Microsoft's mid‑August platform rollup quietly delivered something AKS customers have been asking for for years: control‑plane metrics collection for AKS via Managed Prometheus is now GA. This isn't just another metrics toggle—it's the first‑party pipeline for API server, etcd and other control‑plane telemetry into Azure Monitor's Managed Prometheus, and it changes how you reason about SRE, alerting, and cost on AKS.
Control plane telemetry finally first‑class
Until now, exposing API‑server and controller metrics reliably at scale meant scraping from master VMs, running sidecars, or stitching together third‑party collectors. GA of control‑plane metrics into Managed Prometheus means Azure manages the scrape surface and ingestion plumbing for you; you get Prometheus‑format metrics for the API server, scheduler, controller‑manager and etcd (the announcement calls out API server and control‑plane telemetry) flowing into Azure Monitor. That lets teams build SLOs on request latencies, apiserver error rates, etcd commit latency and leader changes without brittle custom collectors.
Two immediate operational implications:
- Observability: You can now create control‑plane alerts that are consistent across clusters instead of relying on cluster‑specific agents.
- Cost & access: Control‑plane telemetry is billed under Managed Prometheus—expect ingestion, retention and query cost tradeoffs—and you'll need to update RBAC and audit policies because these metrics surface more cluster state to consumers.
This was overdue. Platform teams have been forced into fragile hacks for too long; making the control plane a supported telemetry source is the right call and will materially improve SLO fidelity for production clusters. If you're running large multi‑tenant AKS fleets, treat this as the trigger to rewrite runbooks that currently infer control‑plane health from node metrics.
Agents: serverless hooks and markdown outputs
Microsoft also expanded agent runtimes: serverless AI agents for Azure Functions are available in preview, and App Service agent integrations can return text/markdown payloads in preview. The latter simplifies developer UIs and chat‑ops integrations by allowing structured markdown responses directly from agents. The product blog also updated guidance on model/runtime defaults and on reliable recovery patterns (retries, idempotency, fallback flows) teams should adopt.
A candid take: serverless agents are useful, but they increase your operational surface. Agent failures and inconsistent outputs are a new class of cascading failure—treat agent runtime contracts as first‑class parts of your architecture and instrument their failure modes.
Networking and security: performance where it counts
Azure Firewall Premium received IDPS performance improvements—TLS‑inspected throughput is now reported at up to ~22 Gbps and per‑connection IDPS throughput around ~600 Mbps in some SKUs. That's a meaningful capacity shift for inline inspection use cases; you can reduce Firewall instance count and lower inspection latency, but sizing and failover still matter.
Azure Front Door added GA support for atomic batch rule updates for WAF/CDN deployments and is previewing mutual TLS at the edge, enabling client‑certificate auth closer to users—useful for internal API gateways and high‑security B2B endpoints.
Cost and governance: retirement and reservation changes
Two governance nudges you can't ignore: Databricks Runtime 10.4 LTS is scheduled for retirement in late 2026, and reservation exchanges for services covered by Savings Plans are being discontinued in 2027. The latter will break automation that assumes flexible reservation swaps—FinOps and platform capacity planners must rework long‑term reservation and savings‑plan strategies now.
Maintenance and tooling
August patches for Azure DevOps Server shipped, and the Azure Architecture Diagram Builder received practical updates—Microsoft continues to invest in on‑prem DevOps maintenance and large‑scale architectural tooling.
If you're tracking AKS evolution, this follows a pattern of turning messy hacks into supported primitives (see prior AKS improvements like Gateway API GA and bare‑metal preview). For SREs and platform engineers the choices are simple: adopt these primitives—update RBAC, ingestion/retention assumptions, runbooks and FinOps models—or keep building brittle workarounds that will break in predictable ways.
Final thought: this wave of changes makes Azure's platform feel more opinionated and more usable at scale. That opinion forces engineering work up front, but it buys you consistent control‑plane observability, better agent runtimes, and measurable security performance. If you ignore it, you won't be surprised by a pager—you'll be surprised by the bill and a migration scramble come 2027.