News | Azure Local 2609

Azure Local 2609: a quiet month, which is good news if you are still catching up

The September 2026 release of Azure Local is version 12.2609.1003.7, running OS build 26100.33438. If you were hoping for headline features after the busy 2607 and 2608 waves, this is not that month. 2609 is a reliability and servicing release, and for most operators the work is straightforward: schedule it, run it, move on.

New features

There are no new platform features in 2609. Microsoft describes the release as “various reliability improvements and bug fixes”. The visible changes are component refreshes and documentation:

• OS moves to build 26100.33438. All new and existing deployments run this build. You still need drivers compatible with 26100.33438 or Windows Server 2025, so if you run Integrated System or Premier hardware, confirm with your OEM before you start.
• .NET moves to 8.0.31 and 10.0.12 (Runtime and ASP.NET Core).
• PowerShell moves to 7.6.5, built on .NET 10.
• Azure Migrate for Azure Local continues on its own cadence, so you do not need this Azure Local version to pick up Migrate fixes.

Improvements

The practical improvement this month is documentation, and it is worth five minutes of your time:

• The Learn documentation has been restructured around scenarios, with a “Find your deployment type” entry point. If you have bookmarks into the old structure, expect them to move.
• New guidance has landed for private path network configurations, including registering Azure Local with the Azure Arc gateway over a private path. If you are designing a constrained or low-connectivity network, this is the reference you were missing.

Fixed issues

Two fixes in 12.2609.1003.7, both on the VM side:

• az stack-hci-vm stop no longer fails against clusters older than 2604 with “Cannot do StopGraceful power operation on a Running VM”. The stop command is compatible with pre-2604 clusters again. This one bit anyone running a current CLI against a lagging cluster.
• Some clusters were incorrectly billed for Azure Machine Configuration, which should be free for Azure Local customers. Resolved in the August 2026 Machine Configuration agent release. If you saw unexpected line items, this is your explanation, and it is worth checking your recent invoices.

KNOWN ISSUES

Microsoft logged no new known issues specific to 2609. That does not mean the list is empty: the carried-over issues still apply, and these are the ones that can actually hurt you.

• Windows Admin Center volume deletion (data loss risk). Impact: instances of Windows Admin Center with Cluster Manager below 5.2.6 can have problems with volume deletion operations, with data loss as the stated risk. Workaround: update the Cluster Manager extension to 5.2.6, or use Windows Admin Center 2511 build 2.6.6.18 or higher. Until then, do not delete volumes from Windows Admin Center. Treat this as the single highest priority item on the list.
• Registry restore using RegBack (solution corruption). Impact: restoring the registry with RegBack is not supported and can remove Lifecycle Manager and MOC settings, corrupting the solution. Workaround: none. Do not use RegBack on Azure Local, and make sure whoever covers your out-of-hours recovery knows that.
• Arc registration fails with exit code 42 (blocks deployment). Impact: registering machines with Azure Arc fails with “AZCMAgent command failed with error: exitcode: 42”. Workaround: follow the steps in the Microsoft troubleshooting guide referenced from the known issues page.
• Defender ASR rule blocks Solution Update (blocks update). Impact: if the attack surface reduction rule “Block process creations originating from PSExec and WMI commands” is set to Block, the Azure Local Solution Update fails to run. Workaround: follow the troubleshooting guide. Related: with Defender for Endpoint, the “Restrict App Execution” setting can break Update and Repair operations. Disable it and reboot, and open a support case if the problem persists.
• Add node and repair node fail on recalled images (blocks Day-2 scale-out). Impact: add and repair node operations fail on 11.2510.1002.87 and 12.2510.1002.88 because those images were recalled. Workaround: move to 11.2510.1002.93 or 12.2510.1002.94. If you must add or repair a node mid-update, open a support case to have image validation overridden.
• az stack-hci-vm stop with CLI 1.14.x against pre-2604 clusters. Impact: the command fails. Workaround: use the latest CLI with --skip-shutdown to force a turn off, or drop back to CLI 1.13.0 or earlier. Note the 2609 fix above addresses the cluster-side behaviour, so this is mostly relevant if you are not yet on 2609.
• Update status misreported in the portal (operational noise). Impact: the portal intermittently shows “Failed to update” or “In progress” when the update actually finished. Workaround: check the real state with get-solutionupdate in a remote PowerShell session. If it reports Installed, you are done. The portal self-corrects within 24 hours, or you can restart the Cloud Management cluster group to refresh sooner.
• Mochostagent silently stuck (Day-2 VM management). Impact: the service looks healthy but stops writing logs, sometimes for over a month. Workaround: check C:\programdata\mochostagent\logs for recent writes and run restart-service mochostagent if they have stopped.
• Lower-severity noise you can ignore. “SBE manifest endpoint not reported by Get-SolutionDiscoveryDiagnosticInfo” during update is warning level. Duplicate readiness check names in Azure Update Manager have no workaround, so use View details. Secret rotation status fetch fails even though rotation succeeds. After updating to 2607, the Azure Key Vault extension may sit in a Failed state with no workaround available.

Upgrade planning notes

• Driver compatibility is the gate, as usual. Confirm OEM drivers for OS build 26100.33438 or Windows Server 2025 before you schedule the window.
• Patch Windows Admin Center Cluster Manager to 5.2.6 first. It is unrelated to the update itself, but it is the one open item with a data loss consequence.
• Check your Defender ASR and Restrict App Execution settings before the update window rather than during it. Both are known to stop a Solution Update dead.
• If you are still on the recalled 2510 builds, get to 11.2510.1002.93 or 12.2510.1002.94 before you plan any node add or repair work.
• Because 2609 is servicing only, the risk profile is low and there is little reason to sit this one out. The bigger planning effort belongs to the 2607 and 2608 feature waves (iSCSI SAN GA, confidential VMs in preview, portal-based node add, the prepare updates workflow) if you have not adopted them yet.