Kubernetes comes with a built-in RBAC mechanism that allows you to configure fine-grained sets of permissions and assign them to users, groups, and service accounts (subjects). In this way, as a cluster administrator, you can control how cluster users (internal and external) interact with the API Server, which API resources they can access, and which actions (verbs) they can perform.
Authentication in Kubernetes is highly configurable and extensible; you can read more in the official documentation, at https://kubernetes.io/docs/reference/access-authn-authz/authentication/. In AKS Engine clusters, it is possible to easily integrate with Azure Active Directory (AAD); you can find more details at https://github.com/Azure/aks-engine/blob/master/docs/topics/aad.md ...
