Azure Containers built-in role
Container Registry Credential Set Reader
Reads ACR credential-set configuration through Azure control-plane Actions. It cannot create, update, or delete credential sets and grants no repository artifact DataActions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 29093635-9924-4f2c-913b-650a12949526
Control-plane actions (1)
Microsoft.ContainerRegistry/registries/credentialSets/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on one registry whose artifact-cache authentication configuration the reviewer must inspect. Parent assignments expose credential-set metadata across inherited registries.
Common use cases (1)
- Review which credential sets support artifact-cache rules during audit or troubleshooting without changing authentication configuration.
Prerequisites (1)
- Credential sets must already exist and the reviewer must be approved to view their configuration metadata.
Best practices (2)
- Use this reader role rather than Credential Set Administrator for audit and troubleshooting.
- Do not combine it with repository or cache-rule write access unless the workflow requires those separate capabilities.
Security considerations (1)
- Configuration metadata can reveal upstream registry and authentication topology even though the role does not grant upstream secret retrieval or artifact access.
Assignment guidance
Assign directly on the registry to approved configuration reviewers. Escalate to Credential Set Administrator only for credential-set lifecycle changes.
Related roles (1)
- Container Registry Credential Set Administrator: Adds credential-set create, update, and delete authority.
Common questions
When should I assign the Container Registry Credential Set Reader Azure role?
Assign Container Registry Credential Set Reader when you need to: Review which credential sets support artifact-cache rules during audit or troubleshooting without changing authentication configuration.. Practical scope: Assign on one registry whose artifact-cache authentication configuration the reviewer must inspect. Parent assignments expose credential-set metadata across inherited registries.
What permissions does the Container Registry Credential Set Reader Azure role grant?
The role definition grants 1 combined control-plane and data-plane actions. Representative operations include: Microsoft.ContainerRegistry/registries/credentialSets/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Container Registry Credential Set Reader Azure role?
Key considerations when assigning Container Registry Credential Set Reader: Configuration metadata can reveal upstream registry and authentication topology even though the role does not grant upstream secret retrieval or artifact access.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (7)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Azure Container Registry roles directory reference →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Tutorial: Create a cache rule in Azure Container Registry →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.