Edit

Share via

Azure Container Registry roles directory reference

  • Article

This directory provides a comprehensive reference of all built-in roles available for Azure Container Registry (ACR). This document is designed for expert users who need detailed knowledge of ACR permissions in built-in roles for identity management, auditing, security, or custom role design. Each ACR built-in role is documented here with its included control plane and data plane permissions.

The following built-in role types are available:

For a high-level overview of these built-in roles—including supported role assignment identity types, steps to perform a role assignment, and recommended roles for common scenarios—see Azure Container Registry built-in roles.

Note

The applicable built-in roles and role behavior depends on the registry's "Role assignment permissions mode." This is visible in the "Properties" blade in the Azure portal:

  • RBAC Registry + ABAC Repository Permissions: Supports standard RBAC role assignments with optional Microsoft Entra ABAC conditions to scope assignments to specific repositories.
  • RBAC Registry Permissions: Supports only standard RBAC assignments without ABAC conditions. For details on Microsoft Entra ABAC and ABAC-enabled roles, see Microsoft Entra-based repository permissions.

Built-in roles reference

Each built-in role includes a set of permissions (actions and data actions) that control what operations can be performed on the registry. These permissions fall into two categories:

  • Control plane permissions: Create, manage, delete, and configure ACR registries, registry-wide configurations, and registry-wide policies.
  • Data plane permissions: Perform operations that read, modify, or delete data within a registry, such as pushing, pulling, modifying, or deleting images, artifacts, and tags within the registry. Also includes operations that modify repository-specific configurations and repository-specific policies.

Control plane roles

The following built-in roles are control plane roles. Assign these roles to identities that need to manage registries, but don't require data plane permissions.

The applicable roles and role behavior depends on the registry's "Role assignment permissions mode." This is visible in the "Properties" blade in the Azure portal. For more information on Entra ABAC, see Entra-based repository permissions.

Container Registry Contributor and Data Access Configuration Administrator
Container Registry Configuration Reader and Data Access Configuration Reader
Container Registry Tasks Contributor
  • Use case: Assign to identities—such as CI/CD pipelines or automation tools—that need to manage ACR tasks and task-related resources without access to other registry operations or image data.
  • Permissions: Grants control plane access to manage ACR tasks, including task definitions, runs, task agent pools, quick tasks (quick builds with az acr build and quick runs with az acr run), task logs, and task identities. Doesn't include data plane permissions or access to registry configuration outside of tasks.
    • Control plane permissions:
      • Manage ACR tasks, task runs, task agent pools, quick tasks (quick builds with az acr build and quick runs with az acr run), task logs, and task identities
        • Grants permissions to configure an ACR task's system-assigned managed identity. Note: to manage an ACR task's user-assigned managed identity, the separate Managed Identity Operator role is required.
        • Grants permissions to manage auto-purge on ACR tasks
        • For ABAC-enabled registries, ACR tasks, quick builds, and quick runs don't have default data plane permissions to push, pull, or delete images and tags within repositories.
          • ACR tasks belonging to ABAC-enabled registries must have the Container Registry Repository Reader/Writer/Contributor and Container Registry Repository Catalog Lister roles assigned to the task identity in order to perform data plane operations.
          • For quick builds and quick runs, the identity (caller) invoking the quick task must have the Container Registry Repository Reader/Writer/Contributor and Container Registry Repository Catalog Lister roles assigned to it in order to perform data plane operations.
    • Data plane permissions:
      • None
Container Registry Transfer Pipeline Contributor
Container Registry Data Importer and Data Reader
  • Use case: Assign to identities—such as CI/CD pipelines—that need to import images from other registries with az acr import. The role also enables reading images and artifacts in a registry to validate the success of the import operation.
  • Permissions: Grants control plane access to trigger image imports using az acr import, and data plane access to pull images and artifacts, view repository contents, Open Container Initiative (OCI) referrers, tags, and artifact streaming configurations. Doesn't allow pushing or modifying any content in the registry.
    • Control plane permissions:
    • Data plane permissions:
      • Pull images and artifacts within repositories in the registry
      • View and list OCI referrer artifacts
      • View and list image and artifact metadata such as tags
      • View and list repositories (image names) in the registry
      • View artifact streaming configuration for repositories and images (such as viewing repository policies for automatic artifact streaming conversion, and viewing artifact streaming configuration for an image)

Data plane roles

The following built-in roles are data plane roles. Assign these roles to identities that need to perform data plane operations to interact with images and artifacts stored within a registry, but don't require control plane permissions to manage registries.

The applicable roles and role behavior depends on the registry's "Role assignment permissions mode." This is visible in the "Properties" blade in the Azure portal. For more information on Microsoft Entra ABAC, see Microsoft Entra-based repository permissions.

