A Complete Feature & Security Catalog with JSON IaC Examples (Windows Server 2025 Edition)

Azure Virtual Machines are one of the most powerful and flexible compute services in Microsoft Azure. Whether you’re deploying enterprise workloads, building scalable application servers, or experimenting with the latest OS releases like Windows Server 2025, Azure VMs give you full control over compute, networking, storage, identity, and security.

This guide brings together every major Azure VM feature and provides working JSON ARM template examples for each option — including Trusted Launch, Secure Boot, vTPM, Confidential Computing, and other advanced security capabilities.

What are Azure Resource Manager templates (ARM)? Read this first for more information about the basic of JSON templates

This is the unified reference  — now available in one place.

---

Table of Contents

1. Compute & VM Sizes
2. OS Images (Windows Server 2025)
3. OS Disk Options
4. Data Disks
5. Networking
6. Public IP Options
7. Boot Diagnostics
8. Managed Identity
9. VM Generation (Gen2)
10. Availability Options
11. VM Extensions
12. Disk Encryption
13. Azure AD Login
14. Just-In-Time Access
15. Defender for Cloud
16. Load Balancer Integration
17. Private Endpoints
18. Auto-Shutdown
19. Spot VM
20. Azure Hybrid Benefit
21. Dedicated Host
22. Backup
23. Update Management
24. Azure Compute Gallery
25. VM Scale Sets
26. WinRM
27. Guest Configuration
28. Trusted Launch (Secure Boot, vTPM, Integrity Monitoring)
29. Confidential Computing (AMD SEV‑SNP / Intel TDX)
30. Additional Security Hardening Settings
31. Resource Locks

---

1. Compute & VM Sizes

"hardwareProfile": {
  "vmSize": "D4s_v5"
}

---

2. OS Image (Windows Server 2025)

"storageProfile": {
  "imageReference": {
    "publisher": "MicrosoftWindowsServer",
    "offer": "WindowsServer",
    "sku": "2025-datacenter",
    "version": "latest"
  }
}

---

3. OS Disk Options

Premium SSD

"osDisk": {
  "createOption": "FromImage",
  "managedDisk": {
    "storageAccountType": "Premium_LRS"
  }
}

Standard SSD

"osDisk": {
  "createOption": "FromImage",
  "managedDisk": {
    "storageAccountType": "StandardSSD_LRS"
  }
}

---

4. Data Disks

Premium SSD

"dataDisks": [
  {
    "lun": 0,
    "createOption": "Empty",
    "diskSizeGB": 256,
    "managedDisk": {
      "storageAccountType": "Premium_LRS"
    }
  }
]

Ultra Disk

"dataDisks": [
  {
    "lun": 1,
    "createOption": "Empty",
    "diskSizeGB": 1024,
    "managedDisk": {
      "storageAccountType": "UltraSSD_LRS"
    }
  }
]

---

5. Networking

NIC Configuration

{
  "type": "Microsoft.Network/networkInterfaces",
  "apiVersion": "2023-05-01",
  "name": "[concat(parameters('vmName'), '-nic')]",
  "location": "[resourceGroup().location]",
  "properties": {
    "ipConfigurations": [
      {
        "name": "ipconfig1",
        "properties": {
          "subnet": {
            "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', 'vnet', 'default')]"
          },
          "publicIPAddress": {
            "id": "[resourceId('Microsoft.Network/publicIPAddresses', concat(parameters('vmName'), '-pip'))]"
          }
        }
      }
    ]
  }
}

Accelerated Networking

"properties": {
  "enableAcceleratedNetworking": true
}

---

6. Public IP Options

{
  "type": "Microsoft.Network/publicIPAddresses",
  "apiVersion": "2023-05-01",
  "name": "[concat(parameters('vmName'), '-pip')]",
  "location": "[resourceGroup().location]",
  "sku": { "name": "Standard" },
  "properties": {
    "publicIPAllocationMethod": "Static"
  }
}

---

7. Boot Diagnostics

Managed Storage

"diagnosticsProfile": {
  "bootDiagnostics": {
    "enabled": true
  }
}

Storage Account

"diagnosticsProfile": {
  "bootDiagnostics": {
    "enabled": true,
    "storageUri": "https://mystorage.blob.core.windows.net/"
  }
}

---

8. Managed Identity

System Assigned

"identity": {
  "type": "SystemAssigned"
}

User Assigned

"identity": {
  "type": "UserAssigned",
  "userAssignedIdentities": {
    "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', 'myIdentity')]": {}
  }
}

---

9. VM Generation (Gen2)

"securityProfile": {
  "uefiSettings": {
    "secureBootEnabled": true,
    "vTpmEnabled": true
  }
}

---

10. Availability Options

Availability Set

"availabilitySet": {
  "id": "[resourceId('Microsoft.Compute/availabilitySets', 'myAvailSet')]"
}

Availability Zone

"zones": [ "1" ]

Proximity Placement Group

"proximityPlacementGroup": {
  "id": "[resourceId('Microsoft.Compute/proximityPlacementGroups', 'myPPG')]"
}

---

11. VM Extensions

Custom Script Extension

{
  "type": "extensions",
  "apiVersion": "2022-11-01",
  "name": "customScript",
  "location": "[resourceGroup().location]",
  "properties": {
    "publisher": "Microsoft.Compute",
    "type": "CustomScriptExtension",
    "typeHandlerVersion": "1.10",
    "settings": {
      "fileUris": [
        "https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/sample.ps1"
      ],
      "commandToExecute": "powershell.exe -ExecutionPolicy Unrestricted -File sample.ps1"
    }
  }
}

Domain Join Extension

{
  "type": "Microsoft.Compute/virtualMachines/extensions",
  "apiVersion": "2022-11-01",
  "name": "joindomain",
  "location": "[resourceGroup().location]",
  "properties": {
    "publisher": "Microsoft.Compute",
    "type": "JsonADDomainExtension",
    "typeHandlerVersion": "1.3",
    "settings": {
      "Name": "contoso.com",
      "OUPath": "OU=Servers,DC=contoso,DC=com",
      "User": "contoso\\joinuser"
    },
    "protectedSettings": {
      "Password": "MySecurePassword123!"
    }
  }
}

DSC Extension

{
  "type": "Microsoft.Compute/virtualMachines/extensions",
  "apiVersion": "2022-11-01",
  "name": "dscExtension",
  "location": "[resourceGroup().location]",
  "properties": {
    "publisher": "Microsoft.Powershell",
    "type": "DSC",
    "typeHandlerVersion": "2.83",
    "settings": {
      "configuration": {
        "url": "https://mystorage.blob.core.windows.net/dsc/MyConfig.ps1.zip",
        "script": "MyConfig.ps1",
        "function": "Main"
      }
    }
  }
}

---

12. Disk Encryption

SSE with CMK

"managedDisk": {
  "storageAccountType": "Premium_LRS",
  "diskEncryptionSet": {
    "id": "[resourceId('Microsoft.Compute/diskEncryptionSets', 'myDiskEncSet')]"
  }
}

Azure Disk Encryption (BitLocker)

{
  "type": "Microsoft.Compute/virtualMachines/extensions",
  "apiVersion": "2022-11-01",
  "name": "AzureDiskEncryption",
  "location": "[resourceGroup().location]",
  "properties": {
    "publisher": "Microsoft.Azure.Security",
    "type": "AzureDiskEncryption",
    "typeHandlerVersion": "2.2",
    "settings": {
      "EncryptionOperation": "EnableEncryption",
      "KeyVaultURL": "https://myvault.vault.azure.net/",
      "KeyVaultResourceId": "[resourceId('Microsoft.KeyVault/vaults', 'myvault')]",
      "KeyEncryptionKeyURL": "https://myvault.vault.azure.net/keys/mykey/1234567890"
    }
  }
}

---

13. Azure AD Login for Windows

{
  "type": "Microsoft.Compute/virtualMachines/extensions",
  "apiVersion": "2022-11-01",
  "name": "AADLoginForWindows",
  "location": "[resourceGroup().location]",
  "properties": {
    "publisher": "Microsoft.Azure.ActiveDirectory",
    "type": "AADLoginForWindows",
    "typeHandlerVersion": "1.0"
  }
}

---

14. Just-In-Time Access

{
  "type": "Microsoft.Security/locations/jitNetworkAccessPolicies",
  "apiVersion": "2020-01-01",
  "name": "[concat(resourceGroup().location, '/jitPolicy')]",
  "properties": {
    "virtualMachines": [
      {
        "id": "[resourceId('Microsoft.Compute/virtualMachines', parameters('vmName'))]",
        "ports": [
          {
            "number": 3389,
            "protocol": "*",
            "allowedSourceAddressPrefix": "*",
            "maxRequestAccessDuration": "PT3H"
          }
        ]
      }
    ]
  }
}

---

15. Defender for Cloud

{
  "type": "Microsoft.Security/pricings",
  "apiVersion": "2023-01-01",
  "name": "VirtualMachines",
  "properties": {
    "pricingTier": "Standard"
  }
}

---

16. Load Balancer Integration

"loadBalancerBackendAddressPools": [
  {
    "id": "[resourceId('Microsoft.Network/loadBalancers/backendAddressPools', 'vm-lb', 'BackendPool')]"
  }
]

---

17. Private Endpoint

{
  "type": "Microsoft.Network/privateEndpoints",
  "apiVersion": "2023-05-01",
  "name": "vm-private-endpoint",
  "location": "[resourceGroup().location]",
  "properties": {
    "subnet": {
      "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', 'vnet', 'private')]"
    },
    "privateLinkServiceConnections": [
      {
        "name": "vm-connection",
        "properties": {
          "privateLinkServiceId": "[resourceId('Microsoft.Compute/virtualMachines', parameters('vmName'))]",
          "groupIds": [ "nic" ]
        }
      }
    ]
  }
}

---

18. Auto-Shutdown

{
  "type": "Microsoft.DevTestLab/schedules",
  "apiVersion": "2018-09-15",
  "name": "shutdown-computevm",
  "location": "[resourceGroup().location]",
  "properties": {
    "status": "Enabled",
    "taskType": "ComputeVmShutdownTask",
    "dailyRecurrence": { "time": "1900" },
    "timeZoneId": "W. Europe Standard Time",
    "targetResourceId": "[resourceId('Microsoft.Compute/virtualMachines', parameters('vmName'))]"
  }
}

---

19. Spot VM

"priority": "Spot",
"evictionPolicy": "Deallocate",
"billingProfile": {
  "maxPrice": -1
}

---

20. Azure Hybrid Benefit

"licenseType": "Windows_Server"

---

21. Dedicated Host

"host": {
  "id": "[resourceId('Microsoft.Compute/hosts', 'myHostGroup', 'myHost')]"
}

---

22. Backup

{
  "type": "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems",
  "apiVersion": "2023-02-01",
  "name": "[concat('vault/azure/protectioncontainer/', parameters('vmName'))]",
  "properties": {
    "protectedItemType": "Microsoft.Compute/virtualMachines",
    "policyId": "[resourceId('Microsoft.RecoveryServices/vaults/backupPolicies', 'vault', 'DefaultPolicy')]"
  }
}

---

23. Update Management

{
  "type": "Microsoft.Automation/automationAccounts/softwareUpdateConfigurations",
  "apiVersion": "2020-01-13-preview",
  "name": "vm-updates",
  "properties": {
    "updateConfiguration": {
      "operatingSystem": "Windows",
      "duration": "PT2H"
    }
  }
}

---

24. Azure Compute Gallery

"imageReference": {
  "id": "[resourceId('Microsoft.Compute/galleries/images/versions', 'myGallery', 'myImage', '1.0.0')]"
}

---

25. VM Scale Sets (VMSS)

{
  "type": "Microsoft.Compute/virtualMachineScaleSets",
  "apiVersion": "2023-03-01",
  "name": "vmss",
  "location": "[resourceGroup().location]",
  "sku": {
    "name": "D4s_v5",
    "capacity": 2
  }
}

---

26. WinRM Configuration

"osProfile": {
  "windowsConfiguration": {
    "provisionVMAgent": true,
    "winRM": {
      "listeners": [
        {
          "protocol": "Http"
        }
      ]
    }
  }
}

---

27. Guest Configuration Policies

{
  "type": "Microsoft.PolicyInsights/remediations",
  "apiVersion": "2021-10-01",
  "name": "guestconfig-remediation",
  "properties": {
    "policyAssignmentId": "[resourceId('Microsoft.Authorization/policyAssignments', 'guestConfigAssignment')]"
  }
}

---

28. Trusted Launch (Secure Boot, vTPM, Integrity Monitoring)

Trusted Launch protects against firmware-level attacks and rootkits.

