Azure Containers built-in role

Container Apps Jobs Operator

Container Apps Jobs Operator reads, starts, stops, and inspects executions of existing Container Apps jobs; a start request can replace the entire execution template, including its image, command, arguments, resources, and environment variables, for that run. The published role uses Azure control-plane Actions plus DataActions for job log streaming and exec operations. It can invoke Microsoft.App/jobs/listSecrets/action through its jobs action wildcard to list job secrets; secret listing is an Azure Action and must not be mistaken for an absence of secret-bearing authority merely because the role has no secret DataAction. Access to container registries, Key Vault, monitoring data, managed identities, networks, and application endpoints remains separately authorized.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: b9a307c4-5aa3-4b52-ba60-2b17c136cd7b

Control-plane actions (13)

Data-plane actions (2)

Excluded actions (0)

None

Assignable scopes (1)

Practical scope

Assign on the individual Container Apps job resource when supported, or on its dedicated Container Apps resource group when the principal intentionally manages several related resources. Parent-scope assignments are inherited by every matching Container Apps resource below them.

Common use cases (1)

Prerequisites (2)

Best practices (2)

Security considerations (3)

Assignment guidance

Assign Container Apps Jobs Operator at the narrowest Container Apps job or dedicated resource-group scope to the identity that needs to reads, starts, stops, and inspects executions of existing Container Apps jobs; a start request can replace the entire execution template, including its image, command, arguments, resources, and environment variables, for that run. Grant connected-resource permissions separately and choose the reader, operator, or contributor variant that matches the documented workflow.

Related roles (2)

Common questions

When should I assign the Container Apps Jobs Operator Azure role?

Assign Container Apps Jobs Operator when you need to: Allow a tightly trusted operations identity to start a job with either its stored template or an explicitly reviewed per-execution replacement template, stop executions, stream logs, and exec into running job containers without persistently editing the job resource.. Practical scope: Assign on the individual Container Apps job resource when supported, or on its dedicated Container Apps resource group when the principal intentionally manages several related resources. Parent-scope assignments are inherited by every matching Container Apps resource below them.

What permissions does the Container Apps Jobs Operator Azure role grant?

The role definition grants 15 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Insights/alertRules/*; microsoft.app/jobs/read; Microsoft.App/jobs/*/read; Microsoft.App/jobs/*/action; and Microsoft.app/managedenvironments/read. Review the permission sections above for the complete definition and exclusions.

What are the security risks of the Container Apps Jobs Operator Azure role?

Key considerations when assigning Container Apps Jobs Operator: Starting a job can run an arbitrary replacement image, command, arguments, and environment for that execution under the job identity and with access to all secrets configured for the job; log streaming and exec add direct runtime visibility and command access.; The role can invoke Microsoft.App/jobs/listSecrets/action through its jobs action wildcard to list job secrets, which can disclose credentials or other sensitive configuration to the assignee.; and A broad Azure assignment is inherited by multiple Container Apps resources and extends both the control-plane operations and the published data-plane diagnostic actions to those resources.. Follow the assignment guidance above and use the narrowest practical scope.

Editorial sources (7)

Official Microsoft Learn documentation →