Azure Containers built-in role
AcrImageSigner
AcrImageSigner grants Docker Content Trust signing authority through a registry signing Action and trusted-collection DataAction. Microsoft says to avoid this role because Docker Content Trust and the role are being deprecated and will be completely removed on March 31, 2028; OCI referrer signing uses artifact push permissions instead.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 6cef56e8-d556-48e5-a04f-b8e64114680f
Control-plane actions (1)
Microsoft.ContainerRegistry/registries/sign/write
Data-plane actions (1)
Microsoft.ContainerRegistry/registries/trustedCollections/write
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Existing assignments apply to the target registry and are inherited when created at a parent Azure scope. The role does not represent general registry administration, but its signing authority can affect trust decisions for content throughout the registry.
Common use cases (1)
- Inventory and migrate an existing Docker Content Trust signing workflow before the March 31, 2028 removal date.
Prerequisites (1)
- An existing Docker Content Trust workflow and documented migration owner must be identified; new signing designs should use OCI referrers such as Notary Project instead.
Best practices (2)
- Do not create new AcrImageSigner assignments.
- Migrate signing to OCI referrers, validate signature publication and verification, and remove the legacy assignment before the retirement date.
Security considerations (2)
- Signing authority can cause consumers to trust content as approved, so compromise of the signer undermines the supply-chain trust decision.
- The role combines a control-plane signing Action with a trusted-collection DataAction and is scheduled for removal with Docker Content Trust.
Assignment guidance
Do not assign AcrImageSigner for new work. For an existing Docker Content Trust signer, keep any temporary assignment on the individual registry, migrate to OCI referrer signing with the documented artifact-push role, validate consumers, and remove AcrImageSigner before March 31, 2028.
Related roles (2)
- AcrPush: Microsoft documents AcrPush for publishing OCI referrer signatures in RBAC-only registries.
- Container Registry Repository Writer: ABAC-enabled repository write role used to publish artifacts and OCI referrers in selected repositories.
Common questions
When should I assign the AcrImageSigner Azure role?
Assign AcrImageSigner when you need to: Inventory and migrate an existing Docker Content Trust signing workflow before the March 31, 2028 removal date.. Practical scope: Existing assignments apply to the target registry and are inherited when created at a parent Azure scope. The role does not represent general registry administration, but its signing authority can affect trust decisions for content throughout the registry.
What permissions does the AcrImageSigner Azure role grant?
The role definition grants 2 combined control-plane and data-plane actions. Representative operations include: Microsoft.ContainerRegistry/registries/sign/write; and Microsoft.ContainerRegistry/registries/trustedCollections/write. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the AcrImageSigner Azure role?
Key considerations when assigning AcrImageSigner: Signing authority can cause consumers to trust content as approved, so compromise of the signer undermines the supply-chain trust decision.; and The role combines a control-plane signing Action with a trusted-collection DataAction and is scheduled for removal with Docker Content Trust.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Azure Container Registry Microsoft Entra permissions and role assignments overview →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Azure Container Registry roles directory reference →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.