Microsoft's edit · Azure built-in roles · containers

77 author: rolyon

88 manager: femila

99 ms.author: rolyon

10 −ms.date: 04/25/2025

11 −ms.custom: generated

12 −---

13 −

14 −# Azure built-in roles for Containers

15 −

16 −This article lists the Azure built-in roles in the Containers category.

17 −

18 −

19 −## AcrDelete

20 −

21 −Delete repositories, tags, or manifests from a container registry.

22 −

23 −[Learn more](/azure/container-registry/container-registry-rbac-built-in-roles-directory-reference)

24 −

25 −> [!div class="mx-tableFixed"]

26 −> | Actions | Description |

27 −> | --- | --- |

28 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/artifacts/delete | Delete artifact in a container registry. |

29 −> | **NotActions** | |

30 −> | *none* | |

31 −> | **DataActions** | |

32 −> | *none* | |

33 −> | **NotDataActions** | |

34 −> | *none* | |

35 −

36 −```json

37 −{

38 − "assignableScopes": [

39 − "/"

40 − ],

41 − "description": "acr delete",

42 − "id": "/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11",

43 − "name": "c2f4ef07-c644-48eb-af81-4b1b4947fb11",

44 − "permissions": [

45 − {

46 − "actions": [

47 − "Microsoft.ContainerRegistry/registries/artifacts/delete"

48 − ],

49 − "notActions": [],

50 − "dataActions": [],

51 − "notDataActions": []

52 − }

53 − ],

54 − "roleName": "AcrDelete",

55 − "roleType": "BuiltInRole",

56 − "type": "Microsoft.Authorization/roleDefinitions"

57 −}

58 −```

59 −

60 −## AcrImageSigner

61 −

62 −Push trusted images to or pull trusted images from a container registry enabled for content trust.

63 −

64 −[Learn more](/azure/container-registry/container-registry-rbac-built-in-roles-directory-reference)

65 −

66 −> [!div class="mx-tableFixed"]

67 −> | Actions | Description |

68 −> | --- | --- |

69 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/sign/write | Push/Pull content trust metadata for a container registry. |

70 −> | **NotActions** | |

71 −> | *none* | |

72 −> | **DataActions** | |

73 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/trustedCollections/write | Allows push or publish of trusted collections of container registry content. This is similar to Microsoft.ContainerRegistry/registries/sign/write action except that this is a data action |

74 −> | **NotDataActions** | |

75 −> | *none* | |

76 −

77 −```json

78 −{

79 − "assignableScopes": [

80 − "/"

81 − ],

82 − "description": "acr image signer",

83 − "id": "/providers/Microsoft.Authorization/roleDefinitions/6cef56e8-d556-48e5-a04f-b8e64114680f",

84 − "name": "6cef56e8-d556-48e5-a04f-b8e64114680f",

85 − "permissions": [

86 − {

87 − "actions": [

88 − "Microsoft.ContainerRegistry/registries/sign/write"

89 − ],

90 − "notActions": [],

91 − "dataActions": [

92 − "Microsoft.ContainerRegistry/registries/trustedCollections/write"

93 − ],

94 − "notDataActions": []

95 − }

96 − ],

97 − "roleName": "AcrImageSigner",

98 − "roleType": "BuiltInRole",

99 − "type": "Microsoft.Authorization/roleDefinitions"

100 −}

101 −```

102 −

103 −## AcrPull

104 −

105 −Pull artifacts from a container registry.

106 −

107 −[Learn more](/azure/container-registry/container-registry-rbac-built-in-roles-directory-reference)

108 −

109 −> [!div class="mx-tableFixed"]

110 −> | Actions | Description |

111 −> | --- | --- |

112 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/pull/read | Pull or Get images from a container registry. |

113 −> | **NotActions** | |

114 −> | *none* | |

115 −> | **DataActions** | |

116 −> | *none* | |

117 −> | **NotDataActions** | |

118 −> | *none* | |

119 −

120 −```json

121 −{

122 − "assignableScopes": [

123 − "/"

124 − ],

125 − "description": "acr pull",

126 − "id": "/providers/Microsoft.Authorization/roleDefinitions/7f951dda-4ed3-4680-a7ca-43fe172d538d",

127 − "name": "7f951dda-4ed3-4680-a7ca-43fe172d538d",

128 − "permissions": [

129 − {

130 − "actions": [

131 − "Microsoft.ContainerRegistry/registries/pull/read"

132 − ],

133 − "notActions": [],

134 − "dataActions": [],

135 − "notDataActions": []

136 − }

137 − ],

138 − "roleName": "AcrPull",

139 − "roleType": "BuiltInRole",

140 − "type": "Microsoft.Authorization/roleDefinitions"

141 −}

142 −```

143 −

144 −## AcrPush

145 −

146 −Push artifacts to or pull artifacts from a container registry.

147 −

148 −[Learn more](/azure/container-registry/container-registry-rbac-built-in-roles-directory-reference)

149 −

150 −> [!div class="mx-tableFixed"]

151 −> | Actions | Description |

152 −> | --- | --- |

153 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/pull/read | Pull or Get images from a container registry. |

154 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/push/write | Push or Write images to a container registry. |

155 −> | **NotActions** | |

156 −> | *none* | |

157 −> | **DataActions** | |

158 −> | *none* | |

159 −> | **NotDataActions** | |

160 −> | *none* | |

161 −

162 −```json

163 −{

164 − "assignableScopes": [

165 − "/"

166 − ],

167 − "description": "acr push",

168 − "id": "/providers/Microsoft.Authorization/roleDefinitions/8311e382-0749-4cb8-b61a-304f252e45ec",

169 − "name": "8311e382-0749-4cb8-b61a-304f252e45ec",

170 − "permissions": [

171 − {

172 − "actions": [

173 − "Microsoft.ContainerRegistry/registries/pull/read",

174 − "Microsoft.ContainerRegistry/registries/push/write"

175 − ],

176 − "notActions": [],

177 − "dataActions": [],

178 − "notDataActions": []

179 − }

180 − ],

181 − "roleName": "AcrPush",

182 − "roleType": "BuiltInRole",

183 − "type": "Microsoft.Authorization/roleDefinitions"

184 −}

185 −```

186 −

187 −## AcrQuarantineReader

188 −

189 −Pull quarantined images from a container registry.

190 −

191 −[Learn more](/azure/container-registry/container-registry-rbac-built-in-roles-directory-reference)

192 −

193 −> [!div class="mx-tableFixed"]

194 −> | Actions | Description |

195 −> | --- | --- |

196 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/quarantine/read | Pull or Get quarantined images from container registry |

197 −> | **NotActions** | |

198 −> | *none* | |

199 −> | **DataActions** | |

200 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/quarantinedArtifacts/read | Allows pull or get of the quarantined artifacts from container registry. This is similar to Microsoft.ContainerRegistry/registries/quarantine/read except that it is a data action |

201 −> | **NotDataActions** | |

202 −> | *none* | |

203 −

204 −```json

205 −{

206 − "assignableScopes": [

207 − "/"

208 − ],

209 − "description": "acr quarantine data reader",

210 − "id": "/providers/Microsoft.Authorization/roleDefinitions/cdda3590-29a3-44f6-95f2-9f980659eb04",

211 − "name": "cdda3590-29a3-44f6-95f2-9f980659eb04",

212 − "permissions": [

213 − {

214 − "actions": [

215 − "Microsoft.ContainerRegistry/registries/quarantine/read"

216 − ],

217 − "notActions": [],

218 − "dataActions": [

219 − "Microsoft.ContainerRegistry/registries/quarantinedArtifacts/read"

220 − ],

221 − "notDataActions": []

222 − }

223 − ],

224 − "roleName": "AcrQuarantineReader",

225 − "roleType": "BuiltInRole",

226 − "type": "Microsoft.Authorization/roleDefinitions"

227 −}

228 −```

229 −

230 −## AcrQuarantineWriter

231 −

232 −Push quarantined images to or pull quarantined images from a container registry.

