<p>Azure Admins created a cluster for us.
On VM I installed <code>&quot;az cli&quot; and &quot;kubectl&quot;</code>.
With my account from Azure Portal I can see that Kubernetes Service and Resource Group to which it belongs.
From the level of that cluster in Azure Portal I can see that I have a role:</p>
<blockquote>
<p>&quot;AKS Cluster Admin Operator&quot;</p>
</blockquote>
<p>I am logged on  VM with kubectl with my account. I need to config my kubectl to work with our cluster.
When I try to execute:</p>
<pre><code>az aks get-credentials --resource-group FRONT-AKS-NA2 --name front-aks
</code></pre>
<p>I am getting error:</p>
<blockquote>
<p>ForbiddenError: The client 'my_name@my_comp.COM' with object id
'4ea46ad637c6' does not have authorization to perform action
'Microsoft.ContainerService/managedClusters/listClusterUserCredential/action'
over scope
'/subscriptions/89e05d73-8862-4007-a700-0f895fc0f7ea/resourceGroups/FRONT-AKS-NA2/providers/Microsoft.ContainerService/managedClusters/front-aks'
or the scope is invalid. If access was recently granted, please
refresh your credentials.</p>
</blockquote>

<p>In my case to refresh recently granted credentials helped this one:</p>
<pre class="lang-sh prettyprint-override"><code>az account set --subscription &quot;your current subscription name&quot;
</code></pre>
<p>It led to re-login and fix the issue.</p>
