On September 30, 2026, AKS will begin reaching into customer clusters and migrating VM Availability Set (VMAS) node pools to VM-based node pools (VMSS) automatically — and not in a gently optional way.
Microsoft provides portal, ARM API, and documented migration paths for converting VMAS node pools to VMSS, and operators can script the process with the Azure CLI and ARM templates. There isn't a single magic CLI flag for everyone; follow the official migration documentation and test in nonproduction before you touch production clusters. The operational impact is real: node identity, IPs, kubelet identities, compute SLAs, and node-image compatibility can all change during migration.
Two dates to note: Sept 14, 2026 marks removal of the preview custom-CA node pool property that some teams used to bake private PKI trust onto nodes; Sept 30, 2026 begins the VMAS→VMSS auto-migration. Removing the preview custom-CA option means teams relying on that behavior for private PKI, mTLS, or ingress TLS termination must move custom CA trust into supported cluster mechanisms (node images, CSI drivers, or cluster-level trust configuration) and validate TLS chains. Expect TLS and secret-to-pod mapping issues if you rush this without testing.
Microsoft also released a new AKS storage control plane/CSI stack release alongside these platform moves. The update brings new CRDs and storage class behaviors intended to improve StatefulSet scaling and disk provisioning, but it also changes provisioning semantics and reclaim policies. In practice, that means storageclass names or parameters may change and reclaim behavior can surprise you when node identities or labels shift. Treat the storage control plane update as a separate migration: test StatefulSets and PVC provisioning under the new controller before combining it with node-pool conversions.
Microsoft tied a separate set of changes into the same cadence around cost and AI: ARM cost-management telemetry is now more accessible to programmatic consumers and agent workflows. That can enable useful automation (automated spend reports in CI), but it also requires strict permissioning and auditing. Letting agents query or act on cost/control planes without least-privilege principals and immutable audit trails risks unwanted automated changes.
There were also high-severity security updates across Azure AI surfaces, including fixes addressing privilege-escalation vectors. The practical lesson remains: isolate AI workloads, enforce least privilege, and keep AKS node pools on supported, up-to-date images (use Microsoft-provided or Marketplace images and apply image patches promptly). The urgency is higher when automatic infrastructure migration can change node identities while agents and workloads are active.
Opinion: forcing VMAS out of the ecosystem is the right call. VMAS was a maintenance tax that created upgrade and observability blind spots; VMSS is easier to manage and safer at scale. What Microsoft gets wrong is the timing and signal coordination. Deprecating a trust flag, shipping a new storage control plane, and exposing cost APIs to agents all at once is three separate change-fronts colliding. Teams that treated AKS as a 'set-and-forget' control plane will be surprised; those with CI/CD that can reprovision node pools, run integration tests for storage CRDs, and gate agent permissions will win.
If you run AKS: inventory node pools now (VMAS vs VMSS) with az aks nodepool list, test the documented migration paths in nonproduction (portal, ARM APIs, or scripted CLI workflows), and plan to move custom CA trust into supported images or cluster-level mechanisms before Sept 14. Treat the new storage control plane as a separate rollout and validate StatefulSets and reclaim policies. And if you enable cost-querying agents, put them behind a hardened service principal with narrow scopes and auditable change hooks.
This isn’t paperwork — it’s the shape of reliable AKS operations for the next few years. Microsoft is cutting an old cord; the teams that treat this as a scheduled refactor will come out faster and safer. The ones that don’t will be the ones paging at 2 a.m.
Sources
- Release Notes - Azure/AKS - GitHub
- AKS Engineering Blog
- Microsoft Azure Blog
- Check This Out! (CTO!) Guide (September 2026) - Microsoft Tech Community
- Microsoft Patches 18 Vulnerabilities in AI, Cloud Products
- Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw Enabling Unauthorized Privilege Escalation
- What Is New in Microsoft Azure for September 2026?