Critical Azure Updates: AKS, WAF, SAS Tokens, Azure OpenAI, and Copilot CLI
A batch of critical Azure and AI updates landed that every Azure architect and developer needs to review. These are not minor feature additions — several of these changes affect security posture, operational practices, and application compatibility. Here is what changed and what you need to do about it.
AKS Improvements
Azure Kubernetes Service received updates focused on node auto-provisioning and workload scaling efficiency. The most operationally significant: Node Autoprovision (NAP) enhancements that improve bin-packing efficiency and reduce over-provisioning in heterogeneous workload clusters. For AKS clusters running a mix of compute-intensive and memory-intensive workloads, NAP now makes better node type selections automatically.
AKS also updated its managed add-on lifecycle — add-ons that are no longer maintained are now flagged in advance of deprecation with migration guidance. Review your cluster add-on inventory: deprecated add-ons that are not migrated before the deprecation date will be disabled on the cluster, which can cause unexpected outages.
WAF Rule Enhancements
Azure Web Application Firewall managed rule sets received a significant update. The Microsoft Default Rule Set (DRS) 2.1 was released with expanded bot detection logic and improved false-positive handling for common web application frameworks. If you are running WAF in Prevention mode on DRS 2.0, test 2.1 in Detection mode on your traffic before upgrading — the expanded bot detection logic has different behavior characteristics for some application patterns.
Application Gateway WAF and Front Door WAF both receive the same DRS updates, but the rollout timeline differs. Check your WAF policy version and the update schedule for your deployment type.
SAS Token Security Changes
This is the update with the most immediate security implications. Azure Storage Account SAS tokens — the legacy SAS type that grants broad storage account access — are being deprecated in favour of User Delegation SAS tokens backed by Entra ID credentials. Account SAS tokens do not expire when a user's access is revoked; User Delegation SAS tokens are tied to the issuing identity's permissions and invalidate when the underlying permissions change.
Audit your applications for Account SAS token usage immediately. Any application issuing Account SAS tokens for storage access should be migrated to User Delegation SAS or, preferably, to managed identity with direct RBAC-based storage access — which eliminates SAS token management entirely.
Azure OpenAI Updates
Azure OpenAI rolled out updates to model availability and quotas. The significant change for enterprise deployments: provisioned throughput unit (PTU) pricing was updated with new commitment tier options, making smaller PTU commitments more accessible for teams that need guaranteed throughput but cannot justify the full 100-PTU minimum. Review your Azure OpenAI consumption patterns against the new PTU tier options — cost savings are available for predictable, moderate-throughput workloads.
Model version pinning behavior also changed — deployments on auto-update will now migrate to new model minor versions on a defined schedule. If your applications are sensitive to model behavior changes, switch affected deployments to pinned version mode.
Copilot CLI Capabilities
The Azure Copilot CLI (natural language interface to Azure CLI) expanded its capability set with support for more complex infrastructure queries and remediation suggestions. The practically useful addition: Copilot CLI can now generate Bicep templates from natural language descriptions of desired Azure infrastructure state. Output quality varies by scenario — treat generated Bicep as a starting point for review, not production-ready code.
Priority Actions
- Immediate: Audit and migrate Account SAS token usage — security risk is active, not theoretical
- This sprint: Test WAF DRS 2.1 in Detection mode before upgrading Prevention-mode deployments
- This quarter: Review AKS add-on inventory for deprecated add-ons and plan migrations
- Evaluate: Azure OpenAI PTU tier options against current pay-as-you-go consumption costs
