Azure Containers built-in role
Azure Kubernetes Service Arc Cluster Admin Role
Azure Kubernetes Service Arc Cluster Admin Role authorizes retrieval of the admin certificate-based kubeconfig for AKS enabled by Azure Arc cluster through an Azure control-plane list-credential Action. The returned admin kubeconfig provides administrative cluster access and is distinct from Azure RBAC Kubernetes DataActions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: b29efa5f-7782-4dc3-9537-4d5bc70a5e9f
Control-plane actions (3)
Microsoft.HybridContainerService/provisionedClusterInstances/readMicrosoft.HybridContainerService/provisionedClusterInstances/listAdminKubeconfig/actionMicrosoft.Kubernetes/connectedClusters/Read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual AKS enabled by Azure Arc cluster. A resource-group or broader assignment is inherited by every matching resource below it and permits credential retrieval for each inherited cluster.
Common use cases (1)
- Retrieve the certificate-based admin kubeconfig when administrators are permanently blocked from a valid Microsoft Entra group on one AKS enabled by Azure Arc cluster.
Prerequisites (2)
- The AKS enabled by Azure Arc cluster must exist, and the caller must be able to authenticate to Azure and reach the required Azure and cluster endpoints.
- The administrator must have a documented reason to bypass ordinary user authorization and a secure plan for storing and deleting the downloaded credentials.
Best practices (2)
- Use Microsoft Entra user credentials for routine work and reserve the certificate-based admin kubeconfig for the documented blocked-access case.
- Protect kubeconfig files, avoid committing them to source control, rotate or revoke exposed credentials, and remove temporary assignments promptly.
Security considerations (2)
- Admin kubeconfig retrieval can provide full Kubernetes control outside ordinary per-user Azure RBAC authorization and exposes sensitive client credentials.
- A broad inherited Azure assignment allows credential retrieval from multiple clusters.
Assignment guidance
Assign Azure Kubernetes Service Arc Cluster Admin Role directly on the AKS enabled by Azure Arc cluster to the identity that must retrieve the admin certificate-based kubeconfig. Keep it temporary or eligible, prefer ordinary user access for daily operations, securely delete downloaded credentials after use.
Related roles (1)
- Azure Kubernetes Service Arc Cluster User Role: Retrieves the Microsoft Entra user kubeconfig instead of administrator credentials.
Common questions
When should I assign the Azure Kubernetes Service Arc Cluster Admin Role Azure role?
Assign Azure Kubernetes Service Arc Cluster Admin Role when you need to: Retrieve the certificate-based admin kubeconfig when administrators are permanently blocked from a valid Microsoft Entra group on one AKS enabled by Azure Arc cluster.. Practical scope: Assign on the individual AKS enabled by Azure Arc cluster. A resource-group or broader assignment is inherited by every matching resource below it and permits credential retrieval for each inherited cluster.
What permissions does the Azure Kubernetes Service Arc Cluster Admin Role Azure role grant?
The role definition grants 3 combined control-plane and data-plane actions. Representative operations include: Microsoft.HybridContainerService/provisionedClusterInstances/read; Microsoft.HybridContainerService/provisionedClusterInstances/listAdminKubeconfig/action; and Microsoft.Kubernetes/connectedClusters/Read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Kubernetes Service Arc Cluster Admin Role Azure role?
Key considerations when assigning Azure Kubernetes Service Arc Cluster Admin Role: Admin kubeconfig retrieval can provide full Kubernetes control outside ordinary per-user Azure RBAC authorization and exposes sensitive client credentials.; and A broad inherited Azure assignment allows credential retrieval from multiple clusters.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Access and identity options for AKS enabled by Azure Arc →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.