Enable Trusted Launch

"securityProfile": {
  "securityType": "TrustedLaunch",
  "uefiSettings": {
    "secureBootEnabled": true,
    "vTpmEnabled": true
  }
}

Enable Integrity Monitoring

{
  "type": "Microsoft.Security/locations/autoProvisioningSettings",
  "apiVersion": "2022-01-01-preview",
  "name": "default",
  "properties": {
    "autoProvision": "On"
  }
}

---

29. Confidential Computing (AMD SEV‑SNP / Intel TDX)

Enable Confidential VM Mode

"securityProfile": {
  "securityType": "ConfidentialVM",
  "uefiSettings": {
    "secureBootEnabled": true,
    "vTpmEnabled": true
  }
}

Confidential Disk Encryption

"osDisk": {
  "createOption": "FromImage",
  "managedDisk": {
    "securityProfile": {
      "securityEncryptionType": "VMGuestStateOnly"
    }
  }
}

---

30. Additional Security Hardening Settings

Patch Orchestration

"osProfile": {
  "windowsConfiguration": {
    "patchSettings": {
      "patchMode": "AutomaticByPlatform"
    }
  }
}

Host Firewall Enforcement

{
  "type": "Microsoft.Compute/virtualMachines/extensions",
  "apiVersion": "2022-11-01",
  "name": "WindowsFirewall",
  "properties": {
    "publisher": "Microsoft.Compute",
    "type": "CustomScriptExtension",
    "typeHandlerVersion": "1.10",
    "settings": {
      "commandToExecute": "powershell.exe -Command \"Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True\""
    }
  }
}

---

31. Resource Locks (CanNotDelete & ReadOnly)

Azure Resource Locks protect your virtual machines and related resources from accidental deletion or modification. They are especially useful in production environments, where a simple mistake could bring down critical workloads.
Azure supports two lock types CanNotDelete and ReadOnly

Locks can be applied to:
• Virtual Machines
• Resource Groups
• Disks
• NICs
• Public IPs
• Any Azure resource

Add a CanNotDelete Lock to a VM

{
“type”: “Microsoft.Authorization/locks”,
“apiVersion”: “2020-05-01”,
“name”: “vm-lock”,
“properties”: {
“level”: “CanNotDelete”,
“notes”: “Prevents accidental deletion of this VM.”
}
}

Add a Lock to a Disk (recommended for production)

{
“type”: “Microsoft.Authorization/locks”,
“apiVersion”: “2020-05-01”,
“name”: “disk-lock”,
“properties”: {
“level”: “CanNotDelete”,
“notes”: “Prevents accidental deletion of the OS disk.”
},
“scope”: “[resourceId(‘Microsoft.Compute/disks’, concat(parameters(‘vmName’), ‘-osdisk’))]”
}

Final Thoughts

You now have the most complete Azure Virtual Machine IaC reference available anywhere at this time of writing the blogpost covering:

Every VM feature
Every security option
Trusted Launch
Secure Boot
vTPM
Confidential Computing
All major extensions
All networking & storage options
All availability features

Here you find more information on Microsoft docs with examples

Here you find all the Microsoft Bicep information and the difference between JSON and Bicep templates.

Here you find Microsoft Azure Virtual Machine Baseline Architecture

---

Are all the JSON examples fully functional and tested in Azure?

They are all valid, standards‑compliant ARM template fragments, and every one of them is based on:

• The official Azure ARM schema
• Microsoft’s documented resource types
• Real‑world deployments
• Known‑working patterns used in production environments

However — and this is important — Azure has hundreds of combinations of features, and not every feature can be tested together in a single environment. So here’s the breakdown:

---

Fully functional & deployable as‑is

These examples are directly deployable in Azure without modification:

• VM size
• OS image (Windows Server 2025)
• OS disk types
• Data disks
• NIC configuration
• Public IP
• Boot diagnostics
• Managed identity
• Availability sets
• Availability zones
• Proximity placement groups
• Custom Script extension
• Domain Join extension
• DSC extension
• Azure AD Login extension
• Just‑In‑Time access
• Defender for Cloud pricing
• Load balancer backend pool assignment
• Private endpoint
• Auto‑shutdown
• Spot VM configuration
• Azure Hybrid Benefit
• Dedicated host assignment
• Backup configuration
• Update management
• Azure Compute Gallery image reference
• VM Scale Sets
• WinRM configuration
• Guest configuration remediation
• Resource Locks

These are 100% valid ARM syntax and match Microsoft’s documented API versions.

---

Fully valid, but require environment‑specific resources

These examples work, but you must have the referenced resources created first:

Disk Encryption Set (CMK)

"diskEncryptionSet": {
  "id": "[resourceId('Microsoft.Compute/diskEncryptionSets', 'myDiskEncSet')]"
}

Requires a Disk Encryption Set + Key Vault.

Backup

Requires a Recovery Services Vault + Backup Policy.

Domain Join

Requires a reachable domain controller + correct credentials.

Private Endpoint

Requires a Private Link Service target.

Update Management

Requires an Automation Account.

These are still fully functional, but they depend on your environment.

