Microsoft Solutions Partner — AKS & Kubernetes · 11,000+ engagements

Azure Kubernetes Service (AKS) Enterprise Guide (2026)

How enterprises actually run AKS in production — managed control plane, Karpenter, Defender for Containers, AKS Automatic, Fleet Manager, and the EPC Group five-phase accelerator. Authored by a Microsoft Solutions Partner founded in 1997.

Book an AKS briefing Call 888-381-9725

What is Azure Kubernetes Service and how do enterprises run it in production? AKS is the Microsoft-managed Kubernetes platform — Microsoft operates the API server, etcd, scheduler, and controller manager; the customer owns node pools, workloads, and networking. Enterprises run AKS for microservices, stateful workloads, AI/ML inference, batch processing, and edge — typically with Azure CNI Powered by Cilium, Karpenter Node Autoprovisioning, Spot node pools for cost, Entra Workload ID for identity, Defender for Containers for security, and AKS Fleet Manager for multi-cluster orchestration. EPC Group delivers AKS through a five-phase Assess, Foundation, Platform, Workload, Operate accelerator that produces a production-grade estate in twelve to twenty weeks, fixed-fee.

AKS is the Microsoft-managed Kubernetes platform. Microsoft operates the control plane; the customer owns node pools, workloads, and networking. The 2026 reference architecture pairs Azure CNI Powered by Cilium, Karpenter Node Autoprovisioning, Entra Workload ID, and Defender for Containers. AKS Automatic delivers a low-ops experience for line-of-business teams; DIY AKS keeps full flexibility for tier-zero platforms. EPC Group delivers full AKS activation in a fixed-fee five-phase accelerator between $150K and $600K.

Key Facts

AKS managed control plane — Free, Standard (Uptime SLA), and Premium (Long Term Support up to two years past N-2) tiers
Azure CNI Powered by Cilium is the recommended dataplane — eBPF, kube-proxy replacement, identity-aware policy, Hubble observability
Karpenter Node Autoprovisioning (GA on AKS in 2025) provisions workload-driven nodes — replaces fixed pool sizing for most patterns
Microsoft Entra Workload ID is the production identity model — federated credentials, no secrets in the cluster
Defender for Containers delivers runtime threat detection, registry scanning, posture management, and Sentinel integration
AKS Automatic (GA Nov 2024, expanded 2025) ships a curated low-ops experience for application teams that do not want to operate Kubernetes
AKS Fleet Manager orchestrates upgrades, workload placement, and policy across many AKS clusters; Azure Arc extends governance to EKS, GKE, OpenShift, on-prem
EPC Group five-phase AKS Accelerator delivers full activation in 12 to 20 weeks as a fixed fee — Microsoft Solutions Partner founded in 1997

AKS architecture — control plane, node pools, networking, identity

The 2026 enterprise reference architecture for AKS has four pillars — a Microsoft-managed control plane, customer-owned node pools (increasingly governed by Karpenter rather than fixed sizing), Azure CNI Powered by Cilium for the dataplane, and Microsoft Entra Workload ID for production-grade identity. Each pillar replaces an earlier pattern that was workable but is no longer the right answer for enterprise scale.

Managed control plane

Azure Kubernetes Service runs the Kubernetes API server, scheduler, controller manager, and etcd as a Microsoft-managed control plane — fully patched, scaled, and SLA-backed by Microsoft, with no node-level access required from the customer. Enterprise customers consume the API surface; Microsoft operates everything below it. The Free tier carries a financially-backed availability target, Standard adds an Uptime SLA, and Premium enables Long Term Support for older Kubernetes versions an enterprise cannot upgrade on the public N-2 cadence.

API server, etcd, scheduler, and controller manager managed by Microsoft with regional and Availability Zone redundancy
Three tiers — Free, Standard (Uptime SLA), and Premium (Long Term Support for up to two extra years past N-2)
Automatic Kubernetes patch upgrades and node-image refresh available through cluster auto-upgrade channels
API server VNET integration option for private clusters with no public endpoint exposure
Audit logs and control-plane metrics streamed natively into Azure Monitor and Microsoft Sentinel

Node pools — system, user, spot, GPU

AKS separates system and user node pools so platform components run on protected nodes while application workloads scale independently. System pools host CoreDNS, metrics-server, and konnectivity; user pools host customer workloads. Specialized pools — Spot, GPU, ARM64, FIPS, confidential — extend the model for cost, AI/ML inference, regulated workloads, and confidential computing scenarios. Karpenter — graduated to GA on AKS in 2025 — adds workload-driven node provisioning that selects VM SKU at scheduling time rather than at pool creation time.

