Azure Containers built-in role

Container Apps Contributor

Container Apps Contributor creates, updates, deletes, reads, and performs supported actions on container app. The published role uses Azure control-plane Actions and has no DataActions. It can invoke Microsoft.App/containerApps/listSecrets/action through its containerApps action wildcard to list secrets of a container app; secret listing is an Azure Action and must not be mistaken for an absence of secret-bearing authority merely because the role has no secret DataAction. Access to container registries, Key Vault, monitoring data, managed identities, networks, and application endpoints remains separately authorized.

Control-plane actions (14)

• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.App/containerApps/*/read
• Microsoft.App/containerApps/*/write
• Microsoft.App/containerApps/*/delete
• Microsoft.App/containerApps/*/action
• Microsoft.App/managedEnvironments/read
• Microsoft.App/managedEnvironments/*/read
• Microsoft.App/managedEnvironments/join/action
• Microsoft.App/managedEnvironments/checknameavailability/action
• Microsoft.App/connectedEnvironments/read
• Microsoft.App/connectedEnvironments/*/read
• Microsoft.App/connectedEnvironments/join/action
• Microsoft.App/connectedEnvironments/checknameavailability/action

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on the individual container app resource when supported, or on its dedicated Container Apps resource group when the principal intentionally manages several related resources. Parent-scope assignments are inherited by every matching Container Apps resource below them.

Common use cases (1)

• Create and manage approved container apps, revisions, ingress, scaling, identities, and workload configuration within an existing environment.

Prerequisites (2)

• The target container app and its Container Apps environment design, workload identity, image source, network boundary, and monitoring destination must be approved.
• Grant the workload identity separate access to registries, Key Vault, storage, messaging, and other dependencies used at runtime.

Best practices (2)

• Assign directly on the container app or a dedicated application resource group and keep environment, workload, and dependency administration separate.
• Review image, command, secrets, identity, ingress, scaling, and network changes through the deployment pipeline before applying them.

Security considerations (3)

• Changing images, commands, environment variables, secrets references, identities, ingress, or scale rules can execute untrusted code, expose services, or exercise workload identity permissions.
• The role can invoke Microsoft.App/containerApps/listSecrets/action through its containerApps action wildcard to list secrets of a container app, which can disclose credentials or other sensitive configuration to the assignee.
• A broad Azure assignment is inherited by multiple Container Apps resources even though the role has no resource data-plane DataActions.

Assignment guidance

Assign Container Apps Contributor at the narrowest container app or dedicated resource-group scope to the identity that needs to creates, updates, deletes, reads, and performs supported actions on container app. Grant connected-resource permissions separately and choose the reader, operator, or contributor variant that matches the documented workflow.

Editorial sources (7)

• Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Environments in Azure Container Apps →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Azure permissions for Compute - Microsoft.App →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

Official Microsoft Learn documentation →