diff --git a/pkg/proto/aksnodeconfig/v1/tlsbootstrappingconfig.pb.go b/pkg/proto/aksnodeconfig/v1/tlsbootstrappingconfig.pb.go
index e520e3c56e3..ba6acb4b9c5 100644
--- a/pkg/proto/aksnodeconfig/v1/tlsbootstrappingconfig.pb.go
+++ b/pkg/proto/aksnodeconfig/v1/tlsbootstrappingconfig.pb.go
@@ -142,11 +142,11 @@ type TLSBootstrappingConfig struct {
 	// how the node should join and communicate with the API server after authentication
 	ClusterJoinMethod ClusterJoinMethod `protobuf:"varint,2,opt,name=cluster_join_method,json=clusterJoinMethod,proto3,enum=aksnodeconfig.v1.ClusterJoinMethod" json:"cluster_join_method,omitempty"`
 	// Only required until Secure TLS bootstrapping in place. Would use kubelet identity after that.
-	TlsBootstrappingToken string `protobuf:"bytes,3,opt,name=tls_bootstrapping_token,json=tlsBootstrappingToken,proto3" json:"tls_bootstrapping_token,omitempty"`
+	TlsBootstrappingToken *string `protobuf:"bytes,3,opt,name=tls_bootstrapping_token,json=tlsBootstrappingToken,proto3,oneof" json:"tls_bootstrapping_token,omitempty"`
 	// Only used when secure TLS bootstrapping is enabled or one of the Azure/Arc methods. This is the appserver appid that the node will use to bootstrap.
-	CustomAadResource string `protobuf:"bytes,4,opt,name=custom_aad_resource,json=customAadResource,proto3" json:"custom_aad_resource,omitempty"`
+	CustomAadResource *string `protobuf:"bytes,4,opt,name=custom_aad_resource,json=customAadResource,proto3,oneof" json:"custom_aad_resource,omitempty"`
 	// Only used when one of the Azure/Arc methods is enabled. This is the client ID of the MSI that the node will use to bootstrap.
-	CustomAadClientId string `protobuf:"bytes,5,opt,name=custom_aad_client_id,json=customAadClientId,proto3" json:"custom_aad_client_id,omitempty"`
+	CustomAadClientId *string `protobuf:"bytes,5,opt,name=custom_aad_client_id,json=customAadClientId,proto3,oneof" json:"custom_aad_client_id,omitempty"`
 }
 
 func (x *TLSBootstrappingConfig) Reset() {
@@ -194,22 +194,22 @@ func (x *TLSBootstrappingConfig) GetClusterJoinMethod() ClusterJoinMethod {
 }
 
 func (x *TLSBootstrappingConfig) GetTlsBootstrappingToken() string {
-	if x != nil {
-		return x.TlsBootstrappingToken
+	if x != nil && x.TlsBootstrappingToken != nil {
+		return *x.TlsBootstrappingToken
 	}
 	return ""
 }
 
 func (x *TLSBootstrappingConfig) GetCustomAadResource() string {
-	if x != nil {
-		return x.CustomAadResource
+	if x != nil && x.CustomAadResource != nil {
+		return *x.CustomAadResource
 	}
 	return ""
 }
 
