Azure Containers built-in role

Container Registry Data Importer and Data Reader

Imports artifacts into Azure Container Registry and reads registry data through the published registry operations. Import is a server-side copy workflow; the role is not general Azure registry administration and does not grant role-assignment management.

Control-plane actions (3)

• Microsoft.ContainerRegistry/registries/importImage/action
• Microsoft.ContainerRegistry/registries/read
• Microsoft.ContainerRegistry/registries/pull/read

Data-plane actions (3)

• Microsoft.ContainerRegistry/registries/repositories/content/read
• Microsoft.ContainerRegistry/registries/repositories/metadata/read
• Microsoft.ContainerRegistry/registries/catalog/read

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign on the destination registry for the import workflow. A parent assignment is inherited by every registry below it, broadening both import targets and registry data visibility.

Common use cases (1)

• Allow a migration or replication identity to import approved images and OCI artifacts into a destination registry and verify the imported data.

Prerequisites (2)

• Confirm the source registry, repository, tags or digests, destination repository names, source authentication, and destination registry permissions mode.
• Grant any required source-registry or source-credential access separately.

Best practices (2)

• Use a dedicated migration identity and a destination-registry assignment for a bounded import window.
• Import immutable digests where possible, verify signatures and scan results, and remove temporary source access after migration.

Security considerations (2)

• Import can introduce untrusted or vulnerable artifacts into repositories consumed by deployments, while data read access can expose existing registry content.
• A broad inherited assignment permits imports into multiple registries.

Assignment guidance

Assign on the destination registry to the dedicated import identity for the migration window. Authorize the source separately, validate imported digests and trust metadata, and remove the assignment when recurring import is not required.

Related roles (2)

• Container Registry Repository Reader: ABAC-capable repository read role for consumers that do not perform server-side imports.
• Container Registry Transfer Pipeline Contributor: Configures disconnected transfer pipelines through storage and Key Vault without ordinary push or pull access.

Editorial sources (8)

• Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →

  Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.

• Understand Azure role definitions →

  Supports: Description, Security considerations. Retrieved 2026-07-17.

• Steps to assign an Azure role →

  Supports: Assignment guidance. Retrieved 2026-07-17.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.

• Azure Container Registry roles directory reference →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Import container images to a container registry →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

• Azure ABAC repository permissions in Azure Container Registry →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.

Official Microsoft Learn documentation →