Azure Containers built-in role
Container Registry Cache Rule Administrator
Creates, updates, deletes, and reads ACR artifact-cache rules and related configuration through Azure control-plane Actions. It does not grant repository artifact DataActions, so cached content access still depends on separate repository permissions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: df87f177-bb12-4db1-9793-a413691eff94
Control-plane actions (4)
Microsoft.ContainerRegistry/registries/cacheRules/readMicrosoft.ContainerRegistry/registries/cacheRules/writeMicrosoft.ContainerRegistry/registries/cacheRules/deleteMicrosoft.ContainerRegistry/registries/cacheRules/operationStatuses/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual registry that owns the cache rules. Parent-scope assignments are inherited by every registry below them and permit cache-rule administration across those registries.
Common use cases (1)
- Configure and maintain approved upstream-to-target repository cache mappings for one registry.
Prerequisites (1)
- Define the upstream registry, source repository, target repository, network access, and any credential set required by the cache rule.
Best practices (2)
- Use dedicated credential sets for authenticated upstreams and separate cache-rule administration from repository artifact access.
- Validate source and target mappings to prevent cache poisoning or accidental mirroring into trusted repository names.
Security considerations (2)
- A cache-rule administrator can redirect which upstream content populates a target repository path, affecting software supply-chain integrity.
- The role manages configuration but does not itself authorize pulls, pushes, or deletes in repositories.
Assignment guidance
Assign on the target registry to the platform identity that manages artifact-cache mappings. Grant Credential Set Administrator only when it also manages upstream authentication, and grant repository DataActions separately when artifact access is required.
Related roles (2)
- Container Registry Cache Rule Reader: Reads cache-rule configuration without changing mappings.
- Container Registry Credential Set Administrator: Manages the credential-set configuration referenced by authenticated cache rules.
Common questions
When should I assign the Container Registry Cache Rule Administrator Azure role?
Assign Container Registry Cache Rule Administrator when you need to: Configure and maintain approved upstream-to-target repository cache mappings for one registry.. Practical scope: Assign on the individual registry that owns the cache rules. Parent-scope assignments are inherited by every registry below them and permit cache-rule administration across those registries.
What permissions does the Container Registry Cache Rule Administrator Azure role grant?
The role definition grants 4 combined control-plane and data-plane actions. Representative operations include: Microsoft.ContainerRegistry/registries/cacheRules/read; Microsoft.ContainerRegistry/registries/cacheRules/write; Microsoft.ContainerRegistry/registries/cacheRules/delete; and Microsoft.ContainerRegistry/registries/cacheRules/operationStatuses/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Container Registry Cache Rule Administrator Azure role?
Key considerations when assigning Container Registry Cache Rule Administrator: A cache-rule administrator can redirect which upstream content populates a target repository path, affecting software supply-chain integrity.; and The role manages configuration but does not itself authorize pulls, pushes, or deletes in repositories.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Azure Container Registry roles directory reference →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Tutorial: Create a cache rule in Azure Container Registry →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.