233 −

234 −[Learn more](/azure/container-registry/container-registry-rbac-built-in-roles-directory-reference)

235 −

236 −> [!div class="mx-tableFixed"]

237 −> | Actions | Description |

238 −> | --- | --- |

239 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/quarantine/read | Pull or Get quarantined images from container registry |

240 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/quarantine/write | Write/Modify quarantine state of quarantined images |

241 −> | **NotActions** | |

242 −> | *none* | |

243 −> | **DataActions** | |

244 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/quarantinedArtifacts/read | Allows pull or get of the quarantined artifacts from container registry. This is similar to Microsoft.ContainerRegistry/registries/quarantine/read except that it is a data action |

245 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/quarantinedArtifacts/write | Allows write or update of the quarantine state of quarantined artifacts. This is similar to Microsoft.ContainerRegistry/registries/quarantine/write action except that it is a data action |

246 −> | **NotDataActions** | |

247 −> | *none* | |

248 −

249 −```json

250 −{

251 − "assignableScopes": [

252 − "/"

253 − ],

254 − "description": "acr quarantine data writer",

255 − "id": "/providers/Microsoft.Authorization/roleDefinitions/c8d4ff99-41c3-41a8-9f60-21dfdad59608",

256 − "name": "c8d4ff99-41c3-41a8-9f60-21dfdad59608",

257 − "permissions": [

258 − {

259 − "actions": [

260 − "Microsoft.ContainerRegistry/registries/quarantine/read",

261 − "Microsoft.ContainerRegistry/registries/quarantine/write"

262 − ],

263 − "notActions": [],

264 − "dataActions": [

265 − "Microsoft.ContainerRegistry/registries/quarantinedArtifacts/read",

266 − "Microsoft.ContainerRegistry/registries/quarantinedArtifacts/write"

267 − ],

268 − "notDataActions": []

269 − }

270 − ],

271 − "roleName": "AcrQuarantineWriter",

272 − "roleType": "BuiltInRole",

273 − "type": "Microsoft.Authorization/roleDefinitions"

274 −}

275 −```

276 −

277 −## Azure Arc Enabled Kubernetes Cluster User Role

278 −

279 −List cluster user credentials action.

280 −

281 −> [!div class="mx-tableFixed"]

282 −> | Actions | Description |

283 −> | --- | --- |

284 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/write | Creates or updates an deployment. |

285 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/operationresults/read | Get the subscription operation results. |

286 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |

287 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

288 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/listClusterUserCredentials/action | List clusterUser credential(preview) |

289 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

290 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

291 −> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |

292 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/listClusterUserCredential/action | List clusterUser credential |

293 −> | **NotActions** | |

294 −> | *none* | |

295 −> | **DataActions** | |

296 −> | *none* | |

297 −> | **NotDataActions** | |

298 −> | *none* | |

299 −

300 −```json

301 −{

302 − "assignableScopes": [

303 − "/"

304 − ],

305 − "description": "List cluster user credentials action.",

306 − "id": "/providers/Microsoft.Authorization/roleDefinitions/00493d72-78f6-4148-b6c5-d3ce8e4799dd",

307 − "name": "00493d72-78f6-4148-b6c5-d3ce8e4799dd",

308 − "permissions": [

309 − {

310 − "actions": [

311 − "Microsoft.Resources/deployments/write",

312 − "Microsoft.Resources/subscriptions/operationresults/read",

313 − "Microsoft.Resources/subscriptions/read",

314 − "Microsoft.Resources/subscriptions/resourceGroups/read",

315 − "Microsoft.Kubernetes/connectedClusters/listClusterUserCredentials/action",

316 − "Microsoft.Authorization/*/read",

317 − "Microsoft.Insights/alertRules/*",

318 − "Microsoft.Support/*",

319 − "Microsoft.Kubernetes/connectedClusters/listClusterUserCredential/action"

320 − ],

321 − "notActions": [],

322 − "dataActions": [],

323 − "notDataActions": []

324 − }

325 − ],

326 − "roleName": "Azure Arc Enabled Kubernetes Cluster User Role",

327 − "roleType": "BuiltInRole",

328 − "type": "Microsoft.Authorization/roleDefinitions"

329 −}

330 −```

331 −

332 −## Azure Arc Kubernetes Admin

333 −

334 −Lets you manage all resources under cluster/namespace, except update or delete resource quotas and namespaces.

