Azure Containers built-in role
Container Apps ConnectedEnvironments Reader
Container Apps ConnectedEnvironments Reader reads Container Apps connected environment and related status without changing that resource. The published role uses Azure control-plane Actions and has no DataActions. It also can create and manage classic metric alert rules through Microsoft.Insights/alertRules/*, although it cannot list connected-environment Dapr secrets. Access to container registries, Key Vault, monitoring data, managed identities, networks, and application endpoints remains separately authorized.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: d5adeb5b-107f-4aca-99ea-4e3f4fc008d5
Control-plane actions (6)
Microsoft.Authorization/*/readMicrosoft.Insights/alertRules/*Microsoft.Resources/deployments/readMicrosoft.App/connectedEnvironments/readMicrosoft.App/connectedEnvironments/*/readMicrosoft.Resources/subscriptions/resourceGroups/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual Container Apps connected environment resource when supported, or on its dedicated Container Apps resource group when the principal intentionally manages several related resources. Parent-scope assignments are inherited by every matching Container Apps resource below them.
Common use cases (1)
- Inspect connected-environment configuration, status, and related deployment information for audit or troubleshooting without changing the environment.
Prerequisites (2)
- The target Container Apps connected environment and its Container Apps environment design, workload identity, image source, network boundary, and monitoring destination must be approved.
- The Container Apps connected environment must already exist; this role does not provision its external dependencies.
Best practices (2)
- Assign directly on the Container Apps connected environment or a dedicated application resource group and keep environment, workload, and dependency administration separate.
- Use the reader role for inventory and troubleshooting and escalate only for a documented change or operation.
Security considerations (3)
- Connected-environment metadata can disclose Arc cluster topology and workload-hosting configuration even though the role cannot modify it.
- The role can create and manage classic metric alert rules through Microsoft.Insights/alertRules/*, although it cannot list connected-environment Dapr secrets; this authority is outside the nominal Container Apps connected environment read workflow.
- A broad Azure assignment is inherited by multiple Container Apps resources even though the role has no resource data-plane DataActions.
Assignment guidance
Assign Container Apps ConnectedEnvironments Reader at the narrowest Container Apps connected environment or dedicated resource-group scope to the identity that needs to reads Container Apps connected environment and related status without changing that resource. Grant connected-resource permissions separately and choose the reader, operator, or contributor variant that matches the documented workflow.
Common questions
When should I assign the Container Apps ConnectedEnvironments Reader Azure role?
Assign Container Apps ConnectedEnvironments Reader when you need to: Inspect connected-environment configuration, status, and related deployment information for audit or troubleshooting without changing the environment.. Practical scope: Assign on the individual Container Apps connected environment resource when supported, or on its dedicated Container Apps resource group when the principal intentionally manages several related resources. Parent-scope assignments are inherited by every matching Container Apps resource below them.
What permissions does the Container Apps ConnectedEnvironments Reader Azure role grant?
The role definition grants 6 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Insights/alertRules/*; Microsoft.Resources/deployments/read; Microsoft.App/connectedEnvironments/read; Microsoft.App/connectedEnvironments/*/read; and Microsoft.Resources/subscriptions/resourceGroups/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Container Apps ConnectedEnvironments Reader Azure role?
Key considerations when assigning Container Apps ConnectedEnvironments Reader: Connected-environment metadata can disclose Arc cluster topology and workload-hosting configuration even though the role cannot modify it.; The role can create and manage classic metric alert rules through Microsoft.Insights/alertRules/*, although it cannot list connected-environment Dapr secrets; this authority is outside the nominal Container Apps connected environment read workflow.; and A broad Azure assignment is inherited by multiple Container Apps resources even though the role has no resource data-plane DataActions.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Azure Container Apps on Azure Arc-enabled Kubernetes →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.