Azure Containers built-in role
Azure Kubernetes Service RBAC Admin
Azure Kubernetes Service RBAC Admin grants administrative access to most Kubernetes objects, including roles and role bindings, while excluding namespace and ResourceQuota writes on the AKS cluster. The effective workload authority is expressed as Kubernetes API DataActions under the Microsoft.ContainerService managed-cluster resource provider. The role also includes listClusterUserCredential, so the assignee can retrieve an AKS clusterUser kubeconfig; credential retrieval is not a separate assignment for this role.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 3498e952-d568-435e-9b2c-8d77e338d7f7
Control-plane actions (5)
Microsoft.Authorization/*/readMicrosoft.Resources/subscriptions/operationresults/readMicrosoft.Resources/subscriptions/readMicrosoft.Resources/subscriptions/resourceGroups/readMicrosoft.ContainerService/managedClusters/listClusterUserCredential/action
Data-plane actions (1)
Microsoft.ContainerService/managedClusters/*
Excluded actions (4)
Microsoft.ContainerService/managedClusters/resourcequotas/writeMicrosoft.ContainerService/managedClusters/resourcequotas/deleteMicrosoft.ContainerService/managedClusters/namespaces/writeMicrosoft.ContainerService/managedClusters/namespaces/delete
Assignable scopes (1)
/
Practical scope
Assign at the Kubernetes namespace sub-scope whenever the workflow is namespace-bound. Assigning at the the AKS cluster resource or an inherited parent Azure scope applies the Kubernetes API DataActions across all namespaces available through each inherited cluster.
Common use cases (1)
- Let a namespace administrator manage workloads and namespace-local authorization in an AKS namespace without changing the namespace object or ResourceQuota.
Prerequisites (2)
- The the AKS cluster must use the documented Microsoft Entra and Azure RBAC integration for Kubernetes authorization.
- Protect the kubeconfig retrieved through this same role and verify that its user authentication context maps to the intended Kubernetes authorization.
Best practices (2)
- Create namespace-scoped assignments for application teams and reserve cluster-scope assignments for documented cross-namespace responsibilities.
- Audit Kubernetes API activity and review the ServiceAccounts, Secrets, and authorization objects reachable within the assigned scope.
Security considerations (3)
- The role can create roles and role bindings in scope, read Secrets, and run pods under ServiceAccounts, enabling delegation or escalation within the assigned namespace boundary.
- An Azure role assignment at a parent scope is inherited by child cluster resources; Kubernetes namespace semantics do not prevent a broad Azure assignment from reaching multiple clusters.
- The included credential-list Action exposes a reusable kubeconfig connection context in addition to the role's Kubernetes API DataActions.
Assignment guidance
Assign Azure Kubernetes Service RBAC Admin at the narrowest documented namespace scope to the principal that needs administrative access to most Kubernetes objects, including roles and role bindings, while excluding namespace and ResourceQuota writes. Treat the included kubeconfig retrieval as part of the grant, test both credential download and Kubernetes authorization, and protect downloaded credentials.
Editorial sources (6)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Use Azure RBAC for Kubernetes authorization →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.