Release History¶
A condensed history of the platform, grouped by generation. It shows what each major and minor version brought, which changes needed manual steps, and where the platform changed direction. Patch versions are grouped. Work item numbers and per-customer version tables are left out on purpose.
For the manual steps themselves, see the platform upgrade guides. For the numbering rules, see Releasing.
Versions that needed manual steps¶
| Upgrade to | What you had to do by hand | Guide |
|---|---|---|
| v4.4.0 | Delete policy assignment, definition and initiative files; set state storage overrides if non-default; remove two policy objects in the portal | v4.4.0 |
| v4.5.0 | Edit the entry pipeline: add the configuration repository as a resource and publish it as an artifact (single-pipeline layout) | v4.5.0 |
| v4.5.1 | Remove the custom alerting policy assignments and initiatives in the portal, and the Deploy_* policy definitions with a command |
v4.5.1 |
| v4.6.0 and v4.6.1 | Add a ghrunners.auto.tfvars file per environment and region |
v4.6.x |
| v4.7.0 | Remove three Defender for Cloud policy assignments in the portal | v4.7.0 |
| v4.9.0 | Shorten file paths in every tfvars file, add a firewall variable, remove an environment parameter from the entry pipeline |
v4.9.0 |
| v4.11.x | Delete old private DNS and BIO policy files; remove two assignments and two initiatives in the portal | v4.11.x |
| v4.12.x | Remove the private DNS zones assignment and initiative in the portal; make sure every Application Gateway JSON has a valid firewall_policy_id |
v4.12.x |
All other versions in this history needed no special steps, as far as the upgrade guides show.
Version 2.x: the first landing zone product¶
Before Terraform. Versions 2.0 to 2.2 built the hub and added a spoke deployment.
| Version | Type | Highlights |
|---|---|---|
| 2.0 | Major | Private DNS Resolver replaces the DNS proxy virtual machines (an IaaS component replaced by a PaaS one). Management group structure from the parameter files. Default policies, dynamic policy assignment and optional BIO compliance policies. Alerts on the activity log. Default parameters to shorten parameter files. Azure Firewall SKU as a parameter. Network Watcher in the deployment. Separate subscriptions for connectivity and management are possible. |
| 2.0.1 | Patch | Fix for private DNS zone deployment. |
| 2.1 | Minor | A shared Application Gateway that several teams, applications or environments can use. |
| 2.1.1 to 2.1.3 | Patch | Role assignment for the diagnostic settings policy. VNet peering without a virtual network gateway. Application Gateway SSL certificates, parameters and optional deployment. A deployment selector for the DNS Private Resolver. A shared Log Analytics workspace problem in green/brownfield deployments. |
| 2.2.0 | Minor | Virtual WAN. Bastion in the hub (deployed once, in prod, instead of twice). ExpressRoute circuit. DNS proxy on the Azure Firewall that forwards to the Private DNS Resolver. Spoke deployment. A separate firewall rule pipeline because of timing limits. Optional DDoS protection plan. A resource health alert. |
Version 3.x: Terraform¶
| Version | Type | Highlights |
|---|---|---|
| 3.0 | Major | Terraform replaces the previous infrastructure as code language. Deployments only change what changed, with better Entra ID support and more automation options. Improved Azure DevOps agents with a new pipeline. The bootstrapper was removed. Optional naming convention overrides. Better generic firewall rules. A new method for virtual machine disk alerts. Fixes so the central Bastion works for spokes. |
| 3.1 | Minor | Alerting based on Azure Policy, also for spokes. A WAF policy resource replaces the inline WAF. The canary environment can be removed automatically after a successful production deployment, which lowers cost. Private agents can reach Key Vaults and storage accounts. More naming overrides. |
| 3.2 | Minor | Automatic provisioning of the Log Analytics agent for Secure Score. Basic point-to-site VPN. A pipeline template that destroys canary automatically. A bootstrapper stage for the management group structure. Private DNS policy for private endpoints updated, and a private DNS zone for Azure OpenAI services. Hub Key Vaults and storage accounts lose public access and accept the agent subnet. Sentinel and Defender for DevOps behind feature flags. Virtual hub SKU variable. Terraform files use file names instead of full paths. Updated Defender plans. |
| 3.2.1 | Patch | Key Vault soft delete retention is a variable. Root certificates in Application Gateway backend HTTP settings. |
No release notes exist for versions 3.3 to 4.3.
Version 4.x: remote sync, policy as code and GitHub¶
4.4: the code repository takes over policy and monitoring¶
Version 4.4.0 moved much of the policy and monitoring configuration from the customer parameter repository into the code repository. It needed manual clean-up.
| Area | Change |
|---|---|
| Code distribution | Customer copies of the code repository are synchronised automatically on a release, using service principal authentication (Code synchronisation) |
| Compliance policy | Compliance policy sets are assigned directly from the code repository. Some resource types are excluded from the diagnostic policy to prevent false positives |
| Diagnostics policy | The built-in diagnostic policy set replaces the custom set. Logs go to a Log Analytics workspace in the same region as the resource |
| Exemptions | Automatic exemption management for the hub, based on the default deployment, with decision records |
| Defender for Cloud | Configured with Azure Policy instead of Terraform code |
| Monitoring | Azure Monitor Baseline Alerts (AMBA) deployed from the code repository (How alerting works) |
| Compliance of the management layer | Storage accounts: no public access, HTTPS only, no shared key access, infrastructure encryption, no public access to nested items, customer-managed keys |
Patch versions 4.4.1 to 4.4.12 mostly fixed four areas:
| Area | Versions | What |
|---|---|---|
| Application Gateway certificates | 4.4.1, 4.4.8 to 4.4.10 | Certificates can use a password stored in a Key Vault. Fixes for Let's Encrypt certificates (account key, private key, issuing, and a gateway that tried to read a certificate before it was stored) |
| Self-hosted agent pools | 4.4.1, 4.4.6, 4.4.7, 4.4.11 | Separate pools for canary and production. Every layer uses the supplied pool instead of public agents. Option to allow a static public IP for Key Vault data plane access from the pool |
| Policy | 4.4.1 to 4.4.5 | Policy reference IDs found from display names. Policy deployments moved to another layer because of dependencies. Automatic remediation in the post-deployment layer. Exemption references fixed |
| Cleanup and automation | 4.4.2, 4.4.3 | Deprecated Security Center auto-provisioning removed. Automated documentation with pre-commit hooks. Better canary destroy pipeline. Documentation for standard changes (4.4.1) |
Version 4.4.12 added an option for private link DNS zones to fall back to internet resolution, an alert processing rule for the managing party, a firewall rule for agents during the firewall deployment, and forced re-authentication of the apply step so that federated credentials can be used.
4.5 and 4.6: GitHub support¶
| Version | Type | Highlights |
|---|---|---|
| 4.5.0 | Minor | The platform configuration can come from GitHub. Forced tunnelling for point-to-site VPN. Needed a pipeline edit. |
| 4.5.1 | Patch | AzureRM provider 4.37.0. Updated AMBA alert policies (needed portal clean-up). A setting to steer automatic remediation of policy assignments. The plan stage runs during pull request CI. A script that registers resource providers for new implementations. Multiple WAF policies deploy correctly. Activity log alerts use the global location. |
| 4.5.2 to 4.5.5 | Patch | Fixes: virtual network and BGP peering properties in tfvars, a WAF request_body_enforcement property, a wrong module dependency, VPN connection DPD timeout. A feature flag to skip Azure Firewall rules when a third-party firewall is used. A longer timeout for the first connectivity layer deployment. Private DNS zones for all static web app instances. |
| 4.6.0 | Minor | An extra layer with the network for GitHub-hosted runners. GitHub workflows to deploy from GitHub. A duplicate alert action assignment removed. A private DNS zone for Azure AI services. Needed a new tfvars file. |
| 4.6.1 | Patch | A missing condition made the deployment fail when the GitHub runner layer was not wanted. |
4.7 to 4.12¶
There are no release notes for these versions. What the upgrade guides and the current code show:
| Version | What changed |
|---|---|
| 4.7.0 | The Defender for Cloud v2 policy assignments of the connectivity, identity and management scopes were removed from the platform (guide) |
| 4.9.0 | File paths in tfvars no longer start with the checkout folder of the configuration repository. The firewall layer has a variable for the global rule folder. The environment is no longer a parameter of the entry pipeline templates (guide) |
| 4.11.x | The old private DNS policy definitions and initiatives, and the custom BIO initiative, are no longer kept in the configuration repository. Their files are deleted, and an old alerting and an old DNS assignment and initiative are removed in the portal (guide) |
| 4.12.x | The private DNS zones initiative was replaced, and the Application Gateway JSON needs a valid firewall_policy_id (guide) |
Later changes are visible in the current pipeline layout: entry pipelines hub, spoke, infrastructure and
container, GitHub Actions workflows next to Azure DevOps pipelines, and multi-region hubs. See
Pipelines and workflows.
Spoke canvas versions¶
The spoke canvas used to be a separate product with its own versions (v2.x). Today it is part of the code repository (Glossary). The notes below are from the separate product.
| Version | Type | Highlights |
|---|---|---|
| 2.5.7, 2.5.8 | Patch | Key Vault crypto officer role for the deployment principal (customer-managed key on the storage account). The full list of PIM groups is used, not only the latest. A private endpoint network policy so private endpoints use the routes from the hub. A file naming fix for the drift pipeline |
| 2.6.0 | Minor | Federated credentials with workload identity federation. A spoke configuration can be checked out from another repository (for example GitHub). The Terraform state container is created if missing. |
| 2.7.0, 2.7.1 | Minor, patch | A central Entra ID group is created and managed to give access to shared resources. A fix: Entra groups were filtered instead of searched on their exact name |
| 2.8.0 to 2.8.2 | Minor, patch | Several private endpoints per storage account. Better pipeline templates for file paths with spaces. EasyPIM script update. A script and guide for billing export configuration. Custom DNS server settings (optional, list-based). Changes to required_resource_access of the spoke service principal are ignored |
| 2.9.0, 2.9.1 | Minor, patch | GitHub workflows. Spoke extensions for Azure Container Registry, Communication Services, API Management, Service Bus and Event Hub (later also GitHub integration), pinned to version tags. The old IPAM configuration was removed (guide). private_link_service_network_policies_enabled can be set per subnet. A drift detection fix |
| 2.10.0 | Minor | PIM configurations are defined in the common configuration (guide) |
Spoke canvas capabilities documented after v2.10.0¶
The documentation of the spoke canvas also describes the following capabilities. The version that introduced each one is not recorded. Check the release notes of the code version you pin before you rely on them.
| Capability | What it does |
|---|---|
| Key Vault and storage account switches | deploy: false leaves out the Key Vault or the storage account. The storage account always forces a Key Vault (Spoke canvas) |
| Federated credentials for the Azure DevOps service connection | useFederatedCredentials: true avoids a service principal secret |
| GitHub extension | A GitHub repository with federated credentials for the spoke, with GitHub App authentication |
| PIM role map for Key Vault and storage | Standing read access, and PIM-eligible elevated roles, assigned at subscription scope, with overrides (Spoke canvas) |
| IPAM pools | Spoke files can allocate address space from Azure Virtual Network Manager IPAM pools instead of fixed prefixes |
| Subscription provisioning | A separate step that prepares the subscription (design) |
| Configuration drift report | A scheduled plan per spoke that reports differences (design) |