Azure Containers built-in role

Container Registry Repository Writer

Container Registry Repository Writer reads, pulls, pushes, updates, retags, and destructively untags artifacts without general repository content-delete access in an ACR registry configured for RBAC Registry + ABAC Repository Permissions. Its repository operations are registry DataActions, distinct from Azure control-plane management of the registry resource. An optional ABAC condition on the role assignment can restrict access to repositories whose attributes match the approved expression; without a condition, the assignment applies registry-wide.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: 2a1e307c-b015-4ebd-883e-5b7698a07328

Control-plane actions (0)

None — this role grants no control-plane management actions.

Data-plane actions (4)

Excluded actions (0)

None

Assignable scopes (1)

Practical scope

Assign on the individual registry. Azure assignment scope is inherited from parent resource scopes, while any supported ABAC condition filters the repository data-plane operations inside that registry; a condition does not change which Azure registry resources inherit the assignment.

Common use cases (1)

Prerequisites (2)

Best practices (2)

Security considerations (3)

Assignment guidance

Assign Container Registry Repository Writer on the target ABAC-enabled registry for reads, pulls, pushes, updates, retags, and destructively untags artifacts without general repository content-delete access. Add a tested repository condition unless registry-wide access is required, and grant Repository Catalog Lister separately only if the principal must enumerate repository names.

Related roles (2)

Common questions

When should I assign the Container Registry Repository Writer Azure role?

Assign Container Registry Repository Writer when you need to: Allow a CI/CD workload or approved developer to publish images, signatures, and other OCI artifacts to selected repositories.. Practical scope: Assign on the individual registry. Azure assignment scope is inherited from parent resource scopes, while any supported ABAC condition filters the repository data-plane operations inside that registry; a condition does not change which Azure registry resources inherit the assignment.

What permissions does the Container Registry Repository Writer Azure role grant?

The role definition grants 4 combined control-plane and data-plane actions. Representative operations include: Microsoft.ContainerRegistry/registries/repositories/metadata/read; Microsoft.ContainerRegistry/registries/repositories/content/read; Microsoft.ContainerRegistry/registries/repositories/metadata/write; and Microsoft.ContainerRegistry/registries/repositories/content/write. Review the permission sections above for the complete definition and exclusions.

What are the security risks of the Container Registry Repository Writer Azure role?

Key considerations when assigning Container Registry Repository Writer: Write access can replace mutable tags, publish untrusted artifacts and OCI referrers, and untag artifacts so tag-based clients can no longer resolve them even without general content-delete DataActions.; Repository DataActions authorize artifact operations but do not by themselves grant Azure control-plane permission to configure the registry.; and An assignment without a supported repository condition applies to every repository in the registry.. Follow the assignment guidance above and use the narrowest practical scope.

Editorial sources (8)

Official Microsoft Learn documentation →