diff --git a/hypershift-operator/controllers/hostedcluster/network_policies.go b/hypershift-operator/controllers/hostedcluster/network_policies.go
index 99f681b2d36e..82249c2caee9 100644
--- a/hypershift-operator/controllers/hostedcluster/network_policies.go
+++ b/hypershift-operator/controllers/hostedcluster/network_policies.go
@@ -74,7 +74,8 @@ func (r *HostedClusterReconciler) reconcileNetworkPolicies(ctx context.Context,
 	}
 
 	// ManagementKASNetworkPolicy restricts traffic for pods unless they have a known annotation.
-	if controlPlaneOperatorAppliesManagementKASNetworkPolicyLabel && hcluster.Spec.Platform.Type == hyperv1.AWSPlatform {
+	if controlPlaneOperatorAppliesManagementKASNetworkPolicyLabel &&
+		(hcluster.Spec.Platform.Type == hyperv1.AWSPlatform || hcluster.Spec.Platform.Type == hyperv1.AzurePlatform) {
 		policy = networkpolicy.ManagementKASNetworkPolicy(controlPlaneNamespaceName)
 		if _, err := createOrUpdate(ctx, r.Client, policy, func() error {
 			return reconcileManagementKASNetworkPolicy(policy, managementClusterNetwork, kubernetesEndpoint, r.ManagementClusterCapabilities.Has(capabilities.CapabilityDNS))
diff --git a/test/e2e/util/util.go b/test/e2e/util/util.go
index f8b6ba95210e..8c2468e6531a 100644
--- a/test/e2e/util/util.go
+++ b/test/e2e/util/util.go
@@ -95,6 +95,8 @@ var expectedKasManagementComponents = []string{
 	"cloud-controller-manager",
 	"olm-collect-profiles",
 	"aws-ebs-csi-driver-operator",
+	"azure-disk-csi-driver-operator",
+	"azure-file-csi-driver-operator",
 	"karpenter",
 	"karpenter-operator",
 	"featuregate-generator",
@@ -993,8 +995,8 @@ func EnsureAllRoutesUseHCPRouter(t *testing.T, ctx context.Context, hostClient c
 
 func EnsureNetworkPolicies(t *testing.T, ctx context.Context, c crclient.Client, hostedCluster *hyperv1.HostedCluster) {
 	t.Run("EnsureNetworkPolicies", func(t *testing.T) {
-		if hostedCluster.Spec.Platform.Type != hyperv1.AWSPlatform {
-			t.Skipf("test only supported on AWS platform, saw %s", hostedCluster.Spec.Platform.Type)
+		if hostedCluster.Spec.Platform.Type != hyperv1.AWSPlatform && hostedCluster.Spec.Platform.Type != hyperv1.AzurePlatform {
+			t.Skipf("test only supported on AWS and Azure platforms, saw %s", hostedCluster.Spec.Platform.Type)
 		}
 
 		hcpNamespace := manifests.HostedControlPlaneNamespace(hostedCluster.Namespace, hostedCluster.Name)
@@ -1034,6 +1036,7 @@ func EnsureNetworkPolicies(t *testing.T, ctx context.Context, c crclient.Client,
 			g.Expect(err).To(HaveOccurred())
 
 			// Validate private router is not allowed to access management KAS.
+			// Note: Private router validation only applies to AWS - Azure doesn't have private router config
 			if hostedCluster.Spec.Platform.Type == hyperv1.AWSPlatform {
 				if hostedCluster.Spec.Platform.AWS.EndpointAccess != hyperv1.Private {
 					// TODO (alberto): Run also in private case. Today it results in a flake: