Why start with a map
Azure offers about half a dozen ways to run a container. They overlap, and several of them have been renamed at least once. If you ask "where should this run?" before you know the whole set, you end up choosing whatever the last blog post recommended. So this level builds one page you can pin above your desk. It lists every service, the job it does, its old names and how to check whether something is retiring.
Think of it like the floor plan of a building you're about to work in. You don't need to know every room in detail yet. You need to know which door leads where.
The one-page map
| Category | Service | The job in one sentence | Azure resource type |
|---|---|---|---|
| Kubernetes | AKS Standard | Managed Kubernetes: Azure runs the control plane, and you design and operate the nodes, add-ons and upgrades. | Microsoft.ContainerService/managedClusters |
| Kubernetes | AKS Automatic | The same AKS resource, but with node management, scaling, security and networking preset to Microsoft's recommended defaults. It became generally available in September 2025. | Microsoft.ContainerService/managedClusters |
| Kubernetes (multi-cluster) | Azure Kubernetes Fleet Manager | Groups many AKS clusters so you can roll out updates and workloads across them together. | Microsoft.ContainerService/fleets |
| Serverless containers | Azure Container Apps | Runs apps and jobs without exposing Kubernetes, scales on events and can scale to zero. | Microsoft.App/containerApps |
| Single containers | Azure Container Instances (ACI) | Starts one container group on demand and bills per second. There is no cluster and no orchestration. | Microsoft.ContainerInstance/containerGroups |
| PaaS web hosting | App Service (custom containers) | Hosts a containerised web app or API using App Service plans, deployment slots and built-in authentication. | Microsoft.Web/sites |
| Enterprise Kubernetes | Azure Red Hat OpenShift (ARO) | Fully managed OpenShift clusters, run jointly by Microsoft and Red Hat. | Microsoft.RedHatOpenShift/openShiftClusters |
| Registry | Azure Container Registry (ACR) | A private registry for images and other OCI artifacts that every service above can pull from. | Microsoft.ContainerRegistry/registries |
| Hybrid | Azure Arc-enabled Kubernetes | Connects a Kubernetes cluster running anywhere (on-premises, at the edge or in another cloud) to Azure so you can manage and govern it. | Microsoft.Kubernetes/connectedClusters |
| Security | Microsoft Defender for Containers | A Defender for Cloud plan that hardens clusters, scans images for vulnerabilities and detects runtime threats. | Plan setting on the subscription |
Gotcha: AKS Standard and AKS Automatic have the same resource type. If you count clusters by type, you won't see which mode each one uses. You have to look at the cluster's SKU. Later levels show how.
Walkthrough: what is already running in your subscriptions?
Before choosing anything, find out what you already have. Azure Resource Graph can search every subscription you can read in a single query:
# One-time: add the Resource Graph extension to the Azure CLI
az extension add --name resource-graph
# Count container-related resources by type across all subscriptions you can read
az graph query -q "
resources
| where type in~ (
'microsoft.containerservice/managedclusters',
'microsoft.containerservice/fleets',
'microsoft.app/containerapps',
'microsoft.app/jobs',
'microsoft.containerinstance/containergroups',
'microsoft.redhatopenshift/openshiftclusters',
'microsoft.containerregistry/registries',
'microsoft.kubernetes/connectedclusters')
| summarize count() by type" -o table
The output looks like this:
Type Count_
------------------------------------------- ------
microsoft.containerservice/managedclusters 4
microsoft.app/containerapps 17
microsoft.containerinstance/containergroups 9
microsoft.containerregistry/registries 3
App Service is missing on purpose. Microsoft.Web/sites also covers code-based web apps and Function apps, so to find containerised ones you need to filter on the site's kind (which contains container) rather than on the type alone.
Former names: don't let old docs mislead you
Old runbooks, Stack Overflow answers and Terraform modules often use names that no longer exist. Here is how to translate them:
| You read… | It now means… |
|---|---|
| Azure Container Service (ACS) | A different, older product, not AKS. ACS was retired on 31 January 2020. From that date its APIs were blocked, so you could no longer create, update or scale clusters. AKS replaced it. |
az acs … commands |
Dead. Use az aks …. |
| Web App for Containers | Still the name for App Service running a custom container (the Azure DevOps task is still called AzureWebAppContainer). |
| Azure Security Center / Azure Defender | Renamed Microsoft Defender for Cloud at Ignite 2021. |
| Defender for Kubernetes + Defender for container registries | Merged into the single Defender for Containers plan. The two old plans are deprecated. |
| Container Apps "Consumption only" environment | The older environment type. New environments default to workload profiles, which include a built-in Consumption profile. |
Terraform azurerm_app_service |
Deprecated. Use azurerm_linux_web_app / azurerm_windows_web_app. |
Best practice: when you inherit infrastructure as code, search it for
acs,app_serviceandSecurity Centerfirst. These strings usually mean the code is old and needs review before you trust its defaults.
Checking what is retiring, and writing down when you checked
Retirements happen all the time. Two examples close to this course:
- Azure Spring Apps entered a three-year retirement period on 17 March 2025 and retires on 31 March 2028. Microsoft points its users to Container Apps.
- App Service on Azure Arc-enabled Kubernetes began retiring on 30 September 2025.
Use three sources, in this order:
- Azure updates (
azure.microsoft.com/updates). Filter by product (for example Azure Kubernetes Service) and set Update type to Retirements. If you want to follow it from a feed reader or chat channel, there is an RSS feed athttps://www.microsoft.com/releasecommunications/api/v2/azure/rss. - Azure Advisor → Workbooks → Service Retirement workbook. This shows which of your resources are affected by a retirement. You can export the results to share with your team.
- The service's own docs. Retirement pages such as "Azure Spring Apps retirement announcement" give the migration path.
Record every check in a form like this:
# retirement-check.yaml: keep this next to your selection record
service: Azure Container Apps
feature: consumption-only environment
source: https://azure.microsoft.com/updates (filter: Retirements)
checked_on: 2026-10-29 # always write the date you looked
finding: no retirement announced; new environments default to workload profiles
next_check: 2027-01-29 # quarterly is a sensible rhythm
Trade-off: the Advisor workbook only covers some services (Microsoft has said it covers about 40), and it only reports on resources you already have. Use it to see your exposure, but rely on Azure updates to see the full picture.
Key takeaways
- Azure's container services fall into eight categories: Kubernetes (AKS Standard and Automatic, plus Fleet Manager), serverless (Container Apps), single containers (ACI), PaaS (App Service), OpenShift (ARO), registry (ACR), hybrid (Arc) and security (Defender for Containers).
- AKS Automatic is not a separate resource type. It's an AKS mode with preset defaults, and it has been generally available since September 2025.
- Azure Container Service (ACS) is not AKS. It was retired on 31 January 2020.
- Defender for Containers replaced Defender for Kubernetes and Defender for container registries. Security Center is now Defender for Cloud.
- To check for retirements, filter Azure updates for Retirements, use the Advisor Service Retirement workbook to find affected resources, and record the date you checked.