Azure Containers built-in role

Azure Kubernetes Service Contributor Role

Creates and manages AKS managed-cluster resources. Its managedClusters wildcard also covers clusterUser and clusterAdmin credential retrieval, access-profile credential retrieval, and AKS Run Command. It has no Kubernetes API DataActions, but admin credentials and Run Command can operate the Kubernetes API outside this role definition's DataActions.

Control-plane actions (9)

• Microsoft.Authorization/*/read
• Microsoft.ContainerService/locations/*
• Microsoft.ContainerService/managedClusters/*
• Microsoft.ContainerService/managedclustersnapshots/*
• Microsoft.ContainerService/snapshots/*
• Microsoft.Insights/alertRules/*
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.ContainerService/deploymentSafeguards/*

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on the individual AKS cluster when possible. Resource-group, subscription, or management-group assignments are inherited by all AKS resources below the scope and permit lifecycle changes across those clusters.

Common use cases (1)

• Allow a tightly controlled AKS platform operator to manage cluster lifecycle and, when required, retrieve user or administrator kubeconfig credentials or invoke an approved kubectl or Helm command through AKS Run Command.

Prerequisites (2)

• Define the cluster lifecycle responsibility, network, identity, node pools, upgrade policy, and authorization model before granting management access.
• Grant separate roles on connected registries, networks, managed identities, monitoring workspaces, Key Vaults, and Kubernetes API resources as required.

Best practices (2)

• Assign to a small platform group on dedicated cluster resource groups and use Kubernetes RBAC roles for application teams.
• Use policy, maintenance windows, tested upgrades, and audit logs for cluster changes, credential retrieval, and Run Command; do not grant this role merely to deploy workloads.

Security considerations (3)

• Cluster lifecycle and configuration changes can affect every workload, node, network path, identity, and availability boundary in the cluster.
• The role can retrieve clusterAdmin credentials, which provide administrator access, and Run Command can remotely execute kubectl or Helm and apply attached manifests through an in-cluster command pod.
• The absence of Kubernetes DataActions in the definition is not a workload-access boundary because the included credential and command paths can reach the Kubernetes API.

Assignment guidance

Assign Azure Kubernetes Service Contributor directly on the managed cluster or dedicated AKS resource group only to the platform team that owns lifecycle, credential retrieval, and Run Command. Give application teams namespace-scoped Kubernetes roles and use narrower credential roles when lifecycle management is unnecessary.

Related roles (2)

• Azure Kubernetes Service Cluster User Role: Narrower clusterUser kubeconfig retrieval without cluster lifecycle, clusterAdmin credential, or Run Command authority.
• Azure Kubernetes Service RBAC Admin: Kubernetes API administration within a namespace, separate from Azure cluster management.

Editorial sources (8)

• Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Use Azure RBAC to define access to the Kubernetes configuration file in AKS →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Access a private AKS cluster using Command Invoke or Run Command →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Use Azure RBAC for Kubernetes authorization →

  Supports: Description, Practical scope, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →