Azure Containers built-in role

Azure Kubernetes Service Cluster Admin Role

Azure Kubernetes Service Cluster Admin Role authorizes retrieval of the clusterAdmin kubeconfig and managed-cluster access-profile credentials for AKS managed cluster through an Azure control-plane list-credential Action. The returned admin kubeconfig provides administrative cluster access and is distinct from Azure RBAC Kubernetes DataActions. The role also authorizes AKS Run Command, which remotely invokes commands such as kubectl or Helm through an in-cluster command pod.

Control-plane actions (4)

• Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action
• Microsoft.ContainerService/managedClusters/accessProfiles/listCredential/action
• Microsoft.ContainerService/managedClusters/read
• Microsoft.ContainerService/managedClusters/runcommand/action

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on the individual AKS managed cluster. A resource-group or broader assignment is inherited by every matching resource below it and permits credential retrieval and the documented additional operation for each inherited cluster.

Common use cases (1)

• Retrieve the clusterAdmin kubeconfig for approved administration on one AKS managed cluster, including an approved command-invoke operation.

Prerequisites (2)

• The AKS managed cluster must exist, and the caller must be able to authenticate to Azure and reach the required Azure and cluster endpoints.
• The administrator must have a documented reason to bypass ordinary user authorization and a secure plan for storing and deleting the downloaded credentials.

Best practices (2)

• Disable local accounts where supported, prefer Microsoft Entra user credentials for routine work, and avoid the non-auditable local admin path.
• Protect kubeconfig files, avoid committing them to source control, rotate or revoke exposed credentials, and remove temporary assignments promptly.

Security considerations (3)

• Admin kubeconfig retrieval can provide full Kubernetes control outside ordinary per-user Azure RBAC authorization and exposes sensitive client credentials.
• A broad inherited Azure assignment allows credential retrieval from multiple clusters.
• Run Command can execute kubectl or Helm operations and apply attached manifests through the Azure API, so this role is not limited to downloading administrator credentials.

Assignment guidance

Assign Azure Kubernetes Service Cluster Admin Role directly on the AKS managed cluster to the identity that must retrieve the clusterAdmin kubeconfig and managed-cluster access-profile credentials. Keep it temporary or eligible, prefer ordinary user access for daily operations, securely delete downloaded credentials after use, and audit every command invocation.

Related roles (2)

• Azure Kubernetes Service Cluster User Role: Retrieves the user kubeconfig instead of administrator credentials.
• Azure Kubernetes Service RBAC Cluster Admin: Grants full Kubernetes API DataActions through Azure RBAC while using user authentication.

Editorial sources (8)

• Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Use Azure RBAC to define access to the Kubernetes configuration file in AKS →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Access a private AKS cluster using Command Invoke or Run Command →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Disable local accounts in Azure Kubernetes Service →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →