Azure Containers built-in role
Azure Container Instances Contributor Role
Creates, updates, deletes, starts, stops, and restarts Azure Container Instances container groups. The containerGroups wildcard also permits interactive exec into a running container, attachment to its output stream, reading build and application logs, refreshing delegated resource identity, and writing container-group diagnostic settings. Access to external registries, storage, networks, and managed identities remains separately authorized.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 5d977122-f97e-4b4d-a52f-6b43003ddb4d
Control-plane actions (5)
Microsoft.ContainerInstance/containerGroups/*Microsoft.Resources/deployments/*Microsoft.Authorization/*/readMicrosoft.Insights/alertRules/*Microsoft.Resources/subscriptions/resourceGroups/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the dedicated resource group containing the approved container groups. A subscription or management-group assignment is inherited by every ACI resource below it and permits container execution across those scopes.
Common use cases (1)
- Allow a trusted application or operations team to deploy and manage ACI workloads and, when required, execute an approved troubleshooting command, attach to output, or inspect logs in a dedicated resource group.
Prerequisites (2)
- Define approved images, commands, CPU and memory, restart policy, identity, registry authentication, networking, DNS, volumes, logging, and data-handling requirements.
- Grant separate access to ACR, Azure Files, virtual networks, managed identities, Key Vault, or other connected resources.
Best practices (2)
- Use trusted immutable image digests, managed identities, private networking where required, and dedicated resource groups for workload boundaries.
- Audit container exec, attach, log access, delegated-identity refresh, lifecycle, and diagnostic-setting changes; do not place secrets directly in deployment templates or environment variables when a supported secret reference or managed identity workflow is available.
Security considerations (3)
- Interactive exec can launch a shell or process inside the running container, where the principal can reach files, environment variables, mounted data, and tokens available to that container security context.
- Attach and log reads expose STDOUT, STDERR, build logs, and diagnostic events; lifecycle and diagnostic-setting writes can disrupt workloads or redirect telemetry.
- The role can also deploy arbitrary approved images and commands, attach identities and storage, expose network endpoints, and delete container groups; broad companion roles extend the workload and operator impact.
Assignment guidance
Assign Azure Container Instances Contributor on a dedicated ACI resource group only to an identity trusted with deployment, lifecycle, exec, attach, logs, and diagnostic settings. Authorize external registries, storage, networks, and managed identities separately and avoid subscription-wide human assignment.
Common questions
When should I assign the Azure Container Instances Contributor Role Azure role?
Assign Azure Container Instances Contributor Role when you need to: Allow a trusted application or operations team to deploy and manage ACI workloads and, when required, execute an approved troubleshooting command, attach to output, or inspect logs in a dedicated resource group.. Practical scope: Assign on the dedicated resource group containing the approved container groups. A subscription or management-group assignment is inherited by every ACI resource below it and permits container execution across those scopes.
What permissions does the Azure Container Instances Contributor Role Azure role grant?
The role definition grants 5 combined control-plane and data-plane actions. Representative operations include: Microsoft.ContainerInstance/containerGroups/*; Microsoft.Resources/deployments/*; Microsoft.Authorization/*/read; Microsoft.Insights/alertRules/*; and Microsoft.Resources/subscriptions/resourceGroups/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Azure Container Instances Contributor Role Azure role?
Key considerations when assigning Azure Container Instances Contributor Role: Interactive exec can launch a shell or process inside the running container, where the principal can reach files, environment variables, mounted data, and tokens available to that container security context.; Attach and log reads expose STDOUT, STDERR, build logs, and diagnostic events; lifecycle and diagnostic-setting writes can disrupt workloads or redirect telemetry.; and The role can also deploy arbitrary approved images and commands, attach identities and storage, expose network endpoints, and delete container groups; broad companion roles extend the workload and operator impact.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (9)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- What is Azure Container Instances? →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.
- Azure permissions for Containers →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.
- Execute commands in a running container instance →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.
- Get container instance logs and events →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance. Retrieved 2026-07-17.