Azure Containers built-in role
AcrQuarantineReader
AcrQuarantineReader reads registry quarantine state and quarantined artifacts. The published definition combines an Azure registry quarantine read Action with a quarantined-artifact read DataAction; it does not grant ordinary artifact push, delete, or registry management.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: cdda3590-29a3-44f6-95f2-9f980659eb04
Control-plane actions (1)
Microsoft.ContainerRegistry/registries/quarantine/read
Data-plane actions (1)
Microsoft.ContainerRegistry/registries/quarantinedArtifacts/read
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual registry whose quarantined content the reviewer must inspect. A parent-scope assignment is inherited by every registry below it and exposes quarantined content across those registries.
Common use cases (1)
- Allow an approved security scanner or incident responder to inspect quarantined artifacts and quarantine metadata without changing quarantine state.
Prerequisites (1)
- The registry must use a quarantine workflow and the principal must be approved to inspect potentially malicious or policy-violating artifacts.
Best practices (2)
- Assign to a dedicated scanning or incident-response identity on one registry and keep quarantine mutation separate.
- Treat quarantined content as untrusted and avoid running it outside an isolated analysis workflow.
Security considerations (2)
- Read access can disclose quarantined proprietary or malicious artifacts and their metadata.
- The role includes a registry DataAction for quarantined content but does not authorize normal repository content operations.
Assignment guidance
Assign AcrQuarantineReader directly on the registry to the scanner or responder that only inspects quarantined content. Use QuarantineWriter only for a separate identity that must change quarantine state.
Related roles (1)
- AcrQuarantineWriter: Adds the ability to write quarantine state while retaining quarantined-artifact read access.
Common questions
When should I assign the AcrQuarantineReader Azure role?
Assign AcrQuarantineReader when you need to: Allow an approved security scanner or incident responder to inspect quarantined artifacts and quarantine metadata without changing quarantine state.. Practical scope: Assign on the individual registry whose quarantined content the reviewer must inspect. A parent-scope assignment is inherited by every registry below it and exposes quarantined content across those registries.
What permissions does the AcrQuarantineReader Azure role grant?
The role definition grants 2 combined control-plane and data-plane actions. Representative operations include: Microsoft.ContainerRegistry/registries/quarantine/read; and Microsoft.ContainerRegistry/registries/quarantinedArtifacts/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the AcrQuarantineReader Azure role?
Key considerations when assigning AcrQuarantineReader: Read access can disclose quarantined proprietary or malicious artifacts and their metadata.; and The role includes a registry DataAction for quarantined content but does not authorize normal repository content operations.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Azure Container Registry Microsoft Entra permissions and role assignments overview →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Azure Container Registry roles directory reference →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.