Azure Containers built-in role
Kubernetes Cluster - Azure Arc Onboarding
Creates the Azure Arc connectedClusters resource and related deployment or configuration resources used to onboard an existing Kubernetes cluster. It grants Azure control-plane onboarding Actions and no Kubernetes API DataActions; the local kubeconfig used by the connect command separately determines what can be installed in the cluster.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 34e09817-6cbe-4d01-b1a2-e0eac5743d41
Control-plane actions (13)
Microsoft.Authorization/*/readMicrosoft.Insights/alertRules/*Microsoft.Resources/deployments/writeMicrosoft.Resources/subscriptions/operationresults/readMicrosoft.Resources/subscriptions/readMicrosoft.Resources/subscriptions/resourceGroups/readMicrosoft.Kubernetes/connectedClusters/WriteMicrosoft.Kubernetes/connectedClusters/readMicrosoft.KubernetesConfiguration/extensions/writeMicrosoft.KubernetesConfiguration/extensions/readMicrosoft.KubernetesConfiguration/extensions/deleteMicrosoft.KubernetesConfiguration/extensions/operations/readMicrosoft.Support/*
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the resource group where connected-cluster resources will be created. Subscription or management-group assignment is inherited by more resource groups and permits onboarding into each of them.
Common use cases (1)
- Allow a platform onboarding identity to register approved existing Kubernetes clusters as Azure Arc connected-cluster resources in a dedicated resource group.
Prerequisites (2)
- Register the required Azure resource providers and prepare a supported Kubernetes cluster, network connectivity, Azure CLI extensions, and a kubeconfig with cluster-admin access for agent installation.
- Choose the Azure subscription, resource group, region, tags, proxy settings, and cluster name before running the connect workflow.
Best practices (2)
- Use a dedicated onboarding identity and resource group, protect the local cluster-admin kubeconfig, and remove onboarding access after the approved cluster set is connected.
- Separate later extension management and Kubernetes workload access into their own roles.
Security considerations (2)
- Onboarding installs Azure Arc agents into the Kubernetes cluster using the local kubeconfig and creates an Azure resource representing that cluster.
- The role has no Kubernetes DataActions, but a principal running the connect command also holds local cluster credentials outside this Azure role.
Assignment guidance
Assign Kubernetes Cluster - Azure Arc Onboarding on the dedicated onboarding resource group to the temporary platform identity. Run the documented connect workflow with separately protected cluster credentials, validate the connected agents, and remove the assignment when onboarding is complete.
Common questions
When should I assign the Kubernetes Cluster - Azure Arc Onboarding Azure role?
Assign Kubernetes Cluster - Azure Arc Onboarding when you need to: Allow a platform onboarding identity to register approved existing Kubernetes clusters as Azure Arc connected-cluster resources in a dedicated resource group.. Practical scope: Assign on the resource group where connected-cluster resources will be created. Subscription or management-group assignment is inherited by more resource groups and permits onboarding into each of them.
What permissions does the Kubernetes Cluster - Azure Arc Onboarding Azure role grant?
The role definition grants 13 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Insights/alertRules/*; Microsoft.Resources/deployments/write; Microsoft.Resources/subscriptions/operationresults/read; Microsoft.Resources/subscriptions/read; and Microsoft.Resources/subscriptions/resourceGroups/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Kubernetes Cluster - Azure Arc Onboarding Azure role?
Key considerations when assigning Kubernetes Cluster - Azure Arc Onboarding: Onboarding installs Azure Arc agents into the Kubernetes cluster using the local kubeconfig and creates an Azure resource representing that cluster.; and The role has no Kubernetes DataActions, but a principal running the connect command also holds local cluster credentials outside this Azure role.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Connect an existing Kubernetes cluster to Azure Arc →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.
- Use Azure RBAC on Azure Arc-enabled Kubernetes clusters →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.