Status: OUT
Both container (AKS) and PaaS (App Service) compute substrates achieve equivalent defense-in-depth through the same underlying Azure platform stack — identity-driven secret injection, private-endpoint network isolation, and orthogonal governance enforcement — making workload security posture independent of compute substrate choice.