 func (x *TLSBootstrappingConfig) GetCustomAadClientId() string {
-	if x != nil {
-		return x.CustomAadClientId
+	if x != nil && x.CustomAadClientId != nil {
+		return *x.CustomAadClientId
 	}
 	return ""
 }
@@ -221,7 +221,7 @@ var file_pkg_proto_aksnodeconfig_v1_tlsbootstrappingconfig_proto_rawDesc = []byt
 	0x6f, 0x64, 0x65, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2f, 0x76, 0x31, 0x2f, 0x74, 0x6c, 0x73,
 	0x62, 0x6f, 0x6f, 0x74, 0x73, 0x74, 0x72, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x63, 0x6f, 0x6e,
 	0x66, 0x69, 0x67, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x10, 0x61, 0x6b, 0x73, 0x6e, 0x6f,
-	0x64, 0x65, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x76, 0x31, 0x22, 0xed, 0x02, 0x0a, 0x16,
+	0x64, 0x65, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x76, 0x31, 0x22, 0xc9, 0x03, 0x0a, 0x16,
 	0x54, 0x4c, 0x53, 0x42, 0x6f, 0x6f, 0x74, 0x73, 0x74, 0x72, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67,
 	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x65, 0x0a, 0x19, 0x62, 0x6f, 0x6f, 0x74, 0x73, 0x74,
 	0x72, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6d, 0x65, 0x74,
@@ -235,41 +235,47 @@ var file_pkg_proto_aksnodeconfig_v1_tlsbootstrappingconfig_proto_rawDesc = []byt
 	0x6e, 0x6f, 0x64, 0x65, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x6c,
 	0x75, 0x73, 0x74, 0x65, 0x72, 0x4a, 0x6f, 0x69, 0x6e, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x52,
 	0x11, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x4a, 0x6f, 0x69, 0x6e, 0x4d, 0x65, 0x74, 0x68,
-	0x6f, 0x64, 0x12, 0x36, 0x0a, 0x17, 0x74, 0x6c, 0x73, 0x5f, 0x62, 0x6f, 0x6f, 0x74, 0x73, 0x74,
+	0x6f, 0x64, 0x12, 0x3b, 0x0a, 0x17, 0x74, 0x6c, 0x73, 0x5f, 0x62, 0x6f, 0x6f, 0x74, 0x73, 0x74,
 	0x72, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x03, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x15, 0x74, 0x6c, 0x73, 0x42, 0x6f, 0x6f, 0x74, 0x73, 0x74, 0x72, 0x61,
-	0x70, 0x70, 0x69, 0x6e, 0x67, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x2e, 0x0a, 0x13, 0x63, 0x75,
-	0x73, 0x74, 0x6f, 0x6d, 0x5f, 0x61, 0x61, 0x64, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x11, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x41,
-	0x61, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x2f, 0x0a, 0x14, 0x63, 0x75,
-	0x73, 0x74, 0x6f, 0x6d, 0x5f, 0x61, 0x61, 0x64, 0x5f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f,
-	0x69, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x11, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d,
-	0x41, 0x61, 0x64, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x49, 0x64, 0x2a, 0x66, 0x0a, 0x17, 0x42,
-	0x6f, 0x6f, 0x74, 0x73, 0x74, 0x72, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x41, 0x75, 0x74, 0x68,
-	0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12, 0x15, 0x0a, 0x11, 0x54, 0x6c, 0x73, 0x42, 0x6f, 0x6f,
-	0x74, 0x73, 0x74, 0x72, 0x61, 0x70, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x10, 0x00, 0x12, 0x1a, 0x0a,
-	0x16, 0x53, 0x65, 0x63, 0x75, 0x72, 0x65, 0x54, 0x6c, 0x73, 0x42, 0x6f, 0x6f, 0x74, 0x73, 0x74,
-	0x72, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x10, 0x01, 0x12, 0x0a, 0x0a, 0x06, 0x41, 0x72, 0x63,
-	0x4d, 0x73, 0x69, 0x10, 0x02, 0x12, 0x0c, 0x0a, 0x08, 0x41, 0x7a, 0x75, 0x72, 0x65, 0x4d, 0x73,
-	0x69, 0x10, 0x03, 0x2a, 0x3e, 0x0a, 0x11, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x4a, 0x6f,
-	0x69, 0x6e, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12, 0x0f, 0x0a, 0x0b, 0x47, 0x65, 0x6e, 0x65,
