Azure Containers built-in role
Connected Cluster Managed Identity CheckAccess Reader
Allows an Arc connected-cluster managed identity to read Azure authorization information so the Azure RBAC integration can call the access-check path. It is a service identity role with control-plane read Actions and no Kubernetes DataActions or human cluster workflow.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 65a14201-8f6c-4c28-bec4-12619c5a9aaa
Control-plane actions (1)
Microsoft.Authorization/*/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Microsoft documents assigning the role to the connected cluster managed identity at that cluster ARM resource ID. A broader assignment would expose authorization metadata for unrelated child resources and is unnecessary for the documented setup.
Common use cases (1)
- Enable the connected cluster managed identity to support Azure RBAC authorization checks for its own Arc-enabled Kubernetes cluster.
Prerequisites (2)
- The Kubernetes cluster must already be connected to Azure Arc and expose its managed identity principal ID.
- The administrator must be enabling the documented Azure RBAC feature on that connected cluster.
Best practices (2)
- Assign only to the connected cluster managed identity on its own cluster ARM resource, not to human users or general automation.
- Let the supported Azure Arc enablement workflow manage the assignment and remove it if Azure RBAC is permanently disabled and Microsoft guidance no longer requires it.
Security considerations (2)
- The role reads role and role-assignment metadata but grants no Kubernetes API DataActions and no permission to create or delete role assignments.
- Assigning it at a parent scope unnecessarily expands authorization-metadata visibility.
Assignment guidance
Assign Connected Cluster Managed Identity CheckAccess Reader to the Arc connected-cluster managed identity at the exact connected-cluster ARM resource when enabling Azure RBAC. Do not assign it to people and do not broaden the scope.
Common questions
When should I assign the Connected Cluster Managed Identity CheckAccess Reader Azure role?
Assign Connected Cluster Managed Identity CheckAccess Reader when you need to: Enable the connected cluster managed identity to support Azure RBAC authorization checks for its own Arc-enabled Kubernetes cluster.. Practical scope: Microsoft documents assigning the role to the connected cluster managed identity at that cluster ARM resource ID. A broader assignment would expose authorization metadata for unrelated child resources and is unnecessary for the documented setup.
What permissions does the Connected Cluster Managed Identity CheckAccess Reader Azure role grant?
The role definition grants 1 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Connected Cluster Managed Identity CheckAccess Reader Azure role?
Key considerations when assigning Connected Cluster Managed Identity CheckAccess Reader: The role reads role and role-assignment metadata but grants no Kubernetes API DataActions and no permission to create or delete role assignments.; and Assigning it at a parent scope unnecessarily expands authorization-metadata visibility.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Use Azure RBAC on Azure Arc-enabled Kubernetes clusters →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.