managed namespace update operation
• az aks update: Add --enable-high-log-scale-mode parameter to enable/disable High Log Scale Mode for Container Logs
• az aks enable-addons: Fix monitoring addon key lookup to handle both omsagent and omsAgent API response variants
• az aks disable-addons: Add retry with exponential backoff for Log Analytics workspace creation conflicts
• az aks update: Add --disable-http-proxy and --enable-http-proxy parameters

API Management

• az apim backend: Add new command group to support backend services

App Config

• az appconfig create/update: Enable linking app insights resource to an app configuration store
• az appconfig feature set: Enable telemetry for a feature flag

App Service

• az webapp list-runtimes: Pre-announce breaking changes
• az logicapp create: Add parameter --domain-name-scope to support specifying the scope of uniqueness for the default hostname during resource creation
• az webapp update: Add parameter --platform-release-channel to support setting the platform release channel for the web app
• az appservice plan update: Remove preview flag for --elastic-scale and --max-elastic-worker-count parameters
• az webapp update: Remove preview flag for --minimum-elastic-instance-count and --prewarmed-instance-count parameters
• az webapp up: Add parameter --domain-name-scope to support specifying the scope of uniqueness for the default hostname during resource creation

Cloud

• Add Bleu to the Known Clouds list

Compute

• az vmss create: Add --zone-placement-policy parameter to enable automatic zone selection
• az vmss create: Add --include-zones parameter to support specifying availability zones that must be considered for placement when --zone-placement-policy is set to Auto
• az vmss create: Add --exclude-zones parameter to support specifying availability zones that must be excluded from placement when --zone-placement-policy is set to Auto
• az vmss create: Add --max-zone-count parameter to support specifying the maximum number of availability zones to use when --zone-placement-policy is set to Auto
• az vmss update: Add --max-zone-count parameter to support specifying the maximum number of availability zones to use for this scale set
• az vmss create/update: Add --value-max-instance-percent-per-zone parameter to support specifying the maximum percentage of virtual machine instances that can be allocated to a single availability zone in the virtual machine scale set
• az vmss create/update: Add --instance-percent-policy parameter to support specifying whether maximum percentage of virtual machine instances per zone policy should be enabled on the virtual machine scale set
• az vm run-command invoke: Fix --no-wait not working
• az restore-point collection create/update: Add parameter --instant-access
• az restore-point create: Add parameter --instant-access-duration

Container app

• az containerapp env workload-profile add: Simplify workload-profile creation with default profile name

Core

• Resolve CVE-2026-26007
• az *: Make --acquire-policy-token and --change-reference global arguments available by default, removing the need for core.enable_policy_token configuration
• Resolve CVE-2026-27448
• Resolve CVE-2026-27459
• Resolve CVE-2026-32597
• Resolve CVE-2026-25645
• Resolve CVE-2026-34073

Event Hubs

• Fix #31108, #32073: az eventhubs: Regex updated for commands with --namespace-name arguments

NetAppFiles

• az netapfiles volume create/update: Add paramter --desired-ransomware-protection-state to support advanced ransomware reports
• az netapfiles volume ransomware-report: Add command group to support advanced ransomware reports
• az netapfiles volume list-quota-report: Add command to list quota reports for volumes

Network

• az network private-endpoint-connection: Add provider Microsoft.DurableTask/schedulers