Azure Containers built-in role
Container Registry Repository Catalog Lister
Container Registry Repository Catalog Lister lists repository names without reading artifact content in an ACR registry configured for RBAC Registry + ABAC Repository Permissions. Its repository operations are registry DataActions, distinct from Azure control-plane management of the registry resource. This role does not support repository ABAC conditions and therefore applies its catalog permission across the whole registry.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: bfdb9389-c9a5-478a-bb2f-ba9ca092c3c7
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (1)
Microsoft.ContainerRegistry/registries/catalog/read
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual registry. Azure assignment scope is inherited from parent resource scopes, while any supported ABAC condition filters the repository data-plane operations inside that registry; a condition does not change which Azure registry resources inherit the assignment.
Common use cases (1)
- Allow a discovery tool or operator to enumerate repository names before a separately authorized repository operation.
Prerequisites (2)
- Configure the registry for RBAC Registry + ABAC Repository Permissions mode and refresh any credentials issued under a previous permissions mode.
- Confirm that registry-wide repository catalog visibility is acceptable because this role cannot be limited by a repository ABAC condition.
Best practices (2)
- Grant catalog listing only to identities that must discover repository names; combine it with a repository role only when the workflow also needs artifact access.
- Assign directly on one registry, use workload identities for automation, and test the exact pull, push, delete, and list operations required by the client.
Security considerations (3)
- Registry-wide repository-name disclosure can reveal project, service, customer, or environment naming even though artifact content remains inaccessible.
- Repository DataActions authorize artifact operations but do not by themselves grant Azure control-plane permission to configure the registry.
- An assignment without a supported repository condition applies to every repository in the registry.
Assignment guidance
Assign Container Registry Repository Catalog Lister on the target ABAC-enabled registry for lists repository names without reading artifact content. Do not treat catalog listing as permission to pull, push, or delete artifacts; add the matching repository role separately for those operations.
Related roles (1)
- Container Registry Repository Reader: Provides artifact and metadata read access but does not include registry catalog listing.
Common questions
When should I assign the Container Registry Repository Catalog Lister Azure role?
Assign Container Registry Repository Catalog Lister when you need to: Allow a discovery tool or operator to enumerate repository names before a separately authorized repository operation.. Practical scope: Assign on the individual registry. Azure assignment scope is inherited from parent resource scopes, while any supported ABAC condition filters the repository data-plane operations inside that registry; a condition does not change which Azure registry resources inherit the assignment.
What permissions does the Container Registry Repository Catalog Lister Azure role grant?
The role definition grants 1 combined control-plane and data-plane actions. Representative operations include: Microsoft.ContainerRegistry/registries/catalog/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Container Registry Repository Catalog Lister Azure role?
Key considerations when assigning Container Registry Repository Catalog Lister: Registry-wide repository-name disclosure can reveal project, service, customer, or environment naming even though artifact content remains inaccessible.; Repository DataActions authorize artifact operations but do not by themselves grant Azure control-plane permission to configure the registry.; and An assignment without a supported repository condition applies to every repository in the registry.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (8)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Azure Container Registry Microsoft Entra permissions and role assignments overview →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Azure Container Registry roles directory reference →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Azure ABAC repository permissions in Azure Container Registry →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.