Azure Containers built-in role

Azure Kubernetes Service Namespace User

Reads an AKS managed namespace ARM resource and retrieves that namespace's connection credentials. It grants no Kubernetes DataActions; in-cluster access requires a separate AKS RBAC data role assigned on the managed namespace resource for a Microsoft Entra-enabled cluster.

Control-plane actions (2)

• Microsoft.ContainerService/managedClusters/managedNamespaces/read
• Microsoft.ContainerService/managedClusters/managedNamespaces/listCredential/action

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on the individual managed namespace resource. A parent assignment can be inherited by multiple managed namespaces and should be used only when the same principal is intentionally a user of each one.

Common use cases (1)

• Allow an application-team identity to view an existing managed namespace and retrieve its credentials while a separate AKS RBAC role defines the Kubernetes operations allowed inside that namespace.

Prerequisites (2)

• An AKS managed namespace must already exist on a cluster configured for Microsoft Entra authentication and Azure RBAC for Kubernetes authorization.
• Assign a separate data-plane role such as Azure Kubernetes Service RBAC Reader or Writer on the managed namespace resource before expecting Kubernetes API access.

Best practices (2)

• Assign to groups on the managed namespace and review membership as application-team ownership changes.
• Pair it with the least-privilege AKS RBAC data role required by the team and protect the downloaded namespace credentials.

Security considerations (2)

• The retrieved credential is sensitive connection material, but this role alone does not authorize Kubernetes object access because it has no DataActions.
• A parent Azure assignment can unintentionally grant user access to multiple inherited namespaces.

Assignment guidance

Assign Azure Kubernetes Service Namespace User directly on the existing managed namespace, then assign the least AKS RBAC Reader, Writer, Admin, or Cluster Admin data role required at that same managed namespace scope. Validate credential retrieval and Kubernetes authorization independently.

Related roles (1)

• Azure Kubernetes Service RBAC Writer: Documented separate data-plane role for creating Kubernetes resources within the managed namespace after Namespace User supplies the connection credential.

Editorial sources (7)

• Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Managed namespaces in Azure Kubernetes Service →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Use Azure RBAC for Kubernetes authorization →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →