// roles/azure · containers

Container Registry Contributor and Data Access Configuration AdministratorAzure built-in role

Provides permissions to create, list, and update container registries and registry configuration properties. Provides permissions to configure data access such as admin user credentials, scope maps, and tokens, which can be used to read, write or delete repositories and images. Does not provide direct permissions to read, list, or write registry contents including repositories and images. Does not provide permissions to modify data plane content such as imports, Artifact Cache or Sync, and Transfer Pipelines. Does not provide permissions for managing Tasks.

Role ID	`3bc748fc-213d-45c1-8d91-9da5725539b9`
Category	Containers
Actions	58
Data actions	0

What it can do

Permission	What it allows
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.ContainerRegistry/registries/operationStatuses/read`	Gets a registry async operation status
`Microsoft.ContainerRegistry/registries/read`	Gets the properties of the specified container registry or lists all the container registries under the specified resource group or subscription.
`Microsoft.ContainerRegistry/registries/write`	Creates or updates a container registry with the specified parameters.
`Microsoft.ContainerRegistry/registries/delete`	Deletes a container registry.
`Microsoft.ContainerRegistry/registries/listCredentials/action`	Lists the login credentials for the specified container registry.
`Microsoft.ContainerRegistry/registries/regenerateCredential/action`	Regenerates one of the login credentials for the specified container registry.
`Microsoft.ContainerRegistry/registries/generateCredentials/action`	Generate keys for a token of a specified container registry.
`Microsoft.ContainerRegistry/registries/replications/read`	Gets the properties of the specified replication or lists all the replications for the specified container registry.
`Microsoft.ContainerRegistry/registries/replications/write`	Creates or updates a replication for a container registry with the specified parameters.
`Microsoft.ContainerRegistry/registries/replications/delete`	Deletes a replication from a container registry.
`Microsoft.ContainerRegistry/registries/replications/operationStatuses/read`	Gets a replication async operation status
`Microsoft.ContainerRegistry/registries/privateEndpointConnectionsApproval/action`	Auto Approves a Private Endpoint Connection
`Microsoft.ContainerRegistry/registries/privateEndpointConnections/read`	Gets the properties of private endpoint connection or list all the private endpoint connections for the specified container registry
`Microsoft.ContainerRegistry/registries/privateEndpointConnections/write`	Approves/Rejects the private endpoint connection
`Microsoft.ContainerRegistry/registries/privateEndpointConnections/delete`	Deletes the private endpoint connection
`Microsoft.ContainerRegistry/registries/privateEndpointConnections/operationStatuses/read`	Get Private Endpoint Connection Async Operation Status
`Microsoft.ContainerRegistry/registries/tokens/read`	Gets the properties of the specified token or lists all the tokens for the specified container registry.
`Microsoft.ContainerRegistry/registries/tokens/write`	Creates or updates a token for a container registry with the specified parameters.
`Microsoft.ContainerRegistry/registries/tokens/delete`	Deletes a token from a container registry.
`Microsoft.ContainerRegistry/registries/tokens/operationStatuses/read`	Gets a token async operation status.
`Microsoft.ContainerRegistry/registries/scopeMaps/read`	Gets the properties of the specified scope map or lists all the scope maps for the specified container registry.
`Microsoft.ContainerRegistry/registries/scopeMaps/write`	Creates or updates a scope map for a container registry with the specified parameters.
`Microsoft.ContainerRegistry/registries/scopeMaps/delete`	Deletes a scope map from a container registry.
`Microsoft.ContainerRegistry/registries/scopeMaps/operationStatuses/read`	Gets a scope map async operation status.
`Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/diagnosticSettings/read`	Gets the diagnostic setting for the resource
`Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/diagnosticSettings/write`	Creates or updates the diagnostic setting for the resource
`Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/logDefinitions/read`	Gets the available logs for Microsoft ContainerRegistry
`Microsoft.ContainerRegistry/registries/providers/Microsoft.Insights/metricDefinitions/read`	Gets the available metrics for Microsoft ContainerRegistry
`Microsoft.Resources/deployments/*`	Every operation under Microsoft.Resources/deployments
`Microsoft.Authorization/*/read`	Any read operation on anything under Microsoft.Authorization
`Microsoft.ContainerRegistry/registries/connectedRegistries/read`	Gets the properties of the specified connected registry or lists all the connected registries for the specified container registry.
`Microsoft.ContainerRegistry/registries/connectedRegistries/write`	Creates or updates a connected registry for a container registry with the specified parameters.
`Microsoft.ContainerRegistry/registries/connectedRegistries/delete`	Deletes a connected registry from a container registry.
`Microsoft.ContainerRegistry/registries/connectedRegistries/deactivate/action`	Deactivates a connected registry for a container registry
`Microsoft.ContainerRegistry/registries/webhooks/read`	Gets the properties of the specified webhook or lists all the webhooks for the specified container registry.
`Microsoft.ContainerRegistry/registries/webhooks/write`	Creates or updates a webhook for a container registry with the specified parameters.
`Microsoft.ContainerRegistry/registries/webhooks/delete`	Deletes a webhook from a container registry.
`Microsoft.ContainerRegistry/registries/webhooks/getCallbackConfig/action`	Gets the configuration of service URI and custom headers for the webhook.
`Microsoft.ContainerRegistry/registries/webhooks/ping/action`	Triggers a ping event to be sent to the webhook.
`Microsoft.ContainerRegistry/registries/webhooks/listEvents/action`	Lists recent events for the specified webhook.
`Microsoft.ContainerRegistry/registries/webhooks/operationStatuses/read`	Gets a webhook async operation status
`Microsoft.Insights/AlertRules/Write`	Create or update a classic metric alert
`Microsoft.Insights/AlertRules/Delete`	Delete a classic metric alert
`Microsoft.Insights/AlertRules/Read`	Read a classic metric alert
`Microsoft.Insights/AlertRules/Activated/Action`	Classic metric alert activated
`Microsoft.Insights/AlertRules/Resolved/Action`	Classic metric alert resolved
`Microsoft.Insights/AlertRules/Throttled/Action`	Classic metric alert rule throttled
`Microsoft.Insights/AlertRules/Incidents/Read`	Read a classic metric alert incident
`Microsoft.ContainerRegistry/locations/operationResults/read`	Gets an async operation result
`Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action`	Joins resource such as storage account or SQL database to a subnet. Not alertable.
`Microsoft.Network/virtualNetworks/subnets/read`	Gets a virtual network subnet definition
`Microsoft.Network/virtualNetworks/subnets/write`	Creates a virtual network subnet or updates an existing virtual network subnet
`Microsoft.Network/virtualNetworks/read`	Get the virtual network definition
`Microsoft.Network/privateEndpoints/privateLinkServiceProxies/write`	Creates a new private link service proxy, or updates an existing private link service proxy.
`Microsoft.Network/privateEndpoints/privateLinkServiceProxies/read`	Gets a private link service proxy resource.
`Microsoft.Network/privateEndpoints/privateLinkServiceProxies/delete`	Deletes an private link service proxy resource.
`Microsoft.Support/*`	Every operation under Microsoft.Support

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Container Registry Contributor and Data Access Configuration Administrator" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Container Registry Contributor and Data Access Configuration Administrator" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, '3bc748fc-213d-45c1-8d91-9da5725539b9')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3bc748fc-213d-45c1-8d91-9da5725539b9')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "3bc748fc-213d-45c1-8d91-9da5725539b9"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other containers roles

AcrDelete · 1 permission
AcrPull · 1 permission
Connected Cluster Managed Identity CheckAccess Reader · 1 permission
Container Registry Cache Rule Reader · 1 permission
Container Registry Credential Set Reader · 1 permission
Container Registry Repository Catalog Lister · 1 permission
AcrImageSigner · 2 permissions
AcrPush · 2 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles