Azure Containers built-in role
Azure Kubernetes Service Namespace User
Reads an AKS managed namespace ARM resource and retrieves that namespace's connection credentials. It grants no Kubernetes DataActions; in-cluster access requires a separate AKS RBAC data role assigned on the managed namespace resource for a Microsoft Entra-enabled cluster.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: c9f76ca8-b262-4b10-8ed2-09cf0948aa35
Control-plane actions (2)
Microsoft.ContainerService/managedClusters/managedNamespaces/readMicrosoft.ContainerService/managedClusters/managedNamespaces/listCredential/action
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual managed namespace resource. A parent assignment can be inherited by multiple managed namespaces and should be used only when the same principal is intentionally a user of each one.
Common use cases (1)
- Allow an application-team identity to view an existing managed namespace and retrieve its credentials while a separate AKS RBAC role defines the Kubernetes operations allowed inside that namespace.
Prerequisites (2)
- An AKS managed namespace must already exist on a cluster configured for Microsoft Entra authentication and Azure RBAC for Kubernetes authorization.
- Assign a separate data-plane role such as Azure Kubernetes Service RBAC Reader or Writer on the managed namespace resource before expecting Kubernetes API access.
Best practices (2)
- Assign to groups on the managed namespace and review membership as application-team ownership changes.
- Pair it with the least-privilege AKS RBAC data role required by the team and protect the downloaded namespace credentials.
Security considerations (2)
- The retrieved credential is sensitive connection material, but this role alone does not authorize Kubernetes object access because it has no DataActions.
- A parent Azure assignment can unintentionally grant user access to multiple inherited namespaces.
Assignment guidance
Assign Azure Kubernetes Service Namespace User directly on the existing managed namespace, then assign the least AKS RBAC Reader, Writer, Admin, or Cluster Admin data role required at that same managed namespace scope. Validate credential retrieval and Kubernetes authorization independently.
Related roles (1)
- Azure Kubernetes Service RBAC Writer: Documented separate data-plane role for creating Kubernetes resources within the managed namespace after Namespace User supplies the connection credential.
Common questions
When should I assign the Azure Kubernetes Service Namespace User Azure role?
Assign Azure Kubernetes Service Namespace User when you need to: Allow an application-team identity to view an existing managed namespace and retrieve its credentials while a separate AKS RBAC role defines the Kubernetes operations allowed inside that namespace.. Practical scope: Assign on the individual managed namespace resource. A parent assignment can be inherited by multiple managed namespaces and should be used only when the same principal is intentionally a user of each one.
What permissions does the Azure Kubernetes Service Namespace User Azure role grant?
The role definition grants 2 combined control-plane and data-plane actions. Representative operations include: Microsoft.ContainerService/managedClusters/managedNamespaces/read; and Microsoft.ContainerService/managedClusters/managedNamespaces/listCredential/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Kubernetes Service Namespace User Azure role?
Key considerations when assigning Azure Kubernetes Service Namespace User: The retrieved credential is sensitive connection material, but this role alone does not authorize Kubernetes object access because it has no DataActions.; and A parent Azure assignment can unintentionally grant user access to multiple inherited namespaces.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Managed namespaces in Azure Kubernetes Service →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Use Azure RBAC for Kubernetes authorization →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.