Migrate & Modernize Your VMware Platform Using Azure VMware Solution Gen 2
This video series by Microsoft Global Blackbelts, Carlos Villuendas (CarlosV) and Trevor Davis (tredavis), guides users from configuring prerequisites to deploying, migrating on-premises VMware workloads to Azure VMware Solution, then integrating VMware workloads with Azure Native services for enhanced value. These are the first two videos, much more to come, please check back often. For requests, leave comments in the notes. Enjoy! 1 - Prerequisites 2 - DeploymentBroadcom VMware Licensing Changes: What Azure VMware Solution Customers Need to Know
Broadcom has announced changes are coming to its VMware licensing model on hyperscalers beginning in its new fiscal year on November 1, 2025. If you’re an Azure VMware Solution customer, here’s what you need to know about the new requirements and how they will affect your cloud deployments. What’s changing? Broadcom is changing its VMware licensing policies across all hyperscaler platforms to require customers to “bring your own” portable subscription for VMware Cloud Foundation (VCF). This means customers must purchase portable VCF subscriptions directly from Broadcom to use with cloud services in the future, including Azure VMware Solution. Azure VMware Solution already supports “bring your own” licensing model The good news is that Azure VMware Solution is ready for this change. The Azure VMware Solution VCF BYOL option is available in all 35 AVS regions worldwide, allowing customers to run AVS using their own VCF subscriptions. This BYOL solution is priced lower than AVS with bundled VCF subscription. No product changes to Azure VMware Solution These updates are about licensing only—there are no product changes to how Azure VMware Solution works. Microsoft will continue to deliver Azure VMware Solution as a fully managed VCF private cloud service on Azure. In practice, this means that Microsoft takes care of all infrastructure and VMware host level software management, patches and upgrades. You don’t need to worry about hardware maintenance or manual VMware host updates. Key dates and transition details Microsoft will stop selling Azure VMware Solution with VCF subscriptions included after October 15, 2025. After this date, new Azure VMware Solution node purchases will require you to provide a VCF subscription purchased from Broadcom. Microsoft will honor existing Reserved Instance commitments to Azure VMware Solution customers. If you purchase Azure VMware Solution Reserved Instances (RIs) on or before October 15, 2025, you can continue to use your Azure VMware Solution nodes without any licensing or product changes until your RI term ends. Azure VMware Solution with license included PayGo nodes can continue to operate without any licensing or product changes through October 31, 2026. Alternatively, customers can switch from Azure VMware Solution PayGo and purchase an Azure VMware Solution RI with license included by October 15, 2025. Helpful resources We’re committed to making this transition as smooth as possible for our customers and partners. Here are some helpful links with more details: How to use portable VCF subscriptions with Azure VMware Solution How to purchase an Azure VMware Solution RI Broadcom Blog announcing the VMware licensing change If you need to purchase VCF subscriptions and do not have a Broadcom contract, leverage one of the Broadcom channel partners here. We will be reaching out directly to current Azure VMware Solution customers with more details. If you have any questions, reach out to your Microsoft account representative so we can help you navigate this transition.Azure VMware Solution Broadcom VMSA-2025-0004 Remediation
With continuous monitoring and security intelligence gathering, Microsoft ensures proactive identification and mitigation of security threats. By leveraging advanced analytics, Microsoft is able to detect vulnerabilities early, empowering organizations to stay ahead of potential risks and safeguard their digital assets effectively. Recently, Microsoft discovered a critical ESXi vulnerability and has been collaborating with Broadcom to develop and qualify a secure patch to address this issue. With Microsoft’s commitment to the security of our platform and our improved lifecycle management process, we were able to quickly assemble a global team to work on the acceleration and validation of the ESXi 8.0 U2d Build 24585300 security patch. We have successfully qualified the security patch that will mitigate VMSA-2025-0004 across our fleet. As a result, with the public release of this vulnerability we are ready to patch your existing Azure VMware Solution infrastructure. We are committing to completing the remediation within 30-days. Microsoft will communicate the scheduled date of patching over