diff --git a/base/comps/azurelinux-repos/azurelinux-repos.spec b/base/comps/azurelinux-repos/azurelinux-repos.spec
index ec684035576..75d49856c28 100644
--- a/base/comps/azurelinux-repos/azurelinux-repos.spec
+++ b/base/comps/azurelinux-repos/azurelinux-repos.spec
@@ -12,6 +12,7 @@ BuildRequires:  gnupg sed rpm
 
 Source1:        archmap
 Source2:        azurelinux.repo.in
+Source3:        microsoft.repo
 
 Source10:       RPM-GPG-KEY-azurelinux-4.0-primary
 
@@ -121,6 +122,16 @@ render_repo \
     'https://stcontroltowerdevjwisitg.blob.core.windows.net/azl4-dev' \
     0 0 '6h'
 
+# Install the Microsoft subrepo in both subpackages. The URL is fixed to
+# packages.microsoft.com (the Microsoft-curated content lives there
+# regardless of which Azure Linux base repo a system is pointed at), so the
+# same file is shipped to both variants. The .main / .dev suffixes are
+# stripped by RemovePathPostfixes.
+install -m 644 %{SOURCE3} \
+    "$RPM_BUILD_ROOT/etc/yum.repos.d/microsoft.repo.main"
+install -m 644 %{SOURCE3} \
+    "$RPM_BUILD_ROOT/etc/yum.repos.d/microsoft.repo.dev"
+
 %check
 # Make sure all repo variables were substituted
 for repo in $RPM_BUILD_ROOT/etc/yum.repos.d/*.repo.*; do
@@ -172,6 +183,26 @@ for repo in "$main_file" "$dev_file"; do
     fi
 done
 
+# Microsoft subrepo: shipped in both subpackages. Must exist, be enabled by
+# default, GPG-signed, and point at packages.microsoft.com.
+for microsoft_file in \
+    $RPM_BUILD_ROOT/etc/yum.repos.d/microsoft.repo.main \
+    $RPM_BUILD_ROOT/etc/yum.repos.d/microsoft.repo.dev; do
+    if [ ! -f "$microsoft_file" ]; then
+        echo "ERROR: missing $microsoft_file"
+        exit 1
+    fi
+    if ! grep -q '^baseurl=https://packages.microsoft.com/azurelinux/\$releasever/beta/microsoft/\$basearch$' "$microsoft_file"; then
+        echo "ERROR: $microsoft_file must point at packages.microsoft.com microsoft subrepo"
+        exit 1
+    fi
+    if [ "$(grep -c '^enabled=1' "$microsoft_file")" -ne 1 ] || \
+       [ "$(grep -c '^gpgcheck=1' "$microsoft_file")" -ne 1 ]; then
+        echo "ERROR: $microsoft_file must be enabled=1 and gpgcheck=1"
+        exit 1
+    fi
+done
+
 # Check arch keys exists on supported architectures, and RPM considers
 # them valid
 TMPRING=$(mktemp)
@@ -190,10 +221,12 @@ rm -f "$TMPRING"
 %files
 %dir /etc/yum.repos.d
 %config(noreplace) /etc/yum.repos.d/azurelinux.repo.main
+%config(noreplace) /etc/yum.repos.d/microsoft.repo.main
 
 %files dev
 %dir /etc/yum.repos.d
 %config(noreplace) /etc/yum.repos.d/azurelinux.repo.dev
+%config(noreplace) /etc/yum.repos.d/microsoft.repo.dev
 
 %files -n azurelinux-gpg-keys
 %dir /etc/pki/rpm-gpg
diff --git a/base/comps/azurelinux-repos/microsoft.repo b/base/comps/azurelinux-repos/microsoft.repo
new file mode 100644
index 00000000000..98cdb447b54
--- /dev/null
+++ b/base/comps/azurelinux-repos/microsoft.repo
@@ -0,0 +1,11 @@
+[azurelinux-microsoft]
+name=Azure Linux $releasever - $basearch - Microsoft
+baseurl=https://packages.microsoft.com/azurelinux/$releasever/beta/microsoft/$basearch
+enabled=1
+countme=1
+metadata_expire=7d
+repo_gpgcheck=0
+type=rpm
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch
+skip_if_unavailable=False
diff --git a/locks/azurelinux-repos.lock b/locks/azurelinux-repos.lock
index df6833b3c1f..375f256d9e8 100644
--- a/locks/azurelinux-repos.lock
+++ b/locks/azurelinux-repos.lock
@@ -1,3 +1,3 @@
 # Managed by azldev component update. Do not edit manually.
 version = 1
-input-fingerprint = 'sha256:dc8e54faeb318ce06ea7bebf1e96fea93aeb959508c382709a9aec54792d7314'
+input-fingerprint = 'sha256:33f4990ff0a7a4c7b2879135f7f59db129908d95ca217505676404b21504313b'
diff --git a/specs/a/azurelinux-repos/azurelinux-repos.spec b/specs/a/azurelinux-repos/azurelinux-repos.spec
index 1829d844fc8..b034ca2b930 100644
--- a/specs/a/azurelinux-repos/azurelinux-repos.spec
+++ b/specs/a/azurelinux-repos/azurelinux-repos.spec
@@ -2,7 +2,7 @@
 ## (rpmautospec version 0.8.3)
 ## RPMAUTOSPEC: autorelease, autochangelog
 %define autorelease(e:s:pb:n) %{?-p:0.}%{lua:
-    release_number = 8;
+    release_number = 9;
     base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}"));
     print(release_number + base_release_number - 1);
 }%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}}
@@ -25,6 +25,7 @@ BuildRequires:  gnupg sed rpm
 
