Question

Difficulty: MediumConfigure Azure App Services

You need to configure an Azure App Service web app named app1 to run a container image hosted in a private Azure Container Registry (ACR) named acr1. The web app must authenticate to the registry using its own system-assigned managed identity. Which sequence of actions should you perform? To answer, arrange the actions in the correct order.

  1. 1Enable the system-assigned managed identity on the App Service web app.
  2. 2Assign the AcrPull role to the web app's system-assigned managed identity on the Azure Container Registry.
  3. 3Configure the web app's container settings to reference the registry, repository, and tag, and set the credentials to use the managed identity.
  4. 4Restart the App Service web app to trigger the pull of the container image.

Answer

First, enable the system-assigned managed identity on the App Service web app. Second, assign the AcrPull role to the web app's system-assigned managed identity on the Azure Container Registry. Third, configure the web app's container settings to reference the registry, repository, and tag, and set the credentials to use the managed identity. Finally, restart the App Service web app to trigger the pull of the container image.
To secure communications between Azure App Service and Azure Container Registry without hardcoded credentials, you must first enable the system-assigned managed identity on the web app. This creates a service principal. Next, you authorize this service principal by granting it the AcrPull role on the registry. Then, you configure the container deployment settings on the web app to utilize the registry and authentication via the managed identity. Finally, you restart the web app to apply the configuration and initiate the pull.

Step-by-Step Solution

1
Enable the system-assigned managed identity on the App Service web app.
A service principal representing the web app is created in Microsoft Entra ID.
The security identity must exist in Microsoft Entra ID before it can be granted access to other Azure resources.
2
Assign the AcrPull role to the web app's system-assigned managed identity on the Azure Container Registry.
The identity is authorized to pull container images from the registry.
App Service requires permissions to read and download container images from the private registry.
3
Configure the web app's container settings to reference the registry, repository, and tag, and set the credentials to use the managed identity.
The deployment settings of the web app are updated with the image destination and authentication mechanism.
This links the web app's deployment configuration to the container image and specifies authentication via the managed identity.
4
Restart the App Service web app to trigger the pull of the container image.
The web app pulls the image and runs the container.
Restarting the app applies the deployment configuration changes and starts the container hosting process.

Key Concept

Configuring container settings and system-assigned managed identities for Azure App Service to authenticate against Azure Container Registry.
Rate this question