Azure Containers built-in role
Azure Kubernetes Service Cluster User Role
Azure Kubernetes Service Cluster User Role authorizes retrieval of the clusterUser kubeconfig for AKS managed cluster through an Azure control-plane list-credential Action. The returned user kubeconfig establishes a connection and authentication context; Kubernetes authorization remains governed separately by Microsoft Entra, Azure RBAC, or Kubernetes RBAC.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 4abbcc35-e782-43d8-92c5-2d3f1bd2253f
Control-plane actions (2)
Microsoft.ContainerService/managedClusters/listClusterUserCredential/actionMicrosoft.ContainerService/managedClusters/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual AKS managed cluster. A resource-group or broader assignment is inherited by every matching resource below it and permits credential retrieval for each inherited cluster.
Common use cases (1)
- Allow an approved user or automation identity to obtain the user kubeconfig needed to connect to one AKS managed cluster.
Prerequisites (2)
- The AKS managed cluster must exist and the client must meet its network and Microsoft Entra authentication requirements.
- Assign an appropriate Kubernetes authorization role separately; credential retrieval alone does not define allowed Kubernetes API operations.
Best practices (2)
- Use Microsoft Entra user kubeconfig rather than shared local administrator credentials and keep the Azure assignment on the cluster resource.
- Protect kubeconfig files, avoid committing them to source control, revoke role or identity access when exposure is suspected, and remove temporary assignments promptly.
Security considerations (2)
- On Microsoft Entra-integrated AKS, clusterUser prompts the user to sign in and authorization follows that identity; on clusters without Microsoft Entra integration, Microsoft documents that clusterUser has the same effect as clusterAdmin.
- A broad inherited Azure assignment allows credential retrieval from multiple clusters.
Assignment guidance
Assign Azure Kubernetes Service Cluster User Role directly on the AKS managed cluster to the identity that must retrieve the clusterUser kubeconfig. Add the appropriate Kubernetes API role separately and validate credential retrieval and Kubernetes authorization independently; on an AKS cluster without Microsoft Entra integration, clusterUser has the same effect as clusterAdmin.
Related roles (2)
- Azure Kubernetes Service Cluster Admin Role: Retrieves administrator credentials and bypasses the ordinary user authorization boundary.
- Azure Kubernetes Service RBAC Reader: Separate Kubernetes API read DataActions for an Azure RBAC-enabled cluster.
Common questions
When should I assign the Azure Kubernetes Service Cluster User Role Azure role?
Assign Azure Kubernetes Service Cluster User Role when you need to: Allow an approved user or automation identity to obtain the user kubeconfig needed to connect to one AKS managed cluster.. Practical scope: Assign on the individual AKS managed cluster. A resource-group or broader assignment is inherited by every matching resource below it and permits credential retrieval for each inherited cluster.
What permissions does the Azure Kubernetes Service Cluster User Role Azure role grant?
The role definition grants 2 combined control-plane and data-plane actions. Representative operations include: Microsoft.ContainerService/managedClusters/listClusterUserCredential/action; and Microsoft.ContainerService/managedClusters/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Kubernetes Service Cluster User Role Azure role?
Key considerations when assigning Azure Kubernetes Service Cluster User Role: On Microsoft Entra-integrated AKS, clusterUser prompts the user to sign in and authorization follows that identity; on clusters without Microsoft Entra integration, Microsoft documents that clusterUser has the same effect as clusterAdmin.; and A broad inherited Azure assignment allows credential retrieval from multiple clusters.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Use Azure RBAC to define access to the Kubernetes configuration file in AKS →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.