Az

Author(s)

• Microsoft Corporation

Tags

Azure ARM ResourceManager Linux AzureAutomationNotSupported

PSEditions

Core Desktop

Dependencies

• • Az.Accounts (>= 5.5.2)
  • Az.Advisor (= 3.0.0)
  • Az.Aks (= 7.2.1)
  • Az.AnalysisServices (= 1.3.0)
  • Az.ApiManagement (= 4.2.0)
  • Az.App (= 2.0.1)
  • Az.AppConfiguration (= 2.2.0)
  • Az.ApplicationInsights (= 3.0.0)
  • Az.ArcResourceBridge (= 2.0.0)
  • Az.ArizeAI (= 1.0.0)
  • Az.Attestation (= 3.1.0)
  • Az.Automanage (= 2.0.0)
  • Az.Automation (= 1.12.1)
  • Az.Batch (= 4.1.1)
  • Az.Billing (= 2.3.0)
  • Az.Cdn (= 6.1.0)
  • Az.CloudService (= 3.0.0)
  • Az.CognitiveServices (= 1.17.1)
  • Az.Compute (= 11.8.0)
  • Az.ConfidentialLedger (= 2.0.0)
  • Az.ConnectedMachine (= 1.1.1)
  • Az.ContainerInstance (= 5.0.0)
  • Az.ContainerRegistry (= 5.1.0)
  • Az.CosmosDB (= 1.21.1)
  • Az.DataBoxEdge (= 1.3.0)
  • Az.Databricks (= 2.0.0)
  • Az.DataFactory (= 1.20.1)
  • Az.DataLakeAnalytics (= 1.2.0)
  • Az.DataLakeStore (= 1.6.0)
  • Az.DataMigration (= 1.1.1)
  • Az.DataProtection (= 3.0.1)
  • Az.DataShare (= 1.2.0)
  • Az.DataTransfer (= 1.0.0)
  • Az.DesktopVirtualization (= 6.0.0)
  • Az.DevCenter (= 3.0.0)
  • Az.DeviceRegistry (= 1.0.0)
  • Az.DevTestLabs (= 1.2.0)
  • Az.Dns (= 2.2.0)
  • Az.DnsResolver (= 2.0.0)
  • Az.ElasticSan (= 1.7.0)
  • Az.EventGrid (= 2.2.0)
  • Az.EventHub (= 5.6.0)
  • Az.Fabric (= 1.0.0)
  • Az.FileShare (= 1.0.0)
  • Az.FirmwareAnalysis (= 1.0.0)
  • Az.FrontDoor (= 2.3.0)
  • Az.Functions (= 5.0.1)
  • Az.HDInsight (= 6.5.0)
  • Az.HealthcareApis (= 3.0.0)
  • Az.HealthDataAIServices (= 1.0.0)
  • Az.IotHub (= 2.9.1)
  • Az.KeyVault (= 6.6.0)
  • Az.Kusto (= 3.0.0)
  • Az.LambdaTest (= 1.0.0)
  • Az.LoadTesting (= 2.0.0)
  • Az.LogicApp (= 1.7.0)
  • Az.MachineLearning (= 1.3.0)
  • Az.MachineLearningServices (= 2.0.0)
  • Az.Maintenance (= 1.6.0)
  • Az.ManagedServiceIdentity (= 2.0.0)
  • Az.ManagedServices (= 4.0.0)
  • Az.MarketplaceOrdering (= 2.2.0)
  • Az.Migrate (= 3.0.0)
  • Az.Monitor (= 8.0.0)
  • Az.MySql (= 2.0.0)
  • Az.NetAppFiles (= 1.4.0)
  • Az.Network (= 8.1.0)
  • Az.NetworkCloud (= 3.0.0)
  • Az.Nginx (= 2.0.0)
  • Az.NotificationHubs (= 1.3.0)
  • Az.OperationalInsights (= 3.4.1)
  • Az.Oracle (= 2.0.0)
  • Az.PolicyInsights (= 2.0.0)
  • Az.PowerBIEmbedded (= 2.2.0)
  • Az.PrivateDns (= 1.3.0)
  • Az.RecoveryServices (= 7.14.0)
  • Az.RedisCache (= 1.12.0)
  • Az.RedisEnterpriseCache (= 2.0.0)
  • Az.Relay (= 3.0.0)
  • Az.ResourceGraph (= 1.3.0)
  • Az.ResourceMover (= 2.0.0)
  • Az.Resources (= 10.1.0)
  • Az.Security (= 1.9.0)
  • Az.SecurityInsights (= 4.0.0)
  • Az.ServiceBus (= 4.3.0)
  • Az.ServiceFabric (= 5.2.0)
  • Az.SignalR (= 3.0.0)
  • Az.Sql (= 7.0.0)
  • Az.SqlVirtualMachine (= 3.0.0)
  • Az.StackHCI (= 3.0.0)
  • Az.StackHCIVM (= 2.0.0)
  • Az.Storage (= 9.7.2)
  • Az.StorageAction (= 2.0.0)
  • Az.StorageDiscovery (= 1.0.0)
  • Az.StorageMover (= 2.1.0)
  • Az.StorageSync (= 2.6.0)
  • Az.StreamAnalytics (= 3.0.0)
  • Az.Support (= 2.1.0)
  • Az.Synapse (= 3.3.0)
  • Az.TrafficManager (= 1.4.0)
  • Az.Websites (= 4.0.0)
  • Az.Workloads (= 2.0.0)

Release Notes

16.2.0 - August 2026
Az.Accounts
* Upgraded 'Azure.Core' dependency from 1.56.0 to 1.57.0.
* Upgraded 'System.ClientModel' dependency from 1.12.0 to 1.13.0.

Az.Cdn
* Upgraded API version to 2026-04-01-preview.
* Fixed CDN long-running operations that returned completed resource responses without a Location header.

Az.Compute
* Deprecated installing the legacy Azure Enhanced Monitoring (AEM) extension for SAP on Virtual Machines (VMs); 'Set-AzVMAEMExtension' now installs the new extension by default.
* Added 'New-AzInterconnectBlock', 'Get-AzInterconnectBlock', 'Update-AzInterconnectBlock', and 'Remove-AzInterconnectBlock' cmdlets to manage Microsoft.Compute/interconnectBlocks resources for high-performance artificial intelligence (AI) and machine learning (ML) workloads.
* Marked the '-EnableWAD', '-SkipStorage', and '-InstallNewExtension' parameters of 'Set-AzVMAEMExtension' as deprecated using breaking-change attributes. They will be removed in a future major release.
* Preserved CMD-special characters in 'Invoke-AzVMRunCommand' and 'Invoke-AzVmssVMRunCommand' parameter values for Windows PowerShell RunCommand execution. [#29880]

Az.CosmosDB
* Upgraded 'Azure.Security.KeyVault.Keys' to '4.10.0' to align with other modules.

Az.EventHub
* Added parameter 'IPAddressType' to cmdlets 'New-AzEventHubNamespace' and 'Set-AzEventHubNamespace'

Az.FrontDoor
* Added support for Front Door WAF managed rule exceptions.
   - Added 'ExceptionListException' to 'New-AzFrontDoorWafPolicy' and 'Update-AzFrontDoorWafPolicy'.
   - Added helper cmdlets for WAF managed rule exception scopes.

Az.Functions
* Updated the Function App stacks parser to handle a runtime definition that does not include a 'FUNCTIONS_WORKER_RUNTIME' app setting. [#29630]
* Added support in 'New-AzFunctionApp' to create Go function apps hosted in Flex Consumption plans.

Az.KeyVault
* Populated 'KeySize' in 'Get-AzKeyVaultKey' output for additional key types when available; previously only RSA keys had a size populated.
* Upgraded 'Azure.Security.KeyVault.Keys' dependency from '4.6.0-beta.1' to '4.10.0'.

Az.NetAppFiles
* Added FileAccessLogs to 'Get-AzNetAppFilesCache' output.
* Added Breakthrough Mode support for Azure NetApp Files volumes:
    - Added '-BreakthroughMode' to 'New-AzNetAppFilesVolume' and 'New-AzNetAppFilesVolumeGroup'.
    - Added 'BreakthroughMode' to volume output in 'Get-AzNetAppFilesVolume' and 'Get-AzNetAppFilesVolumeGroup'

Az.Network
* Added new cmdlets for ConnectionPolicy management under VirtualHub
   - 'Get-AzConnectionPolicy': Retrieve one or all ConnectionPolicy resources under a VirtualHub
   - 'New-AzConnectionPolicy': Create a new ConnectionPolicy under a VirtualHub
   - 'Set-AzConnectionPolicy': Update an existing ConnectionPolicy under a VirtualHub
   - 'Remove-AzConnectionPolicy': Delete a ConnectionPolicy from a VirtualHub
* Added Managed HSM support to Application Gateway SSL certificate cmdlets ('New-AzApplicationGatewaySslCertificate', 'Set-AzApplicationGatewaySslCertificate', 'Add-AzApplicationGatewaySslCertificate') with '-HsmKeyId' and '-HsmPublicCertData' parameters.
* Updated Virtual Network and Virtual Network Appliance cmdlets to use new properties.
   - 'New-AzVirtualNetwork': Added '-SummarizedGatewayPrefix' parameter to specify summarized gateway prefixes advertised for the virtual network, and exposed 'SummarizedGatewayPrefixes' on the returned object.
   - 'New-AzVirtualNetworkAppliance': Added '-PrivateIPAddressVersion' parameter (IPv4, DualStack) to support dual-stack Virtual Network Appliances, and exposed 'PrivateIPAddressVersion' on the returned object.
* Added support for equal-cost multi-path (ECMP) routing in route tables
   - Added the 'VirtualApplianceEcmp' next hop type to 'New-AzRouteConfig', 'Add-AzRouteConfig', and 'Set-AzRouteConfig'
   - Extended the '-NextHopIpAddress' parameter to accept a list of next hop IP addresses (2 to 64) for ECMP routes when the next hop type is 'VirtualApplianceEcmp'
   - Added the 'NextHop' property to the route output returned by 'Get-AzRouteTable'
* Added DisablePeeringRoute support for Route Table
   - Added '-DisablePeeringRoute' parameter to 'New-AzRouteTable' cmdlet
   - Supported values are 'None' and 'All'
* Added property 'Nat64' to NatGateway and support for it in the following cmdlets:
   - 'New-AzNatGateway'
   - 'Set-AzNatGateway'
* Fixed 'Get-AzPrivateDnsZoneGroup' list mode passing the resource group and private endpoint names to the SDK in the wrong order, which caused a 'ResourceGroupNotFound' error when listing private DNS zone groups without the '-Name' parameter.
* Added properties 'ServiceTag', 'ReadinessState', 'Description', and 'OutboundSupported' to 'Get-AzNetworkSecurityPerimeterAssociableResourceType' response.
* Removed validations to allow newly added AuxiliarySkus in New-AzNetworkInterface command without needing to add them in ValidateSet.
* Added new cmdlets for DDoS Custom Policy management
   - 'New-AzDdosCustomPolicy': Create a new DDoS custom policy with detection rules
   - 'New-AzDdosCustomPolicy' requires at least one detection rule at creation time
   - 'New-AzDdosCustomPolicyDetectionRule': Create a DDoS custom policy detection rule
   - 'Add-AzDdosCustomPolicyDetectionRule': Add a detection rule to an in-memory DDoS custom policy before persisting it with 'Set-AzDdosCustomPolicy'
   - 'Get-AzDdosCustomPolicy': Retrieve a DDoS custom policy by resource group and name
   - 'Remove-AzDdosCustomPolicy': Remove a DDoS custom policy
   - 'Remove-AzDdosCustomPolicyDetectionRule' and 'Set-AzDdosCustomPolicy': Support the load balancer style workflow to mutate a local policy object and then persist it
   - Supports multiple detection rules with configurable traffic type (Tcp, Udp, TcpSyn) and packets per second thresholds
* Updated the API version of 'Microsoft.HardwareSecurityModules/cloudHsmClusters' to '2025-03-31' for Private Link Common Cmdlets
* Onboarded 'Microsoft.HardwareSecurityModules/paymentHsmClusters' to Private Link Common Cmdlets
* Fixed an issue where 'VerifyClientAuthMode' was not preserved during PowerShell and SDK model conversions for Application Gateway client authentication configuration
* Added cmdlets for cloud service public IP address operations:
   - 'Invoke-AzPublicIpAddressCloudServiceReservation': reserve a cloud service public IP or roll back to dynamic allocation ('-IsRollback').
   - 'Invoke-AzPublicIpAddressDisassociateCloudServiceReservedIp': disassociate a standalone reserved public IP from a cloud service public IP. Use '-PublicIpArmId' for the Azure Resource Manager (ARM) resource ID of the standalone public IP.

Az.RecoveryServices
* Added Cross Subscription Backup (CSB) support for Azure VM:
   - Added optional '-ContainerSubscriptionId' parameter in 'Enable-AzRecoveryServicesBackupProtection' to configure backup for a VM residing in a different subscription than the vault.
   - Added Original Location Recovery (OLR) support for cross-subscription protected items in 'Restore-AzRecoveryServicesBackupItem' (the container subscription is derived from the recovery point, no additional input required).
   - Added 'ContainerSubscriptionId' property to the backup item response of 'Get-AzRecoveryServicesBackupItem'.
   - Added 'ContainerSubscriptionId' property to the detailed job response of 'Get-AzRecoveryServicesBackupJobDetail'.
   - Added client-side validation when '-ContainerSubscriptionId' is supplied so a non-existent VM/resource group/subscription or a VM in a different region than the vault fails with a clear, VM-specific error message.
* Fixed Private Disk Access parameters being silently dropped when adding disks to, reprotecting, or cluster-reprotecting an Azure-to-Azure managed-disk replication
   - 'Add-AzRecoveryServicesAsrReplicationProtectedItemDisk' now honors '-RecoveryNetworkAccessPolicy', '-RecoveryDiskAccessId' and '-RecoveryPublicNetworkAccess' supplied on the disk replication configuration
   - 'Update-AzRecoveryServicesAsrProtectionDirection' (reprotect) forwards the same three fields on the switch-protection call
   - 'Update-AzRecoveryServicesAsrClusterProtectionDirection' (cluster reprotect) forwards the same three fields on the cluster switch-protection call
* Added support for configuring Cost Management Settings (granularity level) on Recovery Services vaults via 'New-AzRecoveryServicesVault' and 'Update-AzRecoveryServicesVault'.

Az.Resources
* Added deployment stack WhatIfResult cmdlets for resource group, subscription, and management group scopes.
   - Added help content and aligned new parameter names with Azure PowerShell naming conventions.
   - Exported all deployment stack WhatIfResult cmdlets from the module manifest.

Az.ServiceBus
* Added parameters 'GeoDataReplicationMaxReplicationLagDurationInSecond', 'GeoDataReplicationLocation', and 'IPAddressType' to cmdlets 'New-AzServiceBusNamespace' and 'Set-AzServiceBusNamespace'
* Added new cmdlets for doing namespace failover - 'Start-AzServiceBusNamespaceFailOver'
* Added new cmdlets for generating replication object for Replication parameter - 'New-AzServiceBusLocationsNameObject'
* Added new cmdlets 'Get-AzServiceBusNetworkSecurityPerimeterConfiguration', 'Get-AzServiceBusNetworkSecurityPerimeterConfigurationsForAssociation'

Az.Storage
* Fixed a path traversal issue in 'Get-AzStorageBlobContent' and 'Get-AzDataLakeGen2ItemContent' where a source blob/file name containing directory traversal segments (e.g. '../') could write content outside the specified destination directory.