<p>I am trying to update my Azure Kubernetes Service (AKS) cluster with the following command:</p>
<pre><code>az aks upgrade \
    --resource-group myResourceGroup \
    --name myAKSCluster \
    --kubernetes-version KUBERNETES_VERSION
</code></pre>
<p>This results in the following response:</p>
<blockquote>
<p>(AuthorizationFailed) The client '&gt;email&lt;' with object id '&gt;object id&lt;' does not have authorization to perform action 'Microsoft.ContainerService/managedClusters/write' over scope '/subscriptions/&gt;id&lt;/resourceGroups/&gt;resourcegroup-name&lt;/providers/Microsoft.ContainerService/managedClusters/&gt;cluster-name&lt;' or the scope is invalid. If access was recently granted, please refresh your credentials.
Code: AuthorizationFailed</p>
</blockquote>
<p>When I go to resourcegroup/Access Control(IAM), I find these roles assigned to me when I click on &quot;view my access&quot;</p>
<p><a href="https://i.stack.imgur.com/080s6.png" rel="nofollow noreferrer">IAM access control roles</a></p>
<p>These are:</p>
<pre><code>Azure Kubernetes Service Cluster Admin Role
List cluster admin credential action.
--
Azure Kubernetes Service RBAC Cluster Admin
Lets you manage all resources in the cluster.
--
Reader
View all resources, but does not allow you to make any changes.
--
Storage Account Contributor
Lets you manage storage accounts, including accessing storage account keys which prov...
</code></pre>
<p>I would expect that having the role &quot;Azure Kubernetes Service RBAC Cluster Admin&quot; that says:
&quot;Lets you manage all resources in the cluster.&quot; would authorize me to upgrade the cluster to a new version.</p>
<p>I run into the same problem when trying to create a static IP-adress via the Microsoft documentation</p>

Jens Voorpyl
<p>Created Kubernetes cluster with 1.24 version when I run the same command got the same error:</p>
<pre class="lang-yaml prettyprint-override"><code>az aks upgrade \
    --resource-group myResourceGroup \
    --name myAKSCluster \
    --kubernetes-version KUBERNETES_VERSION
</code></pre>
<p><a href="https://i.stack.imgur.com/iMMMg.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/iMMMg.png" alt="![enter image description here](https://i.imgur.com/1xgaXsy.png)" /></a></p>
<p>To resolve this issue, make sure to add <strong><code>Contributor</code></strong> role to the user in subscription level.</p>
<p><img src="https://i.imgur.com/eizcLIV.png" alt="enter image description here" /></p>
<p>Now when I run the below command got result successfully:</p>
<pre><code>az aks upgrade --resource-group &lt;RGName&gt; --name &lt;myAKSCluster&gt; --kubernetes-version 1.25
</code></pre>
<p><img src="https://i.imgur.com/8iicEtJ.png" alt="enter image description here" /></p>
<pre><code>agentPoolProfiles&quot;: [
    {
      &quot;availabilityZones&quot;: [
        &quot;1&quot;,
        &quot;2&quot;,
        &quot;3&quot;
      ],
      &quot;count&quot;: 1,
      &quot;creationData&quot;: null,
      &quot;currentOrchestratorVersion&quot;: &quot;1.25.6&quot;,
      &quot;enableAutoScaling&quot;: true,
      &quot;enableEncryptionAtHost&quot;: null,
      &quot;enableFips&quot;: false,
      &quot;enableNodePublicIp&quot;: false,
      &quot;enableUltraSsd&quot;: null,
      &quot;gpuInstanceProfile&quot;: null,
      &quot;hostGroupId&quot;: null,
      &quot;kubeletConfig&quot;: null,
      &quot;kubeletDiskType&quot;: &quot;OS&quot;,
      &quot;linuxOsConfig&quot;: null,
      
</code></pre>
<p>In portal:</p>
<p><img src="https://i.imgur.com/mirhxMw.png" alt="enter image description here" /></p>
