Azure Storage published a deceptively important operational note on Sept 24: delete operations will be blocked when blobs are protected by immutability policies (WORM), legal holds, or retained versions. That’s not a theoretical corner case — it’s the kind of failure mode that ruins automated cleanups, retention rollups, or CI/CD pipelines that assume delete always works.
At the same time Microsoft moved two items to GA in the Sept 18–25 window: Azure Container Apps Express reached general availability (Sept 23), and Azure Firewall’s explicit-proxy model is marked GA in updated docs. Together they point to the same trend: Microsoft is prioritizing developer ergonomics and higher-level traffic controls, but the operational surface area for platform teams just got larger.
Why the Storage guidance matters
If you run lifecycle automation that deletes blobs (cleanup jobs, tenant teardown, test artifacts), the storage post will surprise you: immutability policies, legal holds, and version retention block deletes and return errors. The system is doing exactly what it should for compliance, but Microsoft’s guidance reveals two things teams often miss:
- Retention/immutability is orthogonal to soft-delete; objects can be non-deletable even when soft-delete is disabled.
- Version retention means a delete request for the current version can fail because older versions are still under a retention policy.
The immediate remediation is straightforward — inspect blob properties for immutability, legal holds, and retained versions before attempting delete, and make automated workflows able to detect and surface those conditions. Teams that punted on these checks are going to be paged.
Container Apps Express GA: the right ergonomics, with caveats
Container Apps Express (GA Sept 23) does one genuinely useful thing: it lets engineers push container images as web apps/APIs without creating a Container Apps environment first. That removes friction — fewer knobs for devs, faster iterations, less YAML noise.
This is the right call. Developer velocity matters, and many teams were indifferent to environment topology just to get code running. But speed shifts responsibility. Previously an “environment” centralized ingress, private VNET integration, log sinks, and scale settings. With Express, those controls either become global defaults or they get pushed into other configuration surfaces that developers will ignore until they hurt.
Platform teams must respond by coding guardrails: enforce image scanning and registry policies in CI, inject network controls via policy-as-code, and make observability mandatory. If you let Express produce dozens of app endpoints with inconsistent ingress and telemetry, you’ve traded a small ops step for a messier long tail of incidents.
Azure Firewall explicit-proxy GA: a new interception point
The explicit-proxy GA adds a native configuration model for explicit proxying in Azure Firewall. Operationally that’s useful — it avoids hacks like routing traffic through proxy VMs — but it’s another place to manage policy. Explicit-proxy changes where TLS interception, client authentication, and logging occur. Teams adopting it should treat it like a new service with its own RBAC, audit needs, and performance characteristics.
A practical stance
Treat these announcements as signals, not just features. Microsoft is simplifying developer flows while centralizing certain network patterns. Platform teams should:
- Audit storage lifecycle tooling for immutability/retention checks immediately.
- Add CI gates for images (scanning, provenance) and enforce them before Express deploys hit prod.
- Treat Azure Firewall explicit-proxy as infrastructure that needs dedicated RBAC and telemetry.
Final take: GA doesn’t mean low-touch. Container Apps Express is overdue and the right move for developer UX, but it’s going to accelerate a class of “works for devs, surprises SREs” problems unless platform teams adopt tighter policy-as-code and lifecycle checks. Expect more one-click developer primitives from Azure; if you’re still reacting to failures instead of baking checks into CI/CD and infra-as-code, you’ll be the one paged at 2 a.m.
Sources
- Azure category — Microsoft Community Hub
- Apps on Azure Blog — Azure Container Apps Express is now Generally Available
- Azure Networking Blog — Azure Firewall explicit proxy is now generally available
- Azure Storage Blog — Troubleshooting Azure Storage Deletion: Immutability, WORM, and Version Retention