Azure Compute built-in role
Compute Gallery Image Reader
Reads Azure Compute Gallery image definitions and image versions. It has no write permissions and no DataActions, and it is narrower than broad Reader access to an entire gallery or resource group.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: cf7c76d2-98a3-4358-a134-615aa78bf44d
Control-plane actions (2)
Microsoft.Compute/galleries/images/readMicrosoft.Compute/galleries/images/versions/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign at an image definition when only that image family should be visible, or at the gallery when all contained image definitions and versions should inherit the read access. The role is limited to control-plane reads of image and version metadata.
Common use cases (2)
- Allow a deployment identity to discover an approved image definition and version without managing the gallery.
- Give a consumer read access to a selected image family or to all image definitions in a gallery.
Prerequisites (2)
- The image definition and version must already exist and be replicated to a region supported by the intended VM or disk deployment.
- The consumer needs separate permissions to create the VM, scale set, disk, network, identity, and other deployment resources.
Best practices (3)
- Share at the gallery level for the simplest consumer experience when access to every image is acceptable; otherwise scope to an image definition.
- Do not share individual image versions unless the narrower version scope is operationally necessary.
- Use stable approved image versions and verify regional replication before deployment.
Security considerations (3)
- Read permission allows an image to be used to deploy VMs or disks but does not grant permission to create those target resources.
- Image metadata and version availability can reveal operating-system, application, and release information.
- Access to an untrusted image can lead to vulnerable deployments; consumers must validate publisher and image provenance.
Assignment guidance
Assign at the gallery for approved broad image consumption or at the image definition for a smaller catalog. Grant target deployment permissions separately and do not add publishing or sharing administration to a consumer identity.
Common questions
When should I assign the Compute Gallery Image Reader Azure role?
Assign Compute Gallery Image Reader when you need to: Allow a deployment identity to discover an approved image definition and version without managing the gallery.; and Give a consumer read access to a selected image family or to all image definitions in a gallery.. Practical scope: Assign at an image definition when only that image family should be visible, or at the gallery when all contained image definitions and versions should inherit the read access. The role is limited to control-plane reads of image and version metadata.
What permissions does the Compute Gallery Image Reader Azure role grant?
The role definition grants 2 combined control-plane and data-plane actions. Representative operations include: Microsoft.Compute/galleries/images/read; and Microsoft.Compute/galleries/images/versions/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Compute Gallery Image Reader Azure role?
Key considerations when assigning Compute Gallery Image Reader: Read permission allows an image to be used to deploy VMs or disks but does not grant permission to create those target resources.; Image metadata and version availability can reveal operating-system, application, and release information.; and Access to an untrusted image can lead to vulnerable deployments; consumers must validate publisher and image provenance.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Compute →
Supports: Description, Practical scope. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Overview of Azure Compute Gallery →
Supports: Description, Practical scope, Common use cases, Prerequisites, Assignment guidance. Retrieved 2026-07-16.
- Share resources in Azure Compute Gallery →
Supports: Best practices, Security considerations. Retrieved 2026-07-16.