Microsoft AKS on Azure Local: On-Prem Kubernetes Ledger

Part of the On-Prem Kubernetes Ledger (edition 2026-10-13). How the scores work: methodology.

1. Snapshot

Tier: Hyperscaler on-prem
Owner: Microsoft Corporation, public company
Licence model: Commercial; AKS is included at no extra charge with Azure Local (release 2402 and later, from January 2025); Azure Local is billed per physical core per month through an Azure subscription
Products scored: AKS-HCI and AKS hybrid on Azure Stack HCI 22H2 until 2023; AKS enabled by Azure Arc on Azure Local 23H2 and later from 2024; AKS on Windows Server and AKS on bare metal (preview) are not scored
Latest release: Azure Local 2609 (2026-09-11); AKS Kubernetes 1.31 to 1.33 since train 2602 (2026-02-17), unchanged through 2607
Next signal: No dated roadmap; AKS on bare metal in preview; KMS v1 retirement and Kubernetes 1.34 not scheduled
Archetype: Azure-managed hybrid Kubernetes
Evidence grade: B. Release notes, Kubernetes calendar, docs source, pricing snapshots, GitHub releases and NVD read directly; no public roadmap, a few train dates are missing and security patch dates were not found.

Not ranked: Inclusion test 4 not met on the repository evidence: cncf/k8s-conformance has no AKS Arc, AKS hybrid or Azure Local folder for Kubernetes 1.24 to 1.37, although Microsoft's own comparison table says conformant. Test 3 met only in part: the management plane is Azure, create, upgrade and delete need a connection, and temporary disconnection is limited to 30 days.

2. Scorecard

Dimension	Score	Direction
Capability today	51.0 / 100	higher is better
Momentum since end of 2022	+11.0 points	higher is better
Credibility	14.5 / 25	higher is better
Commercial risk	11.5 / 25	lower is better
Technical lock-in	14.5 / 25	lower is better
Integrator fit	13.0 / 20	higher is better
AI leverage	4.5 / 20	higher is better
Ledger Index	50.6 / 100	balanced weights

3. Capability by domain

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2016	2019	2022	Today
Install, upgrade and lifecycle (12)	n/a	n/a	3	3
Bare metal, edge and on-prem infrastructure (10)	n/a	n/a	2.5	3
Multi-cluster and fleet management (10)	n/a	n/a	2	3
Networking (10)	n/a	n/a	3	2
Storage and data protection (10)	n/a	n/a	2.5	2
Security and compliance (12)	n/a	n/a	3	3.25
Developer platform (8)	n/a	n/a	1.5	2
Observability and day-2 operations (8)	n/a	n/a	2	3
VMs on Kubernetes (VMware exit) (10)	n/a	n/a	0	1
GPU and accelerator workloads (10)	n/a	n/a	0	3
Total / 100	not released	not released	40.0	51.0

Year by year: 2021: 34.6 · 2022: 40.0 · 2023: 46.0 · 2024: 50.6 · 2025: 50.6 · 2026: 51.0

What moved the score

Year	Domain	Change	Points	Trigger
2022	Bare metal, edge and on-prem infrastructure	2 → 2.5	+1.0	AKS-HCI 2208 and 2209: single-node HCI GA, SDN GA
2022	Install, upgrade and lifecycle	2.5 → 3	+1.2	AKS hybrid 2210 (2022-11-15): install pre-checks, scheduled retirement of old monthly versions, three Kubernetes minors in support
2022	Multi-cluster and fleet management	1.5 → 2	+1.0	AKS hybrid 2210: Arc, Azure Policy and Azure Monitor on top of per-host management
2022	Networking	2.5 → 3	+1.0	AKS-HCI 2209 (2022-10-11): SDN GA
2022	Security and compliance	2.5 → 3	+1.2	AKS hybrid 2210: Azure RBAC in preview, Mariner node images
2023	GPU and accelerator workloads	0 → 3	+6.0	AKS-hybrid2303 (2023-03-15): GPU node pools GA; A2, A16, T4 and later L4, L40S, RTX Pro 6000 supported; no sharing or DRA
2024	Developer platform	1.5 → 2	+0.8	Azure Local: Container Registry, Flux through Arc, Edge RAG; no CI or portal
2024	Multi-cluster and fleet management	2 → 3	+2.0	23H2 GA 2024-02-01: Azure portal, CLI and ARM manage clusters across Azure Local instances; no Fleet Manager or templates
2024	Networking	3 → 2	-2.0	Azure Local 23H2: Calico only, no network policies, no SDN; MetalLB and Arc Gateway as extensions
2024	Observability and day-2 operations	2 → 3	+1.6	2405 (2024-07): platform metrics and alerts, control-plane audit logs, Managed Prometheus through Arc, diagnostic checker; no cost reporting
2024	Security and compliance	3 → 3.5	+1.2	2405 (2024-07): Azure RBAC and Entra ID authentication; later certificate rotation, KMS v2 (2510), signed image guide; no FIPS, STIG or SBOM found
2024	Storage and data protection	2.5 → 2	-1.0	Azure Local: disk and SMB/NFS CSI, no volume snapshots, no application backup
2024	VMs on Kubernetes (VMware exit)	0 → 1	+2.0	Azure Local runs Hyper-V VMs beside AKS node VMs; VMs are not Kubernetes objects and AKS has no KubeVirt
2026	Bare metal, edge and on-prem infrastructure	2.5 → 3	+1.0	Azure Local 1 to 16 nodes, multi-rack and SAN deployments, disconnected-operations mode (2408 on, Kubernetes 1.33 only); bare metal still preview
2026	Security and compliance	3.5 → 3.25	-0.6	3.5 less 0.25 for critical CVE-2026-42822 (CVSS 10.0, Azure Local disconnected operations, 2026-05-18); Copy Fail kernel KEV not counted

4. Direction, 2023 to 2026

Each item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2023-03	AKS-HCI 2303: GPU node pools and Windows Server 2022 hosts GA	D13 Accelerators	C
2024-02	Azure Stack HCI 23H2 GA: cloud-managed AKS through Arc Resource Bridge	D1 Install and lifecycle	V
2024-07	Train 2405: Azure RBAC for Kubernetes and metric alerts	D9 Security	C
2024-09	Train 2408: availability sets, Arc Gateway, NVIDIA T4	D2 Bare metal, edge and infrastructure	C
2024-11	Azure Stack HCI renamed Azure Local; workload identity and Terraform in preview	D12 Packaging and licensing	P
2025-01	AKS included in Azure Local at no extra charge	D12 Packaging and licensing	M
2025-07	Train 2507: Azure Linux 3.0 node images after Azure Linux 2.0 end of life	D9 Security	U
2025-10	Train 2510: KMS v2 etcd encryption and Kubernetes 1.32	D9 Security	C
2026-02	Train 2602: Kubernetes 1.33, 1.30 dropped; same versions through 2607	D1 Install and lifecycle	U
2026-05	Copy Fail kernel flaw on KEV: AKS Linux nodes exploitable until Azure Local fix	D9 Security	U
2026-06	AKS hybrid on Windows Server: support ends March 2028	D12 Packaging and licensing	P
2026-09	AKS on bare metal public preview (single-node, Azure Linux or Ubuntu)	D2 Bare metal, edge and infrastructure	V

Centre of gravity: Security (4), Packaging and licensing (3), Install and lifecycle (2)
Driver mix: Vision 17%, Customer need 33%, Market window 8%, Upstream 25%, Portfolio 17%

5. Credibility: 14.5 / 25

Criterion	Score	Basis
Cadence	3.5	Azure Local ships monthly trains but the docs promise a Kubernetes minor about every three months while minors arrive 267 to 381 days after upstream
Roadmap transparency	3	Dated release notes, docs source and Kubernetes calendar are public; no roadmap, tracker or direction beyond events
Say-do	3	4 of 7 preview or announced capability items reached GA in 36 to 120 days; workload identity, Terraform and offline download stay preview 23 to 28 months
Velocity	3	One or two substantive items per release: Azure RBAC, Arc Gateway, KMS v2, GPU models, availability sets
Lifecycle stability	2	Six-month support per Azure Local release, redeploy needed between AKS-HCI and 23H2, 22H2 ended May 2025, Windows Server line retires March 2028

Say-do record, 2023 to 2026: 12 items 2023-2026 from release-note previews and notices: 7 done (GPU pools in 120 days, 23H2 GA, Kubernetes 1.31 in 36 days, KMS v2 in 56 days, Flannel removal, two end-of-support dates on time), 5 pending (workload identity 23 months, Terraform 23, offline VHD 28, KMS v1 retirement 13, bare metal GA). Conference promises were not found.

6. Commercial risk: 11.5 / 25 (lower is better)

Criterion	Score	Basis
Price and licence volatility	1.5	Azure Stack HCI renamed Azure Local in 2024-11 and AKS made free with Azure Local from January 2025; Azure Local host and Windows guest fees unchanged
Purchase constraints	3.5	AKS only through Azure Local on validated hardware with an Azure subscription and per-core host fee; no separate purchase
Channel and access	1.5	Docs, release notes and trial open; hardware through OEM partners, Azure subscription required
Owner stability	1.5	Microsoft is stable, but the line was renamed three times, split into two code lines and the Windows Server line is retiring
Cost of staying supported	3.5	Each Azure Local release supported six months, Kubernetes N to N-2, Arc Resource Bridge needs yearly updates; no extended support

Security record of the product itself: Counted: CVE-2026-42822 (CVSS 10.0, Azure Local disconnected operations, NVD 2026-05-18), 0.25; patch date not found. Not counted: Copy Fail CVE-2026-31431 (Linux kernel, KEV 2026-05-01; AKS bulletin AKSARC-2026-0001, nodes exploitable until Azure Local 2602 plus remediation), Hyper-V host KEV entries, and Azure Arc service CVEs (CVSS up to 10.0, cluster-agent link not established).

7. Technical lock-in: 14.5 / 25 (lower is better)

Criterion	Score	Basis
Formats	1.5	Upstream Kubernetes APIs in the cluster; clusters are Azure resources; Microsoft says conformant but no CNCF listing found
Export path	2.5	Standard manifests move; no migration tooling off Azure Local and 22H2 to 23H2 needs redeploy
Stack coupling	3.5	Azure Local and Hyper-V, Azure Linux nodes, Arc agents and Calico only
Hardware / cloud coupling	4	Validated hardware and a standing Azure connection for create, upgrade and delete; 30-day limit for temporary disconnection
Skills and tooling coupling	3	Azure CLI, ARM and Arc skills alongside kubectl

8. Integrator fit: 13 / 20

Criterion	Score	Basis
Partner programme openness	3	Azure Local OEM hardware partners and Microsoft partner programme; terms not opened
Multi-tenancy and self-service	3	Azure RBAC and Entra ID, one control-plane set per cluster, 32 clusters per Azure Local instance
API and infrastructure-as-code	4	az aksarc, ARM, Bicep and PowerShell; Terraform in preview; no Cluster API
Skills and certification	3	Broad Microsoft certification paths, none specific to AKS on Azure Local

9. AI leverage: 4.5 / 20

Strand	Today	Latest step
AI workload support	2.5	2025: KAITO extension for open models in preview, about 2025-03 (half step)
AI platform stack	0.5	2025: Edge RAG listed for Azure Local; maturity not stated
AI-assisted operations	0	none
Agent openness	1.5	2021: Azure Resource Manager API, az aksarc and PowerShell; the AKS MCP server targets AKS in Azure

AI say-do: 2 announced, 1 GA (GPU pools), 1 preview (KAITO), 0 dropped; first-pass Copilot, DRA and AI operator claims have no source and no assistant or MCP server for AKS on Azure Local was found.

10. Reading

Microsoft is turning AKS on Azure Local into the Kubernetes layer of its Azure Local platform: clusters are Azure resources, created and upgraded from Azure, and included at no extra cost. The record shows steady dated releases but Kubernetes minors arriving about ten months behind upstream, several features stuck in preview for two years and two code lines with a forced redeploy between them. It fits teams already committed to Azure Local hardware and Azure management; it is a weak fit for disconnected or multi-vendor estates.

11. Open questions and evidence caveats

No AKS Arc entry exists in cncf/k8s-conformance for 1.24 to 1.37; confirm certification with Microsoft before ranking.
Security: CVE-2026-42822 (CVSS 10.0) affects the disconnected-operations mode only and its patch date was not found; the deduction of 0.25 is a judgement. Azure Arc service CVEs rated 10.0 were not counted.
Train dates for 2402 and before 2024-07-16 are not on the release page; the 1.27 and 1.28 lags are minimums.
The Windows Server line carries Kubernetes 1.34 while the Azure Local line stops at 1.33; this entry scores the Azure Local line.