Microsoft Azure Security Technologies (AZ-500)

What role should be assigned to a user who needs the ability to upload images to the Azure Container Registry without excessive privileges?

1. Owner

2. Contributor

3. AcrPush

4. AcrPull

The correct answer is: AcrPush

Assigning the AcrPush role to a user who needs the ability to upload images to the Azure Container Registry is the most appropriate choice because this role is specifically designed for users who require permission to push container images to the registry. The AcrPush role provides the necessary access to perform the actions involved in uploading images, such as pushing those images from a local environment to the Azure Container Registry. In contrast, the other roles do not offer the same level of specificity needed for this scenario. The Owner role would grant excessive privileges, allowing the user not only to upload images but also to manage all aspects of the registry, which may not be necessary. The Contributor role is similarly broad, providing rights to manage resources within the registry but also extending to other potential modifications that go beyond just uploading images. The AcrPull role, on the other hand, is focused solely on permissions to pull (or download) images from the registry, which does not meet the requirement of being able to upload images. By assigning the AcrPush role, you maintain a principle of least privilege, ensuring the user has just the access they need to perform their tasks without opening up unnecessary capabilities or risks.