Azure Containers built-in role
Azure Kubernetes Service Cluster Admin Role
Azure Kubernetes Service Cluster Admin Role authorizes retrieval of the clusterAdmin kubeconfig and managed-cluster access-profile credentials for AKS managed cluster through an Azure control-plane list-credential Action. The returned admin kubeconfig provides administrative cluster access and is distinct from Azure RBAC Kubernetes DataActions. The role also authorizes AKS Run Command, which remotely invokes commands such as kubectl or Helm through an in-cluster command pod.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 0ab0b1a8-8aac-4efd-b8c2-3ee1fb270be8
Control-plane actions (4)
Microsoft.ContainerService/managedClusters/listClusterAdminCredential/actionMicrosoft.ContainerService/managedClusters/accessProfiles/listCredential/actionMicrosoft.ContainerService/managedClusters/readMicrosoft.ContainerService/managedClusters/runcommand/action
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual AKS managed cluster. A resource-group or broader assignment is inherited by every matching resource below it and permits credential retrieval and the documented additional operation for each inherited cluster.
Common use cases (1)
- Retrieve the clusterAdmin kubeconfig for approved administration on one AKS managed cluster, including an approved command-invoke operation.
Prerequisites (2)
- The AKS managed cluster must exist, and the caller must be able to authenticate to Azure and reach the required Azure and cluster endpoints.
- The administrator must have a documented reason to bypass ordinary user authorization and a secure plan for storing and deleting the downloaded credentials.
Best practices (2)
- Disable local accounts where supported, prefer Microsoft Entra user credentials for routine work, and avoid the non-auditable local admin path.
- Protect kubeconfig files, avoid committing them to source control, rotate or revoke exposed credentials, and remove temporary assignments promptly.
Security considerations (3)
- Admin kubeconfig retrieval can provide full Kubernetes control outside ordinary per-user Azure RBAC authorization and exposes sensitive client credentials.
- A broad inherited Azure assignment allows credential retrieval from multiple clusters.
- Run Command can execute kubectl or Helm operations and apply attached manifests through the Azure API, so this role is not limited to downloading administrator credentials.
Assignment guidance
Assign Azure Kubernetes Service Cluster Admin Role directly on the AKS managed cluster to the identity that must retrieve the clusterAdmin kubeconfig and managed-cluster access-profile credentials. Keep it temporary or eligible, prefer ordinary user access for daily operations, securely delete downloaded credentials after use, and audit every command invocation.
Related roles (2)
- Azure Kubernetes Service Cluster User Role: Retrieves the user kubeconfig instead of administrator credentials.
- Azure Kubernetes Service RBAC Cluster Admin: Grants full Kubernetes API DataActions through Azure RBAC while using user authentication.
Common questions
When should I assign the Azure Kubernetes Service Cluster Admin Role Azure role?
Assign Azure Kubernetes Service Cluster Admin Role when you need to: Retrieve the clusterAdmin kubeconfig for approved administration on one AKS managed cluster, including an approved command-invoke operation.. Practical scope: Assign on the individual AKS managed cluster. A resource-group or broader assignment is inherited by every matching resource below it and permits credential retrieval and the documented additional operation for each inherited cluster.
What permissions does the Azure Kubernetes Service Cluster Admin Role Azure role grant?
The role definition grants 4 combined control-plane and data-plane actions. Representative operations include: Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action; Microsoft.ContainerService/managedClusters/accessProfiles/listCredential/action; Microsoft.ContainerService/managedClusters/read; and Microsoft.ContainerService/managedClusters/runcommand/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Kubernetes Service Cluster Admin Role Azure role?
Key considerations when assigning Azure Kubernetes Service Cluster Admin Role: Admin kubeconfig retrieval can provide full Kubernetes control outside ordinary per-user Azure RBAC authorization and exposes sensitive client credentials.; A broad inherited Azure assignment allows credential retrieval from multiple clusters.; and Run Command can execute kubectl or Helm operations and apply attached manifests through the Azure API, so this role is not limited to downloading administrator credentials.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (8)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Use Azure RBAC to define access to the Kubernetes configuration file in AKS →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Access a private AKS cluster using Command Invoke or Run Command →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Disable local accounts in Azure Kubernetes Service →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.