MicrosoftDocs · azclibot · May 27, 2026
@@ -3,4 +3,4 @@ ms.topic: include
 ms.custom: devx-track-azurecli
 ---
 
-The current version of the Azure CLI is __2.86.0__. For information about the latest release, see the [release notes](../release-notes-azure-cli.md). To find your installed version and see if you need to update, run [az version](/cli/azure/reference-index#az_version).
+The current version of the Azure CLI is __2.87.0__. For information about the latest release, see the [release notes](../release-notes-azure-cli.md). To find your installed version and see if you need to update, run [az version](/cli/azure/reference-index#az_version).
@@ -1,14 +1,111 @@
 ---
 title: Release notes & updates – Azure CLI | Microsoft Docs
 description: Learn about the latest Azure Command-Line Interface (CLI) release notes and updates for both the current and beta versions of the CLI
-ms.date: 05/05/2026
+ms.date: 06/02/2026
 ms.service: azure-cli
 ms.custom: devx-track-azurecli
 keywords: azure cli updates, azure cli notes, azure cli versions
 ---
 
 # Azure CLI release notes
 
+## June 02, 2026
+
+Version 2.87.0
+
+### ACR
+
+* [BREAKING CHANGE] `az acr replication create/update`: Remove deprecated `--region-endpoint-enabled` flag and use `--global-endpoint-routing` instead
+* [BREAKING CHANGE] `az acr config content-trust update`: No longer accept the `enabled` status
+* [BREAKING CHANGE] `az acr check-health`: Remove Notary client check due to Docker Content Trust deprecation
+* `az acr login`: Make ACR audience customizable in AAD token acquisition
+* `az acr connected-registry resync`: Add command to manually trigger a sync from the parent registry
+* `az acr update`: Add `--endpoint-protocol` parameter to support specifying the endpoint protocol for the registry
+* `az acr login`: Fix regional endpoint matching for registries with DNL suffix
+* `az acr config content-trust/show/update`: Add deprecation labels and notices
+
+### AKS
+
+* `az aks add/update`: Add `--enable-artifact-streaming` and `--disable-artifact-streaming` parameters
+
+### App Config
+
+* `az appconfig kv set-snapshot-reference`: Add support to create a snapshot reference key-value
+* `az appconfig kv list`: Add support to list key-values from a snapshot reference
+* `az appconfig create/update/network-security-perimeter-configuration`: Add Network Security Perimeter (NSP) support
+
+### App Service
+
+* [BREAKING CHANGE] `az webapp list-runtimes`: Change output from flat string list to structured list of dicts with keys: os, runtime, version, config, support, end_of_life
+* `az webapp list-runtimes`: Add `--runtime` and `--support` filter parameters
+* [BREAKING CHANGE] `az webapp list-runtimes`: Remove deprecated `--linux` and `--show-runtime-details` parameters
+* `az webapp log startup`: Add commands to list and view Linux container startup logs
+* `az webapp create`: Add `--site-scoped-certs` parameter to support enabling or disabling site-scoped certificates
+* `az webapp up`: Add warning message for future deprecation
+* `az functionapp deployment source config-zip`: Fix `KeyError` `'FUNCTIONS_WORKER_RUNTIME'` for Go function apps on Flex Consumption
+* `az functionapp update-strategy config set`: Add new command to set or update a function app's update strategy configuration
+* `az functionapp update-strategy config show`: Add new command to get the details of a function app's update strategy configuration
+* Fix #31394: `az functionapp deployment source config-zip`: Never ending loop on flex function app health check
+
+### Compute
+
+* [BREAKING CHANGE] `az vm create`: Change default `--size` from `Standard_DS1_v2` to `Standard_D2s_v5`
+* [BREAKING CHANGE] `az vmss create`: Change default `--vm-sku` from `Standard_DS1_v2` to `Standard_D2s_v5`
+* `az sig image-definition update`: Add ability to update image-definition start version
+* `az vm create/update`: Support zone-resilient VM with `--zone-movement`
+* `az vm update`: Support cross-zone movement
+* `az vm deallocate`: Support vm force deallocate with `--force-deallocate`
+* `az vm/vmss create`: Support Ephemeral OS disk with full caching with `--ephemeral-os-disk-enable-full-caching`
+
+### Container app
+
+* `az containerapp`: Fix typo in help message
+* Fix #33369: `az containerapp up`: Resolve OS/Architecture models from correct SDK package
+
+### Cosmos DB
+
+* `az cosmosdb restore`: Fix cross-region restore by preserving source region in top-level location
+
+### Key Vault
+
+* `az keyvault create`: Fix keyvault create RequestDisallowedByPolicy error by explicitly setting `enableSoftDelete` in the request body
+
+### MySQL
+
+* [BREAKING CHANGE] `az mysql flexible-server backup create/restore/geo-restore/replica`: Remove `--storage-redundancy`
+
+### NetAppFiles
+
+* [BREAKING CHANGE] `az netappfiles volume update`: `--remote-volume-resource-id` has been deprecated
+* [BREAKING CHANGE] `az netappfiles volume create`: `--network-features` default value has changed to `Standard`
+* `az netappfiles cache`: Add new command group to manage Cache resources
+* `az netappfiles volume bucket`: Add new command group to manage Bucket resources
+
+### Network
+
+* `az network vnet create/update`: Add `--summarized-gateway-prefixes` to support summarized gateway prefixes
+* `az network application-gateway ssl-cert create/update`: Add `--hsm` to support Managed HSM
+* `az network virtual-network-appliance create/update`: Add `--private-ip-address-version` to support private ip address version
+
+### PostgreSQL
+
+* [BREAKING CHANGE] `az postgres flexible-server create/update`: Remove `--high-availability` for preferred argument `--zonal-resiliency`
+* [BREAKING CHANGE] `az postgres flexible-server upgrade`: Remove the enum for `--version`
+* [BREAKING CHANGE] `az postgres flexible-server create/update`: Remove deprecated `--cluster-option` and update validation logic
+* [BREAKING CHANGE] `az postgres flexible-server index-tuning`: Remove support for command group
+* [BREAKING CHANGE] `az postgres flexible-server backup create`: Remove backup name requirement and implement automatic name generation for backups
+* [BREAKING CHANGE] `az postgres flexible-server create/geo-restore/restore/revive-dropped`: Don't create or alter networking components like virtual network, subnet, or private DNS zone. Stop supporting `--address-prefixes` and `--subnet-prefixes` anymore
+* [BREAKING CHANGE] `az postgres flexible-server replica create`: Don't create or alter networking components like virtual network, subnet, or private DNS zone. Stop supporting `--address-prefixes` and `--subnet-prefixes` anymore
+* [BREAKING CHANGE] `az postgres flexible-server backup/db/firewall-rule/long-term-retention/migration/replica create`: Make consistent use of `--name` and `--server-name` across all commands
+* [BREAKING CHANGE] `az postgres flexible-server long-term-retention`: Remove support for command group
+
+### Storage
+
+* `az storage account create/update`: Support new value `Smart` for `--access-tier`
+* `az storage account create/update`: Support `--allowed-copy-scope`
+* `az storage account blob-service-properties update`: Add `--enable-static-website`, `--index-document`, `--default-index-document-path`, `--error-document-404-path`
+* `az storage account or-policy create/update`: Add `--tags-replication`
+
 ## May 05, 2026
 
 Version 2.86.0