Azure Containers built-in role

Container Registry Tasks Contributor

Creates, changes, runs, cancels, and inspects ACR Tasks, quick builds, quick runs, task logs, and agent pools, including customer-authored build directives and scripts; it can retrieve run-log SAS URLs. On RBAC-only registries, Microsoft warns that task management can be used for full registry data-plane operations, including reading, writing, or deleting images. On ABAC-enabled registries, tasks and quick operations have no default source-registry data access and require an explicitly authorized task identity or caller.

Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.

Role definition ID: fb382eab-e894-4461-af04-94435c366c3f

Control-plane actions (24)

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Assignable scopes (1)

Practical scope

Assign on the individual registry that owns the tasks. Parent-scope assignments are inherited by every registry below them and permit task administration and execution across those registries.

Common use cases (1)

Prerequisites (2)

Best practices (2)

Security considerations (3)

Assignment guidance

Assign directly on one registry only to the build-platform identity that owns executable ACR Task configuration. In RBAC-only mode, treat the grant as capable of full registry content impact. In ABAC-enabled mode, explicitly assign the least repository role to each task identity or quick-task caller and review any ABAC condition.

Related roles (1)

Common questions

When should I assign the Container Registry Tasks Contributor Azure role?

Assign Container Registry Tasks Contributor when you need to: Let a trusted build-platform identity create, update, run, and troubleshoot automated image build, patch, or maintenance tasks in one registry.. Practical scope: Assign on the individual registry that owns the tasks. Parent-scope assignments are inherited by every registry below them and permit task administration and execution across those registries.

What permissions does the Container Registry Tasks Contributor Azure role grant?

The role definition grants 24 combined control-plane and data-plane actions. Representative operations include: Microsoft.ContainerRegistry/registries/agentpools/read; Microsoft.ContainerRegistry/registries/agentpools/write; Microsoft.ContainerRegistry/registries/agentpools/delete; Microsoft.ContainerRegistry/registries/agentpools/listQueueStatus/action; Microsoft.ContainerRegistry/registries/agentpools/operationResults/status/read; and Microsoft.ContainerRegistry/registries/agentpools/operationStatuses/read. Review the permission sections above for the complete definition and exclusions.

What are the security risks of the Container Registry Tasks Contributor Azure role?

Key considerations when assigning Container Registry Tasks Contributor: A task contributor can run customer-authored scripts and change executable build steps, potentially publishing or deleting artifacts and exercising task identities against connected resources.; Run-log SAS URLs are bearer-style links that can expose task output, which may contain source, build, or diagnostic information; protect and expire them according to the task workflow.; and ABAC-enabled mode removes default source-registry data access but does not make task administration harmless; the attached task identity or quick-task caller supplies the repository authority used by the execution.. Follow the assignment guidance above and use the narrowest practical scope.

Editorial sources (8)

Official Microsoft Learn documentation →