Add Azure AD role info

Author: laurenhughes

articles/aks/control-kubeconfig-access.md

@@ -6,7 +6,7 @@ author: mlearned
 
 ms.service: container-service
 ms.topic: article
-ms.date: 05/31/2019
+ms.date: 01/28/2020
 ms.author: mlearned
 ---
 
@@ -31,14 +31,19 @@ The [az aks get-credentials][az-aks-get-credentials] command lets you get the ac
 The two built-in roles are:
 
 * **Azure Kubernetes Service Cluster Admin Role**  
-    * Allows access to *Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action* API call. This API call [lists the cluster admin credentials][api-cluster-admin].
-    * Downloads *kubeconfig* for the *clusterAdmin* role.
+  * Allows access to *Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action* API call. This API call [lists the cluster admin credentials][api-cluster-admin].
+  * Downloads *kubeconfig* for the *clusterAdmin* role.
 * **Azure Kubernetes Service Cluster User Role**
-    * Allows access to *Microsoft.ContainerService/managedClusters/listClusterUserCredential/action* API call. This API call [lists the cluster user credentials][api-cluster-user].
-    * Downloads *kubeconfig* for *clusterUser* role.
+  * Allows access to *Microsoft.ContainerService/managedClusters/listClusterUserCredential/action* API call. This API call [lists the cluster user credentials][api-cluster-user].
+  * Downloads *kubeconfig* for *clusterUser* role.
 
 These RBAC roles can be applied to an Azure Active Directory (AD) user or group.
 
+> ![NOTE]
+> On clusters that use Azure AD, users with the *clusterUser* role have an empty *kubeconfig* file that prompts a log in. Once logged in, users have access based on their Azure AD user or group settings. Users with the *clusterAdmin* role have admin access.
+>
+> Clusters that do not use Azure AD only use the *clusterAdmin* role.
+
 ## Assign role permissions to a user or group
 
 To assign one of the available roles, you need to get the resource ID of the AKS cluster and the ID of the Azure AD user account or group. The following example commands: