Azure Containers built-in role
Azure Kubernetes Fleet Manager Hub Agent Role
Allows the Fleet Manager hub-cluster identity to read service public IP addresses and create, update, or delete Azure Traffic Manager profiles and endpoints for Fleet DNS load balancing. It is a feature-specific service identity role, not a generic provider-managed hub boundary or a human Kubernetes role.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: de2b316d-7a2c-4143-b4cd-c148f6a355a1
Control-plane actions (7)
Microsoft.Network/publicIPAddresses/readMicrosoft.Network/trafficManagerProfiles/readMicrosoft.Network/trafficManagerProfiles/writeMicrosoft.Network/trafficManagerProfiles/deleteMicrosoft.Network/trafficManagerProfiles/azureEndpoints/readMicrosoft.Network/trafficManagerProfiles/azureEndpoints/writeMicrosoft.Network/trafficManagerProfiles/azureEndpoints/delete
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
For DNS load balancing, Microsoft documents assigning the role to the Fleet Manager system-assigned identity on the resource group where Traffic Manager resources are created and separately on each resource group containing public IP addresses for exported services. Do not assign it generically on the Fleet resource or unrelated parent scopes.
Common use cases (1)
- Enable the Fleet DNS load-balancing controller to manage Traffic Manager configuration and read member-service public IP addresses across the explicitly selected resource groups.
Prerequisites (1)
- A Fleet Manager with a hub cluster and system-assigned managed identity must exist, and the Traffic Manager and public-IP resource groups for the preview DNS load-balancing design must be identified.
Best practices (2)
- Assign only to the Fleet Manager identity on the exact Traffic Manager and public-IP resource groups used by the feature; do not assign to people or application workloads.
- Separate Traffic Manager resources from unrelated network resources and review profile and endpoint changes because this feature is currently preview.
Security considerations (2)
- Traffic Manager profile or endpoint writes and deletes can redirect or disrupt DNS-based traffic across member-cluster workloads.
- A broader resource-group or subscription assignment can expose unrelated public IP addresses or Traffic Manager profiles to the Fleet identity.
Assignment guidance
Assign Azure Kubernetes Fleet Manager Hub Agent Role to the Fleet Manager system-assigned identity on the dedicated Traffic Manager resource group and on each resource group that contains public IPs consumed by ServiceExport. Use Fleet Contributor or Fleet RBAC roles for people and remove assignments when the DNS load-balancing feature is retired.
Related roles (1)
- Azure Kubernetes Fleet Manager Contributor Role: Customer-facing Azure control-plane role for Fleet administrators, distinct from the hub service agent.
Common questions
When should I assign the Azure Kubernetes Fleet Manager Hub Agent Role Azure role?
Assign Azure Kubernetes Fleet Manager Hub Agent Role when you need to: Enable the Fleet DNS load-balancing controller to manage Traffic Manager configuration and read member-service public IP addresses across the explicitly selected resource groups.. Practical scope: For DNS load balancing, Microsoft documents assigning the role to the Fleet Manager system-assigned identity on the resource group where Traffic Manager resources are created and separately on each resource group containing public IP addresses for exported services. Do not assign it generically on the Fleet resource or unrelated parent scopes.
What permissions does the Azure Kubernetes Fleet Manager Hub Agent Role Azure role grant?
The role definition grants 7 combined control-plane and data-plane actions. Representative operations include: Microsoft.Network/publicIPAddresses/read; Microsoft.Network/trafficManagerProfiles/read; Microsoft.Network/trafficManagerProfiles/write; Microsoft.Network/trafficManagerProfiles/delete; Microsoft.Network/trafficManagerProfiles/azureEndpoints/read; and Microsoft.Network/trafficManagerProfiles/azureEndpoints/write. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Kubernetes Fleet Manager Hub Agent Role Azure role?
Key considerations when assigning Azure Kubernetes Fleet Manager Hub Agent Role: Traffic Manager profile or endpoint writes and deletes can redirect or disrupt DNS-based traffic across member-cluster workloads.; and A broader resource-group or subscription assignment can expose unrelated public IP addresses or Traffic Manager profiles to the Fleet identity.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Set up multi-cluster DNS load balancing across Azure Kubernetes Fleet Manager member clusters →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.