Web App for container doesn't align with ABAC-mode registries

Baley Gregoire 10 Reputation points
2026-08-06T16:38:54.2166667+00:00

The Problem: Deployment Center Validation vs. ABAC Reality

  1. ABAC-enabled registries do NOT honor AcrPull

Per the ACR ABAC repository permissions documentation (https://learn.microsoft.com/en-us/azure/container-registry/container-registry-rbac-abac-repository-permissions):

Legacy ACR roles such as AcrPull, AcrPush, and AcrDelete are not honored in ABAC-enabled registries. Instead, use the Container Registry Repository Reader, Container Registry Repository Writer, and Container Registry Repository Contributor roles.

  1. App Service documentation still references AcrPull

The App Service custom container documentation (https://learn.microsoft.com/en-us/azure/app-service/configure-custom-container) still explicitly instructs assigning AcrPull:

az role assignment create --assignee <principal-id> --scope <registry-resource-id> --role "AcrPull"

  1. The Deployment Center checks for AcrPull

The troubleshooting documentation (https://learn.microsoft.com/en-us/troubleshoot/azure/azure-container-registry/pull-image-to-web-app-fail) confirms the Deployment Center validates the Microsoft.ContainerRegistry/registries/pull/read control plane permission (which is on the AcrPull role). This is a portal UI validation that hasn't been updated for ABAC-enabled registries. I doesn't work either using CLI.

Azure App Service
Azure App Service

Azure App Service is a service used to create and deploy scalable, mission-critical web apps.

0 comments

4 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Baley Gregoire 10 Reputation points
    2026-08-07T10:12:53.44+00:00

    Hi Nithin,

    Thank you for this detailed answer!

    If this limitation is known why isn't it documented? I couldn't find any mention on this issue.

    Is there a roadmap to fix the issue? Could you share a resolution target date?

    I have another workaround because I want to avoid handling secret with weaker security level (we currently use it on several scope):

    1. Configure RBAC + ABAC with the needed level of right
    2. Add the old AcrPull RBAC (unused but unlock the webapp control-plane check)
    3. Wait for the fix to remove the AcrPull

    Best regards

    Was this answer helpful?

  2. Baley Gregoire 10 Reputation points
    2026-08-07T10:12:36.8433333+00:00

    Hi Nithin,

    Thank you for this detailed answer!

    If this limitation is known why isn't it documented? I couldn't find any mention on this issue.

    Is there a roadmap to fix the issue? Could you share a resolution target date?

    I have another workaround because I want to avoid handling secret with weaker security level (we currently use it on several scope):

    1. Configure RBAC + ABAC with the needed level of right
    2. Add the old AcrPull RBAC (unused but unlock the webapp control-plane check)
    3. Wait for the fix to remove the AcrPull

    Best regards

    Was this answer helpful?

    0 comments
  3. Baley Gregoire 10 Reputation points
    2026-08-07T07:18:13.1033333+00:00

    Hi Nithin,

    Thank you for this detailed answer!

    If this limitation is known why isn't it documented? I couldn't find any mention on this issue.

    Is there a roadmap to fix the issue? Could you share a resolution target date?

    I have another workaround because I want to avoid handling secret with weaker security level (we currently use it on several scope):

    1. Configure RBAC + ABAC with the needed level of right
    2. Add the old AcrPull RBAC (unused but unlock the webapp control-plane check)
    3. Wait for the fix to remove the AcrPull

    Best regards

    Was this answer helpful?

    0 comments
  4. Nithin 85 Reputation points
    2026-08-06T17:03:59.6833333+00:00

    Hi Baley,

    You are 100% spot on this is a genuine architecture gap between Azure App Service and ACR ABAC (Attribute-Based Access Control).

    Because App Service's managed identity pull agent relies on registry-level control-plane permissions (Microsoft.ContainerRegistry/registries/pull/read), it cannot negotiate repository-scoped ABAC tokens. Since ABAC-enabled registries disable legacy AcrPull entirely, managed identity pulls fail on both Portal and CLI.

    Here are the two working paths today:

    1. Use ACR Scoped Repository Tokens (Service Principal / Credential path): Instead of Managed Identity, create a Repository-Scoped Token in ACR with repository/read permissions and configure App Service using registry credentials:
      • Set DOCKER_REGISTRY_SERVER_USERNAME to your ACR token name.
      • Set DOCKER_REGISTRY_SERVER_PASSWORD to your token secret (stored securely in Azure Key Vault).
    2. Consider Azure Container Apps (ACA): If strict ABAC repository scoping + Managed Identity authentication is an absolute requirement for your architecture, Azure Container Apps natively supports fine-grained repository-scoped ACR pulls without requiring legacy AcrPull.

    Microsoft is tracking App Service support for ABAC registries. In the meantime, Repository Tokens are the recommended workaround for App Service.

    Ref: Azure Container Registry Repository-Scoped Tokens

    If this helps clarify the current limitation and workaround, please mark as Accept Answer!

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.