Microsoft's edit · Azure built-in roles · containers

77 author: rolyon

88 manager: pmwongera

99 ms.author: rolyon

10 −ms.date: 12/31/2025

11 −ms.custom: generated

12 −---

13 −

14 −# Azure built-in roles for Containers

15 −

16 −This article lists the Azure built-in roles in the Containers category.

17 −

18 −

19 −## AcrDelete

20 −

21 −Delete repositories, tags, or manifests from a container registry.

22 −

23 −[Learn more](/azure/container-registry/container-registry-rbac-built-in-roles-directory-reference)

24 −

25 −> [!div class="mx-tableFixed"]

26 −> | Actions | Description |

27 −> | --- | --- |

28 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/artifacts/delete | Delete artifact in a container registry. |

29 −> | **NotActions** | |

30 −> | *none* | |

31 −> | **DataActions** | |

32 −> | *none* | |

33 −> | **NotDataActions** | |

34 −> | *none* | |

35 −

36 −```json

37 −{

38 − "assignableScopes": [

39 − "/"

40 − ],

41 − "description": "acr delete",

42 − "id": "/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11",

43 − "name": "c2f4ef07-c644-48eb-af81-4b1b4947fb11",

44 − "permissions": [

45 − {

46 − "actions": [

47 − "Microsoft.ContainerRegistry/registries/artifacts/delete"

48 − ],

49 − "notActions": [],

50 − "dataActions": [],

51 − "notDataActions": []

52 − }

53 − ],

54 − "roleName": "AcrDelete",

55 − "roleType": "BuiltInRole",

56 − "type": "Microsoft.Authorization/roleDefinitions"

57 −}

58 −```

59 −

60 −## AcrImageSigner

61 −

62 −Avoid using this role. Content Trust in Azure Container Registry and the AcrImageSigner role are being deprecated and will be completely removed on March 31, 2028. For details and transition guidance, see https://aka.ms/acr/dctdeprecation.

63 −

64 −[Learn more](/azure/container-registry/container-registry-rbac-built-in-roles-directory-reference)

65 −

66 −> [!div class="mx-tableFixed"]

67 −> | Actions | Description |

68 −> | --- | --- |

69 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/sign/write | Push/Pull content trust metadata for a container registry. |

70 −> | **NotActions** | |

71 −> | *none* | |

72 −> | **DataActions** | |

73 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/trustedCollections/write | Allows push or publish of trusted collections of container registry content. This is similar to Microsoft.ContainerRegistry/registries/sign/write action except that this is a data action |

74 −> | **NotDataActions** | |

75 −> | *none* | |

76 −

77 −```json

78 −{

79 − "assignableScopes": [

80 − "/"

81 − ],

82 − "description": "Planned DEPRECATION on March 31, 2028. Grant the signing permission for content trust. As content trust is being deprecated and will be completely removed on March 31, 2028, this role will also be removed. Refer to https://aka.ms/acr/dctdeprecation for details and transition guidance.",

83 − "id": "/providers/Microsoft.Authorization/roleDefinitions/6cef56e8-d556-48e5-a04f-b8e64114680f",

84 − "name": "6cef56e8-d556-48e5-a04f-b8e64114680f",

85 − "permissions": [

86 − {

87 − "actions": [

88 − "Microsoft.ContainerRegistry/registries/sign/write"

89 − ],

90 − "notActions": [],

91 − "dataActions": [

92 − "Microsoft.ContainerRegistry/registries/trustedCollections/write"

93 − ],

94 − "notDataActions": []

95 − }

96 − ],

97 − "roleName": "AcrImageSigner",

98 − "roleType": "BuiltInRole",

99 − "type": "Microsoft.Authorization/roleDefinitions"

100 −}

101 −```

102 −

103 −## AcrPull

104 −

105 −Pull artifacts from a container registry.

106 −

107 −[Learn more](/azure/container-registry/container-registry-rbac-built-in-roles-directory-reference)

108 −

109 −> [!div class="mx-tableFixed"]

110 −> | Actions | Description |

111 −> | --- | --- |

112 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/pull/read | Pull or Get images from a container registry. |

113 −> | **NotActions** | |

114 −> | *none* | |

115 −> | **DataActions** | |

116 −> | *none* | |

117 −> | **NotDataActions** | |

118 −> | *none* | |

119 −

120 −```json

121 −{

122 − "assignableScopes": [

123 − "/"

124 − ],

125 − "description": "acr pull",

126 − "id": "/providers/Microsoft.Authorization/roleDefinitions/7f951dda-4ed3-4680-a7ca-43fe172d538d",

127 − "name": "7f951dda-4ed3-4680-a7ca-43fe172d538d",

128 − "permissions": [

129 − {

130 − "actions": [

131 − "Microsoft.ContainerRegistry/registries/pull/read"

132 − ],

133 − "notActions": [],

134 − "dataActions": [],

135 − "notDataActions": []

136 − }

137 − ],

138 − "roleName": "AcrPull",

139 − "roleType": "BuiltInRole",

140 − "type": "Microsoft.Authorization/roleDefinitions"

141 −}

142 −```

143 −

144 −## AcrPush

145 −

146 −Push artifacts to or pull artifacts from a container registry.

147 −

148 −[Learn more](/azure/container-registry/container-registry-rbac-built-in-roles-directory-reference)

149 −

150 −> [!div class="mx-tableFixed"]

151 −> | Actions | Description |

152 −> | --- | --- |

153 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/pull/read | Pull or Get images from a container registry. |

154 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/push/write | Push or Write images to a container registry. |

155 −> | **NotActions** | |

156 −> | *none* | |

157 −> | **DataActions** | |

158 −> | *none* | |

159 −> | **NotDataActions** | |

160 −> | *none* | |

161 −

162 −```json

163 −{

164 − "assignableScopes": [

165 − "/"

166 − ],

167 − "description": "acr push",

168 − "id": "/providers/Microsoft.Authorization/roleDefinitions/8311e382-0749-4cb8-b61a-304f252e45ec",

169 − "name": "8311e382-0749-4cb8-b61a-304f252e45ec",

170 − "permissions": [

171 − {

172 − "actions": [

173 − "Microsoft.ContainerRegistry/registries/pull/read",

174 − "Microsoft.ContainerRegistry/registries/push/write"

175 − ],

176 − "notActions": [],

177 − "dataActions": [],

178 − "notDataActions": []

179 − }

180 − ],

181 − "roleName": "AcrPush",

182 − "roleType": "BuiltInRole",

183 − "type": "Microsoft.Authorization/roleDefinitions"

184 −}

185 −```

186 −

187 −## AcrQuarantineReader

188 −

189 −Pull quarantined images from a container registry.

190 −

191 −[Learn more](/azure/container-registry/container-registry-rbac-built-in-roles-directory-reference)

192 −

193 −> [!div class="mx-tableFixed"]

194 −> | Actions | Description |

195 −> | --- | --- |

196 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/quarantine/read | Pull or Get quarantined images from container registry |

197 −> | **NotActions** | |

198 −> | *none* | |

199 −> | **DataActions** | |

200 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/quarantinedArtifacts/read | Allows pull or get of the quarantined artifacts from container registry. This is similar to Microsoft.ContainerRegistry/registries/quarantine/read except that it is a data action |

201 −> | **NotDataActions** | |

202 −> | *none* | |

203 −

204 −```json

205 −{

206 − "assignableScopes": [

207 − "/"

208 − ],

209 − "description": "acr quarantine data reader",

210 − "id": "/providers/Microsoft.Authorization/roleDefinitions/cdda3590-29a3-44f6-95f2-9f980659eb04",

211 − "name": "cdda3590-29a3-44f6-95f2-9f980659eb04",

212 − "permissions": [

213 − {

214 − "actions": [

215 − "Microsoft.ContainerRegistry/registries/quarantine/read"

216 − ],

217 − "notActions": [],

218 − "dataActions": [

219 − "Microsoft.ContainerRegistry/registries/quarantinedArtifacts/read"

220 − ],

221 − "notDataActions": []

222 − }

223 − ],

224 − "roleName": "AcrQuarantineReader",

225 − "roleType": "BuiltInRole",

226 − "type": "Microsoft.Authorization/roleDefinitions"

227 −}

228 −```

229 −

230 −## AcrQuarantineWriter

231 −

232 −Push quarantined images to or pull quarantined images from a container registry.

