Hi Stevens,

the network contributor has more permissions on network resources - which are typically considered too much for an AKS cluster. Most customers have created their own rules to create a better match in terms of minimal required permissions. In my experience the Virtual Machine Contributor has acceptable network permissions for most customers.