> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/edges/azure/az_acr_contributor.md).

# AZ\_ACR\_CONTRIBUTOR

## Summary

|                            |                                                                                                                     |
| -------------------------- | ------------------------------------------------------------------------------------------------------------------- |
| **Forestall ACL Alias**    | AZ\_ACR\_CONTRIBUTOR                                                                                                |
| **Azure Alias**            | Container Registry Contributor and Data Access Configuration Administrator                                          |
| **Affected Object Types**  | Container Registries (ACR)                                                                                          |
| **Exploitation Certainty** | Certain                                                                                                             |
| **Severity**               | High                                                                                                                |
| **Azure RBAC Roles**       | Container Registry Contributor and Data Access Configuration Administrator (`3bc748fc-213d-45c1-8d91-9da5725539b9`) |

**Custom Role Actions:**

* `Microsoft.ContainerRegistry/registries/*`

## Description

`AZ_ACR_CONTRIBUTOR` represents full management-plane control over an Azure Container Registry via the **Container Registry Contributor and Data Access Configuration Administrator** role (or a custom role with `Microsoft.ContainerRegistry/registries/*`). A principal with this edge can enable the registry's admin user, reconfigure data access settings, and manage scoped tokens.

This is a **scope-level** edge: it states that the principal holds a contributor-grade role over the registry scope. The concrete abuse primitives that role unlocks — retrieving admin credentials, minting scoped tokens, or running ACR Tasks — are carried by the resource-level edges [AZ\_ACR\_LIST\_CREDENTIALS](https://docs.forestall.io/fsprotect/edges/azure/az_acr_list_credentials) and [AZ\_EXECUTE\_COMMAND](https://docs.forestall.io/fsprotect/edges/azure/az_execute_command), which fan out on their own from this assignment.

> **Note:** this edge deliberately does **not** include `AcrPush`, which is a data-plane image-push role rather than a contributor-grade management role.

Related edges: [AZ\_ACR\_LIST\_CREDENTIALS](https://docs.forestall.io/fsprotect/edges/azure/az_acr_list_credentials), [AZ\_EXECUTE\_COMMAND](https://docs.forestall.io/fsprotect/edges/azure/az_execute_command).

## Identification

### PowerShell (Az Module)

```powershell
Connect-AzAccount

# List Container Registry Contributor and Data Access Configuration Administrator assignments
Get-AzRoleAssignment -RoleDefinitionName "Container Registry Contributor and Data Access Configuration Administrator" |
    Select-Object DisplayName, SignInName, ObjectType, Scope |
    Format-Table -AutoSize

# Include broad roles at ACR scopes
Get-AzRoleAssignment |
    Where-Object {
        $_.RoleDefinitionName -in @("Owner", "Contributor", "Container Registry Contributor and Data Access Configuration Administrator") -and
        $_.Scope -match "/Microsoft.ContainerRegistry/registries/"
    } |
    Select-Object RoleDefinitionName, DisplayName, SignInName, ObjectType, Scope |
    Format-Table -AutoSize
```

### Azure Portal

1. Open **Azure Portal** -> target **Container registry**.
2. Go to **Access control (IAM)** -> **Role assignments**.
3. Filter for **Owner**, **Contributor**, **Container Registry Contributor and Data Access Configuration Administrator**, and custom roles with `Microsoft.ContainerRegistry/registries/*`.
4. Review inherited assignments from the resource group, subscription, and management group.

## Exploitation

### Pivot to Registry Credentials

`Microsoft.ContainerRegistry/registries/*` covers enabling the admin user, generating scoped token credentials, and writing tokens — the direct path to push/pull access over the registry contents. For detailed exploitation steps, see [AZ\_ACR\_LIST\_CREDENTIALS](https://docs.forestall.io/fsprotect/edges/azure/az_acr_list_credentials).

### Pivot via ACR Tasks

If the registry has ACR Tasks configured, management-plane control can also be used to run arbitrary commands in the task execution context. For detailed exploitation steps, see [AZ\_EXECUTE\_COMMAND](https://docs.forestall.io/fsprotect/edges/azure/az_execute_command).

### Downstream Impact - Supply-Chain Poisoning

Once credentials are obtained, an attacker can replace or push images that downstream consumers (AKS, App Service, Function Apps, build pipelines) pull and execute on their next deploy.

## Mitigation

1. **Reduce broad ACR roles** - replace **Owner**/**Contributor** with narrower data-plane roles (**AcrPull**, **AcrPush**) where full management access is not required.
2. **Use Privileged Identity Management** for temporary elevation to Owner, Contributor, and Container Registry Contributor and Data Access Configuration Administrator.
3. **Disable the admin user** on the registry (`Properties` -> **Admin user** = **Disabled**) to remove the static-credential pivot.
4. **Restrict registry tokens** and scope maps to the minimum repositories required.
5. **Monitor inherited assignments** at subscription and resource-group scopes, not only direct registry assignments.

## Detection

Use the Azure Portal:

1. Open **Azure Portal** -> target **container registry** -> **Activity log**.
2. Review write operations against `Microsoft.ContainerRegistry/registries/*`, especially admin-user, token, and scope-map changes.
3. Review **Access control (IAM)** for new or unexpected assignments of **Owner**, **Contributor**, or **Container Registry Contributor and Data Access Configuration Administrator**.
4. Send Activity Log and ACR audit logs to a SIEM and alert on configuration changes by unusual principals.

## References

* [Azure Container Registry roles and permissions](https://learn.microsoft.com/en-us/azure/container-registry/container-registry-roles)
* [Registry tokens with scope-maps](https://learn.microsoft.com/en-us/azure/container-registry/container-registry-repository-scoped-permissions)
* [Azure Container Registry authentication overview](https://learn.microsoft.com/en-us/azure/container-registry/container-registry-authentication)