233 −

234 −[Learn more](/azure/container-registry/container-registry-rbac-built-in-roles-directory-reference)

235 −

236 −> [!div class="mx-tableFixed"]

237 −> | Actions | Description |

238 −> | --- | --- |

239 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/quarantine/read | Pull or Get quarantined images from container registry |

240 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/quarantine/write | Write/Modify quarantine state of quarantined images |

241 −> | **NotActions** | |

242 −> | *none* | |

243 −> | **DataActions** | |

244 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/quarantinedArtifacts/read | Allows pull or get of the quarantined artifacts from container registry. This is similar to Microsoft.ContainerRegistry/registries/quarantine/read except that it is a data action |

245 −> | [Microsoft.ContainerRegistry](../permissions/containers.md#microsoftcontainerregistry)/registries/quarantinedArtifacts/write | Allows write or update of the quarantine state of quarantined artifacts. This is similar to Microsoft.ContainerRegistry/registries/quarantine/write action except that it is a data action |

246 −> | **NotDataActions** | |

247 −> | *none* | |

248 −

249 −```json

250 −{

251 − "assignableScopes": [

252 − "/"

253 − ],

254 − "description": "acr quarantine data writer",

255 − "id": "/providers/Microsoft.Authorization/roleDefinitions/c8d4ff99-41c3-41a8-9f60-21dfdad59608",

256 − "name": "c8d4ff99-41c3-41a8-9f60-21dfdad59608",

257 − "permissions": [

258 − {

259 − "actions": [

260 − "Microsoft.ContainerRegistry/registries/quarantine/read",

261 − "Microsoft.ContainerRegistry/registries/quarantine/write"

262 − ],

263 − "notActions": [],

264 − "dataActions": [

265 − "Microsoft.ContainerRegistry/registries/quarantinedArtifacts/read",

266 − "Microsoft.ContainerRegistry/registries/quarantinedArtifacts/write"

267 − ],

268 − "notDataActions": []

269 − }

270 − ],

271 − "roleName": "AcrQuarantineWriter",

272 − "roleType": "BuiltInRole",

273 − "type": "Microsoft.Authorization/roleDefinitions"

274 −}

275 −```

276 −

277 −## Azure Arc Enabled Kubernetes Cluster User Role

278 −

279 −List cluster user credentials action.

280 −

281 −> [!div class="mx-tableFixed"]

282 −> | Actions | Description |

283 −> | --- | --- |

284 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/write | Creates or updates an deployment. |

285 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/operationresults/read | Get the subscription operation results. |

286 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |

287 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

288 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/listClusterUserCredentials/action | List clusterUser credential(preview) |

289 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

290 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

291 −> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |

292 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/listClusterUserCredential/action | List clusterUser credential |

293 −> | **NotActions** | |

294 −> | *none* | |

295 −> | **DataActions** | |

296 −> | *none* | |

297 −> | **NotDataActions** | |

298 −> | *none* | |

299 −

300 −```json

301 −{

302 − "assignableScopes": [

303 − "/"

304 − ],

305 − "description": "List cluster user credentials action.",

306 − "id": "/providers/Microsoft.Authorization/roleDefinitions/00493d72-78f6-4148-b6c5-d3ce8e4799dd",

307 − "name": "00493d72-78f6-4148-b6c5-d3ce8e4799dd",

308 − "permissions": [

309 − {

310 − "actions": [

311 − "Microsoft.Resources/deployments/write",

312 − "Microsoft.Resources/subscriptions/operationresults/read",

313 − "Microsoft.Resources/subscriptions/read",

314 − "Microsoft.Resources/subscriptions/resourceGroups/read",

315 − "Microsoft.Kubernetes/connectedClusters/listClusterUserCredentials/action",

316 − "Microsoft.Authorization/*/read",

317 − "Microsoft.Insights/alertRules/*",

318 − "Microsoft.Support/*",

319 − "Microsoft.Kubernetes/connectedClusters/listClusterUserCredential/action"

320 − ],

321 − "notActions": [],

322 − "dataActions": [],

323 − "notDataActions": []

324 − }

325 − ],

326 − "roleName": "Azure Arc Enabled Kubernetes Cluster User Role",

327 − "roleType": "BuiltInRole",

328 − "type": "Microsoft.Authorization/roleDefinitions"

329 −}

330 −```

331 −

332 −## Azure Arc Kubernetes Admin

333 −

334 −Lets you manage all resources under cluster/namespace, except update or delete resource quotas and namespaces.

335 −

336 −[Learn more](/azure/azure-arc/kubernetes/azure-rbac)

337 −

338 −> [!div class="mx-tableFixed"]

339 −> | Actions | Description |

340 −> | --- | --- |

341 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

342 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

343 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/write | Creates or updates an deployment. |

344 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/operationresults/read | Get the subscription operation results. |

345 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |

346 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

347 −> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |

348 −> | **NotActions** | |

349 −> | *none* | |

350 −> | **DataActions** | |

351 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/apps/controllerrevisions/read | Reads controllerrevisions |

352 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/apps/daemonsets/* | |

353 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/apps/deployments/* | |

354 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/apps/replicasets/* | |

355 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/apps/statefulsets/* | |

356 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/authorization.k8s.io/localsubjectaccessreviews/write | Writes localsubjectaccessreviews |

357 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/autoscaling/horizontalpodautoscalers/* | |

358 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/batch/cronjobs/* | |

359 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/batch/jobs/* | |

360 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/configmaps/* | |

361 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/endpoints/* | |

362 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/events.k8s.io/events/read | Reads events |

363 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/events/read | Reads events |

364 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/extensions/daemonsets/* | |

365 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/extensions/deployments/* | |

366 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/extensions/ingresses/* | |

367 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/extensions/networkpolicies/* | |

368 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/extensions/replicasets/* | |

369 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/limitranges/read | Reads limitranges |

370 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/namespaces/read | Reads namespaces |

371 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/networking.k8s.io/ingresses/* | |

372 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/networking.k8s.io/networkpolicies/* | |

373 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/persistentvolumeclaims/* | |

374 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/pods/* | |

375 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/policy/poddisruptionbudgets/* | |

376 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/rbac.authorization.k8s.io/rolebindings/* | |

377 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/rbac.authorization.k8s.io/roles/* | |

378 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/replicationcontrollers/* | |

379 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/replicationcontrollers/* | |

380 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/resourcequotas/read | Reads resourcequotas |

381 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/secrets/* | |

382 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/serviceaccounts/* | |

383 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/services/* | |

384 −> | **NotDataActions** | |

385 −> | *none* | |

386 −

387 −```json

388 −{

389 − "assignableScopes": [

390 − "/"

391 − ],

392 − "description": "Lets you manage all resources under cluster/namespace, except update or delete resource quotas and namespaces.",

393 − "id": "/providers/Microsoft.Authorization/roleDefinitions/dffb1e0c-446f-4dde-a09f-99eb5cc68b96",

394 − "name": "dffb1e0c-446f-4dde-a09f-99eb5cc68b96",

395 − "permissions": [

396 − {

397 − "actions": [

398 − "Microsoft.Authorization/*/read",

399 − "Microsoft.Insights/alertRules/*",

400 − "Microsoft.Resources/deployments/write",

401 − "Microsoft.Resources/subscriptions/operationresults/read",

402 − "Microsoft.Resources/subscriptions/read",

403 − "Microsoft.Resources/subscriptions/resourceGroups/read",

404 − "Microsoft.Support/*"

405 − ],

406 − "notActions": [],

407 − "dataActions": [

408 − "Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read",

409 − "Microsoft.Kubernetes/connectedClusters/apps/daemonsets/*",

410 − "Microsoft.Kubernetes/connectedClusters/apps/deployments/*",

411 − "Microsoft.Kubernetes/connectedClusters/apps/replicasets/*",

412 − "Microsoft.Kubernetes/connectedClusters/apps/statefulsets/*",

413 − "Microsoft.Kubernetes/connectedClusters/authorization.k8s.io/localsubjectaccessreviews/write",

414 − "Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/*",

415 − "Microsoft.Kubernetes/connectedClusters/batch/cronjobs/*",

416 − "Microsoft.Kubernetes/connectedClusters/batch/jobs/*",

417 − "Microsoft.Kubernetes/connectedClusters/configmaps/*",

418 − "Microsoft.Kubernetes/connectedClusters/endpoints/*",

419 − "Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read",

420 − "Microsoft.Kubernetes/connectedClusters/events/read",

421 − "Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/*",

422 − "Microsoft.Kubernetes/connectedClusters/extensions/deployments/*",

423 − "Microsoft.Kubernetes/connectedClusters/extensions/ingresses/*",

424 − "Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/*",

425 − "Microsoft.Kubernetes/connectedClusters/extensions/replicasets/*",

426 − "Microsoft.Kubernetes/connectedClusters/limitranges/read",

427 − "Microsoft.Kubernetes/connectedClusters/namespaces/read",

428 − "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/*",

429 − "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/*",

430 − "Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/*",

431 − "Microsoft.Kubernetes/connectedClusters/pods/*",

432 − "Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/*",

433 − "Microsoft.Kubernetes/connectedClusters/rbac.authorization.k8s.io/rolebindings/*",

434 − "Microsoft.Kubernetes/connectedClusters/rbac.authorization.k8s.io/roles/*",

435 − "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",

436 − "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",

437 − "Microsoft.Kubernetes/connectedClusters/resourcequotas/read",

438 − "Microsoft.Kubernetes/connectedClusters/secrets/*",

439 − "Microsoft.Kubernetes/connectedClusters/serviceaccounts/*",

440 − "Microsoft.Kubernetes/connectedClusters/services/*"

441 − ],

442 − "notDataActions": []

443 − }

444 − ],

445 − "roleName": "Azure Arc Kubernetes Admin",

446 − "roleType": "BuiltInRole",

447 − "type": "Microsoft.Authorization/roleDefinitions"

448 −}

449 −```

450 −

451 −## Azure Arc Kubernetes Cluster Admin

452 −

453 −Lets you manage all resources in the cluster.

454 −

455 −[Learn more](/azure/azure-arc/kubernetes/azure-rbac)

456 −

457 −> [!div class="mx-tableFixed"]

458 −> | Actions | Description |

459 −> | --- | --- |

460 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

461 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

462 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/write | Creates or updates an deployment. |

463 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/operationresults/read | Get the subscription operation results. |

464 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |

465 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

466 −> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |

467 −> | **NotActions** | |

468 −> | *none* | |

469 −> | **DataActions** | |

470 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/* | |

471 −> | **NotDataActions** | |

472 −> | *none* | |

473 −

474 −```json

475 −{

476 − "assignableScopes": [

477 − "/"

478 − ],

479 − "description": "Lets you manage all resources in the cluster.",

480 − "id": "/providers/Microsoft.Authorization/roleDefinitions/8393591c-06b9-48a2-a542-1bd6b377f6a2",

481 − "name": "8393591c-06b9-48a2-a542-1bd6b377f6a2",

482 − "permissions": [

483 − {

484 − "actions": [

485 − "Microsoft.Authorization/*/read",

486 − "Microsoft.Insights/alertRules/*",

487 − "Microsoft.Resources/deployments/write",

488 − "Microsoft.Resources/subscriptions/operationresults/read",

489 − "Microsoft.Resources/subscriptions/read",

490 − "Microsoft.Resources/subscriptions/resourceGroups/read",

491 − "Microsoft.Support/*"

492 − ],

493 − "notActions": [],

494 − "dataActions": [

495 − "Microsoft.Kubernetes/connectedClusters/*"

496 − ],

497 − "notDataActions": []

498 − }

499 − ],

500 − "roleName": "Azure Arc Kubernetes Cluster Admin",

501 − "roleType": "BuiltInRole",

502 − "type": "Microsoft.Authorization/roleDefinitions"

503 −}

504 −```

505 −

506 −## Azure Arc Kubernetes Viewer

507 −

508 −Lets you view all resources in cluster/namespace, except secrets.

509 −

510 −[Learn more](/azure/azure-arc/kubernetes/azure-rbac)

511 −

512 −> [!div class="mx-tableFixed"]

513 −> | Actions | Description |

514 −> | --- | --- |

515 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

516 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

517 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/write | Creates or updates an deployment. |

518 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/operationresults/read | Get the subscription operation results. |

519 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |

520 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

521 −> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |

522 −> | **NotActions** | |

523 −> | *none* | |

524 −> | **DataActions** | |

525 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/apps/controllerrevisions/read | Reads controllerrevisions |

526 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/apps/daemonsets/read | Reads daemonsets |

527 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/apps/deployments/read | Reads deployments |

528 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/apps/replicasets/read | Reads replicasets |

529 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/apps/statefulsets/read | Reads statefulsets |

530 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/autoscaling/horizontalpodautoscalers/read | Reads horizontalpodautoscalers |

531 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/batch/cronjobs/read | Reads cronjobs |

532 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/batch/jobs/read | Reads jobs |

533 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/configmaps/read | Reads configmaps |

534 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/endpoints/read | Reads endpoints |

535 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/events.k8s.io/events/read | Reads events |

536 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/events/read | Reads events |

537 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/extensions/daemonsets/read | Reads daemonsets |

538 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/extensions/deployments/read | Reads deployments |

539 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/extensions/ingresses/read | Reads ingresses |

540 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/extensions/networkpolicies/read | Reads networkpolicies |

541 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/extensions/replicasets/read | Reads replicasets |

542 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/limitranges/read | Reads limitranges |

543 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/namespaces/read | Reads namespaces |

544 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/networking.k8s.io/ingresses/read | Reads ingresses |

545 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/networking.k8s.io/networkpolicies/read | Reads networkpolicies |

546 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/persistentvolumeclaims/read | Reads persistentvolumeclaims |

547 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/pods/read | Reads pods |

548 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/policy/poddisruptionbudgets/read | Reads poddisruptionbudgets |

549 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/replicationcontrollers/read | Reads replicationcontrollers |

550 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/replicationcontrollers/read | Reads replicationcontrollers |

551 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/resourcequotas/read | Reads resourcequotas |

552 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/serviceaccounts/read | Reads serviceaccounts |

553 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/services/read | Reads services |

554 −> | **NotDataActions** | |

555 −> | *none* | |

556 −

557 −```json

558 −{

559 − "assignableScopes": [

560 − "/"

561 − ],

562 − "description": "Lets you view all resources in cluster/namespace, except secrets.",

563 − "id": "/providers/Microsoft.Authorization/roleDefinitions/63f0a09d-1495-4db4-a681-037d84835eb4",

564 − "name": "63f0a09d-1495-4db4-a681-037d84835eb4",

565 − "permissions": [

566 − {

567 − "actions": [

568 − "Microsoft.Authorization/*/read",

569 − "Microsoft.Insights/alertRules/*",

570 − "Microsoft.Resources/deployments/write",

571 − "Microsoft.Resources/subscriptions/operationresults/read",

572 − "Microsoft.Resources/subscriptions/read",

573 − "Microsoft.Resources/subscriptions/resourceGroups/read",

574 − "Microsoft.Support/*"

575 − ],

576 − "notActions": [],

577 − "dataActions": [

578 − "Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read",

579 − "Microsoft.Kubernetes/connectedClusters/apps/daemonsets/read",

580 − "Microsoft.Kubernetes/connectedClusters/apps/deployments/read",

581 − "Microsoft.Kubernetes/connectedClusters/apps/replicasets/read",

582 − "Microsoft.Kubernetes/connectedClusters/apps/statefulsets/read",

583 − "Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/read",

584 − "Microsoft.Kubernetes/connectedClusters/batch/cronjobs/read",

585 − "Microsoft.Kubernetes/connectedClusters/batch/jobs/read",

586 − "Microsoft.Kubernetes/connectedClusters/configmaps/read",

587 − "Microsoft.Kubernetes/connectedClusters/endpoints/read",

588 − "Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read",

589 − "Microsoft.Kubernetes/connectedClusters/events/read",

590 − "Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/read",

591 − "Microsoft.Kubernetes/connectedClusters/extensions/deployments/read",

592 − "Microsoft.Kubernetes/connectedClusters/extensions/ingresses/read",

593 − "Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/read",

594 − "Microsoft.Kubernetes/connectedClusters/extensions/replicasets/read",

595 − "Microsoft.Kubernetes/connectedClusters/limitranges/read",

596 − "Microsoft.Kubernetes/connectedClusters/namespaces/read",

597 − "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/read",

598 − "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/read",

599 − "Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/read",

600 − "Microsoft.Kubernetes/connectedClusters/pods/read",

601 − "Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/read",

602 − "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/read",

603 − "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/read",

604 − "Microsoft.Kubernetes/connectedClusters/resourcequotas/read",

605 − "Microsoft.Kubernetes/connectedClusters/serviceaccounts/read",

606 − "Microsoft.Kubernetes/connectedClusters/services/read"

607 − ],

608 − "notDataActions": []

609 − }

610 − ],

611 − "roleName": "Azure Arc Kubernetes Viewer",

612 − "roleType": "BuiltInRole",

613 − "type": "Microsoft.Authorization/roleDefinitions"

614 −}

615 −```

616 −

617 −## Azure Arc Kubernetes Writer

618 −

619 −Lets you update everything in cluster/namespace, except (cluster)roles and (cluster)role bindings.

620 −

621 −[Learn more](/azure/azure-arc/kubernetes/azure-rbac)

622 −

623 −> [!div class="mx-tableFixed"]

624 −> | Actions | Description |

625 −> | --- | --- |

626 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

627 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

628 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/write | Creates or updates an deployment. |

629 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/operationresults/read | Get the subscription operation results. |

630 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |

631 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

632 −> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |

633 −> | **NotActions** | |

634 −> | *none* | |

635 −> | **DataActions** | |

636 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/apps/controllerrevisions/read | Reads controllerrevisions |

637 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/apps/daemonsets/* | |

638 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/apps/deployments/* | |

639 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/apps/replicasets/* | |

640 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/apps/statefulsets/* | |

641 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/autoscaling/horizontalpodautoscalers/* | |

642 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/batch/cronjobs/* | |

643 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/batch/jobs/* | |

644 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/configmaps/* | |

645 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/endpoints/* | |

646 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/events.k8s.io/events/read | Reads events |

