Azure Containers built-in role
Container Registry Cache Rule Reader
Reads ACR artifact-cache rules and related configuration through Azure control-plane Actions. It cannot change cache rules and grants no repository artifact DataActions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: c357b964-0002-4b64-a50d-7a28f02edc52
Control-plane actions (1)
Microsoft.ContainerRegistry/registries/cacheRules/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on one registry for a bounded configuration review. A parent assignment exposes cache-rule configuration for every inherited registry.
Common use cases (1)
- Review upstream and target repository mappings for troubleshooting, governance, or supply-chain assurance without changing them.
Prerequisites (1)
- Artifact cache must be configured on the registry and the reviewer must be approved to see upstream and target mapping metadata.
Best practices (2)
- Use the reader role for audit and troubleshooting instead of Cache Rule Administrator.
- Keep repository artifact access and credential-set management on separate assignments.
Security considerations (1)
- Cache-rule configuration can disclose upstream registry and repository topology even though it does not expose artifact data or credentials.
Assignment guidance
Assign directly on the registry to reviewers who only inspect cache configuration. Escalate to Cache Rule Administrator only for approved mapping changes.
Related roles (1)
- Container Registry Cache Rule Administrator: Adds create, update, and delete authority for cache rules.
Common questions
When should I assign the Container Registry Cache Rule Reader Azure role?
Assign Container Registry Cache Rule Reader when you need to: Review upstream and target repository mappings for troubleshooting, governance, or supply-chain assurance without changing them.. Practical scope: Assign on one registry for a bounded configuration review. A parent assignment exposes cache-rule configuration for every inherited registry.
What permissions does the Container Registry Cache Rule Reader Azure role grant?
The role definition grants 1 combined control-plane and data-plane actions. Representative operations include: Microsoft.ContainerRegistry/registries/cacheRules/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Container Registry Cache Rule Reader Azure role?
Key considerations when assigning Container Registry Cache Rule Reader: Cache-rule configuration can disclose upstream registry and repository topology even though it does not expose artifact data or credentials.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Azure Container Registry roles directory reference →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Tutorial: Create a cache rule in Azure Container Registry →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.