AZ_ACR_CONTRIBUTOR

Summary

Forestall ACL Alias	AZ_ACR_CONTRIBUTOR
Azure Alias	Container Registry Contributor and Data Access Configuration Administrator
Affected Object Types	Container Registries (ACR)
Exploitation Certainty	Certain
Severity	High
Azure RBAC Roles	Container Registry Contributor and Data Access Configuration Administrator (3bc748fc-213d-45c1-8d91-9da5725539b9)

Custom Role Actions:

• Microsoft.ContainerRegistry/registries/*

Description

AZ_ACR_CONTRIBUTOR represents full management-plane control over an Azure Container Registry via the Container Registry Contributor and Data Access Configuration Administrator role (or a custom role with Microsoft.ContainerRegistry/registries/*). A principal with this edge can enable the registry’s admin user, reconfigure data access settings, and manage scoped tokens.

This is a scope-level edge: it states that the principal holds a contributor-grade role over the registry scope. The concrete abuse primitives that role unlocks — retrieving admin credentials, minting scoped tokens, or running ACR Tasks — are carried by the resource-level edges AZ_ACR_LIST_CREDENTIALS and AZ_EXECUTE_COMMAND, which fan out on their own from this assignment.

Note: this edge deliberately does not include AcrPush, which is a data-plane image-push role rather than a contributor-grade management role.

Related edges: AZ_ACR_LIST_CREDENTIALS, AZ_EXECUTE_COMMAND.

Identification

PowerShell (Az Module)Azure Portal

PowerShell (Az Module)

Connect-AzAccount

# List Container Registry Contributor and Data Access Configuration Administrator assignments
Get-AzRoleAssignment -RoleDefinitionName "Container Registry Contributor and Data Access Configuration Administrator" |
    Select-Object DisplayName, SignInName, ObjectType, Scope |
    Format-Table -AutoSize

# Include broad roles at ACR scopes
Get-AzRoleAssignment |
    Where-Object {
        $_.RoleDefinitionName -in @("Owner", "Contributor", "Container Registry Contributor and Data Access Configuration Administrator") -and
        $_.Scope -match "/Microsoft.ContainerRegistry/registries/"
    } |
    Select-Object RoleDefinitionName, DisplayName, SignInName, ObjectType, Scope |
    Format-Table -AutoSize

Azure Portal

1. Open Azure Portal -> target Container registry.
2. Go to Access control (IAM) -> Role assignments.
3. Filter for Owner, Contributor, Container Registry Contributor and Data Access Configuration Administrator, and custom roles with Microsoft.ContainerRegistry/registries/*.
4. Review inherited assignments from the resource group, subscription, and management group.

Exploitation

Pivot to Registry Credentials

Microsoft.ContainerRegistry/registries/* covers enabling the admin user, generating scoped token credentials, and writing tokens — the direct path to push/pull access over the registry contents. For detailed exploitation steps, see AZ_ACR_LIST_CREDENTIALS.

Pivot via ACR Tasks

If the registry has ACR Tasks configured, management-plane control can also be used to run arbitrary commands in the task execution context. For detailed exploitation steps, see AZ_EXECUTE_COMMAND.

Downstream Impact - Supply-Chain Poisoning

Once credentials are obtained, an attacker can replace or push images that downstream consumers (AKS, App Service, Function Apps, build pipelines) pull and execute on their next deploy.

Mitigation

1. Reduce broad ACR roles - replace Owner/Contributor with narrower data-plane roles (AcrPull, AcrPush) where full management access is not required.
2. Use Privileged Identity Management for temporary elevation to Owner, Contributor, and Container Registry Contributor and Data Access Configuration Administrator.
3. Disable the admin user on the registry (Properties -> Admin user = Disabled) to remove the static-credential pivot.
4. Restrict registry tokens and scope maps to the minimum repositories required.
5. Monitor inherited assignments at subscription and resource-group scopes, not only direct registry assignments.

Detection

Use the Azure Portal:

1. Open Azure Portal -> target container registry -> Activity log.
2. Review write operations against Microsoft.ContainerRegistry/registries/*, especially admin-user, token, and scope-map changes.
3. Review Access control (IAM) for new or unexpected assignments of Owner, Contributor, or Container Registry Contributor and Data Access Configuration Administrator.
4. Send Activity Log and ACR audit logs to a SIEM and alert on configuration changes by unusual principals.

References

• Azure Container Registry roles and permissions
• Registry tokens with scope-maps
• Azure Container Registry authentication overview