647 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/events/read | Reads events |

648 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/extensions/daemonsets/* | |

649 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/extensions/deployments/* | |

650 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/extensions/ingresses/* | |

651 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/extensions/networkpolicies/* | |

652 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/extensions/replicasets/* | |

653 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/limitranges/read | Reads limitranges |

654 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/namespaces/read | Reads namespaces |

655 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/networking.k8s.io/ingresses/* | |

656 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/networking.k8s.io/networkpolicies/* | |

657 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/persistentvolumeclaims/* | |

658 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/pods/* | |

659 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/policy/poddisruptionbudgets/* | |

660 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/replicationcontrollers/* | |

661 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/replicationcontrollers/* | |

662 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/resourcequotas/read | Reads resourcequotas |

663 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/secrets/* | |

664 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/serviceaccounts/* | |

665 −> | [Microsoft.Kubernetes](../permissions/hybrid-multicloud.md#microsoftkubernetes)/connectedClusters/services/* | |

666 −> | **NotDataActions** | |

667 −> | *none* | |

668 −

669 −```json

670 −{

671 − "assignableScopes": [

672 − "/"

673 − ],

674 − "description": "Lets you update everything in cluster/namespace, except (cluster)roles and (cluster)role bindings.",

675 − "id": "/providers/Microsoft.Authorization/roleDefinitions/5b999177-9696-4545-85c7-50de3797e5a1",

676 − "name": "5b999177-9696-4545-85c7-50de3797e5a1",

677 − "permissions": [

678 − {

679 − "actions": [

680 − "Microsoft.Authorization/*/read",

681 − "Microsoft.Insights/alertRules/*",

682 − "Microsoft.Resources/deployments/write",

683 − "Microsoft.Resources/subscriptions/operationresults/read",

684 − "Microsoft.Resources/subscriptions/read",

685 − "Microsoft.Resources/subscriptions/resourceGroups/read",

686 − "Microsoft.Support/*"

687 − ],

688 − "notActions": [],

689 − "dataActions": [

690 − "Microsoft.Kubernetes/connectedClusters/apps/controllerrevisions/read",

691 − "Microsoft.Kubernetes/connectedClusters/apps/daemonsets/*",

692 − "Microsoft.Kubernetes/connectedClusters/apps/deployments/*",

693 − "Microsoft.Kubernetes/connectedClusters/apps/replicasets/*",

694 − "Microsoft.Kubernetes/connectedClusters/apps/statefulsets/*",

695 − "Microsoft.Kubernetes/connectedClusters/autoscaling/horizontalpodautoscalers/*",

696 − "Microsoft.Kubernetes/connectedClusters/batch/cronjobs/*",

697 − "Microsoft.Kubernetes/connectedClusters/batch/jobs/*",

698 − "Microsoft.Kubernetes/connectedClusters/configmaps/*",

699 − "Microsoft.Kubernetes/connectedClusters/endpoints/*",

700 − "Microsoft.Kubernetes/connectedClusters/events.k8s.io/events/read",

701 − "Microsoft.Kubernetes/connectedClusters/events/read",

702 − "Microsoft.Kubernetes/connectedClusters/extensions/daemonsets/*",

703 − "Microsoft.Kubernetes/connectedClusters/extensions/deployments/*",

704 − "Microsoft.Kubernetes/connectedClusters/extensions/ingresses/*",

705 − "Microsoft.Kubernetes/connectedClusters/extensions/networkpolicies/*",

706 − "Microsoft.Kubernetes/connectedClusters/extensions/replicasets/*",

707 − "Microsoft.Kubernetes/connectedClusters/limitranges/read",

708 − "Microsoft.Kubernetes/connectedClusters/namespaces/read",

709 − "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/ingresses/*",

710 − "Microsoft.Kubernetes/connectedClusters/networking.k8s.io/networkpolicies/*",

711 − "Microsoft.Kubernetes/connectedClusters/persistentvolumeclaims/*",

712 − "Microsoft.Kubernetes/connectedClusters/pods/*",

713 − "Microsoft.Kubernetes/connectedClusters/policy/poddisruptionbudgets/*",

714 − "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",

715 − "Microsoft.Kubernetes/connectedClusters/replicationcontrollers/*",

716 − "Microsoft.Kubernetes/connectedClusters/resourcequotas/read",

717 − "Microsoft.Kubernetes/connectedClusters/secrets/*",

718 − "Microsoft.Kubernetes/connectedClusters/serviceaccounts/*",

719 − "Microsoft.Kubernetes/connectedClusters/services/*"

720 − ],

721 − "notDataActions": []

722 − }

723 − ],

724 − "roleName": "Azure Arc Kubernetes Writer",

725 − "roleType": "BuiltInRole",

726 − "type": "Microsoft.Authorization/roleDefinitions"

727 −}

728 −```

729 −

730 −## Azure Container Instances Contributor Role

731 −

732 −Grants read/write access to container groups provided by Azure Container Instances

733 −

734 −> [!div class="mx-tableFixed"]

735 −> | Actions | Description |

736 −> | --- | --- |

737 −> | [Microsoft.ContainerInstance](../permissions/containers.md#microsoftcontainerinstance)/containerGroups/* | Create and manage container groups |

738 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

739 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

740 −> | [Microsoft.Insights](../permissions/monitor.md#microsoftinsights)/alertRules/* | Create and manage a classic metric alert |

741 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

742 −> | **NotActions** | |

743 −> | *none* | |

744 −> | **DataActions** | |

745 −> | *none* | |

746 −> | **NotDataActions** | |

747 −> | *none* | |

748 −

749 −```json

750 −{

751 − "assignableScopes": [

752 − "/"

753 − ],

754 − "description": "Grants read/write access to container groups provided by Azure Container Instances",

755 − "id": "/providers/Microsoft.Authorization/roleDefinitions/5d977122-f97e-4b4d-a52f-6b43003ddb4d",

756 − "name": "5d977122-f97e-4b4d-a52f-6b43003ddb4d",

757 − "permissions": [

758 − {

759 − "actions": [

760 − "Microsoft.ContainerInstance/containerGroups/*",

761 − "Microsoft.Resources/deployments/*",

762 − "Microsoft.Authorization/*/read",

763 − "Microsoft.Insights/alertRules/*",

764 − "Microsoft.Resources/subscriptions/resourceGroups/read"

765 − ],

766 − "notActions": [],

767 − "dataActions": [],

768 − "notDataActions": []

769 − }

770 − ],

771 − "roleName": "Azure Container Instances Contributor Role",

772 − "roleType": "BuiltInRole",

773 − "type": "Microsoft.Authorization/roleDefinitions"

774 −}

775 −```

776 −

777 −## Azure Container Storage Contributor

778 −

779 −Install Azure Container Storage and manage its storage resources. Includes an ABAC condition to constrain role assignments.

780 −

781 −> [!div class="mx-tableFixed"]

782 −> | Actions | Description |

783 −> | --- | --- |

784 −> | [Microsoft.KubernetesConfiguration](../permissions/hybrid-multicloud.md#microsoftkubernetesconfiguration)/extensions/write | Creates or updates extension resource. |

785 −> | [Microsoft.KubernetesConfiguration](../permissions/hybrid-multicloud.md#microsoftkubernetesconfiguration)/extensions/read | Gets extension instance resource. |

786 −> | [Microsoft.KubernetesConfiguration](../permissions/hybrid-multicloud.md#microsoftkubernetesconfiguration)/extensions/delete | Deletes extension instance resource. |

787 −> | [Microsoft.KubernetesConfiguration](../permissions/hybrid-multicloud.md#microsoftkubernetesconfiguration)/extensions/operations/read | Gets Async Operation status. |

788 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/*/read | Read roles and role assignments |

789 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/resourceGroups/read | Gets or lists resource groups. |

790 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/subscriptions/read | Gets the list of subscriptions. |

791 −> | [Microsoft.Management](../permissions/management-and-governance.md#microsoftmanagement)/managementGroups/read | List management groups for the authenticated user. |

792 −> | [Microsoft.Resources](../permissions/management-and-governance.md#microsoftresources)/deployments/* | Create and manage a deployment |

793 −> | [Microsoft.Support](../permissions/general.md#microsoftsupport)/* | Create and update a support ticket |

794 −> | **NotActions** | |

795 −> | *none* | |

796 −> | **DataActions** | |

797 −> | *none* | |

798 −> | **NotDataActions** | |

799 −> | *none* | |

800 −> | **Actions** | |

801 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/write | Create a role assignment at the specified scope. |

802 −> | [Microsoft.Authorization](../permissions/management-and-governance.md#microsoftauthorization)/roleAssignments/delete | Delete a role assignment at the specified scope. |

803 −> | **NotActions** | |

804 −> | *none* | |

805 −> | **DataActions** | |

Azure built-in roles · containers

Microsoft's edit · 25 Feb 22:49 UTC