Error text: `error: You must be logged in to the server (Unauthorized)`.
Triage:
1. **Token expired.** Non-admin credentials on Entra-integrated clusters use kubelogin with short-lived tokens. Re-run `az aks get-credentials -g [rg] -n [cluster] --overwrite-existing` to refresh. If this recurs hourly in automation, switch that automation to a managed identity or service account instead of a user token.
2. **Wrong context.** `kubectl config current-context` - is it the cluster you think? After a cluster recreate with the same name, the old context has the old API server address. `--overwrite-existing` fixes it.
3. **kubelogin missing.** "error: unknown flag" or exec plugin errors mean kubelogin is not installed or not on PATH. `az aks install-cli` installs kubectl and kubelogin together.
4. **RBAC, not auth.** If the error is `forbidden: User ... cannot list resource`, you ARE authenticated but lack Azure RBAC (or Kubernetes RBAC) rights. Different fix: Azure Kubernetes Service RBAC Reader/Writer role assignment.
5. **Private cluster.** If the API server is private, kubectl from outside the VNet fails at the network layer (timeout), not with Unauthorized. Unauthorized from a peered VNet box is still auth.
Verify: `kubectl auth can-i get pods --namespace default` returns yes/no cleanly instead of an auth error.