Azure Containers built-in role
Azure Kubernetes Service RBAC Cluster Admin
Azure Kubernetes Service RBAC Cluster Admin grants read and write access to all Kubernetes resources on the AKS cluster. The effective workload authority is expressed as Kubernetes API DataActions under the Microsoft.ContainerService managed-cluster resource provider. The role also includes listClusterUserCredential, so the assignee can retrieve an AKS clusterUser kubeconfig; credential retrieval is not a separate assignment for this role.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: b1ff04bb-8a4e-4dc4-8eb5-8693973ce19b
Control-plane actions (5)
Microsoft.Authorization/*/readMicrosoft.Resources/subscriptions/operationresults/readMicrosoft.Resources/subscriptions/readMicrosoft.Resources/subscriptions/resourceGroups/readMicrosoft.ContainerService/managedClusters/listClusterUserCredential/action
Data-plane actions (1)
Microsoft.ContainerService/managedClusters/*
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the AKS cluster only when full cluster administration is required. The role's Kubernetes API DataActions apply throughout the cluster; an Azure assignment inherited from a parent scope can extend that authority to every matching cluster below it.
Common use cases (1)
- Let a tightly controlled platform administrator perform cluster-wide Kubernetes administration in an AKS cluster.
Prerequisites (2)
- The the AKS cluster must use the documented Microsoft Entra and Azure RBAC integration for Kubernetes authorization.
- Protect the kubeconfig retrieved through this same role and verify that its user authentication context maps to the intended Kubernetes authorization.
Best practices (2)
- Use eligible or time-bound access where available, require an operational justification, and remove standing cluster-admin assignments.
- Audit Kubernetes API activity and review the ServiceAccounts, Secrets, and authorization objects reachable within the assigned scope.
Security considerations (3)
- Cluster-admin DataActions grant complete Kubernetes API control, including Secrets, service accounts, authorization objects, admission-related resources, and all namespaces.
- An Azure role assignment at a parent scope is inherited by child cluster resources; Kubernetes namespace semantics do not prevent a broad Azure assignment from reaching multiple clusters.
- The included credential-list Action exposes a reusable kubeconfig connection context in addition to the role's Kubernetes API DataActions.
Assignment guidance
Assign Azure Kubernetes Service RBAC Cluster Admin at the narrowest documented cluster scope to the principal that needs read and write access to all Kubernetes resources. Treat the included kubeconfig retrieval as part of the grant, test both credential download and Kubernetes authorization, and protect downloaded credentials.
Common questions
When should I assign the Azure Kubernetes Service RBAC Cluster Admin Azure role?
Assign Azure Kubernetes Service RBAC Cluster Admin when you need to: Let a tightly controlled platform administrator perform cluster-wide Kubernetes administration in an AKS cluster.. Practical scope: Assign on the AKS cluster only when full cluster administration is required. The role's Kubernetes API DataActions apply throughout the cluster; an Azure assignment inherited from a parent scope can extend that authority to every matching cluster below it.
What permissions does the Azure Kubernetes Service RBAC Cluster Admin Azure role grant?
The role definition grants 6 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Resources/subscriptions/operationresults/read; Microsoft.Resources/subscriptions/read; Microsoft.Resources/subscriptions/resourceGroups/read; Microsoft.ContainerService/managedClusters/listClusterUserCredential/action; and Microsoft.ContainerService/managedClusters/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Kubernetes Service RBAC Cluster Admin Azure role?
Key considerations when assigning Azure Kubernetes Service RBAC Cluster Admin: Cluster-admin DataActions grant complete Kubernetes API control, including Secrets, service accounts, authorization objects, admission-related resources, and all namespaces.; An Azure role assignment at a parent scope is inherited by child cluster resources; Kubernetes namespace semantics do not prevent a broad Azure assignment from reaching multiple clusters.; and The included credential-list Action exposes a reusable kubeconfig connection context in addition to the role's Kubernetes API DataActions.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Use Azure RBAC for Kubernetes authorization →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.