Azure Containers built-in role

Container Apps ManagedEnvironments Reader

Container Apps ManagedEnvironments Reader reads Container Apps managed environment and related status without changing that resource. The published role uses Azure control-plane Actions and has no DataActions. It also can create and manage classic metric alert rules through Microsoft.Insights/alertRules/*, although it cannot list managed-environment Dapr secrets. Access to container registries, Key Vault, monitoring data, managed identities, networks, and application endpoints remains separately authorized.

Control-plane actions (3)

• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.App/managedEnvironments/*/read

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on the individual Container Apps managed environment resource when supported, or on its dedicated Container Apps resource group when the principal intentionally manages several related resources. Parent-scope assignments are inherited by every matching Container Apps resource below them.

Common use cases (1)

• Inspect environment configuration, status, workload profiles, networking, and related deployment information for audit or troubleshooting.

Prerequisites (2)

• The target Container Apps managed environment and its Container Apps environment design, workload identity, image source, network boundary, and monitoring destination must be approved.
• The Container Apps managed environment must already exist; this role does not provision its external dependencies.

Best practices (2)

• Assign directly on the Container Apps managed environment or a dedicated application resource group and keep environment, workload, and dependency administration separate.
• Use the reader role for inventory and troubleshooting and escalate only for a documented change or operation.

Security considerations (3)

• Environment metadata can expose shared network, logging, certificate, and capacity design across hosted workloads even though the role cannot change it.
• The role can create and manage classic metric alert rules through Microsoft.Insights/alertRules/*, although it cannot list managed-environment Dapr secrets; this authority is outside the nominal Container Apps managed environment read workflow.
• A broad Azure assignment is inherited by multiple Container Apps resources even though the role has no resource data-plane DataActions.

Assignment guidance

Assign Container Apps ManagedEnvironments Reader at the narrowest Container Apps managed environment or dedicated resource-group scope to the identity that needs to reads Container Apps managed environment and related status without changing that resource. Grant connected-resource permissions separately and choose the reader, operator, or contributor variant that matches the documented workflow.

Editorial sources (6)

• Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Environments in Azure Container Apps →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

Official Microsoft Learn documentation →