services / Azure / AKS managed cluster JWT authenticators

An AKS managed cluster's JWT authenticator defines how the Kubernetes API server validates external JWT/OIDC tokens, specifying trusted issuers, audiences, and claim-to-user/group mappings that bind external identities to in-cluster Kubernetes principals.

This is the cluster's authentication trust configuration; control over it is effectively cluster-admin-equivalent because it governs which identities can authenticate (and as whom) to the entire cluster.

Microsoft.​ContainerService/​managedClusters/​jwtAuthenticators/​delete

Deleting a JWT authenticator tears down the cluster's authentication/identity-mapping configuration, destroying access-control policy and severing legitimate token-based users from their authorized access to the cluster.

Risks

1. Policy destruction (CRITICAL)
2. Denial-of-access (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links