Azure Containers built-in role

Container Registry Contributor and Data Access Configuration Administrator

Manages Azure Container Registry resources and data-access configuration, including listing and regenerating admin login credentials, generating token credentials, and creating, updating, or deleting tokens and scope maps. It has no direct repository artifact DataActions, but the credentials and token scopes it controls can create repository read, write, or delete access.

Control-plane actions (58)

• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.ContainerRegistry/registries/operationStatuses/read
• Microsoft.ContainerRegistry/registries/read
• Microsoft.ContainerRegistry/registries/write
• Microsoft.ContainerRegistry/registries/delete
• Microsoft.ContainerRegistry/registries/listCredentials/action
• Microsoft.ContainerRegistry/registries/regenerateCredential/action
• Microsoft.ContainerRegistry/registries/generateCredentials/action
• Microsoft.ContainerRegistry/registries/replications/read
• Microsoft.ContainerRegistry/registries/replications/write
• Microsoft.ContainerRegistry/registries/replications/delete
• Microsoft.ContainerRegistry/registries/replications/operationStatuses/read
• Microsoft.ContainerRegistry/registries/privateEndpointConnectionsApproval/action
• Microsoft.ContainerRegistry/registries/privateEndpointConnections/read
• Microsoft.ContainerRegistry/registries/privateEndpointConnections/write
• Microsoft.ContainerRegistry/registries/privateEndpointConnections/delete
• Microsoft.ContainerRegistry/registries/privateEndpointConnections/operationStatuses/read
• Microsoft.ContainerRegistry/registries/tokens/read
• Microsoft.ContainerRegistry/registries/tokens/write
• Microsoft.ContainerRegistry/registries/tokens/delete
• Microsoft.ContainerRegistry/registries/tokens/operationStatuses/read
• Microsoft.ContainerRegistry/registries/scopeMaps/read
• Microsoft.ContainerRegistry/registries/scopeMaps/write
• Microsoft.ContainerRegistry/registries/scopeMaps/delete
• Microsoft.ContainerRegistry/registries/scopeMaps/operationStatuses/read
• Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/diagnosticSettings/read
• Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/diagnosticSettings/write
• Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/logDefinitions/read
• Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/metricDefinitions/read
• Microsoft.Resources/deployments/*
• Microsoft.Authorization/*/read
• Microsoft.ContainerRegistry/registries/connectedRegistries/read
• Microsoft.ContainerRegistry/registries/connectedRegistries/write
• Microsoft.ContainerRegistry/registries/connectedRegistries/delete
• Microsoft.ContainerRegistry/registries/connectedRegistries/deactivate/action
• Microsoft.ContainerRegistry/registries/webhooks/read
• Microsoft.ContainerRegistry/registries/webhooks/write
• Microsoft.ContainerRegistry/registries/webhooks/delete
• Microsoft.ContainerRegistry/registries/webhooks/getCallbackConfig/action
• Microsoft.ContainerRegistry/registries/webhooks/ping/action
• Microsoft.ContainerRegistry/registries/webhooks/listEvents/action
• Microsoft.ContainerRegistry/registries/webhooks/operationStatuses/read
• Microsoft.Insights/AlertRules/Write
• Microsoft.Insights/AlertRules/Delete
• Microsoft.Insights/AlertRules/Read
• Microsoft.Insights/AlertRules/Activated/Action
• Microsoft.Insights/AlertRules/Resolved/Action
• Microsoft.Insights/AlertRules/Throttled/Action
• Microsoft.Insights/AlertRules/Incidents/Read
• Microsoft.ContainerRegistry/locations/operationResults/read
• Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action
• Microsoft.Network/virtualNetworks/subnets/read
• Microsoft.Network/virtualNetworks/subnets/write
• Microsoft.Network/virtualNetworks/read
• Microsoft.Network/privateEndpoints/privateLinkServiceProxies/write
• Microsoft.Network/privateEndpoints/privateLinkServiceProxies/read
• Microsoft.Network/privateEndpoints/privateLinkServiceProxies/delete
• Microsoft.Support/*

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on the individual registry. A resource-group or broader assignment is inherited by every registry below it and permits management of registry security and data-access configuration across all of them.

Common use cases (1)

• Administer one registry, its network and monitoring configuration, and its admin-credential, token, and scope-map access mechanisms while ordinary publishers and consumers receive separate repository roles.

Prerequisites (1)

• Define the registry permissions mode, repository access model, network boundary, identities, and separation between registry administration and artifact workflows.

Best practices (2)

• Disable the registry admin account when it is not required, prefer Microsoft Entra workload identities, and tightly scope every token and scope map.
• Use eligible or time-bound access for people where available and audit credential listing or regeneration, token generation, scope-map changes, permissions-mode changes, and monitoring configuration.

Security considerations (2)

• Listing or regenerating admin credentials and generating token credentials can produce credential-derived repository access even though the role has no repository DataActions.
• Creating or changing tokens and scope maps can grant read, write, or delete authority to holders of generated credentials; registry, network, diagnostic, and alert changes can also disrupt clients or reduce visibility.

Assignment guidance

Assign directly on one registry to a small platform-administration group only when it owns registry configuration and credential-based access mechanisms. Prefer repository roles for ordinary artifact workflows, disable unused admin credentials, and review every generated token and scope map.

Related roles (2)

• Container Registry Configuration Reader and Data Access Configuration Reader: Narrower registry-management role that views configuration and credentials but still writes diagnostic settings and manages classic alert rules.
• Container Registry Repository Contributor: Separate ABAC-capable artifact read, write, and delete DataActions.

Editorial sources (8)

• Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Azure Container Registry Microsoft Entra permissions and role assignments overview →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Azure Container Registry roles directory reference →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Azure ABAC repository permissions in Azure Container Registry →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →