You can upgrade to 7.0.9 for both AWS and Azure platforms using the same OVA image as KVM and VMware.

If Site assertion attribute for remote SAML IdP authenticated customer users is not used (not present in the assertions from the IdP), but you want users to have access to all of their respective sites, the new CLI setting needs to be changed as follows after the upgrade is complete:

config system admin setting
    set remote-org-user-all-sites-access enable
end

Allow all sites is no longer enabled by default.