Microsoft has released Azure Local 2610, the October 2026 update. The new solution version is 12.2610.1004.41, running OS build 26100.33650.
This release is worth a closer look if you manage Azure Local clusters in production. There are useful new capabilities, but the improvements to updates, storage, networking and cluster health are arguably more important.
Let’s look at what actually matters.
New Features
Confidential VMs are now generally available
AMD SEV-SNP confidential VMs on AMD Genoa platforms have reached general availability. This brings hardware-backed memory encryption and workload attestation to Azure Local, making it easier to protect sensitive virtual machines.
More flexibility for SAN deployments
Rack-aware clusters with disaggregated SAN storage are now available in preview. The architecture supports workload protection across two rooms using synchronized storage replication.
The Azure portal deployment wizard also supports disk witness configuration and per-node iSCSI settings, reducing the amount of manual configuration required.
Connectivity changes without redeployment
Three useful capabilities are now in preview for existing environments:
- Changing outbound proxy settings.
- Enabling Azure Arc gateway after deployment.
- Migrating outbound connectivity from a public path to the Azure Local private path architecture.
These are particularly interesting for environments with strict network security requirements.
Other notable additions
Azure Migrate can now preserve existing Arc-enabled server resources when migrating VMware and Hyper-V workloads. This includes tags, RBAC assignments, policies, monitoring settings and extensions.
Azure Government Arizona support is available in preview, and new infrastructure RBAC roles provide more granular GPU infrastructure access in preview.
Improvements
Combined OS and firmware updates
One of the biggest operational improvements is the ability to combine operating system updates with OEM firmware and driver updates through a single coordinated Cluster-Aware Updating (CAU) run.
This should simplify maintenance planning and reduce the number of separate update operations required.
Better visibility into cluster health
The new Get-SolutionHealthSummary PowerShell command provides a concise overview of recent health checks, highlighting critical and important findings.
The new SANDiagnostics log filtering role helps collect storage diagnostics, including MPIO, Fibre Channel, iSCSI, disk, volume and cluster information.
A more flexible security baseline
The Azure Local security baseline now evaluates 429 settings, up from 408.
Administrators can customize additional security settings while retaining drift control. Microsoft keeps guardrails around settings critical to system integrity.
Application Control cmdlets have also been renamed to align with App Control for Business. Existing scripts remain supported.
Updated platform components
The release includes PowerShell 7.6.6, .NET 8.0.32 and .NET 10.0.13.
Composed ISO releases also move to a semiannual cadence aligned with OEM validation cycles.
Fixed Issues
Several fixes address problems that could directly affect production operations.
Networking: Network Controller dependencies could fail during solution updates, disrupting SDN connectivity and network security policy enforcement. This has been corrected, along with inaccurate pre-update SDN health reporting.
Storage: Supported replacement disks or disks on newly added nodes could be incorrectly quarantined. Another issue could cause storage maintenance mode to retry indefinitely with unhealthy virtual disks, blocking node draining or firmware servicing. Both issues are fixed.
Deployment and node lifecycle: Improvements address rejected valid Active Directory credentials during upgrades, incorrect Storage Spaces Direct cache configuration and validation timeouts during node add or repair operations.
Update reliability: Microsoft fixed conflicting concurrent solution updates, stale retry counters, endless driver installation retry loops and missing dependencies in third-party CAU integrations.
Azure Local VMs: Fixes cover Windows guest agents remaining stopped after updates, managed identity sign-in in Azure Government and Arc enablement in sovereign clouds.
These fixes make 2610 particularly relevant for environments that have experienced difficult maintenance windows or unreliable update operations.
KNOWN ISSUES
Microsoft reports no new known issues specific to Azure Local 2610.
However, the release notes still include carried-over issues from previous releases. Several can cause data loss, block deployment or updates, or interfere with day-to-day management.
The following deserve attention before upgrading.
1. Volume deletion can cause data loss
Impact: Windows Admin Center installations with the Cluster Manager extension below version 5.2.6 may encounter problems when deleting volumes, potentially resulting in data loss.
Workaround: Update the Cluster Manager extension to 5.2.6 or use Windows Admin Center 2511 build 2.6.6.18 or later. Do not delete volumes using an affected extension.
2. Defender for Endpoint can interfere with updates and repairs
Impact: The Restrict App Execution setting can cause problems during Azure Local update and repair operations.
Workaround: Disable Restrict App Execution in Microsoft Defender and reboot the affected servers. Contact Microsoft Support if the issue persists.
3. Defender ASR rules can block solution updates
Impact: The attack surface reduction rule that blocks process creation through PSExec and WMI can prevent solution updates from running.
Workaround: Microsoft’s troubleshooting guidance recommends changing the relevant ASR rule from Block to Audit. Check Group Policy, MDM and Configuration Manager for settings that could override the change.
4. Recalled 2510 images can block node operations
Impact: Add-node and repair-node operations fail on builds 11.2510.1002.87 and 12.2510.1002.88.
Workaround: Upgrade to replacement builds 11.2510.1002.93 or 12.2510.1002.94. Microsoft Support is required if node operations must be performed during the transition.
5. Azure Arc registration can fail
Impact: Arc registration can fail with AZCMAgent exit code 42, preventing successful onboarding.
Workaround: Follow Microsoft’s Arc registration troubleshooting guidance. Potential causes include incompatible Az.Accounts module versions, expired access tokens and incorrectly passed tokens.
6. Mandatory Arc extensions can block deployment validation
Impact: Deployment can fail when validation incorrectly reports that required Arc extensions are missing.
Workaround: Retry the deployment.
7. Mochostagent can stop processing requests
Impact: The service may appear to be running while its logs stop updating, potentially affecting Azure Local VM management.
Workaround: Inspect C:\ProgramData\mochostagent\logs and restart the service when the issue is confirmed:
Restart-Service mochostagent
8. Azure portal can incorrectly report failed updates
Impact: Updates that have successfully completed may continue to appear as failed or in progress.
Workaround: Use a remote PowerShell session and Get-SolutionUpdate to inspect the relevant update’s state. If the state is Installed, no further action is required. The portal normally reflects the correct state within 24 hours.
9. Duplicate readiness check names
Impact: Multiple readiness checks may appear under the same name, complicating troubleshooting.
Workaround: Use View details to identify the individual checks. Microsoft does not currently document a complete fix.
Upgrade Planning Notes
Before scheduling the October update, check a few things.
Validate hardware compatibility. Azure Local 2610 requires drivers compatible with OS build 26100.33650 or Windows Server 2025. Confirm OEM image, firmware and driver compatibility before proceeding.
Check the supported update path. Not every installed release can necessarily move directly to the target version. Consult Microsoft’s release information rather than assuming a direct upgrade is supported.
Review security policies. Defender for Endpoint and ASR configurations can interfere with maintenance operations. Check these before your update window.
Review cluster health. Use the available health checks and inspect storage, network, Arc Resource Bridge and OEM extension readiness.
Plan for the November servicing change. Starting November 2026, Microsoft plans to release OS cumulative and .NET security updates during Patch Tuesday week. The applicable installation behavior depends on the installed Azure Local version and supported update path.
My takeaway
Azure Local 2610 is primarily an operational release.
Combined OS and OEM updates, better health visibility and fixes for storage and SDN failures are the biggest reasons to pay attention.
The new confidential VM capabilities and networking previews are welcome additions, but production administrators should prioritize update readiness and the carried-over known issues.
Especially check your Windows Admin Center version, Defender policies and node servicing configuration before touching a production cluster.