335 −

336 −[Learn more](/azure/azure-arc/kubernetes/azure-rbac)

337 −

338 −> [!div class="mx-tableFixed"]

339 −> | Actions | Description |

340 −> | --- | --- |

341 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

342 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

343 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/write | Creates or updates an deployment. |

344 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/operationresults/read | Get the subscription operation results. |

345 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |

346 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

347 −> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |

348 −> | **NotActions** | |

349 −> | *none* | |

350 −> | **DataActions** | |

351 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/apps/controllerrevisions/read | Reads controllerrevisions |

352 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/apps/daemonsets/* | |

353 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/apps/deployments/* | |

354 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/apps/replicasets/* | |

355 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/apps/statefulsets/* | |

356 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/authorization.k8s.io/localsubjectaccessreviews/write | Writes localsubjectaccessreviews |

357 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/autoscaling/horizontalpodautoscalers/* | |

358 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/batch/cronjobs/* | |

359 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/batch/jobs/* | |

360 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/configmaps/* | |

361 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/endpoints/* | |

362 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/events.k8s.io/events/read | Reads events |

363 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/events/read | Reads events |

364 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/extensions/daemonsets/* | |

365 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/extensions/deployments/* | |

366 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/extensions/ingresses/* | |

367 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/extensions/networkpolicies/* | |

368 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/extensions/replicasets/* | |

369 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/limitranges/read | Reads limitranges |

370 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/namespaces/read | Reads namespaces |

371 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/networking.k8s.io/ingresses/* | |

372 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/networking.k8s.io/networkpolicies/* | |

373 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/persistentvolumeclaims/* | |

374 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/pods/* | |

375 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/policy/poddisruptionbudgets/* | |

376 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/rbac.authorization.k8s.io/rolebindings/* | |

377 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/rbac.authorization.k8s.io/roles/* | |

378 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/replicationcontrollers/* | |

379 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/replicationcontrollers/* | |

380 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/resourcequotas/read | Reads resourcequotas |

381 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/secrets/* | |

382 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/serviceaccounts/* | |

383 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/services/* | |

384 −> | **NotDataActions** | |

385 −> | *none* | |

386 −

387 −```json

388 −{

389 − "assignableScopes": [

390 − "/"

391 − ],

392 − "description": "Lets you manage all resources under cluster/namespace, except update or delete resource quotas and namespaces.",

393 − "id": "/providers/Microsoft.Authorization/roleDefinitions/dffb1e0c-446f-4dde-a09f-99eb5cc68b96",

394 − "name": "dffb1e0c-446f-4dde-a09f-99eb5cc68b96",

395 − "permissions": [

396 − {

397 − "actions": [

398 − "Microsoft.Authorization/*/read",

399 − "Microsoft.Insights/alertRules/*",

400 − "Microsoft.Resources/deployments/write",

401 − "Microsoft.Resources/subscriptions/operationresults/read",

402 − "Microsoft.Resources/subscriptions/read",

403 − "Microsoft.Resources/subscriptions/resourceGroups/read",

404 − "Microsoft.Support/*"

405 − ],

406 − "notActions": [],

407 − "dataActions": [

408 − "Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read",

409 − "Microsoft.Kubernetes/connectedClusters/apps/daemonsets/*",

410 − "Microsoft.Kubernetes/connectedClusters/apps/deployments/*",

411 − "Microsoft.Kubernetes/connectedClusters/apps/replicasets/*",

412 − "Microsoft.Kubernetes/connectedClusters/apps/statefulsets/*",

413 − "Microsoft.Kubernetes/connectedClusters/authorization.k8s.io/localsubjectaccessreviews/write",

414 − "Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/*",

415 − "Microsoft.Kubernetes/connectedClusters/batch/cronjobs/*",

416 − "Microsoft.Kubernetes/connectedClusters/batch/jobs/*",

417 − "Microsoft.Kubernetes/connectedClusters/configmaps/*",

418 − "Microsoft.Kubernetes/connectedClusters/endpoints/*",

419 − "Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read",

420 − "Microsoft.Kubernetes/connectedClusters/events/read",

421 − "Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/*",

422 − "Microsoft.Kubernetes/connectedClusters/extensions/deployments/*",

423 − "Microsoft.Kubernetes/connectedClusters/extensions/ingresses/*",

424 − "Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/*",

425 − "Microsoft.Kubernetes/connectedClusters/extensions/replicasets/*",

426 − "Microsoft.Kubernetes/connectedClusters/limitranges/read",

427 − "Microsoft.Kubernetes/connectedClusters/namespaces/read",

428 − "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/*",

429 − "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/*",

430 − "Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/*",

431 − "Microsoft.Kubernetes/connectedClusters/pods/*",

432 − "Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/*",

433 − "Microsoft.Kubernetes/connectedClusters/rbac.authorization.k8s.io/rolebindings/*",