 Source1:        archmap
 Source2:        azurelinux.repo.in
+Source3:        microsoft.repo
 
 Source10:       RPM-GPG-KEY-azurelinux-4.0-primary
 
@@ -134,6 +135,16 @@ render_repo \
     'https://stcontroltowerdevjwisitg.blob.core.windows.net/azl4-dev' \
     0 0 '6h'
 
+# Install the Microsoft subrepo in both subpackages. The URL is fixed to
+# packages.microsoft.com (the Microsoft-curated content lives there
+# regardless of which Azure Linux base repo a system is pointed at), so the
+# same file is shipped to both variants. The .main / .dev suffixes are
+# stripped by RemovePathPostfixes.
+install -m 644 %{SOURCE3} \
+    "$RPM_BUILD_ROOT/etc/yum.repos.d/microsoft.repo.main"
+install -m 644 %{SOURCE3} \
+    "$RPM_BUILD_ROOT/etc/yum.repos.d/microsoft.repo.dev"
+
 %check
 # Make sure all repo variables were substituted
 for repo in $RPM_BUILD_ROOT/etc/yum.repos.d/*.repo.*; do
@@ -185,6 +196,26 @@ for repo in "$main_file" "$dev_file"; do
     fi
 done
 
+# Microsoft subrepo: shipped in both subpackages. Must exist, be enabled by
+# default, GPG-signed, and point at packages.microsoft.com.
+for microsoft_file in \
+    $RPM_BUILD_ROOT/etc/yum.repos.d/microsoft.repo.main \
+    $RPM_BUILD_ROOT/etc/yum.repos.d/microsoft.repo.dev; do
+    if [ ! -f "$microsoft_file" ]; then
+        echo "ERROR: missing $microsoft_file"
+        exit 1
+    fi
+    if ! grep -q '^baseurl=https://packages.microsoft.com/azurelinux/\$releasever/beta/microsoft/\$basearch$' "$microsoft_file"; then
+        echo "ERROR: $microsoft_file must point at packages.microsoft.com microsoft subrepo"
+        exit 1
+    fi
+    if [ "$(grep -c '^enabled=1' "$microsoft_file")" -ne 1 ] || \
+       [ "$(grep -c '^gpgcheck=1' "$microsoft_file")" -ne 1 ]; then
+        echo "ERROR: $microsoft_file must be enabled=1 and gpgcheck=1"
+        exit 1
+    fi
+done
+
 # Check arch keys exists on supported architectures, and RPM considers
 # them valid
 TMPRING=$(mktemp)
@@ -203,10 +234,12 @@ rm -f "$TMPRING"
 %files
 %dir /etc/yum.repos.d
 %config(noreplace) /etc/yum.repos.d/azurelinux.repo.main
+%config(noreplace) /etc/yum.repos.d/microsoft.repo.main
 
 %files dev
 %dir /etc/yum.repos.d
 %config(noreplace) /etc/yum.repos.d/azurelinux.repo.dev
+%config(noreplace) /etc/yum.repos.d/microsoft.repo.dev
 
 %files -n azurelinux-gpg-keys
 %dir /etc/pki/rpm-gpg
@@ -215,6 +248,9 @@ rm -f "$TMPRING"
 
 %changelog
 ## START: Generated by rpmautospec
+* Fri May 22 2026 Chris Co <chrco@microsoft.com> - 4.0-18
+- feat(azurelinux-repos): add Microsoft subrepo
+
 * Wed May 13 2026 reuben olinsky <reubeno@users.noreply.github.com> - 4.0-17
 - fix(repos): disable repo_gpgcheck
 
diff --git a/specs/a/azurelinux-repos/microsoft.repo b/specs/a/azurelinux-repos/microsoft.repo
new file mode 100644
index 00000000000..98cdb447b54
--- /dev/null
+++ b/specs/a/azurelinux-repos/microsoft.repo
@@ -0,0 +1,11 @@
+[azurelinux-microsoft]
+name=Azure Linux $releasever - $basearch - Microsoft
+baseurl=https://packages.microsoft.com/azurelinux/$releasever/beta/microsoft/$basearch
+enabled=1
+countme=1
+metadata_expire=7d
+repo_gpgcheck=0
+type=rpm
+gpgcheck=1
+gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-azurelinux-$releasever-$basearch
+skip_if_unavailable=False