Azure Containers built-in role
Kubernetes Extension Contributor
Creates, updates, reads, lists, and deletes Azure Kubernetes extension resources and reads their asynchronous operations. The Azure control-plane extension resource drives in-cluster agents to install, update, or remove Helm-based components; the role itself has no Kubernetes DataActions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 85cb6faf-e071-4c9b-8136-154b5a04f717
Control-plane actions (9)
Microsoft.Authorization/*/readMicrosoft.Insights/alertRules/*Microsoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/readMicrosoft.KubernetesConfiguration/extensions/writeMicrosoft.KubernetesConfiguration/extensions/readMicrosoft.KubernetesConfiguration/extensions/deleteMicrosoft.KubernetesConfiguration/extensions/operations/readMicrosoft.KubernetesConfiguration/register/action
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual Arc-enabled Kubernetes or supported cluster resource where extensions are managed. A parent assignment is inherited by every matching cluster and permits extension lifecycle operations across them.
Common use cases (1)
- Allow a platform extension administrator to install and manage approved Azure Arc cluster extensions on selected clusters.
Prerequisites (2)
- Connect the cluster to Azure Arc, meet extension architecture and network requirements, and approve the extension type, release train, version, scope, namespaces, and configuration.
- Protect any configuration values passed through protected settings and grant external-resource permissions separately.
Best practices (2)
- Approve extension publishers and versions, prefer stable release trains, and limit assignments to the cluster set owned by the platform team.
- Review whether the extension is cluster-scoped or namespace-scoped and audit protected settings, auto-upgrade, and deletion behavior.
Security considerations (2)
- Most supported extensions are cluster-scoped and their agents can install pods, operators, and custom resource definitions with cluster-wide effect.
- Protected configuration is propagated to in-cluster agents, and a compromised extension or configuration can affect workload confidentiality, integrity, or availability.
Assignment guidance
Assign Kubernetes Extension Contributor on the specific cluster to the platform identity that manages approved extensions. Review extension scope and configuration before deployment, and do not use this role as ordinary Kubernetes workload access.
Common questions
When should I assign the Kubernetes Extension Contributor Azure role?
Assign Kubernetes Extension Contributor when you need to: Allow a platform extension administrator to install and manage approved Azure Arc cluster extensions on selected clusters.. Practical scope: Assign on the individual Arc-enabled Kubernetes or supported cluster resource where extensions are managed. A parent assignment is inherited by every matching cluster and permits extension lifecycle operations across them.
What permissions does the Kubernetes Extension Contributor Azure role grant?
The role definition grants 9 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Insights/alertRules/*; Microsoft.Resources/deployments/*; Microsoft.Resources/subscriptions/resourceGroups/read; Microsoft.KubernetesConfiguration/extensions/write; and Microsoft.KubernetesConfiguration/extensions/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Kubernetes Extension Contributor Azure role?
Key considerations when assigning Kubernetes Extension Contributor: Most supported extensions are cluster-scoped and their agents can install pods, operators, and custom resource definitions with cluster-wide effect.; and Protected configuration is propagated to in-cluster agents, and a compromised extension or configuration can affect workload confidentiality, integrity, or availability.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Deploy and manage an Azure Arc-enabled Kubernetes cluster extension →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.
- Cluster extensions for Azure Arc-enabled Kubernetes →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.