Azure Container Registry RBAC Roles: AcrPush vs AcrPull
Short answer
User1 can upload and download images because the AcrPush role includes pull permissions. User2 can only download images because the AcrPull role restricts access to read-only operations.
Question
You have an Azure Container Registry.
You add role assignments for Registry1 as shown in the following table.
Which users can upload images to Registry1 and which users can download images from Registry1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Key Takeaways
The trap is assuming AcrPush is write-only; it actually includes read (pull) permissions, making it a superset of AcrPull.
This page explains how to determine upload and download permissions in Azure Container Registry based on AcrPush and AcrPull role assignments.
Common mistake: Learners often incorrectly assign 'Upload only' to AcrPush, forgetting that push users typically need to verify images by pulling them or that the role explicitly grants read access.
Expert Analysis
The scenario involves Azure Container Registry (ACR) RBAC assignments. The critical distinction lies in the specific permissions granted by the built-in roles: AcrPush and AcrPull.
User1 is assigned the AcrPush role. This role grants permission to push (upload) container images and manage repository metadata. Crucially, AcrPush also includes read permissions for pulling images, meaning User1 can both upload and download.
User2 is assigned the AcrPull role. This role is strictly limited to reading content from the registry, which means it allows downloading (pulling) images but explicitly denies uploading (pushing) capabilities.
The common confusion here is assuming that 'Push' implies only writing or that 'Pull' implies only reading without considering if one role subsumes the other's base access. However, Microsoft’s documentation clearly states that AcrPush includes all permissions of AcrPull plus write access. Therefore, User1 can do both; User2 can only pull. The correct mapping is: User1 → Upload and Download; User2 → Download only.
Exam Strategy
When facing RBAC questions for Azure services, always check if a broader role (like AcrPush) implicitly includes the permissions of a narrower role (like AcrPull). Memorize the hierarchy: AcrPull is read-only; AcrPush is read-write. Do not assume exclusivity unless explicitly stated.
Frequently Asked Questions
Does AcrPush allow downloading images?
Can AcrPull users upload new images?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
azuretrainer1 👍 1Based on the role assignments in the table, here is the breakdown of permissions for each user regarding Registry1:User1 has the AcrPush role, which allows uploading (pushing) images. (Note: In legacy/standard RBAC modes, AcrPush includes pull capabilities or data-plane push actions, but fundamentally grants write/push permissions).User2 has the AcrPull role, which allows downloading (pulling) images. User3 has the AcrImageSigner role, which is used for content trust signing, not general image uploading or downloading.User4 has the Contributor role, which grants full control over the registry resources, allowing both uploading and downloading of images.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SC-500 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SC-500 Practice Test →