Azure Containers built-in role
Container Registry Credential Set Administrator
Creates, updates, deletes, and reads ACR credential-set configuration through Azure control-plane Actions. Credential sets supply authenticated upstream access for artifact cache; the role does not grant repository artifact DataActions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: f094fb07-0703-4400-ad6a-e16dd8000e14
Control-plane actions (4)
Microsoft.ContainerRegistry/registries/credentialSets/readMicrosoft.ContainerRegistry/registries/credentialSets/writeMicrosoft.ContainerRegistry/registries/credentialSets/deleteMicrosoft.ContainerRegistry/registries/credentialSets/operationStatuses/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual registry containing the credential sets. Parent assignments are inherited and permit credential-set changes across every registry below the scope.
Common use cases (1)
- Configure and rotate the upstream authentication references used by approved artifact-cache rules.
Prerequisites (2)
- Create the approved upstream credentials and secret store references required by the artifact-cache design.
- Define which cache rules may use each credential set and who owns rotation and revocation.
Best practices (2)
- Use a dedicated identity for credential-set administration and keep cache-rule and repository-content permissions separate.
- Rotate upstream credentials, restrict their upstream permissions, and remove unused credential sets promptly.
Security considerations (2)
- Changing a credential set can redirect or disrupt authenticated upstream access and can place broader upstream credentials behind cache workflows.
- The role manages credential configuration but does not itself grant access to pull, push, or delete registry artifacts.
Assignment guidance
Assign directly on the registry only to the identity that manages artifact-cache upstream authentication. Use Credential Set Reader for inspection and grant Cache Rule Administrator separately only when the same trusted identity also owns mappings.
Related roles (2)
- Container Registry Credential Set Reader: Reads credential-set configuration without changing it.
- Container Registry Cache Rule Administrator: Manages cache rules that can reference credential sets.
Common questions
When should I assign the Container Registry Credential Set Administrator Azure role?
Assign Container Registry Credential Set Administrator when you need to: Configure and rotate the upstream authentication references used by approved artifact-cache rules.. Practical scope: Assign on the individual registry containing the credential sets. Parent assignments are inherited and permit credential-set changes across every registry below the scope.
What permissions does the Container Registry Credential Set Administrator Azure role grant?
The role definition grants 4 combined control-plane and data-plane actions. Representative operations include: Microsoft.ContainerRegistry/registries/credentialSets/read; Microsoft.ContainerRegistry/registries/credentialSets/write; Microsoft.ContainerRegistry/registries/credentialSets/delete; and Microsoft.ContainerRegistry/registries/credentialSets/operationStatuses/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Container Registry Credential Set Administrator Azure role?
Key considerations when assigning Container Registry Credential Set Administrator: Changing a credential set can redirect or disrupt authenticated upstream access and can place broader upstream credentials behind cache workflows.; and The role manages credential configuration but does not itself grant access to pull, push, or delete registry artifacts.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Azure Container Registry roles directory reference →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Tutorial: Create a cache rule in Azure Container Registry →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.