434 − "Microsoft.Kubernetes/connectedClusters/rbac.authorization.k8s.io/roles/*",

435 − "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",

436 − "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",

437 − "Microsoft.Kubernetes/connectedClusters/resourcequotas/read",

438 − "Microsoft.Kubernetes/connectedClusters/secrets/*",

439 − "Microsoft.Kubernetes/connectedClusters/serviceaccounts/*",

440 − "Microsoft.Kubernetes/connectedClusters/services/*"

441 − ],

442 − "notDataActions": []

443 − }

444 − ],

445 − "roleName": "Azure Arc Kubernetes Admin",

446 − "roleType": "BuiltInRole",

447 − "type": "Microsoft.Authorization/roleDefinitions"

448 −}

449 −```

450 −

451 −## Azure Arc Kubernetes Cluster Admin

452 −

453 −Lets you manage all resources in the cluster.

454 −

455 −[Learn more](/azure/azure-arc/kubernetes/azure-rbac)

456 −

457 −> [!div class="mx-tableFixed"]

458 −> | Actions | Description |

459 −> | --- | --- |

460 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

461 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

462 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/write | Creates or updates an deployment. |

463 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/operationresults/read | Get the subscription operation results. |

464 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |

465 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

466 −> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |

467 −> | **NotActions** | |

468 −> | *none* | |

469 −> | **DataActions** | |

470 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/* | |

471 −> | **NotDataActions** | |

472 −> | *none* | |

473 −

474 −```json

475 −{

476 − "assignableScopes": [

477 − "/"

478 − ],

479 − "description": "Lets you manage all resources in the cluster.",

480 − "id": "/providers/Microsoft.Authorization/roleDefinitions/8393591c-06b9-48a2-a542-1bd6b377f6a2",

481 − "name": "8393591c-06b9-48a2-a542-1bd6b377f6a2",

482 − "permissions": [

483 − {

484 − "actions": [

485 − "Microsoft.Authorization/*/read",

486 − "Microsoft.Insights/alertRules/*",

487 − "Microsoft.Resources/deployments/write",

488 − "Microsoft.Resources/subscriptions/operationresults/read",

489 − "Microsoft.Resources/subscriptions/read",

490 − "Microsoft.Resources/subscriptions/resourceGroups/read",

491 − "Microsoft.Support/*"

492 − ],

493 − "notActions": [],

494 − "dataActions": [

495 − "Microsoft.Kubernetes/connectedClusters/*"

496 − ],

497 − "notDataActions": []

498 − }

499 − ],

500 − "roleName": "Azure Arc Kubernetes Cluster Admin",

501 − "roleType": "BuiltInRole",

502 − "type": "Microsoft.Authorization/roleDefinitions"

503 −}

504 −```

505 −

506 −## Azure Arc Kubernetes Viewer

507 −

508 −Lets you view all resources in cluster/namespace, except secrets.

509 −

510 −[Learn more](/azure/azure-arc/kubernetes/azure-rbac)

511 −

512 −> [!div class="mx-tableFixed"]

513 −> | Actions | Description |

514 −> | --- | --- |

515 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

516 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

517 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/write | Creates or updates an deployment. |

518 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/operationresults/read | Get the subscription operation results. |

519 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |

520 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

521 −> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |

522 −> | **NotActions** | |

523 −> | *none* | |

524 −> | **DataActions** | |

525 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/apps/controllerrevisions/read | Reads controllerrevisions |

526 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/apps/daemonsets/read | Reads daemonsets |

527 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/apps/deployments/read | Reads deployments |

528 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/apps/replicasets/read | Reads replicasets |

529 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/apps/statefulsets/read | Reads statefulsets |

530 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/autoscaling/horizontalpodautoscalers/read | Reads horizontalpodautoscalers |

531 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/batch/cronjobs/read | Reads cronjobs |

532 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/batch/jobs/read | Reads jobs |

533 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/configmaps/read | Reads configmaps |

534 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/endpoints/read | Reads endpoints |

535 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/events.k8s.io/events/read | Reads events |

536 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/events/read | Reads events |

537 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/extensions/daemonsets/read | Reads daemonsets |

538 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/extensions/deployments/read | Reads deployments |

539 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/extensions/ingresses/read | Reads ingresses |

