Azure Compute built-in role
Compute Gallery Artifacts Publisher
Publishes and manages Azure Compute Gallery artifacts, images, and supporting image resources. The built-in definition explicitly excludes the gallery share action, so publishing content does not by itself authorize direct, tenant-wide, subscription-wide, or public sharing.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 85a2d0d9-2eba-4c9c-b355-11c2cc0788ab
Control-plane actions (11)
Microsoft.Compute/galleries/*Microsoft.Compute/locations/capsOperations/readMicrosoft.Compute/locations/communityGalleries/*Microsoft.Compute/locations/sharedGalleries/*Microsoft.Compute/images/*Microsoft.Compute/virtualMachines/writeMicrosoft.Compute/disks/writeMicrosoft.Authorization/*/readMicrosoft.Insights/alertRules/*Microsoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (1)
Microsoft.Compute/galleries/share/action
Assignable scopes (1)
/
Practical scope
Assign at the gallery or its resource group when the publisher owns all contained definitions and versions; broader assignments are inherited by child galleries. Permissions are control-plane Actions only and include gallery, image, VM, disk, deployment, and alert operations, with no DataActions.
Common use cases (2)
- Build, version, replicate, and maintain approved VM images or applications in an Azure Compute Gallery.
- Operate an image-publishing pipeline without allowing that pipeline to change the gallery sharing profile.
Prerequisites (2)
- Prepare and validate the source VM, disk, image, or application artifact and choose the gallery, definition, version, target regions, and replication settings.
- Grant source-resource access separately when the image-publishing workflow reads resources outside the assignment scope.
Best practices (3)
- Separate test and production galleries, protect production galleries with resource locks, and use version lifecycle controls.
- Use ZRS and sufficient replicas where available, and retain galleries in separate regions for disaster-recovery scenarios.
- Keep sharing authority separate from publishing authority and review image contents before replication.
Security considerations (3)
- The role can create, change, and delete gallery artifacts and images that become the trusted source for future VMs.
- A compromised publisher can distribute vulnerable software or secrets embedded in an image even though it cannot invoke gallery sharing.
- The definition can write VMs and disks and manage deployments, so it is broader than a simple image-version upload permission.
Assignment guidance
Assign to the image publishing group or pipeline at the gallery or dedicated gallery resource group. Keep Compute Gallery Sharing Admin separate, validate artifacts before publication, and narrow access to the source resources used by the publishing process.
Related roles (1)
- Compute Gallery Sharing Admin: Compute Gallery Sharing Admin is the separate role Microsoft documents for enabling direct gallery sharing; Artifacts Publisher explicitly excludes the gallery share action.
Common questions
When should I assign the Compute Gallery Artifacts Publisher Azure role?
Assign Compute Gallery Artifacts Publisher when you need to: Build, version, replicate, and maintain approved VM images or applications in an Azure Compute Gallery.; and Operate an image-publishing pipeline without allowing that pipeline to change the gallery sharing profile.. Practical scope: Assign at the gallery or its resource group when the publisher owns all contained definitions and versions; broader assignments are inherited by child galleries. Permissions are control-plane Actions only and include gallery, image, VM, disk, deployment, and alert operations, with no DataActions.
What permissions does the Compute Gallery Artifacts Publisher Azure role grant?
The role definition grants 11 combined control-plane and data-plane actions. Representative operations include: Microsoft.Compute/galleries/*; Microsoft.Compute/locations/capsOperations/read; Microsoft.Compute/locations/communityGalleries/*; Microsoft.Compute/locations/sharedGalleries/*; Microsoft.Compute/images/*; and Microsoft.Compute/virtualMachines/write. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Compute Gallery Artifacts Publisher Azure role?
Key considerations when assigning Compute Gallery Artifacts Publisher: The role can create, change, and delete gallery artifacts and images that become the trusted source for future VMs.; A compromised publisher can distribute vulnerable software or secrets embedded in an image even though it cannot invoke gallery sharing.; and The definition can write VMs and disks and manage deployments, so it is broader than a simple image-version upload permission.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Compute →
Supports: Description, Practical scope. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Overview of Azure Compute Gallery →
Supports: Description, Practical scope, Common use cases, Prerequisites, Assignment guidance. Retrieved 2026-07-16.
- Share Azure Compute Gallery resources directly with subscriptions and tenants →
Supports: Best practices, Security considerations, Related roles. Retrieved 2026-07-16.