Azure Containers built-in role

Azure Container Instances Contributor Role

Creates, updates, deletes, starts, stops, and restarts Azure Container Instances container groups. The containerGroups wildcard also permits interactive exec into a running container, attachment to its output stream, reading build and application logs, refreshing delegated resource identity, and writing container-group diagnostic settings. Access to external registries, storage, networks, and managed identities remains separately authorized.

Control-plane actions (5)

• Microsoft.ContainerInstance/containerGroups/*
• Microsoft.Resources/deployments/*
• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.Resources/subscriptions/resourceGroups/read

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on the dedicated resource group containing the approved container groups. A subscription or management-group assignment is inherited by every ACI resource below it and permits container execution across those scopes.

Common use cases (1)

• Allow a trusted application or operations team to deploy and manage ACI workloads and, when required, execute an approved troubleshooting command, attach to output, or inspect logs in a dedicated resource group.

Prerequisites (2)

• Define approved images, commands, CPU and memory, restart policy, identity, registry authentication, networking, DNS, volumes, logging, and data-handling requirements.
• Grant separate access to ACR, Azure Files, virtual networks, managed identities, Key Vault, or other connected resources.

Best practices (2)

• Use trusted immutable image digests, managed identities, private networking where required, and dedicated resource groups for workload boundaries.
• Audit container exec, attach, log access, delegated-identity refresh, lifecycle, and diagnostic-setting changes; do not place secrets directly in deployment templates or environment variables when a supported secret reference or managed identity workflow is available.

Security considerations (3)

• Interactive exec can launch a shell or process inside the running container, where the principal can reach files, environment variables, mounted data, and tokens available to that container security context.
• Attach and log reads expose STDOUT, STDERR, build logs, and diagnostic events; lifecycle and diagnostic-setting writes can disrupt workloads or redirect telemetry.
• The role can also deploy arbitrary approved images and commands, attach identities and storage, expose network endpoints, and delete container groups; broad companion roles extend the workload and operator impact.

Assignment guidance

Assign Azure Container Instances Contributor on a dedicated ACI resource group only to an identity trusted with deployment, lifecycle, exec, attach, logs, and diagnostic settings. Authorize external registries, storage, networks, and managed identities separately and avoid subscription-wide human assignment.

Editorial sources (9)

• Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• What is Azure Container Instances? →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Azure permissions for Containers →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Execute commands in a running container instance →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

• Get container instance logs and events →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.

Official Microsoft Learn documentation →