Azure Containers built-in role
Azure Arc Kubernetes Writer
Azure Arc Kubernetes Writer grants read and write access to most Kubernetes objects, excluding role and role-binding management on the Arc-enabled Kubernetes cluster. The effective workload authority is expressed as Kubernetes API DataActions under the Microsoft.Kubernetes connected-cluster resource provider. It also writes ARM deployments, manages classic alert rules, and creates or updates Azure support tickets at the assigned scope; those control-plane capabilities are separate from its Kubernetes DataActions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 5b999177-9696-4545-85c7-50de3797e5a1
Control-plane actions (7)
Microsoft.Authorization/*/readMicrosoft.Insights/alertRules/*Microsoft.Resources/deployments/writeMicrosoft.Resources/subscriptions/operationresults/readMicrosoft.Resources/subscriptions/readMicrosoft.Resources/subscriptions/resourceGroups/readMicrosoft.Support/*
Data-plane actions (30)
Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/readMicrosoft.Kubernetes/connectedClusters/apps/daemonsets/*Microsoft.Kubernetes/connectedClusters/apps/deployments/*Microsoft.Kubernetes/connectedClusters/apps/replicasets/*Microsoft.Kubernetes/connectedClusters/apps/statefulsets/*Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/*Microsoft.Kubernetes/connectedClusters/batch/cronjobs/*Microsoft.Kubernetes/connectedClusters/batch/jobs/*Microsoft.Kubernetes/connectedClusters/configmaps/*Microsoft.Kubernetes/connectedClusters/endpoints/*Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/readMicrosoft.Kubernetes/connectedClusters/events/readMicrosoft.Kubernetes/connectedClusters/extensions/daemonsets/*Microsoft.Kubernetes/connectedClusters/extensions/deployments/*Microsoft.Kubernetes/connectedClusters/extensions/ingresses/*Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/*Microsoft.Kubernetes/connectedClusters/extensions/replicasets/*Microsoft.Kubernetes/connectedClusters/limitranges/readMicrosoft.Kubernetes/connectedClusters/namespaces/readMicrosoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/*Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/*Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/*Microsoft.Kubernetes/connectedClusters/pods/*Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/*Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*Microsoft.Kubernetes/connectedClusters/resourcequotas/readMicrosoft.Kubernetes/connectedClusters/secrets/*Microsoft.Kubernetes/connectedClusters/serviceaccounts/*Microsoft.Kubernetes/connectedClusters/services/*
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign at the Kubernetes namespace sub-scope whenever the workflow is namespace-bound. Assigning at the the Arc-enabled Kubernetes cluster resource or an inherited parent Azure scope applies the Kubernetes API DataActions across all namespaces available through each inherited cluster.
Common use cases (1)
- Let an application team deploy and operate workloads in an Arc-connected namespace without directly managing Kubernetes roles or role bindings.
Prerequisites (1)
- The the Arc-enabled Kubernetes cluster must use the documented Microsoft Entra and Azure RBAC integration for Kubernetes authorization.
Best practices (2)
- Create namespace-scoped assignments for application teams and reserve cluster-scope assignments for documented cross-namespace responsibilities.
- Audit Kubernetes API activity and review the ServiceAccounts, Secrets, and authorization objects reachable within the assigned scope.
Security considerations (3)
- The role can read Secrets and run pods as any ServiceAccount in scope, so it can inherit the Kubernetes API permissions of those ServiceAccounts even though it cannot edit role bindings directly.
- An Azure role assignment at a parent scope is inherited by child cluster resources; Kubernetes namespace semantics do not prevent a broad Azure assignment from reaching multiple clusters.
- The accompanying deployment write, classic-alert management, and support-ticket Actions can change Azure resources outside the Kubernetes data plane at the inherited assignment scope.
Assignment guidance
Assign Azure Arc Kubernetes Writer at the narrowest documented namespace scope to the principal that needs read and write access to most Kubernetes objects, excluding role and role-binding management. Test access with the intended identity and avoid using this role as a substitute for Azure control-plane cluster administration.
Editorial sources (6)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Use Azure RBAC on Azure Arc-enabled Kubernetes clusters →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.