Azure Containers built-in role

Azure Red Hat OpenShift Federated Credential

Allows the ARO cluster identity to create, read, update, and delete federated identity credentials on the eight dedicated core-operator managed identities. These Azure control-plane Actions establish trust between each managed identity, the cluster OIDC issuer, and its Kubernetes service account; the role has no DataActions.

Control-plane actions (4)

• Microsoft.ManagedIdentity/userAssignedIdentities/read
• Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/write
• Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/read
• Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/delete

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Microsoft documents assigning this role to the ARO cluster identity on each of the other operator user-assigned managed identities. A resource-group or subscription assignment would allow federated credential changes on unrelated identities and is outside the documented architecture.

Common use cases (1)

• Allow the ARO cluster identity to create the workload-identity federation bindings required by the eight core operator identities.

Prerequisites (1)

• Create the ARO cluster identity, the eight dedicated operator identities, the cluster OIDC configuration, and the corresponding Kubernetes service-account design.

Best practices (2)

• Use automatic identity and role creation where possible; otherwise assign this role only on each intended operator identity.
• Verify issuer, subject, and audience values and remove stale federated credentials when an operator identity or cluster is retired.

Security considerations (2)

• A malicious federated credential can let an unintended Kubernetes service account obtain tokens as an Azure managed identity and exercise every role assigned to that identity.
• The role should never be assigned broadly or to human users because it controls trust bindings for privileged service identities.

Assignment guidance

Assign Azure Red Hat OpenShift Federated Credential only to the ARO cluster identity, separately on each of the eight operator managed identities documented for the cluster. Do not assign at resource-group or subscription scope and do not use it for application workload federation.

Related roles (2)

• Azure Red Hat OpenShift Service Operator: One of the core operator identities whose workload federation is established by the cluster identity.
• Azure Red Hat OpenShift Machine API Operator: Another core operator identity that receives its own federated credential and infrastructure role assignment.

Editorial sources (7)

• Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Understand managed identities in Azure Red Hat OpenShift →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Create an Azure Red Hat OpenShift cluster with managed identities →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →