// roles/azure · containers

Azure Kubernetes Service Arc Contributor RoleAzure built-in role

Grants access to read and write Azure Kubernetes Services hybrid clusters

Role ID	`5d3f1697-4507-4d08-bb4a-477695db5f82`
Category	Containers
Actions	37
Data actions	0

What it can do

Permission	What it allows
`Microsoft.HybridContainerService/Locations/operationStatuses/read`	read operationStatuses
`Microsoft.HybridContainerService/Locations/operationStatuses/write`	write operationStatuses
`Microsoft.HybridContainerService/Operations/read`	read Operations
`Microsoft.HybridContainerService/kubernetesVersions/read`	Gets the supported kubernetes versions from the underlying custom location
`Microsoft.HybridContainerService/kubernetesVersions/write`	Puts the kubernetes version resource type
`Microsoft.HybridContainerService/kubernetesVersions/delete`	Delete the kubernetes versions resource type
`Microsoft.HybridContainerService/provisionedClusterInstances/read`	Gets the Hybrid AKS provisioned cluster instance
`Microsoft.HybridContainerService/provisionedClusterInstances/write`	Creates the Hybrid AKS provisioned cluster instance
`Microsoft.HybridContainerService/provisionedClusterInstances/delete`	Deletes the Hybrid AKS provisioned cluster instance
`Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/read`	Gets the agent pool in the Hybrid AKS provisioned cluster instance
`Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/write`	Creates the agent pool in the Hybrid AKS provisioned cluster instance
`Microsoft.HybridContainerService/provisionedClusterInstances/agentPools/delete`	Deletes the agent pool in the Hybrid AKS provisioned cluster instance
`Microsoft.HybridContainerService/provisionedClusterInstances/upgradeProfiles/read`	read upgradeProfiles
`Microsoft.HybridContainerService/skus/read`	Gets the supported VM skus from the underlying custom location
`Microsoft.HybridContainerService/skus/write`	Puts the VM SKUs resource type
`Microsoft.HybridContainerService/skus/delete`	Deletes the Vm Sku resource type
`Microsoft.HybridContainerService/virtualNetworks/read`	Gets the Hybrid AKS virtual network
`Microsoft.HybridContainerService/virtualNetworks/write`	Puts the Hybrid AKS virtual network
`Microsoft.HybridContainerService/virtualNetworks/delete`	Deletes the Hybrid AKS virtual network
`Microsoft.ExtendedLocation/customLocations/deploy/action`	Deploy permissions to a Custom Location resource
`Microsoft.ExtendedLocation/customLocations/read`	Gets an Custom Location resource
`Microsoft.Kubernetes/connectedClusters/Read`	Read connectedClusters
`Microsoft.Kubernetes/connectedClusters/Write`	Writes connectedClusters
`Microsoft.Kubernetes/connectedClusters/Delete`	Deletes connectedClusters
`Microsoft.Kubernetes/connectedClusters/listClusterUserCredential/action`	List clusterUser credential
`Microsoft.AzureStackHCI/clusters/read`	Gets clusters
`Microsoft.Resources/deployments/read`	Gets or lists deployments.
`Microsoft.Resources/deployments/write`	Creates or updates an deployment.
`Microsoft.Resources/deployments/delete`	Deletes a deployment.
`Microsoft.Resources/deployments/cancel/action`	Cancels a deployment.
`Microsoft.Resources/deployments/validate/action`	Validates a deployment.
`Microsoft.Resources/deployments/whatIf/action`	Predicts template deployment changes.
`Microsoft.Resources/deployments/exportTemplate/action`	Export template for a deployment
`Microsoft.Resources/deployments/operations/read`	Gets or lists deployment operations.
`Microsoft.Resources/deployments/operationstatuses/read`	Gets or lists deployment operation statuses.
`Microsoft.HybridContainerService/provisionedClusterInstances/hybridIdentityMetadata/delete`	Deletes the hybrid identity metadata proxy resource.
`Microsoft.HybridContainerService/provisionedClusterInstances/hybridIdentityMetadata/write`	Creates the hybrid identity metadata proxy resource that facilitates the managed identity provisioning.

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Azure Kubernetes Service Arc Contributor Role" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Azure Kubernetes Service Arc Contributor Role" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '5d3f1697-4507-4d08-bb4a-477695db5f82')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5d3f1697-4507-4d08-bb4a-477695db5f82')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "5d3f1697-4507-4d08-bb4a-477695db5f82"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other containers roles

AcrDelete · 1 permission
AcrPull · 1 permission
Connected Cluster Managed Identity CheckAccess Reader · 1 permission
Container Registry Cache Rule Reader · 1 permission
Container Registry Credential Set Reader · 1 permission
Container Registry Repository Catalog Lister · 1 permission
AcrImageSigner · 2 permissions
AcrPush · 2 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles