Azure Containers built-in role
Azure Red Hat OpenShift Federated Credential
Allows the ARO cluster identity to create, read, update, and delete federated identity credentials on the eight dedicated core-operator managed identities. These Azure control-plane Actions establish trust between each managed identity, the cluster OIDC issuer, and its Kubernetes service account; the role has no DataActions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: ef318e2a-8334-4a05-9e4a-295a196c6a6e
Control-plane actions (4)
Microsoft.ManagedIdentity/userAssignedIdentities/readMicrosoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/writeMicrosoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/readMicrosoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/delete
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Microsoft documents assigning this role to the ARO cluster identity on each of the other operator user-assigned managed identities. A resource-group or subscription assignment would allow federated credential changes on unrelated identities and is outside the documented architecture.
Common use cases (1)
- Allow the ARO cluster identity to create the workload-identity federation bindings required by the eight core operator identities.
Prerequisites (1)
- Create the ARO cluster identity, the eight dedicated operator identities, the cluster OIDC configuration, and the corresponding Kubernetes service-account design.
Best practices (2)
- Use automatic identity and role creation where possible; otherwise assign this role only on each intended operator identity.
- Verify issuer, subject, and audience values and remove stale federated credentials when an operator identity or cluster is retired.
Security considerations (2)
- A malicious federated credential can let an unintended Kubernetes service account obtain tokens as an Azure managed identity and exercise every role assigned to that identity.
- The role should never be assigned broadly or to human users because it controls trust bindings for privileged service identities.
Assignment guidance
Assign Azure Red Hat OpenShift Federated Credential only to the ARO cluster identity, separately on each of the eight operator managed identities documented for the cluster. Do not assign at resource-group or subscription scope and do not use it for application workload federation.
Related roles (2)
- Azure Red Hat OpenShift Service Operator: One of the core operator identities whose workload federation is established by the cluster identity.
- Azure Red Hat OpenShift Machine API Operator: Another core operator identity that receives its own federated credential and infrastructure role assignment.
Common questions
When should I assign the Azure Red Hat OpenShift Federated Credential Azure role?
Assign Azure Red Hat OpenShift Federated Credential when you need to: Allow the ARO cluster identity to create the workload-identity federation bindings required by the eight core operator identities.. Practical scope: Microsoft documents assigning this role to the ARO cluster identity on each of the other operator user-assigned managed identities. A resource-group or subscription assignment would allow federated credential changes on unrelated identities and is outside the documented architecture.
What permissions does the Azure Red Hat OpenShift Federated Credential Azure role grant?
The role definition grants 4 combined control-plane and data-plane actions. Representative operations include: Microsoft.ManagedIdentity/userAssignedIdentities/read; Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/write; Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/read; and Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/delete. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Red Hat OpenShift Federated Credential Azure role?
Key considerations when assigning Azure Red Hat OpenShift Federated Credential: A malicious federated credential can let an unintended Kubernetes service account obtain tokens as an Azure managed identity and exercise every role assigned to that identity.; and The role should never be assigned broadly or to human users because it controls trust bindings for privileged service identities.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Understand managed identities in Azure Red Hat OpenShift →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Create an Azure Red Hat OpenShift cluster with managed identities →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.