Azure Containers built-in role
Azure Arc Kubernetes Cluster Admin
Azure Arc Kubernetes Cluster Admin grants read and write access to all Kubernetes resources within the assigned Arc-enabled Kubernetes namespace or cluster. The effective workload authority is expressed as Kubernetes API DataActions under the Microsoft.Kubernetes connected-cluster resource provider. It also writes ARM deployments, manages classic alert rules, and creates or updates Azure support tickets at the assigned scope; those control-plane capabilities are separate from its Kubernetes DataActions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 8393591c-06b9-48a2-a542-1bd6b377f6a2
Control-plane actions (7)
Microsoft.Authorization/*/readMicrosoft.Insights/alertRules/*Microsoft.Resources/deployments/writeMicrosoft.Resources/subscriptions/operationresults/readMicrosoft.Resources/subscriptions/readMicrosoft.Resources/subscriptions/resourceGroups/readMicrosoft.Support/*
Data-plane actions (1)
Microsoft.Kubernetes/connectedClusters/*
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign at the Kubernetes namespace sub-scope for full control within one namespace, or on the Arc-enabled Kubernetes cluster only when full control across the cluster is required. An Azure assignment inherited from a parent scope can extend that authority to every matching cluster below it.
Common use cases (1)
- Let a tightly controlled administrator manage all Kubernetes resources within an assigned Arc-connected namespace or cluster.
Prerequisites (1)
- The the Arc-enabled Kubernetes cluster must use the documented Microsoft Entra and Azure RBAC integration for Kubernetes authorization.
Best practices (2)
- Use eligible or time-bound access where available, require an operational justification, and remove standing cluster-admin assignments.
- Audit Kubernetes API activity and review the ServiceAccounts, Secrets, and authorization objects reachable within the assigned scope.
Security considerations (3)
- Cluster-admin DataActions grant complete Kubernetes API control within the assigned namespace or cluster, including Secrets, service accounts, and authorization objects in that scope.
- An Azure role assignment at a parent scope is inherited by child cluster resources; Kubernetes namespace semantics do not prevent a broad Azure assignment from reaching multiple clusters.
- The accompanying deployment write, classic-alert management, and support-ticket Actions can change Azure resources outside the Kubernetes data plane at the inherited assignment scope.
Assignment guidance
Assign Azure Arc Kubernetes Cluster Admin at the narrowest documented namespace or cluster scope to the principal that needs read and write access to all Kubernetes resources. Test access with the intended identity and avoid using this role as a substitute for Azure control-plane cluster administration.
Common questions
When should I assign the Azure Arc Kubernetes Cluster Admin Azure role?
Assign Azure Arc Kubernetes Cluster Admin when you need to: Let a tightly controlled administrator manage all Kubernetes resources within an assigned Arc-connected namespace or cluster.. Practical scope: Assign at the Kubernetes namespace sub-scope for full control within one namespace, or on the Arc-enabled Kubernetes cluster only when full control across the cluster is required. An Azure assignment inherited from a parent scope can extend that authority to every matching cluster below it.
What permissions does the Azure Arc Kubernetes Cluster Admin Azure role grant?
The role definition grants 8 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Insights/alertRules/*; Microsoft.Resources/deployments/write; Microsoft.Resources/subscriptions/operationresults/read; Microsoft.Resources/subscriptions/read; and Microsoft.Resources/subscriptions/resourceGroups/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Arc Kubernetes Cluster Admin Azure role?
Key considerations when assigning Azure Arc Kubernetes Cluster Admin: Cluster-admin DataActions grant complete Kubernetes API control within the assigned namespace or cluster, including Secrets, service accounts, and authorization objects in that scope.; An Azure role assignment at a parent scope is inherited by child cluster resources; Kubernetes namespace semantics do not prevent a broad Azure assignment from reaching multiple clusters.; and The accompanying deployment write, classic-alert management, and support-ticket Actions can change Azure resources outside the Kubernetes data plane at the inherited assignment scope.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Use Azure RBAC on Azure Arc-enabled Kubernetes clusters →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.