Azure Containers built-in role
Azure Kubernetes Fleet Manager Contributor Role
Creates and manages Fleet Manager Azure resources and subresources, including fleets, members, update strategies, update runs, and related orchestration. It is Azure control-plane authority and does not itself grant Kubernetes API DataActions on the hub or member clusters.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 63bb64ad-9799-4770-b5c3-24ed299a07bf
Control-plane actions (3)
Microsoft.ContainerService/fleets/*Microsoft.Resources/deployments/*Microsoft.ContainerService/fleetMemberships/*
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the Fleet Manager resource or its dedicated resource group. A broader parent assignment is inherited by all fleet resources below it and permits fleet orchestration across them.
Common use cases (1)
- Let a fleet platform administrator register members, define update strategies, and operate fleet update runs without granting Kubernetes workload access.
Prerequisites (2)
- Create the Fleet Manager resource and define the approved member clusters, update policy, maintenance process, and hub-cluster requirement.
- Grant any required roles on member AKS resources and Kubernetes data planes separately.
Best practices (2)
- Separate fleet Azure resource administration from hub and member Kubernetes API access.
- Use staged update runs, health gates, and rollback procedures because fleet operations can affect many clusters.
Security considerations (2)
- Membership and update orchestration can affect availability and software versions across multiple clusters.
- The role is broad fleet management, not a workload authorization role and not a least-privilege default for application teams.
Assignment guidance
Assign directly on the Fleet Manager resource to the fleet platform team. Assign hub or member Kubernetes RBAC roles separately on the Fleet or Managed Fleet Namespace ARM scope as documented.
Related roles (2)
- Azure Kubernetes Fleet Manager Hub Cluster User Role: Retrieves hub-cluster connection credentials without managing Fleet resources.
- Azure Kubernetes Fleet Manager RBAC Admin: Kubernetes API administration on the hub data plane, separate from Fleet resource management.
Common questions
When should I assign the Azure Kubernetes Fleet Manager Contributor Role Azure role?
Assign Azure Kubernetes Fleet Manager Contributor Role when you need to: Let a fleet platform administrator register members, define update strategies, and operate fleet update runs without granting Kubernetes workload access.. Practical scope: Assign on the Fleet Manager resource or its dedicated resource group. A broader parent assignment is inherited by all fleet resources below it and permits fleet orchestration across them.
What permissions does the Azure Kubernetes Fleet Manager Contributor Role Azure role grant?
The role definition grants 3 combined control-plane and data-plane actions. Representative operations include: Microsoft.ContainerService/fleets/*; Microsoft.Resources/deployments/*; and Microsoft.ContainerService/fleetMemberships/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Kubernetes Fleet Manager Contributor Role Azure role?
Key considerations when assigning Azure Kubernetes Fleet Manager Contributor Role: Membership and update orchestration can affect availability and software versions across multiple clusters.; and The role is broad fleet management, not a workload authorization role and not a least-privilege default for application teams.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Using Azure RBAC with Azure Kubernetes Fleet Manager →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.