540 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/extensions/networkpolicies/read | Reads networkpolicies |

541 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/extensions/replicasets/read | Reads replicasets |

542 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/limitranges/read | Reads limitranges |

543 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/namespaces/read | Reads namespaces |

544 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/networking.k8s.io/ingresses/read | Reads ingresses |

545 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/networking.k8s.io/networkpolicies/read | Reads networkpolicies |

546 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/persistentvolumeclaims/read | Reads persistentvolumeclaims |

547 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/pods/read | Reads pods |

548 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/policy/poddisruptionbudgets/read | Reads poddisruptionbudgets |

549 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/replicationcontrollers/read | Reads replicationcontrollers |

550 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/replicationcontrollers/read | Reads replicationcontrollers |

551 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/resourcequotas/read | Reads resourcequotas |

552 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/serviceaccounts/read | Reads serviceaccounts |

553 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/services/read | Reads services |

554 −> | **NotDataActions** | |

555 −> | *none* | |

556 −

557 −```json

558 −{

559 − "assignableScopes": [

560 − "/"

561 − ],

562 − "description": "Lets you view all resources in cluster/namespace, except secrets.",

563 − "id": "/providers/Microsoft.Authorization/roleDefinitions/63f0a09d-1495-4db4-a681-037d84835eb4",

564 − "name": "63f0a09d-1495-4db4-a681-037d84835eb4",

565 − "permissions": [

566 − {

567 − "actions": [

568 − "Microsoft.Authorization/*/read",

569 − "Microsoft.Insights/alertRules/*",

570 − "Microsoft.Resources/deployments/write",

571 − "Microsoft.Resources/subscriptions/operationresults/read",

572 − "Microsoft.Resources/subscriptions/read",

573 − "Microsoft.Resources/subscriptions/resourceGroups/read",

574 − "Microsoft.Support/*"

575 − ],

576 − "notActions": [],

577 − "dataActions": [

578 − "Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read",

579 − "Microsoft.Kubernetes/connectedClusters/apps/daemonsets/read",

580 − "Microsoft.Kubernetes/connectedClusters/apps/deployments/read",

581 − "Microsoft.Kubernetes/connectedClusters/apps/replicasets/read",

582 − "Microsoft.Kubernetes/connectedClusters/apps/statefulsets/read",

583 − "Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/read",

584 − "Microsoft.Kubernetes/connectedClusters/batch/cronjobs/read",

585 − "Microsoft.Kubernetes/connectedClusters/batch/jobs/read",

586 − "Microsoft.Kubernetes/connectedClusters/configmaps/read",

587 − "Microsoft.Kubernetes/connectedClusters/endpoints/read",

588 − "Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read",

589 − "Microsoft.Kubernetes/connectedClusters/events/read",

590 − "Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/read",

591 − "Microsoft.Kubernetes/connectedClusters/extensions/deployments/read",

592 − "Microsoft.Kubernetes/connectedClusters/extensions/ingresses/read",

593 − "Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/read",

594 − "Microsoft.Kubernetes/connectedClusters/extensions/replicasets/read",

595 − "Microsoft.Kubernetes/connectedClusters/limitranges/read",

596 − "Microsoft.Kubernetes/connectedClusters/namespaces/read",

597 − "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/read",

598 − "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/read",

599 − "Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/read",

600 − "Microsoft.Kubernetes/connectedClusters/pods/read",

601 − "Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/read",

602 − "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/read",

603 − "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/read",

604 − "Microsoft.Kubernetes/connectedClusters/resourcequotas/read",

605 − "Microsoft.Kubernetes/connectedClusters/serviceaccounts/read",

606 − "Microsoft.Kubernetes/connectedClusters/services/read"

607 − ],

608 − "notDataActions": []

609 − }

610 − ],

611 − "roleName": "Azure Arc Kubernetes Viewer",

612 − "roleType": "BuiltInRole",

613 − "type": "Microsoft.Authorization/roleDefinitions"

614 −}

615 −```

616 −

617 −## Azure Arc Kubernetes Writer

618 −

619 −Lets you update everything in cluster/namespace, except (cluster)roles and (cluster)role bindings.

