Azure Kubernetes Service (AKS)
Azure Kubernetes Service is Microsoft's managed Kubernetes. Azure runs the control plane at no charge, you pay for the worker nodes, and you choose between AKS Automatic (Azure manages nodes, scaling, upgrades and security defaults) and AKS Standard (you configure and run the node pools).1
Also known as AKS, AKS Automatic, AKS Standard
- Intended for
- Platform and Kubernetes administrators, Application developers, DevOps and SRE teams, ML engineers who run training or inference on Kubernetes
- Runs on
- Azure public regions, On-premises and edge through AKS Hybrid and Edge (AKS on Azure Local, AKS on Windows Server, AKS Edge Essentials, AKS on bare metal in preview)
At a glance
- What is it?
- AKS is a managed Kubernetes service in Azure. When you create a cluster, Azure creates and operates the Kubernetes control plane for you without a charge for it, and you pay for the nodes that run your workloads. It comes in two modes. AKS Automatic is Microsoft's recommended default for most new workloads: Azure provisions and scales nodes, applies upgrades and turns on security and monitoring defaults. AKS Standard gives full control over node pools, networking and upgrade timing. AKS gives direct access to the Kubernetes API and is CNCF-certified.1
- What does it do?
- AKS runs containerized applications on Kubernetes clusters in Azure. It handles control plane health and maintenance, supports Linux and Windows Server node pools (Windows pools in Standard), GPU nodes, confidential computing nodes, autoscaling with the cluster autoscaler, HPA, KEDA and VPA, persistent storage through Azure Disks, Azure Files, Azure NetApp Files and Azure Container Storage, and several network plugins including Azure CNI powered by Cilium. It integrates with Microsoft Entra ID and Kubernetes RBAC for access, Azure Policy for guardrails, and Azure Monitor (Container Insights, managed Prometheus, Grafana dashboards) for observability.1
- Who needs it?
- Platform teams that need the full Kubernetes API, custom networking, Windows containers or specific VM sizes; organizations moving existing apps into containers; teams running microservices at scale; and ML teams that train or serve large models on GPU clusters. Microsoft's agent guidance recommends AKS over Container Apps for hosting large language models because it supports large GPU clusters and finer control over scaling and networking.2
- What does it need?
- An Azure subscription with permission to create resource groups and clusters
- Container images in a registry such as Azure Container Registry
- Kubernetes manifests or Helm charts for your workloads (AKS Automatic can generate manifests and CI/CD workflows from a repository)
- Quota for the VM sizes you plan to use, including GPU sizes if needed
- A plan for identity (Microsoft Entra ID groups for cluster access)
- What it is not
- AKS is not a serverless container service: you still own node sizing (in Standard), workload configuration, upgrades of your apps and cluster add-ons. Azure Container Apps is the option without Kubernetes API access. AKS is also not the same as running Kubernetes outside Azure: for on-premises and edge sites Microsoft offers AKS Hybrid and Edge options such as AKS on Azure Local and AKS Edge Essentials, and Azure Arc-enabled Kubernetes for attaching other distributions. The control plane is free, but the Free tier is meant for experimentation; the Standard tier adds an uptime SLA and Premium adds long-term support.34
Availability and licensing. Generally available. Checked 26 October 2026: Azure creates the control plane at no cost and you pay for nodes. The product page lists a Free tier for experimentation, a Standard tier with an uptime SLA and a Premium tier with long-term support (two years per the FAQ). AKS Automatic includes the Standard tier at no extra charge. AKS enabled by Azure Arc is included with Azure Local (release 2402 and later) at no extra charge.56
The problem it solves
Running Kubernetes yourself means operating etcd and the API server, patching nodes, wiring identity, monitoring, ingress and autoscaling, and keeping all of it upgraded on the Kubernetes release cadence. Many teams want the Kubernetes API and ecosystem without carrying that operational load.
AKS moves the control plane to Azure and, in Automatic mode, also the node lifecycle, scaling and security defaults. In Standard mode it keeps the managed control plane but leaves infrastructure choices to the platform team.
How it works
An AKS cluster has two parts:
- Control plane: created and run by Azure at no cost. It hosts the Kubernetes API and manages the objects and worker nodes you deploy.
- Nodes: Azure virtual machines in your subscription that run your pods. In AKS Automatic, node auto-provisioning creates and scales nodes on demand; in AKS Standard you define node pools yourself.
Around the cluster, AKS connects to Microsoft Entra ID and Azure RBAC for sign-in and authorization, workload identity and an OIDC issuer for pod access to Azure resources, Azure Monitor for metrics and logs, and Azure Policy (including deployment safeguards) for guardrails. Automatic clusters turn these on by default together with managed NGINX ingress, Azure CNI Overlay powered by Cilium and a managed NAT gateway.
Pricing tiers
The Free tier is meant for experimentation; the Standard tier adds an uptime SLA and higher node limits; the Premium tier adds long-term support. AKS Automatic includes the Standard tier at no extra charge.15
Diagram as a list
Data & analytics
- Azure Disks, Azure Files, Azure Container StoragePersistent volumes for stateful workloads
Developer tools
- Developers and CI/CDPush images and manifests, for example through GitHub Actions or Helm
Security, identity & governance
- Microsoft Entra ID and Azure RBACAuthenticates and authorizes cluster and workload accessConnects to AKS control plane (Kubernetes API)
- Azure Policy and deployment safeguardsEnforces configuration rules on the clusterConnects to AKS control plane (Kubernetes API)
Cloud & hybrid infrastructure
- Azure Container RegistryStores container images that nodes pullConnects to Node pools or node auto-provisioning
- AKS control plane (Kubernetes API)Managed by Azure at no cost; schedules pods and manages nodesConnects to Node pools or node auto-provisioning
- Node pools or node auto-provisioningAzure VMs (CPU, GPU, Windows or Linux) that run pods
- Ingress (managed NGINX or app routing add-on)Exposes services to users and other systems
- Azure Monitor (Container Insights, managed Prometheus, Grafana)Collects metrics and logs from nodes and pods
Capabilities
Two operating modes1
AKS Automatic runs nodes, scaling, upgrades and security defaults for you; AKS Standard leaves node pools and configuration to your team.
Why it matters: Teams can choose between less operations work and full infrastructure control.
Limits: Automatic does not yet cover every option: Microsoft lists custom networking, Windows node pools and some VM sizes as reasons to use Standard.
Managed control plane at no cost1
Azure creates, monitors and maintains the Kubernetes control plane; you pay for the nodes.
Why it matters: Removes the most failure-prone part of self-run Kubernetes.
Limits: The Free tier is intended for experimentation; production SLA comes with the Standard tier, and long-term support with Premium.
Built-in autoscaling1
HPA, KEDA and VPA for pods, plus the cluster autoscaler or node auto-provisioning for nodes.
Why it matters: Workloads can scale on CPU, memory or event sources such as queues.
Limits: In Standard mode, cluster autoscaler and KEDA are optional and must be enabled.
Identity and policy1
Microsoft Entra ID sign-in, Kubernetes or Azure RBAC, workload identity and Azure Policy guardrails.
Why it matters: Cluster access follows existing groups, and pods can reach Azure services without stored secrets.
Limits: Security defaults are on by default only in Automatic; in Standard each feature is opt-in.
Monitoring1
Container Insights, managed Prometheus and Grafana dashboards in Azure Monitor.
Why it matters: Cluster and app health are visible without running your own monitoring stack.
Limits: Azure Monitor data ingestion and retention are billed as separate services.
Pod readiness SLA in Automatic1
Microsoft offers a financially backed SLA that 99.9% of qualifying pods become ready within five minutes on AKS Automatic.
Why it matters: Gives a contractual target for how fast workloads start.
Limits: Applies only to AKS Automatic and to qualifying pods as defined in the SLA.
GPU and AI workloads15
GPU nodes, confidential computing nodes, and the Kubernetes AI toolchain operator (KAITO) for deploying AI models.
Why it matters: Microsoft recommends AKS for large language models that need large GPU clusters.
Limits: GPU VM quota and regional availability apply.
Hybrid and edge options4
AKS Hybrid and Edge brings the same AKS engine to Azure Local, Windows Server, bare metal (preview) and small devices with AKS Edge Essentials.
Why it matters: One Kubernetes platform across cloud, datacenter and edge.
Limits: Feature sets differ per deployment option; AKS on bare metal is in preview.
Practical use cases
An existing line-of-business application is hard to scale and patch on VMs.
- Approach
- Containerize it and run it on AKS Automatic with managed ingress and autoscaling.
- Role of Azure Kubernetes Service (AKS)
- AKS hosts and scales the containers and runs the control plane.
- Data, infrastructure and skills
- Container images, manifests or Helm charts, an Azure subscription.
- Type of benefit
- Lower operations effort
- Caveats
- Apps that need Windows containers require AKS Standard.
- First step
- Run the AKS Automatic quickstart with one container image of the app.
A team wants to self-host a large open model with high throughput.