System pool isolated with CriticalAddonsOnly taint — platform stability protected from workload bursts
User pools sized per workload class — general purpose, memory-optimized, compute-optimized, GPU, ARM64
Spot node pools deliver 60% to 90% discount on Azure compute for fault-tolerant batch and AI inference
GPU pools support NVIDIA A100, H100, and H200 for training and inference with the AKS GPU operator
Karpenter (Node Autoprovisioning) selects optimal VM SKU per pending pod — replaces fixed pool sizing for many workloads

Networking — Azure CNI, Cilium, ingress, egress

AKS networking has matured into Azure CNI Powered by Cilium as the recommended dataplane — eBPF-based networking, kube-proxy replacement, and Hubble observability built in. Azure CNI Overlay reduces VNET IP exhaustion by giving pods their own overlay address space. Ingress is handled by Application Gateway Ingress Controller, the Application Gateway for Containers (2025 GA replacement), or NGINX. Egress goes through NAT Gateway or Azure Firewall for outbound control. Network Policy with Cilium delivers identity-aware enforcement that legacy iptables-based policies cannot match at scale.

Azure CNI Powered by Cilium — eBPF dataplane, kube-proxy replacement, identity-aware network policy
Azure CNI Overlay — pod IPs from an overlay space, VNET IP usage limited to nodes only
Application Gateway for Containers (AGC) — managed L7 ingress with native Gateway API support
Private cluster mode plus Private Link service for fully VNET-internal control plane and dataplane
Azure Firewall or NAT Gateway for explicit egress control and SOC traceability

Identity — Microsoft Entra Workload ID

Microsoft Entra Workload ID is the production-grade identity model for AKS — federated identity credentials issued to Kubernetes service accounts so pods authenticate to Azure SQL, Key Vault, Storage, and any Entra-aware API with no client secrets, no certificates, and no Pod-Identity sidecar. Entra Workload ID replaced the deprecated Pod Identity model in 2023 and is the only supported pattern going forward. RBAC is unified — Entra ID groups map to Kubernetes RBAC roles, and break-glass admin access flows through Entra Privileged Identity Management with time-bound just-in-time elevation.

Federated identity credentials — Kubernetes service account directly federates to an Entra application
Zero client secrets stored in cluster, eliminating the Kubernetes-secret-as-credential anti-pattern
Unified Entra RBAC — group membership in Entra ID grants Kubernetes RBAC bindings via Azure Kubernetes RBAC
Pod Identity (legacy) deprecated September 2023 — production clusters must migrate to Workload ID
Entra Conditional Access enforced on kubectl auth — IP, device compliance, MFA, sign-in risk score

Six AKS enterprise patterns

Every AKS engagement composes from one or more of these patterns. EPC Group sequences the build against business priority, not against the Kubernetes feature catalog.

Pattern 1 — Stateful workloads on AKS with Azure-managed persistence

AKS is increasingly the home for stateful workloads that used to run on PaaS — message brokers, search engines, analytics tier, and packaged ISV stacks. The persistence story is split: Azure-managed services back the durable layer (Azure Files NFS, Azure NetApp Files, Azure Disks Premium SSD v2, Azure Container Storage backed by NVMe) while StatefulSet operators handle topology, replication, and failover. EPC Group ships reference stacks for Kafka on Strimzi backed by Azure Container Storage, PostgreSQL on CloudNativePG backed by Premium SSD v2, Elasticsearch on ECK backed by Azure NetApp Files, and Redis on the Redis operator. Backup is delivered by Azure Backup for AKS — application-consistent snapshot of Kubernetes resources plus the persistent volume contents — meeting the same RPO and RTO commitments enterprise platform teams expect on VM-based databases.

Pattern 2 — Microservices, service mesh, and event-driven scale

For microservices estates AKS pairs with Open Service Mesh, Istio (now a managed AKS add-on), or Linkerd to deliver mutual TLS, traffic shaping, and progressive delivery. Event-driven scale is delivered by KEDA — installed as an AKS add-on — which scales deployments on the depth of an Azure Service Bus queue, an Event Hub partition, or a Kafka consumer lag rather than CPU and memory alone. The reference architecture pairs AKS with Azure API Management self-hosted gateway for north-south traffic, Application Gateway for Containers for L7 ingress, and Dapr for portable building-block patterns that decouple application code from cloud-specific SDKs. EPC Group standardizes on a contract-first event schema in Azure Schema Registry, GitOps deployment through Flux v2, and progressive delivery through Argo Rollouts for blue-green and canary patterns the audit team can trace.

Pattern 3 — AI/ML inference on Karpenter-managed GPU pools

AKS is the dominant Microsoft surface for self-hosted AI inference outside Azure OpenAI — vLLM, TGI, Triton, Ollama, and the Azure ML inference SDK all run as standard deployments. The cost model only works if GPU capacity is acquired dynamically. Karpenter Node Autoprovisioning watches pending GPU workload, selects the right SKU (T4, A10, A100, H100, H200, MI300X), provisions the node, runs the workload, and decommissions when idle — replacing the legacy pattern of always-on GPU pools sized for peak. EPC Group AI inference stacks combine Karpenter, NVIDIA GPU Operator, KEDA HTTP scaler, and the Azure AI Content Safety sidecar so a model-serving deployment is governed, observable, and cost-optimized from day one. For training workloads we layer Azure Container Storage backed by ephemeral NVMe for dataset throughput plus Azure NetApp Files for checkpoint persistence.

Pattern 4 — Batch and HPC workloads on Spot and Karpenter

Batch processing — genomic pipelines, financial Monte Carlo, geospatial rasterization, video transcoding, simulation — fits AKS better than Azure Batch for the majority of greenfield builds because the workflow engine (Argo Workflows, Volcano, Kueue, Nextflow on Kubernetes) and the compute layer live in one operator-managed cluster. Spot node pools cut 60% to 90% off compute. Karpenter selects the cheapest SKU that matches the pod spec. KEDA cron and queue triggers spin pools up and back to zero around job arrivals. Azure Container Storage delivers high-throughput ephemeral storage for shuffle and intermediate stages. The pattern routinely cuts batch compute spend by half compared with the same workload on always-on D-series nodes.

Pattern 5 — Edge with AKS Edge Essentials and Azure Stack HCI

AKS extends beyond the Azure region with two distinct edge products. AKS Edge Essentials is a lightweight, single-node or two-node Kubernetes distribution that runs on Windows 10 IoT Enterprise, Windows 11 IoT Enterprise, or Windows Server — designed for retail stores, manufacturing floors, and remote sites where the IT team cannot operate a full cluster. AKS enabled by Azure Arc on Azure Stack HCI delivers the full AKS surface on customer-owned hyperconverged infrastructure for hospitals, defense forward bases, and regulated edge sites that need cloud-grade orchestration without cloud connectivity. Both edge SKUs are Arc-enabled by design and inherit Defender for Containers, Azure Policy for Kubernetes, and GitOps through Flux — the governance plane projects to the edge from the same Azure surface as the cloud-hosted AKS estate.

Pattern 6 — Disaster recovery and multi-region active-active

Production AKS for tier-zero workloads is multi-zone within a region and, increasingly, multi-region active-active. The reference architecture pairs two AKS clusters in paired Azure regions, Azure Front Door Premium for global L7 traffic management with per-region health probes, Azure Cosmos DB or Azure Database for PostgreSQL flexible-server with cross-region replication for the stateful tier, and Azure Container Registry geo-replication for the image layer. Velero plus Azure Backup for AKS deliver point-in-time recovery for the cluster state itself. Azure Kubernetes Fleet Manager (covered below) is the multi-cluster control surface that makes coordinated upgrades, image rollout, and policy enforcement across regional clusters tractable. EPC Group sequences DR engagements to deliver active-passive in twelve weeks and active-active in twenty.

Cost optimization

Four levers that cut AKS compute spend 30% to 60% without code changes

AKS cost optimization is not magic — it is a small number of well-applied levers applied in sequence. Spot for the fault-tolerant workload classes, Karpenter for workload-driven node selection, Reserved Instances or Savings Plans for the steady-state core, and ruthless right-sizing of pod requests. EPC Group operates a quarterly FinOps review across the AKS estate to keep the blend efficient as workloads evolve.

Spot node pools — 60% to 90% off

Spot pools draw from unallocated Azure capacity at deep discount with eviction notice. The pattern is correct for stateless web, batch, AI inference, build agents, and CI runners — anything that tolerates a 30-second eviction. Combine with Pod Disruption Budgets and a topology-aware scheduler so eviction cannot take out the entire workload. EPC Group routinely lands AI inference fleets at 65% blended savings using Spot plus on-demand fallback.

Karpenter Node Autoprovisioning — right-sized at schedule time

Karpenter (AKS Node Autoprovisioning) watches the kube-scheduler pending queue and provisions nodes that exactly match the pending workload — including GPU SKU, ARM64 vs x64, memory profile, and Spot vs on-demand mix. Replaces the manual node-pool sizing exercise that almost always over-provisions for peak. Real customer outcomes — 30% to 55% compute savings versus fixed pools — without a workload code change.

Reserved Instances and Savings Plans for the steady-state core

The portion of an AKS estate that runs 24x7 with predictable steady-state should ride on three-year Azure Reserved Instances or Azure Savings Plans for compute — 40% to 65% discount versus pay-as-you-go. The pattern is a baseline RI/SP layer covering the system pool, the steady-state user pool floor, and the always-on platform services, with Spot and on-demand pools handling the variable layer above that. Cost ratio targets are reviewed quarterly as workload shapes evolve.

Right-sizing — pod requests, node SKU, idle reclamation

The single largest source of AKS waste is over-spec'd pod requests. EPC Group ships a Vertical Pod Autoscaler recommendation pipeline plus a quarterly right-sizing review backed by Azure Monitor Container Insights and Goldilocks. Idle namespaces and stale deployments are reclaimed automatically through a kubectl-ttl operator. Combined with Karpenter, right-sizing typically frees an additional 20% to 35% of compute capacity that was paid for but not used.

Security posture

Five controls that make AKS auditor-ready for HIPAA, FedRAMP, and CMMC

Production AKS security stands on five controls that ship natively with the Microsoft stack — Entra Workload ID for identity, Defender for Containers for runtime and registry, Cilium-backed network policy, ACR plus Notary for the supply chain, and Azure Policy for Kubernetes for uniform enforcement. The combination delivers evidence the compliance team and the SOC consume from one surface — see the broader Defender for Cloud CNAPP guide for the platform context.

Entra Workload ID + Conditional Access for cluster access

Pods authenticate to Azure services through federated identity credentials issued to Kubernetes service accounts. Operators and developers authenticate to the AKS API server through Entra ID with Conditional Access enforcing MFA, device compliance, and IP allowlists. Privileged elevation flows through Entra Privileged Identity Management with time-bound just-in-time roles audited end-to-end. No standing cluster-admin tokens.

Microsoft Defender for Containers — runtime, registry, posture

Defender for Containers is the workload protection plane — runtime threat detection through eBPF sensors, image registry scanning across Azure Container Registry, agentless cluster vulnerability assessment, and Kubernetes posture management with control-plane misconfiguration findings. Defender posts incidents into Microsoft Sentinel and the cloud-native XDR view across endpoints, identities, and workloads. Pricing is per vCore of monitored Kubernetes capacity.

Network policy with Cilium and Azure CNI

Default-deny network policy is the production baseline. Azure CNI Powered by Cilium provides identity-aware policy (label-based rather than IP-based), L7 HTTP policy for known protocols, and Hubble flow visibility for SOC investigation. Egress policy with FQDN allow-listing keeps regulated workloads inside compliance boundaries. Combined with Azure Firewall as the cluster egress, network telemetry flows into Sentinel for correlation.

Image scanning and supply chain — ACR, Notary, SBOM

Container images are scanned at push in Azure Container Registry through Defender for Containers, then continuously across the registry for newly disclosed CVEs. Notary Project signing on ACR enables image provenance verification, enforced at admission through Ratify or Connaisseur policies. SBOM generation through Syft is pinned to the CI pipeline, with SLSA Level 3 build provenance for tier-zero workloads. The full supply chain — source, build, sign, attest, deploy — is auditor-ready.

Azure Policy for Kubernetes — Gatekeeper at scale

Azure Policy for Kubernetes (Gatekeeper-based OPA) enforces pod security standards, label requirements, image registry allow-listing, and namespace standards. Compliance initiatives map to HIPAA, ISO 27001, NIST CSF 2.0, FedRAMP Moderate, and CMMC 2.0 with auditor-friendly Resource Graph queries that prove enforcement state at any point in time. Policy is applied at management-group scope so every AKS cluster inherits enforcement uniformly.

HIPAA

SOC 2

FedRAMP

FINRA

CMMC

GxP

Multi-cluster control

AKS Fleet Manager + Azure Arc — multi-cluster at enterprise scale

Once the AKS estate reaches ten clusters, manual coordination across regions and business units breaks down. AKS Fleet Manager is the Microsoft surface for coordinated multi-cluster operations within AKS — staged Kubernetes version upgrades, workload placement through ClusterResourcePlacement, multi-cluster L4 load balancing, and centralized RBAC. Azure Arc extends the governance plane beyond AKS to Arc-enabled EKS, GKE, OpenShift, Rancher, and on-prem clusters — projecting them into Azure Resource Manager so Defender, Policy, Monitor, and Resource Graph apply uniformly across the multi-cluster, multi-cloud estate.

Fleet Manager update orchestration

Staged upgrades across cluster groups with documented rings, health-check gates, and rollback. Replaces handcrafted runbook coordination across regions and BU clusters.

Workload propagation

ClusterResourcePlacement distributes namespaces, configurations, and workloads to clusters matching label selectors — declarative multi-cluster GitOps with a Microsoft-supported control plane.

Arc projection for non-AKS

Arc-enabled Kubernetes brings EKS, GKE, OpenShift, and on-prem clusters into the Azure governance plane. Defender, Policy, Flux, and Cluster Connect work uniformly. See the Azure Arc enterprise hub for depth.

Centralized RBAC

Entra ID group memberships propagate into RBAC across the fleet — platform engineers and tenants get the right access in every cluster without per-cluster role administration.

Low-ops experience

AKS Automatic — Kubernetes for application teams that do not want to run Kubernetes

AKS Automatic, generally available in November 2024 and significantly expanded in 2025, is a curated AKS experience where Microsoft selects opinionated defaults and operates more of the platform on the customer's behalf. Karpenter Node Autoprovisioning is on. Azure CNI Powered by Cilium is the dataplane. Managed Prometheus and managed Grafana are pre-wired. Deployment safeguards block unsafe workload patterns at admission. Image Cleaner runs automatically. Cluster auto-upgrade keeps the Kubernetes version inside the supported window without operator intervention.

The trade-off is reduced customization — Automatic chooses the CNI, the dataplane, the autoscaler, and the observability stack. Customers who need a custom CNI, specialized VM SKUs, advanced service mesh, or operator-led tuning stay on DIY AKS. EPC Group typically recommends Automatic for line-of-business application teams that want a paved road and DIY AKS for the tier-zero platform clusters the platform engineering team owns. The two SKUs coexist in the same enterprise without conflict — same Entra identity, same Defender posture, same Sentinel surface.

When AKS Automatic is the right call

Line-of-business application teams that need Kubernetes capabilities without operating Kubernetes
Greenfield workloads happy to adopt Microsoft-recommended defaults for CNI, dataplane, and observability
Pre-production and staging environments where reduced operational surface is more valuable than tuning latitude
Internal developer platforms wrapping Automatic with an opinionated CI/CD and Helm chart library

The EPC Group Azure Kubernetes Service Accelerator — five phases, fixed fee

The accelerator anchors on The EPC Group Lifecycle — Assess, Foundation, Platform, Workload, Operate. Fixed-scope between $150,000 and $600,000 depending on cluster count, regulatory scope, AI/ML and stateful workload depth, and multi-cluster Fleet Manager rollout. Senior-architect led, no offshore handoff.

Phase 1 — Assess

Workload, cost, and security baseline in three weeks

Phase one inventories every workload — containerized today, on a VM today, or greenfield — and maps each to the right AKS pattern. EPC Group ships a workload taxonomy, an AKS cluster topology proposal (region, node-pool, networking), a costed roadmap, and a board-ready governance design. Existing Kubernetes estates get a posture review against Microsoft AKS Baseline reference architecture with prioritized gap remediation.

Workload inventory and pattern classification — stateful, microservice, batch, AI/ML, edge, DR
Cluster topology proposal — regions, node-pool layout, networking model, ingress, egress
Existing-cluster posture review against AKS Baseline and CIS Kubernetes Benchmark
Costed roadmap with Spot, Karpenter, RI/SP blend and per-workload landing zone

Phase 2 — Foundation

Landing zone, identity, and network plane stood up

Phase two builds the AKS landing zone — subscription topology, management groups, Azure Policy initiatives, hub-and-spoke network with Azure Firewall, Private DNS, Container Registry geo-replicated, Key Vault, Log Analytics, and Sentinel. Identity is wired through Entra Workload ID with a documented service account-to-application federation pattern. Defender for Containers is enabled at subscription scope.

Landing zone subscriptions, RBAC, and Policy initiatives applied at management-group scope
Hub VNET, Azure Firewall, Private DNS, Private Endpoints, ACR, Key Vault, Log Analytics provisioned
Entra Workload ID federation patterns documented, service-account naming standards published
Defender for Containers, Defender for Servers, and Sentinel data connectors enabled

Phase 3 — Platform

Cluster build, GitOps, and platform services

Phase three stands up the production AKS clusters — private API server, Azure CNI Powered by Cilium, system pool plus user pools (general purpose, memory-optimized, GPU as needed), Karpenter for Node Autoprovisioning, Application Gateway for Containers ingress, Azure Container Storage where stateful workloads demand it. GitOps is the deployment surface — Flux v2 with a documented repo structure for platform and application separation. Argo Rollouts handles progressive delivery.

Production cluster build per AKS Baseline reference — private API server, multi-zone, ZRS-backed control plane tier
GitOps repo structure for platform and tenant separation with Flux v2 multi-tenancy patterns
Karpenter NodeClass and NodePool CRDs configured for general, memory, GPU, ARM64 workload classes
Application Gateway for Containers, Cert Manager, External Secrets, Cluster Autoscaler stand-up

Phase 4 — Workload

Application onboarding and platform productization

Phase four onboards the first tranche of workloads. EPC Group runs a containerization pattern library — multi-stage Dockerfiles, distroless bases, Helm charts, ArgoCD ApplicationSets — and a self-service workload onboarding pattern so the platform team productizes the cluster rather than handcrafting each application. KEDA scalers are wired for queue-driven and event-driven workloads. Observability ships through Azure Monitor managed Prometheus and Grafana with workload-aligned dashboards.

First wave of workloads ported with documented onboarding pattern reusable by platform tenants
KEDA scalers, Pod Disruption Budgets, resource quotas, and namespace standards applied to every workload
Azure Monitor managed Prometheus + managed Grafana with workload-aligned dashboard library
Backup, DR runbook, and chaos engineering tests executed before any workload enters production

Phase 5 — Operate

Day-two operations, FinOps, and continuous compliance

Phase five operationalizes the AKS estate. Quarterly right-sizing reviews drive the Karpenter + Spot + RI/SP blend toward target cost efficiency. Defender for Containers feeds Sentinel for SOC investigation. Azure Policy compliance state is reported through Resource Graph to the compliance team and the auditor. AKS Fleet Manager coordinates upgrades across regional and multi-cluster topologies. Cluster auto-upgrade keeps every cluster on a supported Kubernetes version with no manual cadence dependency.

Quarterly cost-efficiency review across Spot, Karpenter, RI/SP, right-sizing, and idle reclamation
Defender for Containers + Sentinel runbook for runtime threat investigation and incident response
AKS Fleet Manager for coordinated multi-cluster upgrades, image rollout, and policy distribution
Cluster auto-upgrade channel configured with documented maintenance windows by environment ring

Why EPC Group leads enterprise AKS deployments

1997

Founded · Microsoft consulting

70+

Fortune 500 clients

216+

M&A tenant consolidations

1.83 million

Users migrated

Microsoft Solutions Partner — Infrastructure & Digital App Innovation

Microsoft Solutions Partner with the Infrastructure (Azure) and Digital & App Innovation (Azure) designations covering AKS engagements end-to-end, plus four additional designations across Security, Data & AI, Modern Work, and Business Applications.

Four-time author for Microsoft Press and Sams

Founder Errin O’Connor has nearly three decades of Microsoft consulting leadership and is a four-time author for Microsoft Press and Sams across Power BI and SharePoint.

Fixed-fee accelerators

Every AKS engagement is fixed-fee with a costed roadmap and named senior architect on-record from kickoff through go-live. No T&M overruns, no offshore handoff, no junior-analyst-led production cutover.

Compliance-native

EPC Group is compliance-native across HIPAA, SOC 2, FedRAMP, FINRA, CMMC, and GxP. AKS deployments ship with auditor-ready control matrices, Defender for Containers HIPAA mappings, and Resource Graph evidence queries.

Frequently asked questions — Azure Kubernetes Service

AKS vs Amazon EKS vs Google GKE — which managed Kubernetes is best for an enterprise?

All three are conformant Kubernetes; the real differentiation is the platform that wraps each. AKS wins for Microsoft-anchored enterprises because Entra Workload ID, Defender for Containers, Azure Policy, Azure Monitor, Azure Container Registry, and Microsoft Sentinel integrate natively without third-party glue — the platform team gets one identity surface, one policy surface, and one SOC surface across cluster, application, and data. EKS leads in raw ecosystem maturity if the rest of the estate is already AWS, particularly for Karpenter (which originated at AWS), IAM Roles for Service Accounts, and the GuardDuty integration. GKE leads on developer experience, Autopilot for low-ops, and Google's native networking. For enterprises with Entra ID as the identity plane, Defender as the security plane, and Sentinel as the SIEM, AKS is the correct economic choice — the integration cost of running EKS or GKE while keeping Microsoft governance is real and persistent. The broader analysis lives in /microsoft-azure-aws-gcp-multi-cloud-orchestration.

AKS Automatic vs DIY AKS — when should an enterprise pick Automatic?

AKS Automatic, GA in November 2024 and significantly expanded in 2025, is a managed-experience SKU where Microsoft handles node provisioning, image management, scaling, upgrades, and a curated set of best-practice defaults — Karpenter, Cilium dataplane, managed Prometheus, deployment safeguards, and image cleaner are all on by default. The trade-off is reduced customization — you cannot pick your CNI, you cannot pin a specific VM SKU per pool, and the platform makes opinionated choices. Automatic is correct for application teams that want to ship workloads without operating Kubernetes themselves, for the long tail of business applications that do not warrant a dedicated platform team, and for greenfield environments where the customer is happy to adopt the Microsoft-recommended pattern. DIY AKS — what most large enterprises still pick for tier-zero — preserves full flexibility for custom networking, specialized SKUs, advanced workload classes, and operator-led tuning. EPC Group typically deploys Automatic for line-of-business application teams and DIY AKS for platform-team-owned tier-zero clusters in the same enterprise.

What does AKS actually cost — and how does it compare with EKS and GKE?

For the cluster control plane, AKS Free tier is $0, AKS Standard with Uptime SLA is $0.10/hour (~$73/month), and Premium with Long Term Support is $0.60/hour. EKS is $0.10/hour for every cluster. GKE Autopilot has no per-cluster fee on the first cluster per region per billing account and charges per pod resource usage. The control plane fee is rounding error at enterprise scale; the dominant cost is the node pool compute, which is comparable across the three clouds when comparing equivalent VM SKUs. Where AKS wins economically is the integration overhead avoided — Defender for Containers replaces a third-party CSPM and runtime stack, Entra Workload ID replaces a SPIFFE/SPIRE setup, Azure Monitor managed Prometheus replaces a self-hosted Prometheus operator. A realistic enterprise AKS budget envelope is the node pool compute (RI/SP-discounted) plus $15 to $30 per vCore for Defender for Containers plus Log Analytics ingestion at $2.30/GB or Sentinel commitment-tier rates.

How does the AKS security posture compare with EKS — what does Microsoft do differently?

AKS security ships native integrations EKS customers either build themselves or buy from third parties. Entra Workload ID is the production identity model — federated credentials, no secrets in the cluster. Defender for Containers covers runtime threat detection, registry scanning, posture management, and Kubernetes API analytics in one product wired into Sentinel. Azure Policy for Kubernetes (Gatekeeper-based) ships out-of-the-box initiatives for HIPAA, FedRAMP, NIST CSF 2.0, and CMMC 2.0 with auto-remediation. Microsoft Defender XDR correlates AKS alerts with endpoint, identity, email, and cloud-app alerts in one investigation surface. EKS gets the same outcomes through IAM Roles for Service Accounts plus Falco plus Polaris plus OPA Gatekeeper plus a SIEM integration — workable, but it is a multi-vendor stack a platform team owns rather than a Microsoft-integrated product. The deeper Defender story lives in /microsoft-defender-for-cloud-cnapp-enterprise-2026 and /microsoft-defender-xdr-enterprise-2026.

When should an enterprise use AKS Fleet Manager and how does it relate to Azure Arc?

AKS Fleet Manager is the multi-cluster control plane for coordinated operations across many AKS clusters — sequenced upgrades through staged stages and groups, workload propagation through ClusterResourcePlacement, multi-cluster L4 load balancing, and centralized RBAC. It is purpose-built for enterprises running ten, fifty, or hundreds of AKS clusters across regions and business units. Azure Arc complements Fleet Manager by extending the governance plane to non-AKS Kubernetes — EKS, GKE, OpenShift, and on-prem — projecting them as Arc-enabled Kubernetes resources subject to the same Defender, Policy, and Monitor surfaces. The pattern: Fleet Manager for AKS-to-AKS multi-cluster orchestration; Arc for AKS-plus-everything-else multi-cloud governance. The two together cover the full Kubernetes estate. Detailed Arc treatment lives in /azure-arc-hybrid-multicloud-enterprise-2026.

Is AKS HIPAA, FedRAMP, and CMMC compliant — what about GCC High and DoD IL5?

AKS in Azure commercial regions is covered by the Microsoft HIPAA BAA, HITRUST CSF, ISO 27001, ISO 27017, ISO 27018, SOC 1, SOC 2, SOC 3, FedRAMP Moderate, and PCI DSS attestations. AKS in Azure Government regions adds FedRAMP High and DoD Impact Levels 2, 4, and 5. CMMC 2.0 controls map through Azure Policy for Kubernetes initiatives. Healthcare workloads anchor on the BAA plus Defender for Containers HIPAA control mappings; federal contractors anchor on the GCC High or DoD IL5 deployment with the CMMC 2.0 control overlay applied at management-group scope. EPC Group ships every regulated AKS engagement with a documented control matrix linked to assessment evidence, policy artifacts, and Resource Graph queries an auditor will accept. See /government-federal-microsoft-consulting-fedramp-cmmc-2026 for the federal angle.

When is AKS the wrong answer — should I use Azure Container Apps or Azure App Service instead?

AKS is not always the correct surface. Azure Container Apps (serverless containers built on Kubernetes-Event-Driven-Autoscaling and Dapr) is a better fit for event-driven microservices that scale to zero, lightweight APIs, and teams that do not want to operate Kubernetes — no node management, per-second billing, scale-to-zero. Azure App Service for Containers is better for traditional web apps that benefit from PaaS conveniences (deployment slots, integrated authentication, App Service Plans) without the operational surface of Kubernetes. AKS earns its operational cost when workloads need custom networking, GPU pools, specialized operators, stateful workloads, multi-cluster orchestration, or service-mesh patterns. The rule we apply: start with Container Apps for greenfield event-driven microservices, move to AKS when the workload needs Kubernetes-specific primitives the abstraction layer cannot expose. EPC Group sometimes runs both — Container Apps for line-of-business APIs, AKS for the platform tier.

How does AKS work with Microsoft Entra ID and what is the right RBAC model for production?

Production AKS clusters disable local Kubernetes accounts and rely entirely on Entra ID for authentication. Operators and developers authenticate through Entra ID with Conditional Access enforcing MFA, device compliance, IP allowlists, and sign-in risk score on every kubectl call. Authorization uses Azure Kubernetes RBAC — Entra group membership maps directly to Kubernetes RBAC ClusterRoleBindings and RoleBindings via Azure RBAC assignments, so an Entra group like aks-prod-developers automatically grants read-only namespace access without manual Kubernetes role plumbing. Privileged elevation flows through Entra Privileged Identity Management with time-bound just-in-time roles that expire automatically and audit end-to-end. The legacy break-glass cluster-admin kubeconfig is rotated to an emergency-only Entra account stored in a vault with manager approval, not distributed to operators. The full identity story lives in /microsoft-entra-id-enterprise-2026.

Continue exploring the EPC Group enterprise Microsoft library

AKS is one plane inside a broader Microsoft cloud orchestration story. These hubs and analyses cover adjacent and complementary territory.

Production AKS, designed and operated by senior Microsoft architects

Book an AKS briefing with an EPC Group senior architect. Two-hour working session — workload inventory, cluster topology, cost model, accelerator scoping. Zero obligation, board-ready output.

Book the briefing 888-381-9725