Azure Containers built-in role

Container Registry Configuration Reader and Data Access Configuration Reader

Views Azure Container Registry and data-access configuration, lists registry login credentials, tokens, and scope maps, and can create or update diagnostic settings and manage classic alert rules. It has no direct repository artifact DataActions, but exposed admin or token credentials can carry repository read, write, or delete access.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: 69b07be0-09bf-439a-b9a6-e73de851bd59

Control-plane actions (33)

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

Practical scope

Assign on the individual registry whose configuration the principal reviews. A parent assignment is inherited by every registry below it and exposes both registry and data-access configuration across those registries.

Common use cases (1)

Prerequisites (1)

Best practices (2)

Security considerations (2)

Assignment guidance

Assign directly on one registry only when the identity needs the documented credential-listing and monitoring-write capabilities as well as configuration reads. Use a narrower custom role for read-only audits and do not treat the absence of DataActions as proof that the role cannot yield repository access through credentials.

Related roles (1)

Common questions

When should I assign the Container Registry Configuration Reader and Data Access Configuration Reader Azure role?

Assign Container Registry Configuration Reader and Data Access Configuration Reader when you need to: Support a tightly controlled registry audit or monitoring workflow that requires configuration visibility, registry credential listing, and diagnostic or classic-alert configuration without direct repository DataActions.. Practical scope: Assign on the individual registry whose configuration the principal reviews. A parent assignment is inherited by every registry below it and exposes both registry and data-access configuration across those registries.

What permissions does the Container Registry Configuration Reader and Data Access Configuration Reader Azure role grant?

The role definition grants 33 combined control-plane and data-plane actions. Representative operations include: Microsoft.ContainerRegistry/registries/operationStatuses/read; Microsoft.ContainerRegistry/registries/read; Microsoft.ContainerRegistry/registries/privateEndpointConnections/read; Microsoft.ContainerRegistry/registries/privateEndpointConnections/operationStatuses/read; Microsoft.ContainerRegistry/registries/listCredentials/action; and Microsoft.ContainerRegistry/registries/tokens/read. Review the permission sections above for the complete definition and exclusions.

What are the security risks of the Container Registry Configuration Reader and Data Access Configuration Reader Azure role?

Key considerations when assigning Container Registry Configuration Reader and Data Access Configuration Reader: Listing registry login credentials can expose admin credentials whose effective repository authority can include reading, writing, or deleting artifacts.; and Diagnostic-setting and classic-alert writes can redirect telemetry or change alert behavior even though the role cannot directly push or pull repository content.. Follow the assignment guidance above and use the narrowest practical scope.

Editorial sources (8)

Official Microsoft Learn documentation →