Azure Containers built-in role
Container Registry Tasks Contributor
Creates, changes, runs, cancels, and inspects ACR Tasks, quick builds, quick runs, task logs, and agent pools, including customer-authored build directives and scripts; it can retrieve run-log SAS URLs. On RBAC-only registries, Microsoft warns that task management can be used for full registry data-plane operations, including reading, writing, or deleting images. On ABAC-enabled registries, tasks and quick operations have no default source-registry data access and require an explicitly authorized task identity or caller.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: fb382eab-e894-4461-af04-94435c366c3f
Control-plane actions (24)
Microsoft.ContainerRegistry/registries/agentpools/readMicrosoft.ContainerRegistry/registries/agentpools/writeMicrosoft.ContainerRegistry/registries/agentpools/deleteMicrosoft.ContainerRegistry/registries/agentpools/listQueueStatus/actionMicrosoft.ContainerRegistry/registries/agentpools/operationResults/status/readMicrosoft.ContainerRegistry/registries/agentpools/operationStatuses/readMicrosoft.ContainerRegistry/registries/tasks/readMicrosoft.ContainerRegistry/registries/tasks/writeMicrosoft.ContainerRegistry/registries/tasks/deleteMicrosoft.ContainerRegistry/registries/tasks/listDetails/actionMicrosoft.ContainerRegistry/registries/scheduleRun/actionMicrosoft.ContainerRegistry/registries/listBuildSourceUploadUrl/actionMicrosoft.ContainerRegistry/registries/runs/readMicrosoft.ContainerRegistry/registries/runs/writeMicrosoft.ContainerRegistry/registries/runs/listLogSasUrl/actionMicrosoft.ContainerRegistry/registries/runs/cancel/actionMicrosoft.ContainerRegistry/registries/taskruns/readMicrosoft.ContainerRegistry/registries/taskruns/writeMicrosoft.ContainerRegistry/registries/taskruns/deleteMicrosoft.ContainerRegistry/registries/taskruns/listDetails/actionMicrosoft.ContainerRegistry/registries/taskruns/operationStatuses/readMicrosoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/readMicrosoft.ContainerRegistry/registries/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual registry that owns the tasks. Parent-scope assignments are inherited by every registry below them and permit task administration and execution across those registries.
Common use cases (1)
- Let a trusted build-platform identity create, update, run, and troubleshoot automated image build, patch, or maintenance tasks in one registry.
Prerequisites (2)
- Define the source context, task steps, trigger, target repositories, task identity, credentials, and external resources used by each task.
- For an ABAC-enabled source registry, attach an identity to each task and grant that identity the required Repository role and Catalog Lister access; quick builds and runs use an appropriately authorized caller identity. Authorize source control, Key Vault, or other external resources separately.
Best practices (2)
- Review task definitions and source references as executable supply-chain configuration and use dedicated managed identities.
- Treat RBAC-only task administration as capable of full registry content impact; on ABAC-enabled registries, constrain task and caller repository roles with conditions and narrowly authorize every external credential.
Security considerations (3)
- A task contributor can run customer-authored scripts and change executable build steps, potentially publishing or deleting artifacts and exercising task identities against connected resources.
- Run-log SAS URLs are bearer-style links that can expose task output, which may contain source, build, or diagnostic information; protect and expire them according to the task workflow.
- ABAC-enabled mode removes default source-registry data access but does not make task administration harmless; the attached task identity or quick-task caller supplies the repository authority used by the execution.
Assignment guidance
Assign directly on one registry only to the build-platform identity that owns executable ACR Task configuration. In RBAC-only mode, treat the grant as capable of full registry content impact. In ABAC-enabled mode, explicitly assign the least repository role to each task identity or quick-task caller and review any ABAC condition.
Related roles (1)
- Container Registry Repository Writer: Separate repository DataActions for publishing artifacts in an ABAC-enabled registry.
Editorial sources (8)
- Azure built-in roles for Containers - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Understand Azure role definitions →
Supports: Description, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role →
Supports: Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Azure Container Registry roles directory reference →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- ACR Tasks overview →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Azure ABAC repository permissions in Azure Container Registry →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.