Azure Containers built-in role

Azure Kubernetes Service Namespace Contributor

Creates, reads, updates, and deletes AKS managed namespace ARM resources and their supported quota, network-policy, label, annotation, adoption, and delete-policy configuration. It has no Kubernetes DataActions and no Microsoft.Authorization role-assignment write or delete permission.

Control-plane actions (5)

• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.ContainerService/managedClusters/managedNamespaces/*
• Microsoft.Resources/deployments/*

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on the AKS cluster or the bounded parent scope where the administrator creates managed namespaces. A parent assignment is inherited by every managed namespace and cluster resource below it.

Common use cases (1)

• Delegate managed namespace resource creation and lifecycle configuration to an AKS tenancy administrator without granting role-assignment administration.

Prerequisites (1)

• The AKS cluster must support managed namespaces and the organization must define namespace ownership, quotas, policies, and user groups.

Best practices (2)

• Separate managed namespace resource administration from Namespace User credential retrieval and from AKS RBAC data-role assignment.
• Use dedicated clusters or resource groups for intentional tenant boundaries and avoid broad inherited assignments across unrelated clusters.

Security considerations (2)

• Changing quotas, network policies, adoption behavior, or delete policy can affect workload isolation, availability, and lifecycle; deleting a managed namespace can disrupt applications and, with Delete policy, remove contained resources.
• The role cannot create or delete Azure role assignments, so a separate authorized role-assignment administrator must grant Namespace User and AKS RBAC data roles.

Assignment guidance

Assign on the exact AKS cluster to the tenancy administrator responsible for managed namespace resources. Have a separately authorized RBAC administrator assign Namespace User and the required AKS RBAC data role on each managed namespace, and audit namespace lifecycle and policy changes.

Related roles (1)

• Azure Kubernetes Service Namespace User: Reads an existing managed namespace and retrieves its credentials but still needs a separate AKS RBAC data role for Kubernetes API access.

Editorial sources (6)

• Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Managed namespaces in Azure Kubernetes Service →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →