Will nodes with Azure Network Policy Manager die on September 30?

Nope - AFAIK, your servers and AKS clusters will not be suddenly shut down or deleted on September 30, 2026. However, entering the post-retirement phase without migrating introduces specific operational and security constraints that you should prepare for.

After the target date, your existing Windows nodes and container workloads will continue running and routing traffic. Microsoft does not pull the plug on active computing infrastructure simply because Azure NPM has been retired. Your existing Azure NPM configuration can continue to function, but Azure NPM itself becomes a frozen legacy component.

The main concern is loss of support. If a future update to Kubernetes, a Windows node image, or the underlying Azure infrastructure causes the NPM functionality to stop working, Microsoft would no longer troubleshoot or patch the retired NPM component. The environment may continue operating, but you would be operating with an unsupported networking component.

Deployment compatibility is another concern. After the retirement date, you may encounter restrictions when scaling node pools, upgrading your Kubernetes cluster version, or creating new clusters that depend on the legacy network configuration. This is particularly important if you expect to add capacity or perform AKS upgrades after September 30.

The security risk is that Microsoft will no longer provide security updates for Azure NPM on Windows after retirement. If a vulnerability is subsequently discovered in the retired NPM component, an existing cluster that continues using it may remain exposed because there will be no new NPM security patches.

There can also be compliance implications. Whether continued use of a retired component constitutes a compliance violation depends on the specific regulatory requirements and your organization's policies. An unsupported component can, however, create an audit finding if your security or compliance controls require supported software or timely security updates. It should not be assumed that retirement automatically causes an "instant" regulatory violation.

If you cannot complete a full migration to Project Calico or node-level NSGs by the end of September, one way to reduce operational risk is to minimize changes around the retirement date. Avoid scheduling AKS control-plane upgrades or Windows node-image updates immediately around September 30 if they are not necessary. Keeping the environment stable can reduce the chance of introducing a compatibility issue while you complete the migration.

If you anticipate traffic increases or require additional Windows-node capacity in October, you can also consider scaling the Windows node pools before September 30 while the existing deployment configuration is still supported. This does not eliminate the need to migrate, but it can provide additional capacity while you transition away from Azure NPM.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin