LocalStack for Azure Enters Public Preview with Security Settings Stored but Not Enforced

The product runs Azure services on a developer machine and accepts existing ARM and Bicep templates, Terraform modules, Pulumi programs, and Azure CLI scripts without rewrites. The pitch is to test applications, as LocalStack puts it, "without waiting on a dev subscription or paying for every iteration." The service list is broad, covering AKS, Container Apps, Functions, App Service, Cosmos DB, Service Bus, Event Hubs, Key Vault, App Configuration, Managed Identity, API Management and more, and is wider than the announcement itself suggests. Each developer gets an isolated sandbox, and LocalStack positions it for development and testing rather than as a replacement for Azure.

The project is led by Paolo Salvatori, a Microsoft principal for 28 years before joining LocalStack and the creator of Service Bus Explorer. He sets the fidelity contract in one line:

If your solution runs perfectly on Azure but fails on our emulator, that is our bug to fix.

The documentation covers 24 resource providers and reports how much of each API is implemented. Storage Accounts covers 13 of 81 operations. App Service covers 143 of 616. Virtual Network covers 10 of 29.

The more useful pattern is what happens to the operations that are implemented. Configuration is frequently accepted, stored, and returned without taking effect. On App Service:

Keys, access restrictions, authentication settings, and publishing credential policies are not enforced.

The same page records that httpsOnly is not enforced and the emulator serves HTTP, that custom host-name bindings are stored and listed while the app answers only on its default names, that VNet integration is stored and returned with no network effect, and that backup configuration is stored while backup and restore are not implemented.

Networking follows suit. The Virtual Network page states plainly that "the emulator does not route network traffic or enforce security rules," that peering is unsupported, and that VPN gateways, ExpressRoute circuits, Load Balancer, Application Gateway, and Network Watcher are not implemented. Private DNS zones accept only A records.

Several Storage divergences land on authentication. Data-plane requests with a bearer token succeed whenever a token is present unless RBAC enforcement is enabled. A user delegation SAS does not re-check the principal’s RBAC when used. A SAS restricted to the caller’s public IP is refused because the emulator sees a Docker or loopback address. Unsupported request headers are silently accepted rather than rejected, and the x-ms-version header is not validated at all.

That promise is about code that runs in Azure and fails locally. The documented gaps mostly describe the reverse: an app with httpsOnly set serves HTTP here, and a data-plane request carrying any bearer token gets through. Both pass locally, and nothing in the run flags the difference.

Three behaviors will surprise people before any of that does. A web app created on a Windows plan runs its code in the Linux runtime. The Oryx build image ships for amd64 only, so on Apple Silicon a code deployment’s build fails, and the app starts without its dependencies. App Service state is held in memory and lost when the emulator stops.

Microsoft’s own local tooling is narrower and older. Azurite emulates Blob, Queue, and Table storage, the Cosmos DB emulator covers that database, and Azure Functions Core Tools runs Functions locally. None compose into a single environment where an ARM or Bicep deployment can be exercised end to end, which is the gap LocalStack aims to fill.

LocalStack also pitches the sandbox at AI agents, somewhere they can "deploy, break, and retry" without live credentials. An agent iterating there gets access restrictions stored rather than applied, and any bearer token accepted. Both come back as passes.

Developer experience features, including App Inspector, snapshots, and the chaos APIs, are not in preview. Pricing arrives at general availability, and preview access ends there. The transition terms are not settled: the product page still carries "[30 days]" as a literal placeholder and an unfilled next-steps section.

Presented by: David Iparraguirre - Senior Product Marketing Manager at Datadog, and Jessica Yang - Product Manager at Datadog