Azure ACR: why can i push to ACR having ONLY AcrPull role?

Question

I created a private registry having only AcrPull role, as showing below :

But when i build my own image and PUSH, it works fine! (instead of deny me )

I would like to know why ? (since it has only AcrPull and NOT AcrPush )

Thank you!

Answer 1

As you have created the ACR yourself (that's what I understand from your post), you have also the Owner role. That enables push as well (as does Contributor role).

As suggested in the comments, when you try with a different user account that has no such permissions, push will not work.

See here: https://learn.microsoft.com/en-us/azure/container-registry/container-registry-roles?tabs=azure-cli