Azure Containers built-in role

Azure Arc Kubernetes Admin

Azure Arc Kubernetes Admin grants administrative access to most Kubernetes objects, including roles and role bindings, while excluding namespace and ResourceQuota writes on the Arc-enabled Kubernetes cluster. The effective workload authority is expressed as Kubernetes API DataActions under the Microsoft.Kubernetes connected-cluster resource provider. It also writes ARM deployments, manages classic alert rules, and creates or updates Azure support tickets at the assigned scope; those control-plane capabilities are separate from its Kubernetes DataActions.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: dffb1e0c-446f-4dde-a09f-99eb5cc68b96

Control-plane actions (7)

Data-plane actions (33)

Excluded actions (0)

None

Assignable scopes (1)

Practical scope

Assign at the Kubernetes namespace sub-scope whenever the workflow is namespace-bound. Assigning at the the Arc-enabled Kubernetes cluster resource or an inherited parent Azure scope applies the Kubernetes API DataActions across all namespaces available through each inherited cluster.

Common use cases (1)

Prerequisites (1)

Best practices (2)

Security considerations (3)

Assignment guidance

Assign Azure Arc Kubernetes Admin at the narrowest documented namespace scope to the principal that needs administrative access to most Kubernetes objects, including roles and role bindings, while excluding namespace and ResourceQuota writes. Test access with the intended identity and avoid using this role as a substitute for Azure control-plane cluster administration.

Common questions

When should I assign the Azure Arc Kubernetes Admin Azure role?

Assign Azure Arc Kubernetes Admin when you need to: Let a namespace administrator manage workloads and namespace-local authorization in an Arc-connected namespace without changing the namespace object or ResourceQuota.. Practical scope: Assign at the Kubernetes namespace sub-scope whenever the workflow is namespace-bound. Assigning at the the Arc-enabled Kubernetes cluster resource or an inherited parent Azure scope applies the Kubernetes API DataActions across all namespaces available through each inherited cluster.

What permissions does the Azure Arc Kubernetes Admin Azure role grant?

The role definition grants 40 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Insights/alertRules/*; Microsoft.Resources/deployments/write; Microsoft.Resources/subscriptions/operationresults/read; Microsoft.Resources/subscriptions/read; and Microsoft.Resources/subscriptions/resourceGroups/read. Review the permission sections above for the complete definition and exclusions.

What are the security risks of the Azure Arc Kubernetes Admin Azure role?

Key considerations when assigning Azure Arc Kubernetes Admin: The role can create roles and role bindings in scope, read Secrets, and run pods under ServiceAccounts, enabling delegation or escalation within the assigned namespace boundary.; An Azure role assignment at a parent scope is inherited by child cluster resources; Kubernetes namespace semantics do not prevent a broad Azure assignment from reaching multiple clusters.; and The accompanying deployment write, classic-alert management, and support-ticket Actions can change Azure resources outside the Kubernetes data plane at the inherited assignment scope.. Follow the assignment guidance above and use the narrowest practical scope.

Editorial sources (6)

Official Microsoft Learn documentation →