Azure Containers built-in role
Azure Kubernetes Fleet Manager RBAC Reader
Azure Kubernetes Fleet Manager RBAC Reader grants read-only access to most Kubernetes objects, excluding Secrets and role or role-binding visibility on the fleet-managed hub cluster. The effective workload authority is expressed as Kubernetes API DataActions under the Microsoft.ContainerService Fleet resource provider. The role also includes Fleet read and listCredentials Actions, so the assignee can retrieve the hub-cluster kubeconfig; credential retrieval is not a separate assignment for this role.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 30b27cfc-9c84-438e-b0ce-70e35255df80
Control-plane actions (6)
Microsoft.Authorization/*/readMicrosoft.Resources/subscriptions/operationresults/readMicrosoft.Resources/subscriptions/readMicrosoft.Resources/subscriptions/resourceGroups/readMicrosoft.ContainerService/fleets/readMicrosoft.ContainerService/fleets/listCredentials/action
Data-plane actions (30)
Microsoft.ContainerService/fleets/apps/controllerrevisions/readMicrosoft.ContainerService/fleets/apps/daemonsets/readMicrosoft.ContainerService/fleets/apps/deployments/readMicrosoft.ContainerService/fleets/apps/statefulsets/readMicrosoft.ContainerService/fleets/autoscaling/horizontalpodautoscalers/readMicrosoft.ContainerService/fleets/batch/cronjobs/readMicrosoft.ContainerService/fleets/batch/jobs/readMicrosoft.ContainerService/fleets/configmaps/readMicrosoft.ContainerService/fleets/endpoints/readMicrosoft.ContainerService/fleets/events.k8s.io/events/readMicrosoft.ContainerService/fleets/events/readMicrosoft.ContainerService/fleets/extensions/daemonsets/readMicrosoft.ContainerService/fleets/extensions/deployments/readMicrosoft.ContainerService/fleets/extensions/ingresses/readMicrosoft.ContainerService/fleets/extensions/networkpolicies/readMicrosoft.ContainerService/fleets/limitranges/readMicrosoft.ContainerService/fleets/namespaces/readMicrosoft.ContainerService/fleets/networking.k8s.io/ingresses/readMicrosoft.ContainerService/fleets/networking.k8s.io/networkpolicies/readMicrosoft.ContainerService/fleets/persistentvolumeclaims/readMicrosoft.ContainerService/fleets/policy/poddisruptionbudgets/readMicrosoft.ContainerService/fleets/replicationcontrollers/readMicrosoft.ContainerService/fleets/replicationcontrollers/readMicrosoft.ContainerService/fleets/resourcequotas/readMicrosoft.ContainerService/fleets/serviceaccounts/readMicrosoft.ContainerService/fleets/services/readMicrosoft.ContainerService/fleets/cluster.kubernetes-fleet.io/internalmemberclusters/readMicrosoft.ContainerService/fleets/placement.kubernetes-fleet.io/resourceoverrides/readMicrosoft.ContainerService/fleets/placement.kubernetes-fleet.io/resourceoverridesnapshots/readMicrosoft.ContainerService/fleets/placement.kubernetes-fleet.io/works/read
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the Fleet ARM resource for fleet-wide access or on its Microsoft.ContainerService/fleets/managedNamespaces ARM subresource for one Managed Fleet Namespace. These roles aren't assigned directly to a generic hub-cluster or member-cluster Kubernetes namespace. At Fleet scope, the hub role applies across hub namespaces; at Managed Fleet Namespace scope, it is limited to that managed namespace.
Common use cases (1)
- Let an approved reviewer inspect nonsensitive workload state in the Fleet hub cluster or a hub namespace without reading Secrets or changing Kubernetes objects.
Prerequisites (2)
- The the fleet-managed hub cluster must use the documented Microsoft Entra and Azure RBAC integration for Kubernetes authorization.
- Protect the kubeconfig retrieved through this same role and verify that its user authentication context maps to the intended Kubernetes authorization.
Best practices (2)
- Use the Managed Fleet Namespace ARM subresource for namespace-bound teams and reserve Fleet-scope assignments for documented cross-namespace responsibilities.
- Use this reader role for observation and grant write or admin access only for a separately approved workflow.
Security considerations (3)
- The role deliberately excludes Secrets because reading them can expose ServiceAccount credentials and enable privilege escalation; other visible workload configuration can still contain operationally sensitive data.
- An Azure role assignment at a parent scope is inherited by child cluster resources; Kubernetes namespace semantics do not prevent a broad Azure assignment from reaching multiple clusters.
- The included credential-list Action exposes a reusable kubeconfig connection context in addition to the role's Kubernetes API DataActions.
Assignment guidance
Assign Azure Kubernetes Fleet Manager RBAC Reader at the exact Fleet resource or Managed Fleet Namespace ARM subresource to the principal that needs read-only access to most Kubernetes objects, excluding Secrets and role or role-binding visibility. Treat the included kubeconfig retrieval as part of the grant, test both credential download and Kubernetes authorization, and protect downloaded credentials.
Editorial sources (6)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Using Azure RBAC with Azure Kubernetes Fleet Manager →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.