Stop Using the AKS Admin Kubeconfig

az aks get-credentials --admin is the command everyone reaches for because it just works. It hands you a cluster-admin kubeconfig backed by a local account and a static certificate. It also has three properties you do not want in production: it's shared, it's not tied to a person, and it's hard to revoke.

That certificate doesn't expire on a human timescale. Once it's on a few laptops, in a pipeline, in a Slack DM "just to unblock you," you've lost track of who can administer your cluster, and you can't surgically pull one person's access, because there's no "person" in the credential at all. When the audit asks "who had admin to prod," the honest answer is "unknown."

The fix is to stop minting that credential and use Entra ID integration with Kubernetes RBAC instead:

• Each engineer authenticates as themselves, through Entra ID, with your conditional access and MFA along for the ride.
• Access is granted by role binding, so "read-only on this namespace" is a thing you can actually express instead of "admin on everything."
• Revocation is immediate and per-person: remove the group membership and they're out, no cert rotation, no cluster rebuild.
• Every action traces to a real identity, so the audit question has an answer.

Then close the back door: disable local accounts on the cluster so the admin kubeconfig can't be minted at all. Break-glass access still exists by design. Just make it a deliberate, logged exception rather than the daily default.

You don't lose any capability. You trade a shared, unattributable, hard-to-revoke key for per-user, auditable, instantly-revocable access. The only thing you give up is the ability to say "I don't know who has admin," which was never an answer you wanted to give.