the next three weeks. Any Azure VMware Solution private cloud deployed after March 4, 2025 will be provisioned with the patch already applied to the environment. Microsoft takes an in-depth approach to vulnerability and risk management. With our new and improved partnership with Broadcom, this allows us to enhance our overall security and quickly address vulnerabilities in VMware solutions. If you are interested in the Azure VMware Solution, please use these resources to learn more about the service: Homepage: Azure VMware Solution Documentation: Azure VMware Solution SLA: SLA for Azure VMware Solution Azure Regions: Azure Products by Region Known Issues: Azure VMware Solution Software Versions: Azure VMware Solution Security Advisories: Broadcom Release Notes: ESXi 8.0 U2d Build 24585300 Author Bios Ricky Perez is a Senior Technical Program Manager in the Azure VMware Solution product group at Microsoft. His background is in solution architecture with experience in public cloud and core infrastructure services. Chastidy Harris is a Senior Program Manager in the Azure VMware Solution product group at Microsoft. Rahi Patel is a Senior Technical Program Manager in the Azure VMware Solution product group at Microsoft. René van den Bedem is a Principal Technical Program Manager in the Azure VMware Solution product group at Microsoft. His background is in enterprise architecture with extensive experience across all facets of the enterprise, public cloud & service provider spaces, including digital transformation and the business, enterprise, and technology architecture stacks. René works backwards from the problem to be solved and designs solutions that deliver business value with the minimum of risk. In addition to being the first quadruple VMware Certified Design Expert (VCDX), he is also a Dell Technologies Certified Master Enterprise Architect, a Nutanix Platform Expert (NPX), and a VMware vExpert.Take Control of Your Azure VMware Solution Maintenance Schedule
Overview Azure VMware Solution is a VMware validated first party Azure service from Microsoft that provides private clouds containing VMware vSphere clusters built from dedicated bare-metal Azure infrastructure. It enables customers to leverage their existing investments in VMware skills and tools, allowing them to focus on developing and running their VMware-based workloads on Azure. At Microsoft, we’re continuously evolving our services based on customer feedback and Azure VMware Solution is no exception. As a fully Microsoft-managed service, Azure VMware Solution takes care of the end-to-end lifecycle management of your VMware environment, from ESXi host patching to vCenter Server and NSX upgrades. This ensures your private cloud stays secure, compliant, and up-to-date. Historically, planned maintenance for Azure VMware Solution was scheduled by Microsoft, and customers who needed the schedule adjustments had to open a support request to modify their maintenance windows. But that’s changing. Introducing Self-Service Maintenance Scheduling We’re thrilled to introduce Self-Service Scheduling for planned maintenance events in Azure VMware Solution. Go ahead and schedule your next Azure VMware Solution maintenance on your terms and let the built-in health checks guide you to a smooth upgrade: Self-Service the planned Maintenance events – An Azure Portal feature that gives customers a user interface to view upcoming maintenance and schedule it to a preferred time without contacting support. Private Cloud “Maintainable State” Indicator – A built-in pre-check that determines if your private cloud is in a maintenance-ready state. If not, it will show which issues need attention to make the environment ready for upgrade. Designed for Agility and Peace of Mind These features mark a significant step toward a more agile and transparent Azure VMware Solution maintenance experience. You maintain the benefits of a fully managed service, expert-managed upgrades, built-in security, and full support, while gaining precise control over the timing of your upgrades. Whether you're planning around critical business windows or simply want more predictability, the new self-service capabilities help ensure smoother, more efficient Azure VMware Solution operations. Ready to try it out? Step 1 - Log in to the Azure portal and take control of your next maintenance event. It’s maintenance, your way. Step 2 - From the Azure VMware Solution private cloud Overview page in the Azure Portal, look for the maintenance message and click the schedule link or under the Operations option, select the Maintenance page. Step 3 - From the Maintenance page, check the "Maintenance ready" status for each item and use the "Reschedule" link to change the upgrade date and time. Step 4 - If the Maintenance ready status is "No", check the detailed message for the remediation plan to unblock the upgrade. Summary Self-Service Maintenance Scheduling is now in Public Preview, use this instead of opening a service request to change your Azure VMware Solution planned maintenance. If you are interested in the Azure VMware Solution, please use these resources to learn more about the service: Homepage: Azure VMware Solution Documentation: Azure VMware Solution SLA: SLA for Azure VMware Solution Azure Regions: Azure Products by Region Self-Service Maintenance: Plan self-service maintenance for Azure VMware Solution Author Bios Hetal Prashnani is a Technical Program Manager in the Azure VMware Solution product group at Microsoft. René van den Bedem is a Principal Technical Program Manager in the Azure VMware Solution product group at Microsoft. His background is in enterprise architecture with extensive experience across all facets of the enterprise, public cloud & service provider spaces, including digital transformation and the business, enterprise, and technology architecture stacks. René works backwards from the problem to be solved and designs solutions that deliver business value with the minimum of risk. In addition to being the first quadruple VMware Certified Design Expert (VCDX), he is also a Dell Technologies Certified Master Enterprise Architect, a Nutanix Platform Expert (NPX), and a VMware vExpert.Azure VMware Solution Broadcom VMSA-2025-0013 Remediation
Broadcom has released a new Critical Security Advisory, VMSA-2025-0013 with a CVSS base score range of 7.1 to 9.3. With Microsoft’s commitment to the security of our platform and our improved lifecycle management process, we were able to quickly assemble a global team to work on the acceleration and validation of the ESXi 8.0 U3f + Hot Patch (VAIO bug fix) Build 24797835 security patch . We have nearly finished qualifying the security patch that will mitigate VMSA-2025-0013 across our fleet. As a result, with the public release of this vulnerability we expect to be able to patch your existing Azure VMware Solution infrastructure next week. We are committing to completing the remediation within 30-days. Microsoft will communicate the scheduled date of patching over the next three weeks. Any Azure VMware Solution private cloud deployed next week will be provisioned with the patch already applied to the environment. Microsoft takes an in-depth approach to vulnerability and risk management. With our new and improved partnership with Broadcom, this allows us to enhance our overall security and quickly address vulnerabilities in VMware solutions. If you are interested in the Azure VMware Solution, please use these resources to learn more about the service: Homepage: Azure VMware Solution Documentation: Azure VMware Solution SLA: SLA for Azure VMware Solution Azure Regions: Azure Products by Region Known Issues: Azure VMware Solution Software Versions: Azure VMware Solution Security Advisories: Broadcom Release Notes: vCenter Server 8.0 U3e Build 24674346 Release Notes: ESXi 8.0 U3f + Hot Patch (VAIO bug fix) Build 24797835 Author Bios Rahi Patel is a Senior Technical Program Manager in the Azure VMware Solution product group at Microsoft. René van den Bedem is a Principal Technical Program Manager in the Azure VMware Solution product group at Microsoft. His background is in enterprise architecture with extensive experience across all facets of the enterprise, public cloud & service provider spaces, including digital transformation and the business, enterprise, and technology architecture stacks. René works backwards from the problem to be solved and designs solutions that deliver business value with the minimum of risk. In addition to being the first quadruple VMware Certified Design Expert (VCDX), he is also a Dell Technologies Certified Master Enterprise Architect, a Nutanix Platform Expert (NPX), and a VMware vExpert.New Automation enhancements in AVS Landing Zone for Migration-Ready Infrastructure
Azure VMware Solution (AVS) Landing Zone offers PowerShell automation scripts that streamline deployment and management of key AVS components—jumpbox for secure access, HCX Connector for hybrid connectivity, and HCX Service Mesh for workload mobility—enabling consistent, repeatable setups that reduce manual effort, improve operational readiness, and accelerate migration timelines across multiple environments and regions.HCX 4.11.0 Upgrade and What it means for Current HCX Users
Overview Azure VMware Solution is a VMware validated first party Azure service from Microsoft that provides private clouds containing VMware vSphere clusters built from dedicated bare-metal Azure infrastructure. It enables customers to leverage their existing investments in VMware skills and tools, allowing them to focus on developing and running their VMware-based workloads on Azure. VMware HCX is the mobility and migration software used by the Azure VMware Solution to connect remote VMware vSphere environments to the Azure VMware Solution. These remote VMware vSphere environments can be on-premises, co-location or cloud-based instances. Figure 1 – Azure VMware Solution with VMware HCX Service Mesh Broadcom has announced the end-of-life (EOL) for VMware HCX version 4.10.x, effective July 27, 2025. To proactively address this change and ensure continued support, Microsoft will begin upgrading all Azure VMware Solution customers using HCX Manager to HCX version 4.11.0. What Changes are introduced as part of HCX 4.11.0? With the release of HCX 4.11.0, Broadcom has made significant changes to the way HCX will be available for download and upgrades. Local Mode From HCX 4.11.0 onwards, HCX will only be available in local mode. This means that HCX systems running 4.11.0 or later will no longer receive upgrade notifications under the System updates section from Broadcom. Once HCX systems are upgraded to 4.11.0 using the offline bundle they will operate in Local mode only. Connection to VMware & Hybridity Depot. As of 4.11.0 activation key-based licensing has been deprecated. Activation keys in HCX 4.11.0 will stop working 450 days after the upgrade to HCX 4.11.0 takes place. HCX systems running versions prior to 4.11.0 that are currently using the activation keys will stop working when connect.hcx.vmware.com is decommissioned later this year. Please note, the following HCX functionality is deprecated in HCX 4.11.0 and will be removed in a future release. HCX is 4.11.0 will no longer be supported as of December 24 th , 2025. Customers should plan to migrate to an alternative solution at the earliest if they use any of the following features. HCX V2T Migration HCX WAN Optimization HCX Disaster Recovery vCenter Server Plug-in for HCX HCX UI – Tracking page in Migration interface What actions will customers need to take? To ensure smooth migration, customers will be required to upgrade any paired HCX connectors and service mesh appliances to HCX 4.11.0. Furthermore, customers may be required to execute a resync operation on each HCX service mesh on both the source and connector sides to ensure that no errors have occurred due to the upgrade. All Azure VMware Solution customers have now been notified of their preliminary scheduled upgrade date. Customers have the option to reschedule using the Azure VMware Solution portal but must complete this upgrade during US work hours before July 31. Microsoft will only upgrade the HCX Cloud Manager, the on-prem HCX manager and service mesh appliances will need to be upgraded by the customer. Once upgraded, customers will find previous and current versions of the HCX connector bundles, including HCX 4.11.0, in their vSAN datastore for cluster-1, under a folder named “AVS_Official_HCX_Connector_Binaries” The HCX 4.11.0 bundle should be used by customers to upgrade their on-prem HCX connector. Summary Microsoft is working towards upgrading all Azure VMware Solution customers that are using HCX by the end of July 2025. Customers are currently being notified of when their upcoming HCX upgrade will take place. For additional information on VMware HCX 4.11, please review the following Knowledge base article from Broadcom. Upgrade Bundle Download from 443 UI will Fail in All HCX versions prior to 4.11 If you are interested in the Azure VMware Solution, please use these resources to learn more about the service. Homepage: Azure VMware Solution Learn: Run VMware resources on Azure VMware Solution Training Documentation: Azure VMware Solution Azure CLI: Azure Command-Line Interface (CLI) Overview PowerShell module: Az.VMware Module Terraform provider: azurerm_vmware_private_cloud Terraform Registry GitHub repository: Azure/azure-vmware-solution Cloud Adoption Framework: Introduction to the Azure VMware Solution adoption scenario Network connectivity scenarios: Enterprise-scale network topology and connectivity for Azure VMware Solution Enterprise Scale Landing Zone: Enterprise-scale for Microsoft Azure VMware Solution Enterprise Scale GitHub repository: Azure/Enterprise-Scale-for-AZURE VMWARE SOLUTIONS VMware homepage: VMware to Azure Migration Solutions VMware Ports and Protocols for HCX VMware HCX - VMware Ports and Protocols Author Bios Ricky Perez is a Senior Technical Program Manager in the Azure VMware Solution product group at Microsoft. His background is in solution architecture with experience in public cloud and core infrastructure services. Varun Hariharan is a Senior Product Manager on the Azure VMware Solution team at Microsoft, where he is focusing on observability and workload strategies for customers. His background is in Infrastructure as a Service (IaaS), log management, enterprise software, and DevOps.
Firewall integration in Azure VMware Solution
2020 has been a year like no other. In just a few months' time, businesses have transformed and have accelerated their efforts to migrate to the cloud. Following our announcement of Azure VMware Solution (AVS) last year, we have been helping customers accelerate this move to cloud by providing an easy lift and shift migration. Albeit customers love the same operational experience for VMware workloads and use familiar VMware technologies like vCenter, NSX Manager, HCX etc. in AVS, they also want to leverage security integrations that they have invested in for years. Below are a few common questions that we get from customers around this topic. How can they use the same firewalls/tools that they have been using for years? How do they maintain the same security posture? How can they use the same firewall for both Azure and VMware workloads in AVS? In this blog series, we plan to discuss native security options, 3 rd party firewall integration with AVS along with a deep dive into configuration details. First in the series, this blog would summarize the security options available at your disposal. Let’s start with the built-in security capabilities that you can leverage in AVS. Built-in security/firewall with VMware NSX-T - VMware NSX-T is the default networking stack in AVS and it provides out-of-box security features that you can use to protect your workloads. Following are the capabilities that you can leverage. Distributed Firewall (DFW) -A stateful L3-L7 firewall that powers micro-segmentation and runs on your ESXi hosts in your AVS private cloud. DFW rules are enforced on the vNIC level of a VM workload and what that means is that the traffic is either allowed or dropped on the vNIC level based on the rule you defined. So, there is no more hair-pinning that traffic through a centralized or perimeter firewall. From a feature standpoint, it's rich and allows you to define security rules using network or application constructs. You could group the workloads using static (IPSet/NSX constructs like Segment etc.) or dynamic membership (VM tags, guest OS etc.). Even when you have a perimeter firewall, you should secure your East-West traffic. Gateway Firewall - A L4-L7 aware stateful North-South firewall that can be configured on NSX-T Tier-1 Gateway in AVS. It can also be used as an Inter-tenant or Inter-zone firewall i.e. filtering traffic between different tenants of your organization each with a dedicated Tier-1 Gateway. Azure Firewall - A managed, stateful firewall with built-in HA and SLA of 99.99% (when deployed in two or more availability zones). Customers can configure L3-L7 policies to filter traffic and take advantage of threat intelligence-based filtering to alert and deny traffic from/to known malicious IP addresses and domains. Please refer to the Azure firewall feature set here. If you are already using Azure firewall capabilities deployed in Azure Virtual WAN to protect resources in VNETs, you can connect the same virtual WAN hub over an express route connection to AVS and route internet traffic from AVS to Azure firewall. Let's switch gears and talk about the 3rd party firewall integration with Azure VMware Solution. There is a strong desire from customers to continue using the same firewall in AVS that they have been using in an on-premises datacenter. Based on the use-case, you could deploy a 3rd party firewall NVA in AVS private cloud or SDDC or leverage a firewall from Azure marketplace. Let's double click on both options. 3rd Party firewall deployed as NVA in AVS private cloud or SDDC -Before we discuss this integration, it's important to understand NSX-T deployment in AVS private cloud. When you create a private cloud in AVS, a default NSX-T Tier-0 Gateway configured in Active/Active mode and a default NSX-T Tier-1 Gateway configured in Active/Standby mode is deployed for you. Users can connect segments (logical switches) and provide East-West and North-South connectivity to the workloads connected on these segments. A 3rd party firewall NVA can be connected southbound to the default NSX-T Tier-1 gateway and this firewall can act as a North-South firewall or East-West firewall depending upon your use case. This integration is supported in following topologies. Option 1: Workload segments are directly connected to the firewall and the gateway on workloads is 3 rd party firewall. This topology restricts the users with numerous segments as the vNICs on the NVA becomes a limiting factor. Option 2: Workload segments are connected to an isolated Tier-1 and this Tier-1 gateway provides northbound connectivity to a 3 rd party firewall. This topology solves the problem of limited number of vNICs on NVA as you connect 100s of workload segments to an isolated Tier-1 which connects to the firewall NVA northbound. In this topology, isolated Tier-1s simulate security zones and the firewall can provide East-West filtering between security zones and North-South filtering for all traffic. We will discuss routing and other configuration details for these topologies in next part of this blog series. 3rd Party firewall deployed in Azure VNET – Customers can also deploy a 3 rd party firewall in Azure VNET and route traffic from AVS to this firewall via Azure Virtual WAN hub. To redirect internet traffic from AVS VMs to the firewall NVA, you need to connect AVS to an express route gateway in Azure virtual WAN and propagate a default route. Next, you configure a default route in Azure Virtual WAN hub to direct internet bound traffic to a NVA in spoke VNET. We will go through the configuration details in greater detail in upcoming blogs. Stay tuned! Summary Azure VMware Solution customers have multiple security options available to protect their workloads. Some of these firewalling capabilities can be used out of the box to provide East-West and North-South firewalling. Along with the built-in security capabilities, customers can also leverage the 3 rd party firewalls or next-gen firewalls to provide additional security and maintain the same security posture as they have on-premises. Following are a few resources to learn more about Azure VMware Solution. Learn Azure VMware Solution Networking Try Azure VMware Solution Hands-on-labAzure VMware Solution now available in Korea Central
We are pleased to announce that Azure VMware Solution is now available in Korea Central. Now in 34 Azure regions, Azure VMware Solution empowers you to seamlessly extend or migrate existing VMware workloads to Azure without the cost, effort or risk of re-architecting applications or retooling operations. Azure VMware Solution supports: Rapid cloud migration of VMware-based workloads to Azure without refactoring. Datacenter exit while maintaining operational consistency for the VMware environment. Business continuity and disaster recovery for on-premises VMware environments. Attach Azure services and innovate applications at your own pace. Includes the VMware technology stack and lets you leverage existing Microsoft licenses for Windows Server and SQL Server. For updates on current and upcoming region availability, visit the product by region page here. Streamline migration with new offers and licensing benefits, including a 20% discount. We recently announced the VMware Rapid Migration Plan, where Microsoft provides a comprehensive set of licensing benefits and programs to give you price protection and savings as you migrate to Azure VMware Solution. Azure VMware Solution is a great first step to the cloud for VMware customers, and this plan can help you get there. Learn MoreEnhancing Disaster Recovery and Ransomware Protection with Azure VMware Solution and JetStream
Enhancing Disaster Recovery and Ransomware Protection with Azure VMware Solution and JetStream Software Disaster Recovery (DR) and ransomware protection are critical concerns for organizations today, as the frequency and cost of attacks continue to rise. Our customers demand comprehensive and cost-effective options to safeguard their critical workloads without compromising application performance. AVS collaborates with leading technology companies, such as JetStream Software, to deliver advanced DR solutions that offer both near-zero Recovery Point Objectives (RPO) and near-zero Recovery Time Objective (RTO) options. The JetStream DR and Ransomware solution implements Continuous Data Protection (CDP) by immediately replicating all data generated by protected VMs. It employs heuristic algorithms to detect data tampering by utilizing cost-effective and high-performance storage options like Azure Blob Storage, Azure NetApp Files (ANF), and ESAN-based solutions. Utilizing the VMware-certified VAIO APIs means that the JetStream solution is fully VMware Ready certified. This approach is unique compared to other market offerings that provide DR protection by creating intermittent snapshots. JetStream has also partnered with Microsoft to develop a unique feature that rehydrates VMs and their data from Azure Blob object storage, deploying them to AVS nodes provisioned on-demand, to a pilot light cluster in AVS. This ensures a rapid and cost-controlled recovery that minimizes downtime in the event of a disaster or ransomware attack. To learn more about the power of this integration, watch our sessions at VMware Explore 2024 in Las Vegas: “Future-Proof VMware Workloads with Azure VMware Solution” [Session ID: VCFB2530LVS] “Implementing a Robust BCDR Plan with Azure VMware Solution” [Session ID: VCFB2534LVS] “Discover the Partner Ecosystem for Azure VMware Solution” [Session ID: VCFB2532LVS]
