Azure Containers built-in role

Azure Kubernetes Fleet Manager RBAC Admin for Member Clusters

Azure Kubernetes Fleet Manager RBAC Admin for Member Clusters grants administrative access to most Kubernetes objects, including roles and role bindings, while excluding namespace and ResourceQuota writes on member clusters reached through a Managed Fleet Namespace. The effective workload authority is expressed as Kubernetes API DataActions under the Microsoft.ContainerService Fleet resource provider.

Control-plane actions (4)

• Microsoft.Authorization/*/read
• Microsoft.Resources/subscriptions/operationresults/read
• Microsoft.Resources/subscriptions/read
• Microsoft.Resources/subscriptions/resourceGroups/read

Data-plane actions (1)

• Microsoft.ContainerService/fleets/members/*

Excluded actions (4)

• Microsoft.ContainerService/fleets/members/resourcequotas/write
• Microsoft.ContainerService/fleets/members/resourcequotas/delete
• Microsoft.ContainerService/fleets/members/namespaces/write
• Microsoft.ContainerService/fleets/members/namespaces/delete

Assignable scopes (1)

• /

Practical scope

Assign on the Fleet ARM resource for fleet-wide access or on its Microsoft.ContainerService/fleets/managedNamespaces ARM subresource for one Managed Fleet Namespace. These roles aren't assigned directly to a generic hub-cluster or member-cluster Kubernetes namespace. Microsoft warns that a Managed Fleet Namespace assignment also grants access to unmanaged namespaces with the same name on member clusters.

Common use cases (1)

• Let a namespace administrator manage workloads and namespace-local authorization in a Managed Fleet Namespace on member clusters without changing the namespace object or ResourceQuota.

Prerequisites (1)

• The member clusters reached through a Managed Fleet Namespace must use the documented Microsoft Entra and Azure RBAC integration for Kubernetes authorization.

Best practices (2)

• Use the Managed Fleet Namespace ARM subresource for namespace-bound teams and reserve Fleet-scope assignments for documented cross-namespace responsibilities.
• Audit Kubernetes API activity and review the ServiceAccounts, Secrets, and authorization objects reachable within the assigned scope.

Security considerations (2)

• The role can create roles and role bindings in scope, read Secrets, and run pods under ServiceAccounts, enabling delegation or escalation within the assigned namespace boundary.
• An Azure role assignment at a parent scope is inherited by child cluster resources; Kubernetes namespace semantics do not prevent a broad Azure assignment from reaching multiple clusters.

Assignment guidance

Assign Azure Kubernetes Fleet Manager RBAC Admin for Member Clusters at the exact Fleet resource or Managed Fleet Namespace ARM subresource to the principal that needs administrative access to most Kubernetes objects, including roles and role bindings, while excluding namespace and ResourceQuota writes. Test access with the intended identity and avoid using this role as a substitute for Azure control-plane cluster administration.

Editorial sources (6)

• Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Use Managed Fleet Namespaces for multi-cluster multi-tenancy →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

Official Microsoft Learn documentation →