Azure Containers built-in role
Azure Kubernetes Fleet Manager RBAC Cluster Admin for Member Clusters
Azure Kubernetes Fleet Manager RBAC Cluster Admin for Member Clusters grants read and write access to all Kubernetes resources within the granted Fleet or Managed Fleet Namespace scope on member clusters. The effective workload authority is expressed as Kubernetes API DataActions under the Microsoft.ContainerService Fleet resource provider.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 79a36d98-eb96-4a76-ae1d-481dc98d2c23
Control-plane actions (4)
Microsoft.Authorization/*/readMicrosoft.Resources/subscriptions/operationresults/readMicrosoft.Resources/subscriptions/readMicrosoft.Resources/subscriptions/resourceGroups/read
Data-plane actions (1)
Microsoft.ContainerService/fleets/members/*
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the Fleet ARM resource for fleet-wide access or on its Microsoft.ContainerService/fleets/managedNamespaces ARM subresource for one Managed Fleet Namespace. These roles aren't assigned directly to a generic hub-cluster or member-cluster Kubernetes namespace. Microsoft warns that a Managed Fleet Namespace assignment also grants access to unmanaged namespaces with the same name on member clusters.
Common use cases (1)
- Let a tightly controlled administrator manage all Kubernetes resources within an assigned Managed Fleet Namespace or across the Fleet member clusters when assigned at Fleet scope.
Prerequisites (1)
- The Fleet member clusters within the granted Fleet or Managed Fleet Namespace scope must use the documented Microsoft Entra and Azure RBAC integration for Kubernetes authorization.
Best practices (2)
- Use eligible or time-bound access where available, require an operational justification, and remove standing cluster-admin assignments.
- Audit Kubernetes API activity and review the ServiceAccounts, Secrets, and authorization objects reachable within the assigned scope.
Security considerations (2)
- Cluster-admin DataActions grant complete Kubernetes API control within the assigned Managed Fleet Namespace; at Fleet scope, they extend across all current member clusters.
- An Azure role assignment at a parent scope is inherited by child cluster resources; Kubernetes namespace semantics do not prevent a broad Azure assignment from reaching multiple clusters.
Assignment guidance
Assign Azure Kubernetes Fleet Manager RBAC Cluster Admin for Member Clusters at the exact Fleet resource or Managed Fleet Namespace ARM subresource to the principal that needs read and write access to all Kubernetes resources. Test access with the intended identity and avoid using this role as a substitute for Azure control-plane cluster administration.
Common questions
When should I assign the Azure Kubernetes Fleet Manager RBAC Cluster Admin for Member Clusters Azure role?
Assign Azure Kubernetes Fleet Manager RBAC Cluster Admin for Member Clusters when you need to: Let a tightly controlled administrator manage all Kubernetes resources within an assigned Managed Fleet Namespace or across the Fleet member clusters when assigned at Fleet scope.. Practical scope: Assign on the Fleet ARM resource for fleet-wide access or on its Microsoft.ContainerService/fleets/managedNamespaces ARM subresource for one Managed Fleet Namespace. These roles aren't assigned directly to a generic hub-cluster or member-cluster Kubernetes namespace. Microsoft warns that a Managed Fleet Namespace assignment also grants access to unmanaged namespaces with the same name on member clusters.
What permissions does the Azure Kubernetes Fleet Manager RBAC Cluster Admin for Member Clusters Azure role grant?
The role definition grants 5 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Resources/subscriptions/operationresults/read; Microsoft.Resources/subscriptions/read; Microsoft.Resources/subscriptions/resourceGroups/read; and Microsoft.ContainerService/fleets/members/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Kubernetes Fleet Manager RBAC Cluster Admin for Member Clusters Azure role?
Key considerations when assigning Azure Kubernetes Fleet Manager RBAC Cluster Admin for Member Clusters: Cluster-admin DataActions grant complete Kubernetes API control within the assigned Managed Fleet Namespace; at Fleet scope, they extend across all current member clusters.; and An Azure role assignment at a parent scope is inherited by child cluster resources; Kubernetes namespace semantics do not prevent a broad Azure assignment from reaching multiple clusters.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Use Managed Fleet Namespaces for multi-cluster multi-tenancy →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.