Migrate from Azure Container Registry 2017-03-01-(GA) API

Hello Nischay,

Just checking in to see if the solution shared above help you to resolve your issue. please reach out to us If you have any further questions.

Thanks

Hi @Siva shunmugam Nadessin ,

Thank you for your detailed response.

We've reviewed our backend code and couldn't find any references to the Azure Container Registry (ACR) API version 2017-03-01, and we don't believe any of our SDKs are making calls to ACR. However, we'd like to double-check this to be sure. Could you please provide more instructions/guidance on how we can verify this further? For example, are there any queries or commands we can run in Resource Graph Explorer or via Azure CLI to confirm whether any of our services are using ACR, or to check logs for any calls to this API version?

We'd really appreciate any specific steps or references you can point us to.

Looking forward to your response.

Best regards,

Nischay

Hello Nischay, There is no direct Azure query that says:

“Show me all callers using ACR API version 2017‑03‑01”

Azure does not surface api-version as a first‑class field in Resource Graph or standard metrics. Verification has to be inferred from:

• Activity Log (management-plane calls)
• Diagnostic logs (if enabled)
• SDK / toolchain versions
• Known legacy ACR usage patterns

This is consistent with Microsoft’s ACR monitoring and API deprecation guidance

Reference:

Deprecated and Removed Features in Azure Container Registry - Azure Container Registry | Azure Docs

Monitor Azure Container Registry - Azure Container Registry | Microsoft Learn

Check Azure Activity Log (most reliable signal)

The Activity Log captures ARM (management-plane) operations against ACR. If something is calling an old API version, it will appear here.

Azure Portal

• Go to Monitor → Activity log
• Filter:
  • Resource Provider = Microsoft.ContainerRegistry
  • Operation name = Write, List, Delete, Update
  • Time range: last 30–90 days

Then open an event and look for:

• Caller (user / appId / service principal)
• Operation name
• Client IP / Claims

While the UI doesn’t show api-version, these events confirm who is calling ACR. Microsoft explicitly documents Activity Log as the authoritative source for ACR management operations

You can also try with Azure CLI  which is recommended for precision.

az monitor activity-log list \
  --resource-provider Microsoft.ContainerRegistry \
  --status Succeeded \
  --offset 90d \
  --output table

If you see:

• Old service principals
• Automation accounts
• Unknown app registrations

those are your prime suspects. The Activity Log schema is the same data source documented in Azure Monitor for ACR.

Monitor Azure Container Registry - Azure Container Registry | Microsoft Learn 

Enable and query ACR Diagnostic Logs (if not already enabled)

If diagnostic settings are enabled, you get deep operational visibility.

Enable diagnostics (once per registry)

• ACR → Diagnostic settings
• Send logs to Log Analytics
• Enable:
  • ContainerRegistryLoginEvents
  • ContainerRegistryRepositoryEvents

These tables are officially documented ACR log sources

Reference:

Azure Monitor tables for microsoft.containerregistry/registries - Azure Monitor | Azure Docs

Use KQL queries (Log Analytics), These logs do not show API version, but they prove active usage paths (AKS, ACI, pipelines, old agents).

Who is authenticating to ACR?

ContainerRegistryLoginEvents
| summarize count() by CallerIdentity, AuthenticationType
| order by count_ desc
 

What is accessing repositories?

ContainerRegistryRepositoryEvents
| summarize count() by Repository, Operation, CallerIdentity
| order by count_ desc

Resource Graph – what you can and cannot infer

What Resource Graph can do Find all ACRs, Correlate linked services (AKS, ACI, Web Apps, Tasks) it cannot

• Detect API versions
• Show historical REST calls
• Identify SDK versions 

Resources
| where type == "microsoft.containerregistry/registries"
| project name, resourceGroup, location, sku

 You can use the above query to track usage and manually check the api version.

Azure Resource Graph documentation | Microsoft Learn

Hope this helps, kindly check and let us know if any questions?

Hi @Siva shunmugam Nadessin ,

Thanks for the additional information!

We checked the Activity Logs and didn’t find any entries related to Microsoft.ContainerRegistry in the past 60–90 days.

When we ran the commands via Azure CLI, we encountered the following error:-

We had another question (screenshot below) - we previously had a DevOps pipeline for a Cloud Service (Classic) deployment that we no longer use, and it was used the Azure Classic service connection type. Could this possibly be related to ACR in any way?

Looking forward to your response.

Best regards,

Nischay

Nischay, kindly try below command.

az monitor activity-log list --namespace Microsoft.ContainerRegistry --status Succeeded --offset 90d --output table 

From the screenshot, the service connection has:

• Service connection type: Azure Classic
• Authentication: Using credentials
• Purpose (historical): Cloud Service (Classic) deployment

This corresponds to the legacy Azure Service Management (ASM / “Classic”) API, not Azure Resource Manager (ARM) and not ACR. Azure DevOps explicitly documents Azure Classic service connections as legacy connections for pre‑ARM resources such as Cloud Services (Classic) and classic VMs