---

Trusted Launch & Confidential Computing

These are valid ARM configurations, but:

• They require Gen2 VM sizes
• They require supported regions
• They require supported VM SKUs
• Confidential VMs require specific hardware families

The JSON is correct, but Azure enforces compatibility rules.

For example:

"securityProfile": {
  "securityType": "TrustedLaunch",
  "uefiSettings": {
    "secureBootEnabled": true,
    "vTpmEnabled": true
  }
}

This works only on Gen2 VMs.

And:

"securityType": "ConfidentialVM"

Works only on:

• DCasv5
• ECasv5
• DCesv5
• ECesv5

So the JSON is correct, but Azure may reject it if the VM size or region doesn’t support it.

---

Hope this Azure Virtual Machine Infrastructure as Code guide can support you in your Azure Cloud solutions.

All the Microsoft Azure Virtual Machine features and options today.

Windows Admin Center Secured-core server view

The latest Windows Admin Center (WAC) release, version 2511 (November 2025, public preview), introduces refreshed management tools and deeper integration with modern Windows security features like Secure Boot, TPM 2.0, Kernel DMA Protection, Virtualization‑based Security (VBS), and OSConfig baselines for Windows Server.

Secured-core is a collection of capabilities that offers built-in hardware, firmware, driver and operating system security features. The protection provided by Secured-core systems begins before the operating system boots and continues whilst running. Secured-core server is designed to deliver a secure platform for critical data and applications.

Secured-core server is built on three key security pillars:

• Creating a hardware backed root of trust.
• Defense against firmware level attacks.
• Protecting the OS from the execution of unverified code.

Windows Admin Center 2511: Security Meets Modern Management

Windows Admin Center has steadily evolved into the preferred management platform for Windows Server and hybrid environments. With the 2511 build now in public preview, Microsoft continues to refine the experience for IT administrators, blending usability improvements with defense‑in‑depth security Microsoft Community.

 Security Features at the Core

What makes this release stand out is how WAC aligns with the latest Windows security stack. Let’s break down the highlights:

• OSConfig Security Baselines
  WAC now integrates baseline enforcement, ensuring servers adhere to CIS Benchmarks and DISA STIGs. Drift control automatically remediates deviations, keeping configurations locked to secure defaults. ( I like this one!)
• Hardware‑based Root of Trust
  Through TPM 2.0 and System Guard, WAC can validate boot integrity. This means admins can remotely attest that servers started securely, free from tampering.
• Kernel DMA Protection
  Thunderbolt and USB4 devices are notorious vectors for DMA attacks. WAC surfaces configuration and compliance checks, ensuring IOMMU‑based protection is active.
• Secure Boot Management
  OEM Secure Boot policies are visible and manageable, giving admins confidence that only signed, trusted firmware and drivers load during startup.
• Virtualization‑based Security (VBS)
  WAC exposes controls for enabling VBS and Memory Integrity (HVCI). These features isolate sensitive processes in a hypervisor‑protected environment, blocking unsigned drivers and kernel exploits.

Windows Server security baseline not yet implemented as you can see

 What’s New in Build 2511

Beyond security, version 2511 delivers refinements to the virtual machines tool, installer improvements, and bug fixes. Combined with the backend upgrade to .NET 8 in the earlier 2410 GA release, WAC is faster, more reliable, and better equipped for enterprise workloads.

Why It Matters

In today’s hybrid IT landscape, security and manageability must coexist. Windows Admin Center 2511 demonstrates Microsoft’s commitment to:

• Unified management: One pane of glass for servers, clusters, and Azure Arc‑connected resources.
• Compliance assurance: Built‑in baselines reduce audit headaches.
• Future‑proof security: Hardware‑rooted trust and virtualization‑based isolation protect against evolving threats.

Final Thoughts

If you’re an IT admin preparing for Windows Server 2025 deployments, the new Windows Admin Center build is more than just a management tool—it’s a security enabler. By weaving in Secure Boot, TPM, DMA protection, and VBS, WAC ensures that your infrastructure isn’t just easier to manage, but fundamentally harder to compromise.

Here you find the Microsoft docs :

What is Secured-core server for Windows Server | Microsoft Learn

OSConfig overview for Windows Server | Microsoft Learn

How System Guard helps protect Windows | Microsoft Learn

Kernel DMA Protection | Microsoft Learn

Secure boot | Microsoft Learn

Trusted Plaform Module (TPM) 2.0 | Microsoft Learn

Virtualization-based Security (VBS) | Microsoft Learn

Enable memory integrity | Microsoft Learn

What is Windows Admin Center Virtualization Mode (Preview)?

Windows Admin Center Virtualization Mode is a purpose-built management experience for virtualization infrastructure. It enables IT professionals to centrally administer Hyper-V hosts, clusters, storage, and networking at scale.

Unlike administration mode, which focuses on general system management, Virtualization Mode focuses on fabric management. It supports parallel operations and contextual views for compute, storage, and network resources. This mode is optimized for large-scale, cluster-based environments and integrates lifecycle management, global search, and role-based access control.

Virtualization Mode offers the following key capabilities:

• Search across navigation objects with contextual filtering.
• Support for SAN, NAS, hyperconverged, and scale-out file server architectures.
• VM templates, integrated disaster recovery with Hyper-V Replica, and onboarding of Arc-enabled resources (future capability).
• Software-defined storage and networking (not available at this time).

Install Windows Admin Center Virtualization Mode

Test all these New features of Windows Admin Center and Windows Server in your test environment and be ready for production when it becomes general available. Download Windows Admin Center 2511 Preview here

Updating Windows Server Insider Preview Build to version 26461.1001

On August 7, 2025, Microsoft dropped a fresh Insider Preview build for Windows Server vNext—Build 26461—and it’s packed with innovations aimed at enterprise resilience, storage performance, and hybrid cloud readiness. Whether you’re a datacenter architect or a curious sysadmin, this build offers a glimpse into the future of Windows Server 2025.

Rack Level Nested Mirror (RLNM) for S2D Campus Cluster

One of the headline features is Rack Level Nested Mirror (RLNM) for Storage Spaces Direct (S2D) Campus Clusters. This enhancement is designed to meet NIS2 compliance for multi-room data redundancy in industrial environments.

Key capabilities:

• Enables fast and resilient storage across multiple racks or rooms.
• Supports all-flash storage (SSD/NVMe) with RDMA NICs (iWARP, RoCE, InfiniBand).
• Requires defining rack fault domains during cluster setup.
• Supports four-copy volumes with both fixed and thin provisioning.

This is a game-changer for factories and enterprises needing high availability across physical fault domains.

Under the Hood: Germanium Codebase

Build 26461 is based on the Germanium codebase, aligning with the broader Windows 11 ecosystem. It supports both AMD64 and ARM64 architectures and was compiled on July 31, 2025.

Final Thoughts

Windows Server vNext Build 26461 is more than just a preview—it’s a blueprint for the next generation of enterprise-grade infrastructure. With RLNM, expanded deployment options, and tighter integration with Azure, Microsoft is clearly doubling down on hybrid cloud and high-availability scenarios.

You can explore the full announcement on Microsoft’s Community Hub. Enjoy your testing

Unleashing the Future: Windows Server 2025’s Hyper‑V Virtualization & Advanced Security

Microsoft Windows Server 2025 is rewriting the playbook on enterprise virtualization. With its Hyper‑V solution at the core, it delivers not only powerful computing and storage capabilities but also a resilient security foundation that addresses today’s rapidly evolving threat landscape. In this post, we’ll explore the architectural advances, enhanced virtualization features, and robust security mechanisms baked into this release.

Hyper‑V in Windows Server 2025: A New Paradigm in Virtualization

A Strategic and Integrated Platform

Hyper‑V remains Microsoft’s flagship hardware virtualization technology—now scaled to meet modern data center demands. In Windows Server 2025, Hyper‑V serves as the backbone for a wide array of Microsoft solutions, from on‑premises infrastructures to cloud integrations via Azure and Azure Arc. This unified approach ensures seamless orchestration across hybrid environments, providing flexibility and cost efficiencies to businesses switching between workloads on Windows Server Standard and Datacenter editions. Notably, while the Standard edition grants licensing rights to run two Windows Server guest operating systems, the Datacenter edition offers unlimited virtualization rights, empowering enterprises with a dramatic boost in scalability.

Virtual Machines Optimized for Modern Workloads

Hyper‑V’s modern enhancements are not just about quantity but also quality. The solution supports a diverse catalog of guest operating systems—including not only Windows but also leading Linux distributions such as Red Hat Enterprise Linux, CentOS, Debian, Oracle Linux, SUSE, and Ubuntu, with integration services natively updated within the Linux kernel. Even FreeBSD gets its own integration enhancements for improved performance. By offering this extensive compatibility, Microsoft ensures that organizations can integrate heterogeneous environments without sacrificing performance or support.

Innovative Tools and Performance Enhancements

Windows Server 2025 embraces innovative management and performance tools:

• DTrace Integration: A native tool for dynamic system instrumentation, DTrace’s inclusion allows administrators to conduct real‑time performance monitoring and troubleshooting at both the kernel and user levels without modifying source code.
• Storage and Networking Virtualization: Integrated with technologies like Software‑Defined Storage (Storage Spaces Direct) and Software‑Defined Networking (SDN), Hyper‑V enables efficient resource utilization across modern storage infrastructures—whether local, SAN, or hyperconverged solutions. SDN Multisite allows you to expand the capabilities of traditional SDN deployed at different physical locations. SDN Multisite enables native Layer 2 and Layer 3 connectivity across different physical locations for virtualized workloads
• Enhanced Desktop Integration and Hybrid Cloud Capabilities: The new desktop shell and advanced upgrade paths from previous Windows Server versions ensure a smooth transition, bolstering both administrative efficiency and user experience.

Together, these capabilities position Hyper‑V as a strategic tool in the IT arsenal of enterprises worldwide.

Fortifying Infrastructure with Advanced Security

Multilayered Security Architecture

On the security front, Windows Server 2025 represents a major leap forward. At a time when cyber threats are increasingly sophisticated, Microsoft has embedded multiple security layers directly into the operating system. Hyper‑V plays a central role in virtualization‑based security (VBS), where hardware virtualization creates isolations that serve as roots of trust—from the hypervisor to the kernel. This design reduces the attack surface significantly, even if core components are compromised.

Active Directory and SMB Improvements

Primary security staples such as Active Directory have seen significant security enhancements. New protocols, improved encryption standards, and hardened configurations offer a resilient defense against credential-based attacks. In addition, file sharing services in Windows Server 2025 benefit from SMB hardening techniques, including support for SMB over QUIC. This ensures that file sharing remains secure against man‑in‑the‑middle attacks, brute force attempts, and spoofing threats while providing seamless access over the internet.

Delegate Managed Service Accounts (dMSA)

Microsoft has also overhauled the approach to service identity management. By introducing delegate Managed Service Accounts (dMSA), Windows Server 2025 eliminates the need for manual password management on service accounts. This automated process not only simplifies administrative overhead but also tightens security by ensuring that every account has the minimal privileges required—and every access is logged for better accountability.

Hotpatching: Zero‑Downtime Security Updates

Among the innovations, hot patching stands out as a “game changer.” In traditional systems, applying security patches often necessitated reboots—a disruptive process in today’s always‑on environments. Windows Server 2025 now supports hot patching, enabling administrators to apply updates to live systems without interruption. By leveraging Azure Arc, Windows Server 2025 brings a level of agility to on‑premises deployments similar to that found in cloud environments. It’s important to note, however, that for on‑premises solutions, hot patching is currently offered under a paid subscription model, while Azure customers get this capability as part of standard service offerings.

Hotpatch process

Bridging Cloud and On‑Premises with Seamless Integration

Hybrid Cloud Flexibility

Windows Server 2025’s hybrid cloud capabilities offer the best of both worlds. When integrated with Microsoft Azure Arc, Hyper‑V not only extends its virtualization benefits but also ensures that on‑premises deployments continuously receive cutting‑edge cloud agility. This seamless integration paves the way for dynamic scaling, improved disaster recovery, and unified management across multi‑cloud environments.

