// roles/azure · containers

Azure Arc Kubernetes AdminAzure built-in role

Lets you manage all resources under cluster/namespace, except update or delete resource quotas and namespaces.

Role ID	`dffb1e0c-446f-4dde-a09f-99eb5cc68b96`
Category	Containers
Actions	7
Data actions	32

Before you assign it

It reaches the data, not just the resource. It has 32 data actions, such as reading blobs, secrets or messages.

What it can do

Permission	What it allows
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.Insights/alertRules/*`	Every operation under Microsoft.Insights/alertRules
`Microsoft.Resources/deployments/write`	Creates or updates an deployment.
`Microsoft.Resources/subscriptions/operationresults/read`	Get the subscription operation results.
`Microsoft.Resources/subscriptions/read`	Gets the list of subscriptions.
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.Support/*`	Every operation under Microsoft.Support

Data actions

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Azure Arc Kubernetes Admin" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Azure Arc Kubernetes Admin" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, 'dffb1e0c-446f-4dde-a09f-99eb5cc68b96')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'dffb1e0c-446f-4dde-a09f-99eb5cc68b96')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "dffb1e0c-446f-4dde-a09f-99eb5cc68b96"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other containers roles

AcrDelete · 1 permission
AcrPull · 1 permission
Connected Cluster Managed Identity CheckAccess Reader · 1 permission
Container Registry Cache Rule Reader · 1 permission
Container Registry Credential Set Reader · 1 permission
Container Registry Repository Catalog Lister · 1 permission
AcrImageSigner · 2 permissions
AcrPush · 2 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles

Permission	What it allows
`Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read`	Reads controllerrevisions
`Microsoft.Kubernetes/connectedClusters/apps/daemonsets/*`	Every operation under Microsoft.Kubernetes/connectedClusters/apps/daemonsets
`Microsoft.Kubernetes/connectedClusters/apps/deployments/*`	Every operation under Microsoft.Kubernetes/connectedClusters/apps/deployments
`Microsoft.Kubernetes/connectedClusters/apps/replicasets/*`	Every operation under Microsoft.Kubernetes/connectedClusters/apps/replicasets
`Microsoft.Kubernetes/connectedClusters/apps/statefulsets/*`	Every operation under Microsoft.Kubernetes/connectedClusters/apps/statefulsets
`Microsoft.Kubernetes/connectedClusters/authorization.k8s.io/localsubjectaccessreviews/write`	Writes localsubjectaccessreviews
`Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/*`	Every operation under Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers
`Microsoft.Kubernetes/connectedClusters/batch/cronjobs/*`	Every operation under Microsoft.Kubernetes/connectedClusters/batch/cronjobs
`Microsoft.Kubernetes/connectedClusters/batch/jobs/*`	Every operation under Microsoft.Kubernetes/connectedClusters/batch/jobs
`Microsoft.Kubernetes/connectedClusters/configmaps/*`	Every operation under Microsoft.Kubernetes/connectedClusters/configmaps
`Microsoft.Kubernetes/connectedClusters/endpoints/*`	Every operation under Microsoft.Kubernetes/connectedClusters/endpoints
`Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read`	Reads events
`Microsoft.Kubernetes/connectedClusters/events/read`	Reads events
`Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/*`	Every operation under Microsoft.Kubernetes/connectedClusters/extensions/daemonsets
`Microsoft.Kubernetes/connectedClusters/extensions/deployments/*`	Every operation under Microsoft.Kubernetes/connectedClusters/extensions/deployments
`Microsoft.Kubernetes/connectedClusters/extensions/ingresses/*`	Every operation under Microsoft.Kubernetes/connectedClusters/extensions/ingresses
`Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/*`	Every operation under Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies
`Microsoft.Kubernetes/connectedClusters/extensions/replicasets/*`	Every operation under Microsoft.Kubernetes/connectedClusters/extensions/replicasets
`Microsoft.Kubernetes/connectedClusters/limitranges/read`	Reads limitranges
`Microsoft.Kubernetes/connectedClusters/namespaces/read`	Reads namespaces
`Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/*`	Every operation under Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses
`Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/*`	Every operation under Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies
`Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/*`	Every operation under Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims
`Microsoft.Kubernetes/connectedClusters/pods/*`	Every operation under Microsoft.Kubernetes/connectedClusters/pods
`Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/*`	Every operation under Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets
`Microsoft.Kubernetes/connectedClusters/rbac.authorization.k8s.io/rolebindings/*`	Every operation under Microsoft.Kubernetes/connectedClusters/rbac.authorization.k8s.io/rolebindings
`Microsoft.Kubernetes/connectedClusters/rbac.authorization.k8s.io/roles/*`	Every operation under Microsoft.Kubernetes/connectedClusters/rbac.authorization.k8s.io/roles
`Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*`	Every operation under Microsoft.Kubernetes/connectedClusters/replicationcontrollers
`Microsoft.Kubernetes/connectedClusters/resourcequotas/read`	Reads resourcequotas
`Microsoft.Kubernetes/connectedClusters/secrets/*`	Every operation under Microsoft.Kubernetes/connectedClusters/secrets
`Microsoft.Kubernetes/connectedClusters/serviceaccounts/*`	Every operation under Microsoft.Kubernetes/connectedClusters/serviceaccounts
`Microsoft.Kubernetes/connectedClusters/services/*`	Every operation under Microsoft.Kubernetes/connectedClusters/services