Disable ACR admin user#
Use Azure AD identities instead of using the registry admin user.
Azure Container Registry (ACR) includes a built-in admin user account. The admin user account is a single user account with administrative access to the registry. This account provides single user access for early test and development. The admin user account is not intended for use with production container registries.
Instead use role-based access control (RBAC). RBAC can be used to delegate registry permissions to an Azure AD (AAD) identity.
Consider disabling the admin user account and only using AAD-based identities for registry operations.
Configure with Azure CLI#
az acr update --admin-enabled false -n '<name>' -g '<resource_group>'
Configure with Azure PowerShell#
Update-AzContainerRegistry -ResourceGroupName '<resource_group>' -Name '<name>' -DisableAdminUser
- Authenticate with a private Docker container registry
- Best practices for Azure Container Registry
- Use role-based access control (RBAC)
- Azure Container Registry authentication with service principals
- Use an Azure managed identity to authenticate to an Azure container registry
- Azure Container Registry roles and permissions
- What is Azure role-based access control (Azure RBAC)?