Azure Containers built-in role

Container Apps Operator

Container Apps Operator reads existing container apps, streams logs, and executes commands inside running containers. The published role uses Azure control-plane Actions plus DataActions for log streaming, container exec, and debug operations. It can invoke Microsoft.App/containerApps/listSecrets/action through its containerApps action wildcard to list secrets of a container app; secret listing is an Azure Action and must not be mistaken for an absence of secret-bearing authority merely because the role has no secret DataAction. Access to container registries, Key Vault, monitoring data, managed identities, networks, and application endpoints remains separately authorized.

Control-plane actions (12)

• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.App/containerApps/*/read
• Microsoft.App/containerApps/*/action
• Microsoft.App/managedEnvironments/read
• Microsoft.App/managedEnvironments/*/read
• Microsoft.App/managedEnvironments/join/action
• Microsoft.App/managedEnvironments/checknameavailability/action
• Microsoft.App/connectedEnvironments/read
• Microsoft.App/connectedEnvironments/*/read
• Microsoft.App/connectedEnvironments/join/action
• Microsoft.App/connectedEnvironments/checknameavailability/action

Data-plane actions (3)

• Microsoft.App/containerApps/logstream/action
• Microsoft.App/containerApps/exec/action
• Microsoft.App/containerApps/debug/action

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on the individual container app resource when supported, or on its dedicated Container Apps resource group when the principal intentionally manages several related resources. Parent-scope assignments are inherited by every matching Container Apps resource below them.

Common use cases (1)

• Let a trusted operations or support engineer inspect an existing app, stream logs, and run an approved diagnostic command inside a container without changing the app definition.

Prerequisites (2)

• The target container app and its Container Apps environment design, workload identity, image source, network boundary, and monitoring destination must be approved.
• The container app must already exist; this role does not provision its external dependencies.

Best practices (2)

• Assign directly on the container app or a dedicated application resource group and keep environment, workload, and dependency administration separate.
• Audit operational actions and avoid granting contributor access when the principal only needs the documented run, log, or exec workflow.

Security considerations (3)

• Exec access runs commands inside the workload security context and can expose application data, mounted files, environment variables, tokens, or secrets available to that container.
• The role can invoke Microsoft.App/containerApps/listSecrets/action through its containerApps action wildcard to list secrets of a container app, which can disclose credentials or other sensitive configuration to the assignee.
• A broad Azure assignment is inherited by multiple Container Apps resources and extends both the control-plane operations and the published data-plane diagnostic actions to those resources.

Assignment guidance

Assign Container Apps Operator at the narrowest container app or dedicated resource-group scope to the identity that needs to reads existing container apps, streams logs, and executes commands inside running containers. Grant connected-resource permissions separately and choose the reader, operator, or contributor variant that matches the documented workflow.

Editorial sources (7)

• Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Environments in Azure Container Apps →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Azure permissions for Compute - Microsoft.App →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

Official Microsoft Learn documentation →