Azure Containers built-in role
Container Registry Repository Writer
Container Registry Repository Writer reads, pulls, pushes, updates, retags, and destructively untags artifacts without general repository content-delete access in an ACR registry configured for RBAC Registry + ABAC Repository Permissions. Its repository operations are registry DataActions, distinct from Azure control-plane management of the registry resource. An optional ABAC condition on the role assignment can restrict access to repositories whose attributes match the approved expression; without a condition, the assignment applies registry-wide.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 2a1e307c-b015-4ebd-883e-5b7698a07328
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (4)
Microsoft.ContainerRegistry/registries/repositories/metadata/readMicrosoft.ContainerRegistry/registries/repositories/content/readMicrosoft.ContainerRegistry/registries/repositories/metadata/writeMicrosoft.ContainerRegistry/registries/repositories/content/write
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual registry. Azure assignment scope is inherited from parent resource scopes, while any supported ABAC condition filters the repository data-plane operations inside that registry; a condition does not change which Azure registry resources inherit the assignment.
Common use cases (1)
- Allow a CI/CD workload or approved developer to publish images, signatures, and other OCI artifacts to selected repositories.
Prerequisites (2)
- Configure the registry for RBAC Registry + ABAC Repository Permissions mode and refresh any credentials issued under a previous permissions mode.
- Define and test the repository attribute condition before granting access when the principal should reach fewer than all repositories.
Best practices (2)
- Use an ABAC condition for repository-specific access and leave the assignment unconditioned only when registry-wide access is intentional.
- Assign directly on one registry, use workload identities for automation, and test the exact pull, push, delete, and list operations required by the client.
Security considerations (3)
- Write access can replace mutable tags, publish untrusted artifacts and OCI referrers, and untag artifacts so tag-based clients can no longer resolve them even without general content-delete DataActions.
- Repository DataActions authorize artifact operations but do not by themselves grant Azure control-plane permission to configure the registry.
- An assignment without a supported repository condition applies to every repository in the registry.
Assignment guidance
Assign Container Registry Repository Writer on the target ABAC-enabled registry for reads, pulls, pushes, updates, retags, and destructively untags artifacts without general repository content-delete access. Add a tested repository condition unless registry-wide access is required, and grant Repository Catalog Lister separately only if the principal must enumerate repository names.
Related roles (2)
- Container Registry Repository Reader: Read-only repository access for consumers that do not publish artifacts.
- Container Registry Repository Contributor: Adds general repository metadata and content deletion DataActions beyond Writer's destructive untag capability.
Editorial sources (8)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Azure Container Registry Microsoft Entra permissions and role assignments overview →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Azure Container Registry roles directory reference →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Azure ABAC repository permissions in Azure Container Registry →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.