Azure Containers built-in role
Azure Kubernetes Service Namespace Contributor
Creates, reads, updates, and deletes AKS managed namespace ARM resources and their supported quota, network-policy, label, annotation, adoption, and delete-policy configuration. It has no Kubernetes DataActions and no Microsoft.Authorization role-assignment write or delete permission.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 289d8817-ee69-43f1-a0af-43a45505b488
Control-plane actions (5)
Microsoft.Authorization/*/readMicrosoft.Insights/alertRules/*Microsoft.Resources/subscriptions/resourceGroups/readMicrosoft.ContainerService/managedClusters/managedNamespaces/*Microsoft.Resources/deployments/*
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the AKS cluster or the bounded parent scope where the administrator creates managed namespaces. A parent assignment is inherited by every managed namespace and cluster resource below it.
Common use cases (1)
- Delegate managed namespace resource creation and lifecycle configuration to an AKS tenancy administrator without granting role-assignment administration.
Prerequisites (1)
- The AKS cluster must support managed namespaces and the organization must define namespace ownership, quotas, policies, and user groups.
Best practices (2)
- Separate managed namespace resource administration from Namespace User credential retrieval and from AKS RBAC data-role assignment.
- Use dedicated clusters or resource groups for intentional tenant boundaries and avoid broad inherited assignments across unrelated clusters.
Security considerations (2)
- Changing quotas, network policies, adoption behavior, or delete policy can affect workload isolation, availability, and lifecycle; deleting a managed namespace can disrupt applications and, with Delete policy, remove contained resources.
- The role cannot create or delete Azure role assignments, so a separate authorized role-assignment administrator must grant Namespace User and AKS RBAC data roles.
Assignment guidance
Assign on the exact AKS cluster to the tenancy administrator responsible for managed namespace resources. Have a separately authorized RBAC administrator assign Namespace User and the required AKS RBAC data role on each managed namespace, and audit namespace lifecycle and policy changes.
Related roles (1)
- Azure Kubernetes Service Namespace User: Reads an existing managed namespace and retrieves its credentials but still needs a separate AKS RBAC data role for Kubernetes API access.
Common questions
When should I assign the Azure Kubernetes Service Namespace Contributor Azure role?
Assign Azure Kubernetes Service Namespace Contributor when you need to: Delegate managed namespace resource creation and lifecycle configuration to an AKS tenancy administrator without granting role-assignment administration.. Practical scope: Assign on the AKS cluster or the bounded parent scope where the administrator creates managed namespaces. A parent assignment is inherited by every managed namespace and cluster resource below it.
What permissions does the Azure Kubernetes Service Namespace Contributor Azure role grant?
The role definition grants 5 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Insights/alertRules/*; Microsoft.Resources/subscriptions/resourceGroups/read; Microsoft.ContainerService/managedClusters/managedNamespaces/*; and Microsoft.Resources/deployments/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Kubernetes Service Namespace Contributor Azure role?
Key considerations when assigning Azure Kubernetes Service Namespace Contributor: Changing quotas, network policies, adoption behavior, or delete policy can affect workload isolation, availability, and lifecycle; deleting a managed namespace can disrupt applications and, with Delete policy, remove contained resources.; and The role cannot create or delete Azure role assignments, so a separate authorized role-assignment administrator must grant Namespace User and AKS RBAC data roles.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Managed namespaces in Azure Kubernetes Service →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.