Azure Containers built-in role

Container Apps SessionPools Reader

Container Apps SessionPools Reader reads Container Apps session pool and related status without changing that resource. The published role uses Azure control-plane Actions and has no DataActions. It also can create and manage classic metric alert rules through Microsoft.Insights/alertRules/*, although it cannot fetch or rotate MCP server credentials. Access to container registries, Key Vault, monitoring data, managed identities, networks, and application endpoints remains separately authorized.

Control-plane actions (3)

• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.App/sessionPools/*/read

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on the individual Container Apps session pool resource when supported, or on its dedicated Container Apps resource group when the principal intentionally manages several related resources. Parent-scope assignments are inherited by every matching Container Apps resource below them.

Common use cases (1)

• Inspect session-pool configuration, status, capacity, image, and network settings without changing the pool or executing sessions.

Prerequisites (2)

• The target Container Apps session pool and its Container Apps environment design, workload identity, image source, network boundary, and monitoring destination must be approved.
• The Container Apps session pool must already exist; this role does not provision its external dependencies.

Best practices (2)

• Assign directly on the Container Apps session pool or a dedicated application resource group and keep environment, workload, and dependency administration separate.
• Use the reader role for inventory and troubleshooting and escalate only for a documented change or operation.

Security considerations (3)

• Pool configuration can disclose images, capacity, endpoints, network posture, and runtime design even though session execution authorization is separate.
• The role can create and manage classic metric alert rules through Microsoft.Insights/alertRules/*, although it cannot fetch or rotate MCP server credentials; this authority is outside the nominal Container Apps session pool read workflow.
• A broad Azure assignment is inherited by multiple Container Apps resources even though the role has no resource data-plane DataActions.

Assignment guidance

Assign Container Apps SessionPools Reader at the narrowest Container Apps session pool or dedicated resource-group scope to the identity that needs to reads Container Apps session pool and related status without changing that resource. Grant connected-resource permissions separately and choose the reader, operator, or contributor variant that matches the documented workflow.

Editorial sources (6)

• Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Use session pools in Azure Container Apps →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

Official Microsoft Learn documentation →