-	0x72, 0x61, 0x74, 0x65, 0x43, 0x73, 0x72, 0x10, 0x00, 0x12, 0x18, 0x0a, 0x14, 0x55, 0x73, 0x65,
-	0x42, 0x6f, 0x6f, 0x74, 0x73, 0x74, 0x72, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x41, 0x75, 0x74,
-	0x68, 0x10, 0x01, 0x42, 0xdc, 0x01, 0x0a, 0x14, 0x63, 0x6f, 0x6d, 0x2e, 0x61, 0x6b, 0x73, 0x6e,
-	0x6f, 0x64, 0x65, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x76, 0x31, 0x42, 0x1b, 0x54, 0x6c,
-	0x73, 0x62, 0x6f, 0x6f, 0x74, 0x73, 0x74, 0x72, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x63, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x46, 0x67, 0x69, 0x74,
-	0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x41, 0x7a, 0x75, 0x72, 0x65, 0x2f, 0x41, 0x67,
-	0x65, 0x6e, 0x74, 0x42, 0x61, 0x6b, 0x65, 0x72, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x2f, 0x61, 0x6b, 0x73, 0x6e, 0x6f, 0x64, 0x65, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x2f, 0x76, 0x31, 0x3b, 0x61, 0x6b, 0x73, 0x6e, 0x6f, 0x64, 0x65, 0x63, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x76, 0x31, 0xa2, 0x02, 0x03, 0x41, 0x58, 0x58, 0xaa, 0x02, 0x10, 0x41, 0x6b, 0x73, 0x6e,
-	0x6f, 0x64, 0x65, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x56, 0x31, 0xca, 0x02, 0x10, 0x41,
-	0x6b, 0x73, 0x6e, 0x6f, 0x64, 0x65, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x5c, 0x56, 0x31, 0xe2,
-	0x02, 0x1c, 0x41, 0x6b, 0x73, 0x6e, 0x6f, 0x64, 0x65, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x5c,
-	0x56, 0x31, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02,
-	0x11, 0x41, 0x6b, 0x73, 0x6e, 0x6f, 0x64, 0x65, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x3a, 0x3a,
-	0x56, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x15, 0x74, 0x6c, 0x73, 0x42, 0x6f, 0x6f, 0x74, 0x73, 0x74,
+	0x72, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x88, 0x01, 0x01, 0x12,
+	0x33, 0x0a, 0x13, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5f, 0x61, 0x61, 0x64, 0x5f, 0x72, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x48, 0x01, 0x52, 0x11,
+	0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x41, 0x61, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x88, 0x01, 0x01, 0x12, 0x34, 0x0a, 0x14, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5f, 0x61,
+	0x61, 0x64, 0x5f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x05, 0x20, 0x01,
+	0x28, 0x09, 0x48, 0x02, 0x52, 0x11, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x41, 0x61, 0x64, 0x43,
+	0x6c, 0x69, 0x65, 0x6e, 0x74, 0x49, 0x64, 0x88, 0x01, 0x01, 0x42, 0x1a, 0x0a, 0x18, 0x5f, 0x74,
+	0x6c, 0x73, 0x5f, 0x62, 0x6f, 0x6f, 0x74, 0x73, 0x74, 0x72, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67,
+	0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x42, 0x16, 0x0a, 0x14, 0x5f, 0x63, 0x75, 0x73, 0x74, 0x6f,
+	0x6d, 0x5f, 0x61, 0x61, 0x64, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x42, 0x17,
+	0x0a, 0x15, 0x5f, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5f, 0x61, 0x61, 0x64, 0x5f, 0x63, 0x6c,
+	0x69, 0x65, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x2a, 0x66, 0x0a, 0x17, 0x42, 0x6f, 0x6f, 0x74, 0x73,
+	0x74, 0x72, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x41, 0x75, 0x74, 0x68, 0x4d, 0x65, 0x74, 0x68,
+	0x6f, 0x64, 0x12, 0x15, 0x0a, 0x11, 0x54, 0x6c, 0x73, 0x42, 0x6f, 0x6f, 0x74, 0x73, 0x74, 0x72,
+	0x61, 0x70, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x10, 0x00, 0x12, 0x1a, 0x0a, 0x16, 0x53, 0x65, 0x63,
+	0x75, 0x72, 0x65, 0x54, 0x6c, 0x73, 0x42, 0x6f, 0x6f, 0x74, 0x73, 0x74, 0x72, 0x61, 0x70, 0x70,
+	0x69, 0x6e, 0x67, 0x10, 0x01, 0x12, 0x0a, 0x0a, 0x06, 0x41, 0x72, 0x63, 0x4d, 0x73, 0x69, 0x10,
+	0x02, 0x12, 0x0c, 0x0a, 0x08, 0x41, 0x7a, 0x75, 0x72, 0x65, 0x4d, 0x73, 0x69, 0x10, 0x03, 0x2a,
+	0x3e, 0x0a, 0x11, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x4a, 0x6f, 0x69, 0x6e, 0x4d, 0x65,
+	0x74, 0x68, 0x6f, 0x64, 0x12, 0x0f, 0x0a, 0x0b, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x65,
+	0x43, 0x73, 0x72, 0x10, 0x00, 0x12, 0x18, 0x0a, 0x14, 0x55, 0x73, 0x65, 0x42, 0x6f, 0x6f, 0x74,
+	0x73, 0x74, 0x72, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x41, 0x75, 0x74, 0x68, 0x10, 0x01, 0x42,
+	0xdc, 0x01, 0x0a, 0x14, 0x63, 0x6f, 0x6d, 0x2e, 0x61, 0x6b, 0x73, 0x6e, 0x6f, 0x64, 0x65, 0x63,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x76, 0x31, 0x42, 0x1b, 0x54, 0x6c, 0x73, 0x62, 0x6f, 0x6f,
+	0x74, 0x73, 0x74, 0x72, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x46, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e,
+	0x63, 0x6f, 0x6d, 0x2f, 0x41, 0x7a, 0x75, 0x72, 0x65, 0x2f, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x42,
+	0x61, 0x6b, 0x65, 0x72, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x61,
+	0x6b, 0x73, 0x6e, 0x6f, 0x64, 0x65, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2f, 0x76, 0x31, 0x3b,
+	0x61, 0x6b, 0x73, 0x6e, 0x6f, 0x64, 0x65, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x76, 0x31, 0xa2,
+	0x02, 0x03, 0x41, 0x58, 0x58, 0xaa, 0x02, 0x10, 0x41, 0x6b, 0x73, 0x6e, 0x6f, 0x64, 0x65, 0x63,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x56, 0x31, 0xca, 0x02, 0x10, 0x41, 0x6b, 0x73, 0x6e, 0x6f,
+	0x64, 0x65, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x5c, 0x56, 0x31, 0xe2, 0x02, 0x1c, 0x41, 0x6b,
+	0x73, 0x6e, 0x6f, 0x64, 0x65, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x5c, 0x56, 0x31, 0x5c, 0x47,
+	0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x11, 0x41, 0x6b, 0x73,
+	0x6e, 0x6f, 0x64, 0x65, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x3a, 0x3a, 0x56, 0x31, 0x62, 0x06,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -306,6 +312,7 @@ func file_pkg_proto_aksnodeconfig_v1_tlsbootstrappingconfig_proto_init() {
 	if File_pkg_proto_aksnodeconfig_v1_tlsbootstrappingconfig_proto != nil {
 		return
 	}
+	file_pkg_proto_aksnodeconfig_v1_tlsbootstrappingconfig_proto_msgTypes[0].OneofWrappers = []any{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
diff --git a/pkg/proto/aksnodeconfig/v1/tlsbootstrappingconfig.proto b/pkg/proto/aksnodeconfig/v1/tlsbootstrappingconfig.proto
index b2cf58ff90d..cb05b05635d 100644
--- a/pkg/proto/aksnodeconfig/v1/tlsbootstrappingconfig.proto
+++ b/pkg/proto/aksnodeconfig/v1/tlsbootstrappingconfig.proto
@@ -34,11 +34,11 @@ message TLSBootstrappingConfig {
   ClusterJoinMethod cluster_join_method = 2;
 
   // Only required until Secure TLS bootstrapping in place. Would use kubelet identity after that.
-  string tls_bootstrapping_token = 3;
+  optional string tls_bootstrapping_token = 3;
 
   // Only used when secure TLS bootstrapping is enabled or one of the Azure/Arc methods. This is the appserver appid that the node will use to bootstrap.
-  string custom_aad_resource = 4;
+  optional string custom_aad_resource = 4;
 
   // Only used when one of the Azure/Arc methods is enabled. This is the client ID of the MSI that the node will use to bootstrap.
-  string custom_aad_client_id = 5;
+  optional string custom_aad_client_id = 5;
 }
\ No newline at end of file