Azure Containers built-in role
Container Apps Jobs Contributor
Container Apps Jobs Contributor creates, updates, deletes, reads, and performs supported actions on Container Apps job. The published role uses Azure control-plane Actions and has no DataActions. It can invoke Microsoft.App/jobs/listSecrets/action through its jobs action wildcard to list job secrets; secret listing is an Azure Action and must not be mistaken for an absence of secret-bearing authority merely because the role has no secret DataAction. Access to container registries, Key Vault, monitoring data, managed identities, networks, and application endpoints remains separately authorized.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 4e3d2b60-56ae-4dc6-a233-09c8e5a82e68
Control-plane actions (16)
Microsoft.Authorization/*/readMicrosoft.Insights/alertRules/*microsoft.app/jobs/readMicrosoft.App/jobs/*/readMicrosoft.App/jobs/*/actionMicrosoft.App/jobs/writeMicrosoft.App/jobs/deleteMicrosoft.app/managedenvironments/readMicrosoft.App/managedenvironments/*/readMicrosoft.App/managedenvironments/join/actionMicrosoft.App/managedenvironments/checknameavailability/actionMicrosoft.app/connectedEnvironments/readMicrosoft.App/connectedEnvironments/*/readMicrosoft.App/connectedEnvironments/join/actionMicrosoft.App/connectedEnvironments/checknameavailability/actionMicrosoft.Resources/deployments/*
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual Container Apps job resource when supported, or on its dedicated Container Apps resource group when the principal intentionally manages several related resources. Parent-scope assignments are inherited by every matching Container Apps resource below them.
Common use cases (1)
- Create, update, delete, start, stop, and troubleshoot scheduled, event-driven, or manual Container Apps jobs.
Prerequisites (2)
- The target Container Apps job and its Container Apps environment design, workload identity, image source, network boundary, and monitoring destination must be approved.
- Grant the workload identity separate access to registries, Key Vault, storage, messaging, and other dependencies used at runtime.
Best practices (2)
- Assign directly on the Container Apps job or a dedicated application resource group and keep environment, workload, and dependency administration separate.
- Review image, command, secrets, identity, ingress, scaling, and network changes through the deployment pipeline before applying them.
Security considerations (3)
- The role can change executable job definitions and start executions; Microsoft notes that starting a job gives access to all secrets configured for that job.
- The role can invoke Microsoft.App/jobs/listSecrets/action through its jobs action wildcard to list job secrets, which can disclose credentials or other sensitive configuration to the assignee.
- A broad Azure assignment is inherited by multiple Container Apps resources even though the role has no resource data-plane DataActions.
Assignment guidance
Assign Container Apps Jobs Contributor at the narrowest Container Apps job or dedicated resource-group scope to the identity that needs to creates, updates, deletes, reads, and performs supported actions on Container Apps job. Grant connected-resource permissions separately and choose the reader, operator, or contributor variant that matches the documented workflow.
Related roles (2)
- Container Apps Jobs Operator: Starts, stops, and reads existing jobs without changing their definitions.
- Container Apps Jobs Reader: Reads job definitions and executions without starting or changing them.
Common questions
When should I assign the Container Apps Jobs Contributor Azure role?
Assign Container Apps Jobs Contributor when you need to: Create, update, delete, start, stop, and troubleshoot scheduled, event-driven, or manual Container Apps jobs.. Practical scope: Assign on the individual Container Apps job resource when supported, or on its dedicated Container Apps resource group when the principal intentionally manages several related resources. Parent-scope assignments are inherited by every matching Container Apps resource below them.
What permissions does the Container Apps Jobs Contributor Azure role grant?
The role definition grants 16 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Insights/alertRules/*; microsoft.app/jobs/read; Microsoft.App/jobs/*/read; Microsoft.App/jobs/*/action; and Microsoft.App/jobs/write. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Container Apps Jobs Contributor Azure role?
Key considerations when assigning Container Apps Jobs Contributor: The role can change executable job definitions and start executions; Microsoft notes that starting a job gives access to all secrets configured for that job.; The role can invoke Microsoft.App/jobs/listSecrets/action through its jobs action wildcard to list job secrets, which can disclose credentials or other sensitive configuration to the assignee.; and A broad Azure assignment is inherited by multiple Container Apps resources even though the role has no resource data-plane DataActions.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Jobs in Azure Container Apps →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Azure permissions for Compute - Microsoft.App →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.