Azure finally made the single most operationally useful feature for many stateful Kubernetes workloads officially supported: AKS now supports Encryption in Transit (EiT) for Azure Files NFS v4.1 volumes using the Azure File CSI driver. That one line changes how you reason about running databases, clustered filesystems, and any workload that mounts NFS from pods — now you can require TLS between the pod and the Azure Files service without contorting your network topology or inserting sidecars.
What this actually gives you
- TLS-protected traffic between pods and Azure Files NFS v4.1 mounts handled by the CSI driver. For teams subject to compliance (PCI, HIPAA, internal security baselines) that long-awaited checkbox is now natively achievable on AKS.
- A simpler security model than forcing everything over private peering or VPNs. You can continue to use private endpoints and VNet integration for isolation, but EiT closes the gap where attackers with network visibility could sniff NFS traffic.
Operational caveats
This is GA, not magic. Validate mount options, the Azure File CSI driver version, and node OS/NFS client compatibility in your clusters before flipping it on broadly. Some workloads are sensitive to added latency from TLS handshakes (small but measurable per-mount); test failover behavior for stateful sets since encrypted mounts can expose different timing characteristics during node evacuation. If you run mixed Windows and Linux nodes, confirm supported behavior across both platforms.
This move is overdue. Azure Files has supported NFS for a while; getting EiT to GA for the CSI driver should have been a priority years ago. Still, better late than teams baking fragile TLS proxies into their apps.
Identity and governance: Entra shifts from helpful to central
Microsoft Entra ID has added capabilities that change platform architecture: access packages can now create and govern Azure role assignments as part of entitlement lifecycles, enabling just-in-time, least-privilege elevation flows that produce RBAC assignments tied to access governance rather than ad-hoc role grants.
Combined with improved device soft-delete behavior, better tooling for app account discovery, and expanded controls around object source-of-authority, Entra is being positioned as the central control plane for identity lifecycle and role-assignment governance. This is the right call. Teams that keep RBAC assignments outside identity governance are courting permission sprawl that becomes impossible to audit at scale.
AI observability arrives — and it expands your operational surface
Azure Copilot observability features have reached general availability with an agent that correlates telemetry, resource context, and natural-language instructions to suggest or (with configured permissions) execute triage steps.
This will change runbooks and incident response — for better and worse. On the plus side, faster median time to identify noisy signals and actionable remediation suggestions. On the downside, you now have an agent with decision-making capability touching production telemetry and potential remediation flows. Treat it like any other privileged runtime: instrument, audit, and restrict its scope.
Migration timelines you can’t ignore
Microsoft has announced deprecations that matter for platform teams: the legacy Azure DevOps issuer for workload identity federation is planned for retirement in 2027, and the Log Analytics HTTP Data Collector API (classic ingestion) is slated for retirement in 2026. If you rely on Azure DevOps pipelines exchanging tokens via older issuer flows, or you push logs with the classic Data Collector API, migrate to Entra-based federation patterns and Data Collection Rule (DCR)-based ingestion now. These are non-trivial refactors for CI/CD and telemetry pipelines and will touch service principals, federated credentials, and monitoring architectures.
Final take
This week’s updates aren’t flashy feature drops — they’re the scaffolding that makes secure, observable, and identity-driven Azure infrastructure practical at scale. Enable EiT for sensitive NFS mounts, but don’t let the storage change distract you from the harder work: centralizing role-assignment governance in Entra, migrating identity federation away from deprecated issuers, and treating AI observability agents as a new privileged runtime. If you skip the identity and ingestion migrations now, you’ll trade a minor engineering sprint for a painful compliance and operational debt sprint later.
If you want the hands-on checklist: validate CSI driver versions and mount behavior, map all Azure DevOps federated flows, and bake Entra access packages into your RBAC lifecycle. Do that, and these releases become a net win instead of tomorrow’s firefight.
Related reading: see our technical coverage of AKS EiT rollout for details on driver flags and cluster configuration: AKS GA: TLS encryption in transit for Azure Files NFS v4.1 via Azure File CSI driver.