Azure Containers built-in role

Container Apps Operator

Container Apps Operator reads existing container apps, streams logs, and executes commands inside running containers. The published role uses Azure control-plane Actions plus DataActions for log streaming, container exec, and debug operations. It can invoke Microsoft.App/containerApps/listSecrets/action through its containerApps action wildcard to list secrets of a container app; secret listing is an Azure Action and must not be mistaken for an absence of secret-bearing authority merely because the role has no secret DataAction. Access to container registries, Key Vault, monitoring data, managed identities, networks, and application endpoints remains separately authorized.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: f3bd1b5c-91fa-40e7-afe7-0c11d331232c

Control-plane actions (12)

Data-plane actions (3)

Excluded actions (0)

None

Assignable scopes (1)

Practical scope

Assign on the individual container app resource when supported, or on its dedicated Container Apps resource group when the principal intentionally manages several related resources. Parent-scope assignments are inherited by every matching Container Apps resource below them.

Common use cases (1)

Prerequisites (2)

Best practices (2)

Security considerations (3)

Assignment guidance

Assign Container Apps Operator at the narrowest container app or dedicated resource-group scope to the identity that needs to reads existing container apps, streams logs, and executes commands inside running containers. Grant connected-resource permissions separately and choose the reader, operator, or contributor variant that matches the documented workflow.

Common questions

When should I assign the Container Apps Operator Azure role?

Assign Container Apps Operator when you need to: Let a trusted operations or support engineer inspect an existing app, stream logs, and run an approved diagnostic command inside a container without changing the app definition.. Practical scope: Assign on the individual container app resource when supported, or on its dedicated Container Apps resource group when the principal intentionally manages several related resources. Parent-scope assignments are inherited by every matching Container Apps resource below them.

What permissions does the Container Apps Operator Azure role grant?

The role definition grants 15 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Insights/alertRules/*; Microsoft.App/containerApps/*/read; Microsoft.App/containerApps/*/action; Microsoft.App/managedEnvironments/read; and Microsoft.App/managedEnvironments/*/read. Review the permission sections above for the complete definition and exclusions.

What are the security risks of the Container Apps Operator Azure role?

Key considerations when assigning Container Apps Operator: Exec access runs commands inside the workload security context and can expose application data, mounted files, environment variables, tokens, or secrets available to that container.; The role can invoke Microsoft.App/containerApps/listSecrets/action through its containerApps action wildcard to list secrets of a container app, which can disclose credentials or other sensitive configuration to the assignee.; and A broad Azure assignment is inherited by multiple Container Apps resources and extends both the control-plane operations and the published data-plane diagnostic actions to those resources.. Follow the assignment guidance above and use the narrowest practical scope.

Editorial sources (7)

Official Microsoft Learn documentation →