<p>Use <code>azure aks get-credentials --admin</code> can get kubernetes admin config file and <code>azure aks get-credentials</code> can get only user config file on azure.</p>

<p>How to set something to deny user run <code>azure aks get-credentials --admin</code>?</p>

Jingqiang Zhang
<p>well, be default they cant run it, unless they have specific azure permissions. so by default you dont have to do anything. they shouldnt have this specific permission:</p>

<pre><code>Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action
</code></pre>

<p>which they would get if they are contributor for the AKS resource or resource group. They need this permission to get user credentials:</p>

<pre><code>Microsoft.ContainerService/managedClusters/listClusterUserCredential/action
</code></pre>
