OS
Microsoft Azure
Microsoft is retiring Azure Linux with OS Guard (preview) as a node pool operating system in Azure Kubernetes Service (AKS). Support ends December 10, 2026, after which no new Azure Linux with OS Guard node pools can be created and existing pools stop receiving node images and security patches; on March 10, 2027 AKS removes the node images entirely. Azure Container Linux is the named replacement.
departs 10 Dec 2026
Quick answers
- Is it true that Azure Linux with OS Guard in Azure Kubernetes Service (AKS) is retiring on December 10, 2026?
- Yes. Microsoft Azure has officially announced it, effective 10 Dec 2026. Azure Linux with OS Guard is a hardened, preview node pool OS option for Azure Kubernetes Service (AKS).
- When does it take effect?
- 10 Dec 2026. Verified against the vendor's own announcement.
- What should I use instead?
- Microsoft names Azure Container Linux as the replacement and points to a migration tutorial for moving affected node pools.
What this means for you
Azure Linux with OS Guard is a hardened, preview node pool OS option for Azure Kubernetes Service (AKS). Microsoft is winding it down in two steps. Starting December 10, 2026: you will no longer be able to create new Azure Linux with OS Guard (preview) node pools; AKS will stop producing new node images for affected pools; and existing pools will no longer receive security patches — so any cluster still running these node pools becomes progressively less secure the longer it stays on them. Then on March 10, 2027, AKS removes the Azure Linux with OS Guard node images altogether, and after that point any scaling or remediation operation on an affected node pool — including reimage and redeploy — will fail. In practice that means an unmigrated node pool can be left unable to scale up, self-heal, or recover nodes. Because this is a preview OS SKU, the blast radius is teams who opted into Azure Linux with OS Guard specifically (often for its confidential/hardened posture) rather than the default Azure Linux or Ubuntu node pools, which are unaffected by this notice.
Where to go
Microsoft names Azure Container Linux as the replacement and points to a migration tutorial for moving affected node pools. Do it before December 10, 2026 to keep receiving security patches, and well before March 10, 2027 to avoid losing scaling and remediation on the node pools. First, inventory which AKS node pools use Azure Linux with OS Guard (check the node pool OS SKU across your clusters and subscriptions, e.g. via `az aks nodepool list`), since only those pools are affected — default Azure Linux and Ubuntu node pools are not. Then migrate each affected pool to Azure Container Linux following Microsoft's "Migrate to Azure Container Linux" tutorial for AKS. Validate workloads on the new OS in a non-production cluster first, especially anything that depended on OS Guard's hardened image characteristics, then roll the change through production node pools before the December cutoff.
- Azure Container Linux — Microsoft's named replacement for Azure Linux with OS Guard in AKS (migration tutorial provided)
- Standard Azure Linux node pools in AKS — the general-purpose Azure Linux (Mariner-derived) node OS, unaffected by this retirement
- Ubuntu node pools in AKS — the default node OS option, unaffected
Microsoft is retiring Azure Linux with OS Guard as a node pool operating system in Azure Kubernetes Service (AKS). Per the official Azure Updates retirement notice, the feature is in preview, and Azure Container Linux is the replacement.
The timeline
Microsoft describes a two-stage wind-down:
- December 10, 2026 — support ends. You can no longer create new Azure Linux with OS Guard (preview) node pools; AKS stops producing new node images for affected pools; and existing pools stop receiving security patches.
- March 10, 2027 — node images removed. AKS removes the Azure Linux with OS Guard node images. After that, scaling and remediation operations on affected node pools — including reimage and redeploy — will fail.
Who this affects — and who it doesn’t
This is a preview node pool OS SKU, so it affects teams that specifically opted into Azure Linux with OS Guard — typically for its hardened image posture — rather than the defaults. It does not affect standard Azure Linux node pools or Ubuntu node pools, which remain fully supported.
The practical risk is leaving a node pool unmigrated: after December 10, 2026 it stops getting security patches, and after March 10, 2027 it can no longer scale up, self-heal, or recover nodes, because the node images it needs are gone.
What to do
Microsoft points to Azure Container Linux and provides a migration tutorial. Before December 10, 2026:
- Inventory which AKS node pools use Azure Linux with OS Guard across your clusters and subscriptions (check the node pool OS SKU, e.g.
az aks nodepool list). Only those pools are affected. - Migrate each affected pool to Azure Container Linux, following Microsoft’s “Migrate to Azure Container Linux” tutorial for AKS.
- Validate workloads on the new OS in a non-production cluster first — especially anything that relied on OS Guard’s hardened characteristics — then roll the change through production node pools before the December cutoff, and well ahead of the March 2027 image removal.
This entry tracks Microsoft’s official Azure Updates notice; if Microsoft changes the dates or migration guidance, the entry will be updated with a changelog note.
Entry changelog
- — last reviewed.
- — Entry created from Microsoft's official Azure Updates retirement notice (id 571257), verified against the machine-readable Azure release-communications API. Microsoft states support for Azure Linux with OS Guard (preview) in AKS ends December 10, 2026 (no new node pools, no new node images, no security patches), and that node images are removed on March 10, 2027, after which scaling and remediation — including reimage and redeploy — fail for affected pools. Azure Container Linux is named as the replacement. Not machine-detectable in a code repository (an AKS node pool OS SKU set in cluster infrastructure/config, not a package, image tag, or literal that the CLI scans), so no detect fingerprint added.
Put this countdown in your README
Building on Microsoft Azure? Drop this badge into a project’s README or docs — it shows the days left and
refreshes on its own every night from this page. 
[](https://lastcall.dev/entries/azure-linux-os-guard-aks-retirement)Spot an error or a changed date? Tell us and it’s corrected the same night.