- Approach
- Run the model on GPU node pools in AKS and point agents or apps at the internal endpoint.
- Role of Azure Kubernetes Service (AKS)
- AKS schedules GPU workloads and handles scaling and networking.
- Data, infrastructure and skills
- GPU VM quota, a model-serving container, Kubernetes skills.
- Type of benefit
- Control over models and data
- Caveats
- GPU capacity is costly and region-dependent; a managed model API may be enough.
- First step
- Check GPU quota in the target region and test with KAITO or your own serving image.
Dozens of microservices need consistent deployment, secrets and scaling.
- Approach
- Use AKS with GitHub Actions or Azure Pipelines, KEDA for event-driven scaling and Azure Policy for guardrails.
- Role of Azure Kubernetes Service (AKS)
- AKS provides the shared runtime and policy enforcement point.
- Data, infrastructure and skills
- CI/CD pipelines, a registry, platform team ownership.
- Type of benefit
- Consistency and governance
- Caveats
- If the team does not need Kubernetes APIs, Container Apps can be simpler.
- First step
- Pilot two services on one cluster with deployment safeguards turned on.
Works with
Optional integration
- Azure ArcArc-enabled Kubernetes clusters appear alongside AKS clusters for inventory, GitOps, policy and monitoring.
- Microsoft EntraAKS uses Microsoft Entra ID for Kubernetes access based on identity and group membership.
Complementary tools
- Azure GPU virtual machinesMicrosoft recommends AKS for hosting large models on large GPU clusters.
- Azure LocalAKS on Azure Local brings the AKS engine to on-premises hardware and is included with Azure Local.
- Azure IoT OperationsAKS Edge Essentials and AKS on Azure Local are supported Kubernetes distributions.
Alternative approaches
- Azure Container AppsMicrosoft recommends AKS when you need direct Kubernetes API access; Container Apps otherwise.
- Microsoft Foundry ModelsMicrosoft suggests AKS for hosting your own large models instead of Foundry endpoints.
Optional integration for
- Azure LocalAKS on Azure Local is part of the platform and included at no extra charge.
- Azure ArcArc-enabled clusters are listed alongside AKS clusters, and AKS Hybrid and Edge options connect to the same Azure management plane.
- Azure Cosmos DBMicrosoft lists AKS among the Azure services Cosmos DB integrates with.
- Microsoft for StartupsAKS usage on a sponsored subscription is covered automatically while credits last.
- Azure Database for PostgreSQLMicrosoft documents deploying a Django app on AKS with this database.
Relationship labels follow Microsoft's documentation. "Alternative approaches" does not mean one is better: each profile says when it fits.
Compared with
Getting started
Pick a mode
Start with AKS Automatic unless you need Windows node pools, custom networking, a VM size Automatic does not offer, or existing automation built around manual node pools.
Check: You can state which of those Standard-only needs, if any, apply to you.
Create the cluster
Follow the AKS Automatic quickstart from a container image, or the quickstart that starts from source code and generates manifests and a CI/CD workflow.
Check: kubectl get nodes returns nodes and the Azure portal shows the cluster as running.
Wire identity and access
Map Microsoft Entra groups to cluster roles and use workload identity for pods that call Azure services.
Check: A test user in the right group can list pods; one outside the group cannot.
Deploy and observe
Deploy a workload with Helm or manifests, then open Container Insights and the Grafana dashboards.
Check: Pod metrics and logs appear in Azure Monitor.
Review cost and reliability
Check the pricing tier (Free, Standard or Premium), node sizes and autoscaling settings against the AKS cost guidance and the Well-Architected service guide.
Check: Production clusters run on a tier with an uptime SLA.
Official resources
Deciding whether you need it?
Three free tools apply Microsoft's own published guidance to your situation, and say when Azure Kubernetes Service (AKS) or any new technology is not needed.
Sources
Each statement above links to the source it comes from. Labels say who reported it.
- What is Azure Kubernetes Service (AKS)? (opens in a new tab)
- Technology plan for AI agents (Cloud Adoption Framework) (opens in a new tab)
- Comparing Container Apps with other Azure container options (opens in a new tab)
- What is AKS Hybrid and Edge? (opens in a new tab)
- Azure Kubernetes Service product page (opens in a new tab)
- Azure Local pricing (opens in a new tab)
- Overview of Azure Arc-enabled Kubernetes (opens in a new tab)
- Azure IoT Operations deployment overview (opens in a new tab)
Thank you. Your correction was sent.
The editors check it against the sources. If you left an email address, they may reply about it.