Azure Containers built-in role
Container Registry Data Importer and Data Reader
Imports artifacts into Azure Container Registry and reads registry data through the published registry operations. Import is a server-side copy workflow; the role is not general Azure registry administration and does not grant role-assignment management.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 577a9874-89fd-4f24-9dbd-b5034d0ad23a
Control-plane actions (3)
Microsoft.ContainerRegistry/registries/importImage/actionMicrosoft.ContainerRegistry/registries/readMicrosoft.ContainerRegistry/registries/pull/read
Data-plane actions (3)
Microsoft.ContainerRegistry/registries/repositories/content/readMicrosoft.ContainerRegistry/registries/repositories/metadata/readMicrosoft.ContainerRegistry/registries/catalog/read
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the destination registry for the import workflow. A parent assignment is inherited by every registry below it, broadening both import targets and registry data visibility.
Common use cases (1)
- Allow a migration or replication identity to import approved images and OCI artifacts into a destination registry and verify the imported data.
Prerequisites (2)
- Confirm the source registry, repository, tags or digests, destination repository names, source authentication, and destination registry permissions mode.
- Grant any required source-registry or source-credential access separately.
Best practices (2)
- Use a dedicated migration identity and a destination-registry assignment for a bounded import window.
- Import immutable digests where possible, verify signatures and scan results, and remove temporary source access after migration.
Security considerations (2)
- Import can introduce untrusted or vulnerable artifacts into repositories consumed by deployments, while data read access can expose existing registry content.
- A broad inherited assignment permits imports into multiple registries.
Assignment guidance
Assign on the destination registry to the dedicated import identity for the migration window. Authorize the source separately, validate imported digests and trust metadata, and remove the assignment when recurring import is not required.
Related roles (2)
- Container Registry Repository Reader: ABAC-capable repository read role for consumers that do not perform server-side imports.
- Container Registry Transfer Pipeline Contributor: Configures disconnected transfer pipelines through storage and Key Vault without ordinary push or pull access.
Common questions
When should I assign the Container Registry Data Importer and Data Reader Azure role?
Assign Container Registry Data Importer and Data Reader when you need to: Allow a migration or replication identity to import approved images and OCI artifacts into a destination registry and verify the imported data.. Practical scope: Assign on the destination registry for the import workflow. A parent assignment is inherited by every registry below it, broadening both import targets and registry data visibility.
What permissions does the Container Registry Data Importer and Data Reader Azure role grant?
The role definition grants 6 combined control-plane and data-plane actions. Representative operations include: Microsoft.ContainerRegistry/registries/importImage/action; Microsoft.ContainerRegistry/registries/read; Microsoft.ContainerRegistry/registries/pull/read; Microsoft.ContainerRegistry/registries/repositories/content/read; Microsoft.ContainerRegistry/registries/repositories/metadata/read; and Microsoft.ContainerRegistry/registries/catalog/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Container Registry Data Importer and Data Reader Azure role?
Key considerations when assigning Container Registry Data Importer and Data Reader: Import can introduce untrusted or vulnerable artifacts into repositories consumed by deployments, while data read access can expose existing registry content.; and A broad inherited assignment permits imports into multiple registries.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (8)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Azure Container Registry roles directory reference →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Import container images to a container registry →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Azure ABAC repository permissions in Azure Container Registry →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.