Cost Efficiency and Licensing Strategies

The licensing approach is designed with flexibility in mind. Whether you opt for the Standard edition or embrace the unlimited potential of the Datacenter edition, you receive enterprise‑grade virtualization at no additional cost for Hyper‑V. This cost model proves particularly attractive for organizations extending their operations to include Linux guests or multiple virtualized servers, streamlining operational costs without compromising security or performance.
Here you find more about Comparison of Windows Server editions.

Conclusion

Microsoft Windows Server 2025, with its powerhouse Hyper‑V virtualization solution, redefines how enterprises approach infrastructure management in an era of constant digital transformation. By combining advanced virtualization techniques with multilayered security features—ranging from VBS to hot patching—this release is a testament to Microsoft’s commitment to high performance and resilient, adaptive security.

For IT professionals eager to modernize their data centers and streamline hybrid cloud deployments, exploring the latest improvements in Hyper‑V and the overarching security framework in Windows Server 2025 is not just recommended—it’s imperative.

If you’re looking to experiment with these features and integrate them into your infrastructure, consider diving deeper into hot patching subscription details, exploring Linux guest integrations, or even benchmarking Hyper‑V performance against legacy virtualization systems. Each step uncovers further opportunities to optimize and secure your IT environment for the future.

JOIN the Microsoft Windows Server Insider Program

Test and Innovate with the New Windows Server Insider features!
It’s Awesome and Hyper-V Rocks

Try Now!

Windows Server 2025 Insider Preview Build 26360

Exploring the Latest Features in Microsoft Windows Server Insider Preview Builds

Microsoft’s Windows Server Insider Preview Builds are a treasure trove of innovation and advanced features designed to enhance performance, security, and flexibility for IT professionals. Today, we’re diving into the latest updates and new features introduced in the Windows Server 2025 Insider Preview Build.
Here you find more on What’s New in Microsoft Windows Server 2025

Here are some Highlights of new Windows Server 2025 Insider Preview features:

1. Enhanced Security with Delegated Managed Service Accounts (dMSA)

One of the standout features in this build is the introduction of Delegated Managed Service Accounts (dMSA). This new account type allows for migration from traditional service accounts to machine accounts with managed and fully randomized keys. By linking authentication to the device identity, dMSA helps prevent credential harvesting through compromised accounts, a common issue with traditional service accounts.

2. Windows Admin Center (WAC) Integration

Starting with this build, users can now download and install the Windows Admin Center (WAC) directly from the Windows Server Desktop. This in-OS app simplifies the installation process and provides a seamless experience for managing your server infrastructure.

3. Bluetooth Connectivity

Windows Server 2025 now supports Bluetooth connectivity, allowing users to connect mice, keyboards, headsets, and other peripherals directly to the server. This feature enhances flexibility and convenience for server management.

4. DTrace for Real-Time Performance Monitoring

The new build includes DTrace, a powerful command-line utility that enables real-time performance monitoring and troubleshooting. DTrace allows users to dynamically instrument both kernel and user-space code without modifying the code itself, supporting a range of data collection and analysis techniques.

5. Improved Upgrade Experience

Upgrading to Windows Server 2025 has never been easier. The build supports in-place upgrades from Windows Server 2012 R2 and later versions, allowing you to upgrade up to four versions at a time. This streamlined upgrade process ensures a smooth transition to the latest server version.

6. Feedback Hub for User Input

The new Feedback Hub app is now available for Server Desktop users. This app allows users to submit feedback or report issues directly to Microsoft, helping the development team understand user experiences and improve future builds.

7. SMB over QUIC and Alternative Ports

The build introduces SMB over QUIC with support for alternative ports. This feature enhances security and performance by allowing SMB traffic to use custom-defined ports instead of the default UDP/443 port.

8. Enhanced Desktop Experience

When you sign in for the first time, the desktop shell experience now conforms to the style and appearance of Windows 11. This visual update provides a familiar and modern interface for server administrators.

These new features and enhancements in the Windows Server 2025 Insider Preview Build demonstrate Microsoft’s commitment to providing cutting-edge solutions for IT professionals. Whether you’re looking to improve security, streamline management, or enhance performance, the latest Windows Server Insider Preview Build has something to offer.

Stay tuned for more updates and features as Microsoft continues to innovate and improve its server offerings.

Conclusion:

Become a Microsoft Windows Server Insider and get all the newest features first to play with it in your test environment.

Get started here and register for free

Mark Russinovich and Scott Hanselman on Stage talking about Copilot, ChatGPT and AI

Scott and Mark learn responsible AI

Always check the output of AI

Microsoft Azure Local 

NEW Microsoft Introducing disconnected Operations (Preview)

Azure Local with disconnected Operations
Awesome!

NSG with Azure Local

Security in Azure Local video

 

Defender for Cloud

Get Started Today

Azure Linux 3.0 on AKS kubernetes in Preview

QuickStart

AKS Automatic
Dynamic System Node pool in Preview

More Buit-in policies for AKS

Auto-Instrumentation with Application Insights
Preview in January 2025

Enhanced Risk & Attack Path Analysis for Containers

Microsoft Azure Container Registry – Image Auto Patching in Private Preview
Security on Vulnerabilities

Network Isolated Cluster in Public Preview
Here you find Best practices for cluster isolation in Azure Kubernetes Service (AKS)

Microsoft Container Vulnerabilities Management

Container Vulnerabilities Assessment throughout the software development lifecycle.

Defender for Cloud Container Security
Continuously reduce risks.

Attack path and remediation on your AKS Kubernetes Cluster Inside overview

Container Security posture from Code to runtime is important!

Microsoft Azure Kubernetes Fleet Manager Auto-Upgrade

Microsoft AKS Static Egress Gateway for Pod-level Access Control.

Block pod access to the Azure Instance Metadata Service (IMDS) endpoint (preview)

Trusted launch for Azure Kubernetes Service (AKS)

Seccomp Default Public Preview

Node Auto Provisioning GA January 2025

Comprehensive Security Controls overview

Experience Security Copilot Today

My Conclusion

Always start small with New innovative features like Azure Copilot or making your Adaptive Cloud first in a test environment.
Do your own experiences, testing and make your Secure architecture designs for your production. Keep it simple because it can be quick complex with a lot of dependencies. Microsoft works hard to make your life more easy in this changing IT landscape
I like to thank all the people who supported the Microsoft Ignite 2024 event, it was Awesome with a lot of Great News.

Here you find the Microsoft Ignite 2024 Book of News.

 

Don’t miss this Awesome Microsoft Windows Server Summit 2024 virtual event to get the latest and Greatest information powered by the Engineering team!

When: March 26-28, 2024. Mark your Calendar

Topic wise: it will be wide ranging covering all the new goodness of Windows Server 2025, on-prem and Hybrid scenarios, Azure Arc, Identity, Virtualization, SMB updates and more! 
Here you can find more information: Windows Server Summit 2024

Get started Today with Windows Server 2025 Insider Preview Build in your test environment!

Microsoft Windows Server 2025 Datacenter Insider Preview Build 26040

Microsoft released a new Windows Server Insider preview Build 26040 on January 26th and changed Windows Server vNext name into Microsoft Windows Server 2025!

So time to update my MVPLAB domain stack.local.

I’m updating my domain controller from build 26010 to 26040.

Before we can move further, we have to run adprep.

Run adprep from the new ISO on the Domain controller.
by Typing C and enter it will run.

Schema upgrade from 90 to 91

adprep /domainprep.

Adprep successfully updated.

After this click on refresh in the Windows Server Setup if you have this still open.

 

I want to keep my files, settings and apps on my domain controller.
Click on Install

Installing Windows Server 2025 Insider Preview Build 26040

Don’t turn off your machine.

Microsoft Windows Server 2025 Datacenter Insider Preview Build 26040
is running as my Domain Controller.

Don’t forget the last updates.

Running Schema object version 91.

Here you can find more information about Windows Server 2025 Insider Preview Build 26040

Follow Jeff Woolsey on X (Twitter) here

Follow Ned Pyle on X (Twitter) here

Get started by joining Windows Server Insider program

Make your Windows Servers Hybrid with Microsoft Azure Arc
for more Hybrid IT management Benefits

Seagate vient d’annoncer l’arrivée d’un nouveau disque dur pour NAS : IronWolf Pro 22 To. Il est basé sur la technologie CMR, remplit d’Helium et le fabricant annonce des débits pouvant atteindre 285 Mo/s. Son prix public : 595€… Seagate a également profité de l’occasion pour annoncer un nouveau partenariat avec le constructeur de NAS QNAP. Seagate IronWolf Pro 22 To et nouveau partenariat Lors de la conférence NAB 2023, Seagate a fait 2 annonces. La première, c’est l’arrivée d’un […]

Merci à vous de suivre le flux Rss de www.sospc.name. ;o)<

Je vous propose un logiciel d'une valeur de 40€, gratuit, et avec une licence à vie.  Si vous avez déjà bénéficié de ce bon plan proposé en janvier 2023 avec la version 5.199, il suffit d'effectuer la mise à jour tout simplement vers la version 5.203. Si c'est la première fois que vous installez le […]

Cet article [Bon Plan] Glary Utilities Pro 5 offert est apparu en premier sur votre site préféré www.sospc.name ;o)<

Microsoft vient d’annoncer une mise à jour de son Surface Hub 2S, avec ses deux modèles 50 et 85 pouces .C’est le premier tableau numérique tactile à exécuter nativement Teams Rooms sous Windows. Le passage de Windows 10 Team Edition (le système d’exploitation qui équipe le Surface Hub 2S de première génération) débloque plusieurs fonctionnalités de Teams Rooms par exemple la prise en charge de Front Row. Actuellement aucune information sur le matériel qui équipe le Surface Hub 2S actualisé. Windows Central affirme que l’ordinateur fonctionne avec un processeur Intel Core de 11e génération sans plus de précision.

Concernant la première génération du Surface Hub 2S, Microsoft continuera d’envoyer des mises à jour de sécurité et des correctifs critiques jusqu’au 14 octobre 2025 (pour rappel, nous vous en parlions sur le blog et lors des derniers Briefing, Microsoft a cessé de prendre en charge le Surface Hub original en décembre dernier).

Pour ce qui est de la date de dispo, Microsoft annonce qu’il sera disponible dans le courant de l’année, sans plus de précision.

Parallèlement à l’annonce par Microsoft de la prochaine version du Surface Hub 2S, l’entreprise a également annoncé de nouvelles fonctionnalités et de nouveaux appareils qui seront ajoutés pour Teams Rooms. L’un de ces nouveaux appareils est le Cisco Board Pro, un tableau blanc à écran tactile disponible en 55 et 75 pouces.

Microsoft révèle également quelques nouvelles fonctionnalités qui seront ajoutées à Teams Rooms dans les mois à venir. L’une d’entre elles permettra aux utilisateurs de se connecter à leur compte à l’aide d’un code QR via leur téléphone portable :

Avec cette mise à jour, les utilisateurs n’ont plus à saisir manuellement leurs identifiants dans l’appareil, ce qui ralentit leur productivité. Cette fonctionnalité a été introduite après quelques essais pilotes d’affichage de Teams dans des salles téléphoniques sur le campus de Microsoft. Nos utilisateurs impliqués dans le processus de test nous ont fait part de leurs commentaires précieux, nous indiquant que la connexion à l’appareil était fastidieuse et inefficace. La possibilité de se connecter à l’aide d’un code QR devrait donc permettre de rationaliser ce processus.
Une nouvelle interface utilisateur pour Teams Rooms sur Windows sera également déployée ce mois-ci. Elle comprendra des fonctionnalités telles qu’une page d’accueil remaniée, plusieurs nouveaux thèmes, un moyen de les personnaliser afin que les utilisateurs puissent voir le logo de leur entreprise, et bien d’autres choses encore.

Au deuxième trimestre 2023, Microsoft Teams for Rooms ajoutera également la prise en charge de Microsoft Defender for Endpoint Plan 2, qui comprendra la protection contre les logiciels malveillants.

Enfin, Microsoft a révélé la nouvelle plateforme de l’écosystème des appareils Microsoft, basée sur le projet Android Open Source (AOSP).

La plateforme de l’écosystème d’appareils Microsoft offre une sécurité de premier ordre adaptée aux espaces partagés et comporte un ensemble de fonctions de sécurité et de résistance à la falsification de premier ordre, notamment le démarrage sécurisé et vérifié, l’anti-rollback, les politiques de sécurité à accès contrôlé, le verrouillage du numéro d’unité logique (LUN) de la partition et le cryptage des données au repos.
Le système de barre vidéo Jabra PanaCast 50 sera le premier appareil à prendre en charge la plate-forme de l’écosystème Microsoft. Il exécutera nativement Microsoft Teams Rooms sur Android et offrira des espaces partagés et des salles de réunion avec des fonctions vidéo et audio sécurisées. D’autres appareils compatibles avec le nouvel écosystème seront dévoilés dans les mois à venir.

Rendez-vous au Briefing pour un récap de tout cela

Businesses in search of the latest hardware – key to helping them better defend against the latest security threats and improve productivity – now have another advantage when they buy Windows 11 PCs: a new Intel vPro platform powered by 13th Intel Core processors. Intel vPro has built-in hardware security to detect ransomware and software supply chain attacks. Customers will have more choice with endpoint detection and response (EDR) vendors enabled with Intel Threat Detection Technology. New IT-enabled memory encryption will also take virtualization-based security to a game-changing level in Windows 11. This year, Intel’s expansive commercial portfolio will deliver more than 170 notebooks, desktops and entry workstations from partners including Acer, ASUS, Dell, HP, Lenovo, Fujitsu, Panasonic and Samsung. Modern business computing is further optimized through Intel vPro devices thanks to Intel Wi-Fi 6E (Gig+), Thunderbolt 4 and the validation of the Intel Evo platform with experiences like intelligent collaboration. For edge application developers, 13th Gen Intel Core processors on Intel vPro platforms provide edge processing performance, remote device manageability, powerful security tools and much more to unleash the power of their data. The processors are ideal for applications in retail, banking, hospitality, education, healthcare and manufacturing, and other small or medium-sized businesses, large enterprises, public sector organizations or academic institutions. Find out more about the platform and processors over at Intel.

Microsoft a rendu disponible une nouvelle mise à jour applicative pour les Microsoft Teams Rooms sur Android, anciennement barre de collaborations. C'est une mise a jour très attendue qui amène une évolution de l'expérience utilisateur intéressante pour les organisations. Vous pouvez trouver la description des nouveautés sur mon précédent post ici: [Microsoft Teams] Importante évolution de l'expérience utilisateur avec les Microsoft Teams Rooms sur Android planifié pour mars 2023 Version: 1449/1.0.96.2023031201 Date: 23 Mars 2023 Les différentes nouveautés avec les prérequis associés sont résumés ci-dessous: Rejoindre une réunion Teams avec ID - disponible dans toutes les licences Microsoft Teams Rooms. Réunions ad hoc d'un seul clic - disponible dans toutes les licences Microsoft Teams Rooms. Extension de réservation de salle - disponible uniquement dans les licences Teams Pro. Disposition de première rangée - disponible dans les licences Teams Standard, Premium et Pro. Discussion de la réunion dans les modes Galerie, Grande galerie et Ensemble - disponible uniquement dans les licences Teams Pro. Contrôles de partage automatique HDMI Connect - disponible dans toutes les licences Microsoft Teams Rooms. Partage audio HDMI - disponible dans toutes les licences Microsoft Teams Rooms. Prise en charge d'annotations collaboratives - disponible dans toutes les licences Microsoft Teams Rooms. Prise en charge des réunions avec filigrane Teams Premium - disponible dans toutes les licences Microsoft Teams Rooms. Il est notable de considérer une différence de fonctionnalité dorénavant pour les organisations utilisant le nouveau modèle de licence Teams Room Pro par rapport à l'ancien modèle avec des licences MTR standard.

Merci à vous de suivre le flux Rss de www.sospc.name. ;o)<

Windows se contente de lancer l’exécutable de désinstallation intégré à chaque logiciel, et le problème c'est que la plupart ne sont pas très performants. Oui, les programmeurs négligent, volontairement ou non, de supprimer certaines clés de registre et/ou dossiers. Il est vrai qu'à partir du moment où vous quittez un éditeur, ce dernier n'a pas […]

Cet article [Bon plan] IObit Uninstaller Pro 12 : un désinstalleur remarquable est apparu en premier sur votre site préféré www.sospc.name ;o)<

Merci à vous de suivre le flux Rss de www.sospc.name. ;o)<

Je vous propose d'installer la version professionnelle d'un excellent logiciel de partitionnement très utile de nos jours au regard de la taille des disques durs qui va croissant ces dernières années. AOMEI Partition Assistant Professional, en français et compatible de Windows XP à 11, est vraiment très intuitif à utiliser. Je vous l'avais proposé à […]

Cet article [Bon Plan] AOMEI Partition Assistant Pro 2023 offert ! est apparu en premier sur votre site préféré www.sospc.name ;o)<

Alors que nos smartphones deviennent chaque année de plus en plus puissants, ils se transforment petit à petit en véritables consoles de jeu. De nombreux éditeurs n’hésitent pas à porter leur jeu sur mobile ou en tout cas créer des versions pour téléphones. Et puis, le cloud est venu révolutionner le jeu sur mobile en […]

L'article Test : la manette MG-X pour iPhone transforme votre téléphone en console de jeu est apparu pour la première fois sur Byothe.fr.