Diagnose: error: You must be logged in to the server (Unauthorized) on AKS

SYMPTOM error: You must be logged in to the server (Unauthorized) on AKS

CAUSE The kubelogin token for the Entra-integrated cluster expired, or the kubeconfig context is stale after a cluster recreate. Authenticated-but-forbidden (cannot list resource) is a different error with a different fix.

CONFIRM IT CONFIRM: kubectl config current-context shows the intended cluster; az aks get-credentials -g [rg] -n [cluster] --overwrite-existing then retry - if it works, it was token/context staleness. az aks install-cli if kubelogin is missing from PATH.

FIX FIX: refresh credentials with --overwrite-existing. For automation that hits this hourly, stop using user tokens: switch to a managed identity, workload identity, or a dedicated service account with Azure RBAC roles (Azure Kubernetes Service RBAC Cluster Admin/Reader).

VERIFY VERIFY: kubectl auth can-i get pods returns a clean yes/no instead of an auth error.

Diagnostic skill indexed by the exact error string. Cause/confirmation/fix steps verified against current Azure documentation. Evidence: https://learn.microsoft.com/en-us/azure/aks/control-kubeconfig-access