Container Registry Repository Reader
  • Use case: Assign to container host nodes, orchestrators, vulnerability scanners, or developers that only need to pull images and read repository metadata—without permissions to push or modify content.
  • Permissions: Grants data plane read-only access to pull images and artifacts, view tags, repositories, Open Container Initiative (OCI) referrers, and artifact streaming configurations. Doesn't include any control plane or write permissions.
    • Control plane permissions:
      • None
    • Data plane permissions:
      • Pull images and artifacts within repositories in the registry
      • View and list OCI referrer artifacts
      • View and list image and artifact metadata such as tags
      • View and list repositories (image names) in the registry
      • View artifact streaming configuration for repositories and images (such as viewing repository policies for automatic artifact streaming conversion, and viewing artifact streaming configuration for an image)
      • Doesn't grant repository catalog list permissions.
    • ABAC support: Supports optional Microsoft Entra ABAC conditions to scope role assignments to specific repositories.
Container Registry Repository Writer
  • Use case: Assign to CI/CD pipelines, automation tools, or developers that need to push and pull container images, manage tags, and work with artifacts—without needing control over registry configuration or settings. Also assign to automated processes or services that sign images as part of a trusted supply chain.
  • Permissions: Grants data plane access to push and pull images and artifacts, read/manage tags, read/manage OCI referrers, and enable (but not disable) artifact streaming for repositories and images. Doesn't include any control plane permissions.
    • Control plane permissions:
      • None
    • Data plane permissions:
      • Push and pull images and artifacts within repositories in the registry
      • Create, view, and list OCI referrer artifacts
      • Manage image and artifact metadata such as tags (creating, reading, listing, retagging, and untagging tags)
      • View and list repositories (image names) in the registry
      • Configure artifact streaming for repositories and images (such as setting repository policies for automatic artifact streaming conversion, and enabling (but not disabling) artifact streaming conversion for specific images)
      • Doesn't grant repository catalog list permissions.
    • ABAC support: Supports optional Microsoft Entra ABAC conditions to scope role assignments to specific repositories.
Container Registry Repository Contributor
  • Use case: Assign to identities or services responsible for managing image lifecycle and cleanup.
  • Permissions: Grants permissions to read, write, update, and delete images and artifacts, read/manage/delete tags, read/manage/delete OCI referrers, and enable/disable artifact streaming for repositories and images. Doesn't include any control plane permissions.
    • Control plane permissions:
      • None
    • Data plane permissions:
      • Push, pull, and delete images and artifacts within repositories in the registry
      • Create, view, list, and delete OCI referrer artifacts
      • Manage and delete image and artifact metadata such as tags (creating, reading, listing, retagging, untagging, and deleting tags)
      • View and list repositories (image names) in the registry
      • Configure artifact streaming for repositories and images (such as setting repository policies for automatic artifact streaming conversion, and enabling/disabling artifact streaming conversion for specific images)
      • Doesn't grant repository catalog list permissions.
    • ABAC support: Supports optional Microsoft Entra ABAC conditions to scope role assignments to specific repositories.
Container Registry Repository Catalog Lister
  • Use case: Assign to identities or services that need to list all repositories in a registry, such as CI/CD pipelines, developers, vulnerability scanners, or registry monitoring and auditing tools.
  • Permissions: Grants data plane access to list all repositories in the registry. Doesn't include any control plane permissions or permissions to push/pull images.
    • Control plane permissions:
      • None
    • Data plane permissions:
      • List all repositories (image names) in the registry
      • Grants permissions to invoke the {loginServerURL}/acr/v1/_catalog or {loginServerURL}/v2/_catalog registry API endpoints to list all repositories in the registry.
      • Doesn't grant permissions to view or list images, artifacts, tags, or OCI referrers within repositories.
    • ABAC support: This role doesn't support Entra ABAC conditions. As such, this role assignment will grant permissions to list all repositories in the registry.
AcrQuarantineWriter
  • Use case: Assign to automated processes or services that manage quarantined images, such as CI/CD pipelines and vulnerability scanners.
  • Permissions: Manage quarantined images in a registry.
    • Control plane permissions:
      • None
    • Data plane permissions:
    • ABAC support: Doesn't support Microsoft Entra ABAC conditions.
AcrQuarantineReader
  • Use case: Assign to automated processes or services that list, read, and pull quarantined images, such as CI/CD pipelines and vulnerability scanners.
  • Permissions: List, read, and pull quarantined images in a registry.
    • Control plane permissions:
      • None
    • Data plane permissions:
    • ABAC support: Doesn't support Microsoft Entra ABAC conditions.

Privileged roles

The following built-in roles are privileged roles. Assign these roles only to trusted identities, as they provide access to a wide range of resources and permissions over other resource types, not just Azure Container Registry.

Azure recommends using less privileged control plane roles or data plane roles whenever possible instead of these privileged roles.

The applicable roles and role behavior depends on the registry's "Role assignment permissions mode." This is visible in the "Properties" blade in the Azure portal. For more information on Microsoft Entra ABAC, see Microsoft Entra-based repository permissions.

Owner
Contributor
  • Use case: Assign to identities that need to manage registries, but don't require role assignment permissions.
  • Permissions: Full access to all registry control plane operations, except role assignment permissions.
    • Control plane permissions:
      • Same as Owner, except for managing or performing role assignments for registries. Only permissions for viewing and listing role assignments for a registry are granted.
      • Note: to manage or perform role assignments for registries, the Role Based Access Control Administrator role is required. This less privileged role is recommended in lieu of the Owner role for managing role assignments.
    • Data plane permissions:
      • None - ABAC-enabled registries don't have data plane permissions for the built-in Contributor role.
Reader

Next steps