620 −

621 −[Learn more](/azure/azure-arc/kubernetes/azure-rbac)

622 −

623 −> [!div class="mx-tableFixed"]

624 −> | Actions | Description |

625 −> | --- | --- |

626 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

627 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

628 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/write | Creates or updates an deployment. |

629 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/operationresults/read | Get the subscription operation results. |

630 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |

631 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

632 −> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |

633 −> | **NotActions** | |

634 −> | *none* | |

635 −> | **DataActions** | |

636 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/apps/controllerrevisions/read | Reads controllerrevisions |

637 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/apps/daemonsets/* | |

638 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/apps/deployments/* | |

639 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/apps/replicasets/* | |

640 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/apps/statefulsets/* | |

641 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/autoscaling/horizontalpodautoscalers/* | |

642 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/batch/cronjobs/* | |

643 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/batch/jobs/* | |

644 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/configmaps/* | |

645 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/endpoints/* | |

646 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/events.k8s.io/events/read | Reads events |

647 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/events/read | Reads events |

648 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/extensions/daemonsets/* | |

649 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/extensions/deployments/* | |

650 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/extensions/ingresses/* | |

651 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/extensions/networkpolicies/* | |

652 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/extensions/replicasets/* | |

653 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/limitranges/read | Reads limitranges |

654 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/namespaces/read | Reads namespaces |

655 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/networking.k8s.io/ingresses/* | |

656 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/networking.k8s.io/networkpolicies/* | |

657 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/persistentvolumeclaims/* | |

658 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/pods/* | |

659 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/policy/poddisruptionbudgets/* | |

660 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/replicationcontrollers/* | |

661 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/replicationcontrollers/* | |

662 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/resourcequotas/read | Reads resourcequotas |

663 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/secrets/* | |

664 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/serviceaccounts/* | |

665 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/services/* | |

666 −> | **NotDataActions** | |

667 −> | *none* | |

668 −

669 −```json

670 −{

671 − "assignableScopes": [

672 − "/"

673 − ],

674 − "description": "Lets you update everything in cluster/namespace, except (cluster)roles and (cluster)role bindings.",

675 − "id": "/providers/Microsoft.Authorization/roleDefinitions/5b999177-9696-4545-85c7-50de3797e5a1",

676 − "name": "5b999177-9696-4545-85c7-50de3797e5a1",

677 − "permissions": [

678 − {

679 − "actions": [

680 − "Microsoft.Authorization/*/read",

681 − "Microsoft.Insights/alertRules/*",

682 − "Microsoft.Resources/deployments/write",

683 − "Microsoft.Resources/subscriptions/operationresults/read",

684 − "Microsoft.Resources/subscriptions/read",

685 − "Microsoft.Resources/subscriptions/resourceGroups/read",

686 − "Microsoft.Support/*"

687 − ],

688 − "notActions": [],

689 − "dataActions": [

690 − "Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read",

691 − "Microsoft.Kubernetes/connectedClusters/apps/daemonsets/*",

692 − "Microsoft.Kubernetes/connectedClusters/apps/deployments/*",

693 − "Microsoft.Kubernetes/connectedClusters/apps/replicasets/*",

694 − "Microsoft.Kubernetes/connectedClusters/apps/statefulsets/*",

695 − "Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/*",

696 − "Microsoft.Kubernetes/connectedClusters/batch/cronjobs/*",

697 − "Microsoft.Kubernetes/connectedClusters/batch/jobs/*",

698 − "Microsoft.Kubernetes/connectedClusters/configmaps/*",

699 − "Microsoft.Kubernetes/connectedClusters/endpoints/*",

700 − "Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read",

701 − "Microsoft.Kubernetes/connectedClusters/events/read",

702 − "Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/*",

703 − "Microsoft.Kubernetes/connectedClusters/extensions/deployments/*",

704 − "Microsoft.Kubernetes/connectedClusters/extensions/ingresses/*",

705 − "Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/*",

706 − "Microsoft.Kubernetes/connectedClusters/extensions/replicasets/*",

707 − "Microsoft.Kubernetes/connectedClusters/limitranges/read",

708 − "Microsoft.Kubernetes/connectedClusters/namespaces/read",

709 − "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/*",

710 − "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/*",

711 − "Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/*",

712 − "Microsoft.Kubernetes/connectedClusters/pods/*",

713 − "Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/*",

714 − "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",

715 − "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",

716 − "Microsoft.Kubernetes/connectedClusters/resourcequotas/read",

717 − "Microsoft.Kubernetes/connectedClusters/secrets/*",

718 − "Microsoft.Kubernetes/connectedClusters/serviceaccounts/*",

719 − "Microsoft.Kubernetes/connectedClusters/services/*"

720 − ],

721 − "notDataActions": []

722 − }

723 − ],

724 − "roleName": "Azure Arc Kubernetes Writer",

725 − "roleType": "BuiltInRole",

726 − "type": "Microsoft.Authorization/roleDefinitions"

727 −}

728 −```

729 −

730 −## Azure Container Storage Contributor

731 −

732 −Install Azure Container Storage and manage its storage resources. Includes an ABAC condition to constrain role assignments.

733 −

734 −> [!div class="mx-tableFixed"]

735 −> | Actions | Description |

736 −> | --- | --- |

737 −> | [Microsoft.KubernetesConfiguration](../permissions/hybrid-multicloud.md#microsoftkubernetesconfiguration)/extensions/write | Creates or updates extension resource. |

738 −> | [Microsoft.KubernetesConfiguration](../permissions/hybrid-multicloud.md#microsoftkubernetesconfiguration)/extensions/read | Gets extension instance resource. |

739 −> | [Microsoft.KubernetesConfiguration](../permissions/hybrid-multicloud.md#microsoftkubernetesconfiguration)/extensions/delete | Deletes extension instance resource. |

740 −> | [Microsoft.KubernetesConfiguration](../permissions/hybrid-multicloud.md#microsoftkubernetesconfiguration)/extensions/operations/read | Gets Async Operation status. |

741 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

742 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

743 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |

744 −> | [Microsoft.Management](../permissions/management-and-governance.md#microsoftmanagement)/managementGroups/read | List management groups for the authenticated user. |

745 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

746 −> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |

747 −> | **NotActions** | |

748 −> | *none* | |

749 −> | **DataActions** | |

750 −> | *none* | |

751 −> | **NotDataActions** | |

752 −> | *none* | |

753 −> | **Actions** | |

754 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/write | Create a role assignment at the specified scope. |

755 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/delete | Delete a role assignment at the specified scope. |

756 −> | **NotActions** | |

757 −> | *none* | |

758 −> | **DataActions** | |

759 −> | *none* | |

760 −> | **NotDataActions** | |

761 −> | *none* | |

762 −> | **Condition** | |

763 −> | ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619})) | Add or remove role assignments for the following roles:<br/>Azure Container Storage Operator |

764 −

765 −```json

766 −{

767 − "assignableScopes": [

768 − "/"

769 − ],

770 − "description": "Lets you install Azure Container Storage and manage its storage resources",

771 − "id": "/providers/Microsoft.Authorization/roleDefinitions/95dd08a6-00bd-4661-84bf-f6726f83a4d0",

772 − "name": "95dd08a6-00bd-4661-84bf-f6726f83a4d0",

773 − "permissions": [

774 − {

775 − "actions": [

776 − "Microsoft.KubernetesConfiguration/extensions/write",

777 − "Microsoft.KubernetesConfiguration/extensions/read",

778 − "Microsoft.KubernetesConfiguration/extensions/delete",

779 − "Microsoft.KubernetesConfiguration/extensions/operations/read",

780 − "Microsoft.Authorization/*/read",

781 − "Microsoft.Resources/subscriptions/resourceGroups/read",

782 − "Microsoft.Resources/subscriptions/read",

783 − "Microsoft.Management/managementGroups/read",

784 − "Microsoft.Resources/deployments/*",

785 − "Microsoft.Support/*"

786 − ],

787 − "notActions": [],

788 − "dataActions": [],

789 − "notDataActions": []

790 − },

791 − {

792 − "actions": [

793 − "Microsoft.Authorization/roleAssignments/write",

794 − "Microsoft.Authorization/roleAssignments/delete"

795 − ],

796 − "notActions": [],

797 − "dataActions": [],

798 − "notDataActions": [],

799 − "conditionVersion": "2.0",

800 − "condition": "((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{08d4c71acc634ce4a9c85dd251b4d619}))"

801 − }

802 − ],

803 − "roleName": "Azure Container Storage Contributor",

804 − "roleType": "BuiltInRole",

805 − "type": "Microsoft.Authorization/roleDefinitions"

Azure built-in roles · containers

Microsoft's edit · 26 May 2025 19:45 UTC