Azure Containers built-in role

Container Apps Jobs Operator

Container Apps Jobs Operator reads, starts, stops, and inspects executions of existing Container Apps jobs; a start request can replace the entire execution template, including its image, command, arguments, resources, and environment variables, for that run. The published role uses Azure control-plane Actions plus DataActions for job log streaming and exec operations. It can invoke Microsoft.App/jobs/listSecrets/action through its jobs action wildcard to list job secrets; secret listing is an Azure Action and must not be mistaken for an absence of secret-bearing authority merely because the role has no secret DataAction. Access to container registries, Key Vault, monitoring data, managed identities, networks, and application endpoints remains separately authorized.

Control-plane actions (13)

• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• microsoft.app/jobs/read
• Microsoft.App/jobs/*/read
• Microsoft.App/jobs/*/action
• Microsoft.app/managedenvironments/read
• Microsoft.App/managedenvironments/*/read
• Microsoft.App/managedenvironments/join/action
• Microsoft.App/managedenvironments/checknameavailability/action
• Microsoft.app/connectedEnvironments/read
• Microsoft.App/connectedEnvironments/*/read
• Microsoft.App/connectedEnvironments/join/action
• Microsoft.App/connectedEnvironments/checknameavailability/action

Data-plane actions (2)

• Microsoft.App/jobs/logstream/action
• Microsoft.App/jobs/exec/action

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on the individual Container Apps job resource when supported, or on its dedicated Container Apps resource group when the principal intentionally manages several related resources. Parent-scope assignments are inherited by every matching Container Apps resource below them.

Common use cases (1)

• Allow a tightly trusted operations identity to start a job with either its stored template or an explicitly reviewed per-execution replacement template, stop executions, stream logs, and exec into running job containers without persistently editing the job resource.

Prerequisites (2)

• The target Container Apps job and its Container Apps environment design, workload identity, image source, network boundary, and monitoring destination must be approved.
• The Container Apps job must already exist; this role does not provision its external dependencies.

Best practices (2)

• Assign directly on the Container Apps job or a dedicated application resource group and keep environment, workload, and dependency administration separate.
• Audit operational actions and avoid granting contributor access when the principal only needs the documented run, log, or exec workflow.

Security considerations (3)

• Starting a job can run an arbitrary replacement image, command, arguments, and environment for that execution under the job identity and with access to all secrets configured for the job; log streaming and exec add direct runtime visibility and command access.
• The role can invoke Microsoft.App/jobs/listSecrets/action through its jobs action wildcard to list job secrets, which can disclose credentials or other sensitive configuration to the assignee.
• A broad Azure assignment is inherited by multiple Container Apps resources and extends both the control-plane operations and the published data-plane diagnostic actions to those resources.

Assignment guidance

Assign Container Apps Jobs Operator at the narrowest Container Apps job or dedicated resource-group scope to the identity that needs to reads, starts, stops, and inspects executions of existing Container Apps jobs; a start request can replace the entire execution template, including its image, command, arguments, resources, and environment variables, for that run. Grant connected-resource permissions separately and choose the reader, operator, or contributor variant that matches the documented workflow.

Related roles (2)

• Container Apps Jobs Contributor: Adds job creation, update, and deletion.
• Container Apps Jobs Reader: Removes start and stop authority for observation-only workflows.

Editorial sources (7)

• Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Jobs in Azure Container Apps →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Azure permissions for Compute - Microsoft.App →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →