// roles/azure · containers

Container Registry Tasks ContributorAzure built-in role

Provides permissions to configure, read, list, trigger, or cancel Container Registry Tasks, Task Runs, Task Logs, Quick Runs, Quick Builds, and Task Agent Pools. Permissions granted for Tasks management can be used for full registry data plane permissions including reading/writing/deleting container images in registries. Permissions granted for Tasks management can also be used to run customer authored build directives and run scripts to build software artifacts.

Role ID	`fb382eab-e894-4461-af04-94435c366c3f`
Category	Containers
Actions	24
Data actions	0

What it can do

Permission	What it allows
`Microsoft.ContainerRegistry/registries/agentpools/read`	Get a agentpool for a container registry or list all agentpools.
`Microsoft.ContainerRegistry/registries/agentpools/write`	Create or Update an agentpool for a container registry.
`Microsoft.ContainerRegistry/registries/agentpools/delete`	Delete an agentpool for a container registry.
`Microsoft.ContainerRegistry/registries/agentpools/listQueueStatus/action`	List all queue status of an agentpool for a container registry.
`Microsoft.ContainerRegistry/registries/agentpools/operationResults/status/read`	Gets an agentpool async operation result status
`Microsoft.ContainerRegistry/registries/agentpools/operationStatuses/read`	Gets an agentpool async operation status
`Microsoft.ContainerRegistry/registries/tasks/read`	Gets a task for a container registry or list all tasks.
`Microsoft.ContainerRegistry/registries/tasks/write`	Creates or Updates a task for a container registry.
`Microsoft.ContainerRegistry/registries/tasks/delete`	Deletes a task for a container registry.
`Microsoft.ContainerRegistry/registries/tasks/listDetails/action`	List all details of a task for a container registry.
`Microsoft.ContainerRegistry/registries/scheduleRun/action`	Schedule a run against a container registry.
`Microsoft.ContainerRegistry/registries/listBuildSourceUploadUrl/action`	Get source upload url location for a container registry.
`Microsoft.ContainerRegistry/registries/runs/read`	Gets the properties of a run against a container registry or list runs.
`Microsoft.ContainerRegistry/registries/runs/write`	Updates a run.
`Microsoft.ContainerRegistry/registries/runs/listLogSasUrl/action`	Gets the log SAS URL for a run.
`Microsoft.ContainerRegistry/registries/runs/cancel/action`	Cancel an existing run.
`Microsoft.ContainerRegistry/registries/taskruns/read`	Get a taskrun for a container registry or list all taskruns.
`Microsoft.ContainerRegistry/registries/taskruns/write`	Create or Update a taskrun for a container registry.
`Microsoft.ContainerRegistry/registries/taskruns/delete`	Delete a taskrun for a container registry.
`Microsoft.ContainerRegistry/registries/taskruns/listDetails/action`	List all details of a taskrun for a container registry.
`Microsoft.ContainerRegistry/registries/taskruns/operationStatuses/read`	Gets a taskrun async operation status
`Microsoft.Resources/deployments/*`	Every operation under Microsoft.Resources/deployments
`Microsoft.Resources/subscriptions/resourceGroups/read`	Gets or lists resource groups.
`Microsoft.ContainerRegistry/registries/read`	Gets the properties of the specified container registry or lists all the container registries under the specified resource group or subscription.

Assign it

Scope it as tightly as you can: a resource or resource group rather than the whole subscription.

azure cli

az role assignment create \
  --assignee "jane.doe@contoso.com" \
  --role "Container Registry Tasks Contributor" \
  --scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

powershell3 lines

1
2
3New-AzRoleAssignment -SignInName "jane.doe@contoso.com" `
  -RoleDefinitionName "Container Registry Tasks Contributor" `
  -Scope "/subscriptions/<subscription id>/resourceGroups/<resource group>"

bicep7 lines

1
2
3
4
5
6
7resource assignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(resourceGroup().id, principalId, 'fb382eab-e894-4461-af04-94435c366c3f')
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fb382eab-e894-4461-af04-94435c366c3f')
    principalId: principalId
  }
}

Who already has it?

kql · azure resource graph

authorizationresources
| where type == "microsoft.authorization/roleassignments"
| where tostring(properties.roleDefinitionId) endswith "fb382eab-e894-4461-af04-94435c366c3f"
| project principalId = tostring(properties.principalId), principalType = tostring(properties.principalType), scope = tostring(properties.scope)

Other containers roles

AcrDelete · 1 permission
AcrPull · 1 permission
Connected Cluster Managed Identity CheckAccess Reader · 1 permission
Container Registry Cache Rule Reader · 1 permission
Container Registry Credential Set Reader · 1 permission
Container Registry Repository Catalog Lister · 1 permission
AcrImageSigner · 2 permissions
AcrPush · 2 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Azure built-in roles