Secure Client-Specific Access for Pulling Images from Azure Container Registry

hi,

sharing a registry username and password is not recommended and should be avoided. Azure Container Registry supports identity based access control so you do not need to share static credentials. The preferred approach is to use Azure RBAC with Microsoft Entra identities. You can assign the AcrPull role at registry or repository level to a specific service principal or managed identity. Each client then authenticates using their own identity rather than shared credentials. If the clients are using AKS, the best practice is to use a managed identity on the AKS cluster and grant that identity AcrPull access to the registry. This way the cluster pulls images securely without storing any passwords.

If you need isolation per client, you can use repository scoped permissions and assign access only to specific repositories instead of the whole registry. Azure supports repository level RBAC and also token based authentication with scope maps for fine grained access control, for scoped tokens u can read https://learn.microsoft.com/azure/container-registry/container-registry-repository-scoped-permissions

as well an option is to create separate service principals per client and assign each one only AcrPull on the required repository. That way if one client’s credentials are compromised it does not affect others.

pls use identity based authentication with RBAC or scoped tokens, not shared admin credentials.

rgds,

Alex