Azure built-in roles · containers

This page's changes and edits · All guidance changes

Microsoft's edit · 19 Sep 2025 22:34 UTC

Adding changes to roles and adding to What's New

Microsoft's commit message in MicrosoftDocs/azure-docs · commit 9cf6424 · +49 ~~−35~~ lines · also on GitHub

⋯ 1909 unchanged lines

19101910

19111911 Allows users to create and manage Azure Kubernetes Service namespace resources.

19121912

1913 +[Learn more](/azure/aks/concepts-managed-namespaces)

1914 +

19131915 > [!div class="mx-tableFixed"]

19141916 > | Actions | Description |

19151917 > | --- | --- |

⋯ 7 unchanged lines

19231925 > | **DataActions** | |

19241926 > | *none* | |

19251927 > | **NotDataActions** | |

1926 −> | *none* | Writes resourcequotas |

1928 +> | *none* | |

19271929

19281930 ```json

19291931 {

1930 − "Name": "Azure Kubernetes Service Namespace Contributor",

1931 − "Id": "289d8817-ee69-43f1-a0af-43a45505b488",

1932 − "IsCustom": false,

1933 − "Description": "Allows users to create and manage Azure Kubernetes Service namespace resources.",

1934 − "Actions": [

1935 − "Microsoft.Authorization/*/read",

1936 − "Microsoft.Insights/alertRules/*",

1937 − "Microsoft.Resources/subscriptions/resourceGroups/read",

1938 − "Microsoft.ContainerService/managedClusters/managedNamespaces/*",

1939 − "Microsoft.Resources/deployments/*"

1940 − ],

1941 − "NotActions": [],

1942 − "DataActions": [],

1943 − "NotDataActions": [],

1944 − "AssignableScopes": [

1932 + "assignableScopes": [

19451933 "/"

19461934 ],

1947 − "Condition": null,

1948 − "ConditionVersion": null

1935 + "description": "Allows users to create and manage Azure Kubernetes Service namespace resources.",

1936 + "id": "/providers/Microsoft.Authorization/roleDefinitions/289d8817-ee69-43f1-a0af-43a45505b488",

1937 + "name": "289d8817-ee69-43f1-a0af-43a45505b488",

1938 + "permissions": [

1939 + {

1940 + "actions": [

1941 + "Microsoft.Authorization/*/read",

1942 + "Microsoft.Insights/alertRules/*",

1943 + "Microsoft.Resources/subscriptions/resourceGroups/read",

1944 + "Microsoft.ContainerService/managedClusters/managedNamespaces/*",

1945 + "Microsoft.Resources/deployments/*"

1946 + ],

1947 + "notActions": [],

1948 + "dataActions": [],

1949 + "notDataActions": []

1950 + }

1951 + ],

1952 + "roleName": "Azure Kubernetes Service Namespace Contributor",

1953 + "roleType": "BuiltInRole",

1954 + "type": "Microsoft.Authorization/roleDefinitions"

19491955 }

19501956 ```

19511957

1958 +

19521959 ## Azure Kubernetes Service Namespace User

19531960

19541961 Allows users to read Azure Kubernetes Service namespace resources. In-cluster namespace access further requires assignment of Azure Kubernetes Service RBAC roles to the namespace resource for an Entra ID enabled cluster.

19551962

1963 +[Learn more](/azure/aks/concepts-managed-namespaces)

1964 +

19561965 > [!div class="mx-tableFixed"]

19571966 > | Actions | Description |

19581967 > | --- | --- |

1959 −> | [Microsoft.ContainerService](../permissions/containers.md#microsoftcontainerservice)/managedClusters/managedNamespaces/read | Reads namespaces |

1960 −> | [Microsoft.ContainerService](../permissions/containers.md#microsoftcontainerservice)/managedClusters/managedNamespaces/listCredential/action | List credentials for the given namespace |

1968 +> | [Microsoft.ContainerService](../permissions/containers.md#microsoftcontainerservice)/managedClusters/managedNamespaces/read | Get a managed namespace of a managed cluster |

1969 +> | [Microsoft.ContainerService](../permissions/containers.md#microsoftcontainerservice)/managedClusters/managedNamespaces/listCredential/action | List cluster credentials of a managed namespace |

19611970 > | **NotActions** | |

19621971 > | *none* | |

19631972 > | **DataActions** | |

19641973 > | *none* | |

19651974 > | **NotDataActions** | |

1966 −> | *none* | Writes resourcequotas |

1975 +> | *none* | |

19671976

19681977 ```json

19691978 {

1970 − "Name": "Azure Kubernetes Service Namespace User",

1971 − "Id": "c9f76ca8-b262-4b10-8ed2-09cf0948aa35",

1972 − "IsCustom": false,

1973 − "Description": "Allows users to read Azure Kubernetes Service namespace resources. In-cluster namespace access further requires assignment of Azure Kubernetes Service RBAC roles to the namespace resource for an Entra ID enabled cluster.",

1974 − "Actions": [

1975 − "Microsoft.ContainerService/managedClusters/managedNamespaces/read",

1976 − "Microsoft.ContainerService/managedClusters/managedNamespaces/listCredential/action"

1977 − ],

1978 − "NotActions": [],

1979 − "DataActions": [],

1980 − "NotDataActions": [],

1981 − "AssignableScopes": [

1979 + "assignableScopes": [

19821980 "/"

19831981 ],

1984 − "Condition": null,

1985 − "ConditionVersion": null

1982 + "description": "Allows users to read Azure Kubernetes Service namespace resources. In-cluster namespace access further requires assignment of Azure Kubernetes Service RBAC roles to the namespace resource for an Entra ID enabled cluster.",

1983 + "id": "/providers/Microsoft.Authorization/roleDefinitions/c9f76ca8-b262-4b10-8ed2-09cf0948aa35",

1984 + "name": "c9f76ca8-b262-4b10-8ed2-09cf0948aa35",

1985 + "permissions": [

1986 + {

1987 + "actions": [

1988 + "Microsoft.ContainerService/managedClusters/managedNamespaces/read",

1989 + "Microsoft.ContainerService/managedClusters/managedNamespaces/listCredential/action"

1990 + ],

1991 + "notActions": [],

1992 + "dataActions": [],

1993 + "notDataActions": []

1994 + }

1995 + ],

1996 + "roleName": "Azure Kubernetes Service Namespace User",

1997 + "roleType": "BuiltInRole",

1998 + "type": "Microsoft.Authorization/roleDefinitions"

19861999 }

19872000 ```

2001 +

19882002

19892003 ## Azure Kubernetes Service RBAC Admin

19902004

⋯ 2618 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/azure-docs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy today 09:05 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.