Azure Containers built-in role
Azure Kubernetes Service RBAC Reader
Azure Kubernetes Service RBAC Reader grants read-only access to most Kubernetes objects, excluding Secrets and role or role-binding visibility on the AKS cluster. The effective workload authority is expressed as Kubernetes API DataActions under the Microsoft.ContainerService managed-cluster resource provider.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 7f6c6a51-bcf8-42ba-9220-52d62157d7db
Control-plane actions (4)
Microsoft.Authorization/*/readMicrosoft.Resources/subscriptions/operationresults/readMicrosoft.Resources/subscriptions/readMicrosoft.Resources/subscriptions/resourceGroups/read
Data-plane actions (31)
Microsoft.ContainerService/managedClusters/apps/controllerrevisions/readMicrosoft.ContainerService/managedClusters/apps/daemonsets/readMicrosoft.ContainerService/managedClusters/apps/deployments/readMicrosoft.ContainerService/managedClusters/apps/replicasets/readMicrosoft.ContainerService/managedClusters/apps/statefulsets/readMicrosoft.ContainerService/managedClusters/autoscaling/horizontalpodautoscalers/readMicrosoft.ContainerService/managedClusters/batch/cronjobs/readMicrosoft.ContainerService/managedClusters/batch/jobs/readMicrosoft.ContainerService/managedClusters/configmaps/readMicrosoft.ContainerService/managedClusters/discovery.k8s.io/endpointslices/readMicrosoft.ContainerService/managedClusters/endpoints/readMicrosoft.ContainerService/managedClusters/events.k8s.io/events/readMicrosoft.ContainerService/managedClusters/events/readMicrosoft.ContainerService/managedClusters/extensions/daemonsets/readMicrosoft.ContainerService/managedClusters/extensions/deployments/readMicrosoft.ContainerService/managedClusters/extensions/ingresses/readMicrosoft.ContainerService/managedClusters/extensions/networkpolicies/readMicrosoft.ContainerService/managedClusters/extensions/replicasets/readMicrosoft.ContainerService/managedClusters/limitranges/readMicrosoft.ContainerService/managedClusters/metrics.k8s.io/pods/readMicrosoft.ContainerService/managedClusters/metrics.k8s.io/nodes/readMicrosoft.ContainerService/managedClusters/namespaces/readMicrosoft.ContainerService/managedClusters/networking.k8s.io/ingresses/readMicrosoft.ContainerService/managedClusters/networking.k8s.io/networkpolicies/readMicrosoft.ContainerService/managedClusters/persistentvolumeclaims/readMicrosoft.ContainerService/managedClusters/pods/readMicrosoft.ContainerService/managedClusters/policy/poddisruptionbudgets/readMicrosoft.ContainerService/managedClusters/replicationcontrollers/readMicrosoft.ContainerService/managedClusters/resourcequotas/readMicrosoft.ContainerService/managedClusters/serviceaccounts/readMicrosoft.ContainerService/managedClusters/services/read
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign at the Kubernetes namespace sub-scope whenever the workflow is namespace-bound. Assigning at the the AKS cluster resource or an inherited parent Azure scope applies the Kubernetes API DataActions across all namespaces available through each inherited cluster.
Common use cases (1)
- Let an approved reviewer inspect nonsensitive workload state in an AKS cluster or namespace without reading Secrets or changing Kubernetes objects.
Prerequisites (1)
- The the AKS cluster must use the documented Microsoft Entra and Azure RBAC integration for Kubernetes authorization.
Best practices (2)
- Create namespace-scoped assignments for application teams and reserve cluster-scope assignments for documented cross-namespace responsibilities.
- Use this reader role for observation and grant write or admin access only for a separately approved workflow.
Security considerations (2)
- The role deliberately excludes Secrets because reading them can expose ServiceAccount credentials and enable privilege escalation; other visible workload configuration can still contain operationally sensitive data.
- An Azure role assignment at a parent scope is inherited by child cluster resources; Kubernetes namespace semantics do not prevent a broad Azure assignment from reaching multiple clusters.
Assignment guidance
Assign Azure Kubernetes Service RBAC Reader at the narrowest documented namespace scope to the principal that needs read-only access to most Kubernetes objects, excluding Secrets and role or role-binding visibility. Test access with the intended identity and avoid using this role as a substitute for Azure control-plane cluster administration.
Editorial sources (6)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Use Azure RBAC for Kubernetes authorization →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.