Secure Client-Specific Access for Pulling Images from Azure Container Registry

hi,

sharing a registry username and password is not recommended and should be avoided. Azure Container Registry supports identity based access control so you do not need to share static credentials. The preferred approach is to use Azure RBAC with Microsoft Entra identities. You can assign the AcrPull role at registry or repository level to a specific service principal or managed identity. Each client then authenticates using their own identity rather than shared credentials. If the clients are using AKS, the best practice is to use a managed identity on the AKS cluster and grant that identity AcrPull access to the registry. This way the cluster pulls images securely without storing any passwords.

If you need isolation per client, you can use repository scoped permissions and assign access only to specific repositories instead of the whole registry. Azure supports repository level RBAC and also token based authentication with scope maps for fine grained access control, for scoped tokens u can read https://learn.microsoft.com/azure/container-registry/container-registry-repository-scoped-permissions

as well an option is to create separate service principals per client and assign each one only AcrPull on the required repository. That way if one client’s credentials are compromised it does not affect others.

pls use identity based authentication with RBAC or scoped tokens, not shared admin credentials.

rgds,

Alex

Hello Raj,

Thank you for reaching out Q/A. You are right to reconsider the current approach of sharing the ACR admin username and password. The admin account is intended for limited or testing scenarios, and in a multi-client environment it creates security risks because it grants broad access that cannot be scoped, audited, or revoked per customer.

To provide secure, client-specific access, Azure Container Registry supports the following recommended approaches:

1. Service Principal per Client:

Create a separate Microsoft Entra ID Service Principal for each client and assign only the AcrPull role on your registry. Each client then authenticates using their own identity when pulling images into AKS.

Reference: Azure Container Registry authentication with service principals

2.Managed Identity:

If the client workloads are hosted in Azure (for example AKS, VM, or App Service), you can use Managed Identity and grant it the AcrPull role. This removes the need for credentials entirely and uses Azure AD token-based authentication.

Reference: Use a managed identity to authenticate to an Azure container registry

3. ACR Tokens with Scope Maps:

For customers outside your tenant or when you need repository-level control, you can use ACR Tokens with Scope Maps to grant access only to specific repositories.

A Scope Map defines what a client can access (for example, read-only access to one repository), and each client receives a unique token.

• Create a Scope Map: A scope map defines permissions on repositories. You can create a scope map that specifies which repositories a client can pull from.

    REGISTRY_NAME=<container-registry-name>
    # Create a scope map with read-only access
    az acr scope-map create \
      --name MyScopeMap \
      --registry $REGISTRY_NAME \
      --repository <repository-name> content/read \
      --description "Sample scope map"
  

• Create a Client Token: The client token will be associated with the scope map you just created.

    az acr token create --name myClientToken --registry $REGISTRY_NAME --scope-map MyScopeMap
  

  Note: Updating a scope map immediately applies changes to all associated tokens. You only need to update a connected registry if you are using connected registry scenarios. Update token permissions

This allows you to manage access per customer without exposing the entire registry.

Reference: Non-Microsoft Entra token-based repository permissions in Azure Container Registry

Authenticate with Azure Container Registry

Pull images from a connected registry

Hope this helps! Please let me know if you have any queries.