Moving AKS Workloads from AAD Pod Identity to Entra Workload ID

Azure Kubernetes Service clusters that still authenticate through the deprecated AAD Pod Identity system need to migrate to Entra Workload ID, which uses OIDC federation. The old setup relies on AzureIdentity and AzureIdentityBinding resources plus Node Managed Identity pods, which add CPU overhead and security exposure. The guidance stresses first inventorying existing bindings to learn each workload's real access needs, then mapping each one to a federated Kubernetes service account. Entra ID matches the federated subject string exactly, and a missing pod label stops the webhook from injecting credentials, so both must be verified. The recommended approach is a staged migration with token exchange tested beforehand, followed by deleting the old resources and confirming through Azure Activity Logs that only the new identity makes the calls.