You have a private Azure Container Registry named registry1 and an Azure Container App named app1. You need to configure app1 to pull images from registry1 using a system-assigned managed identity. The configuration must follow the principle of least privilege. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
- 1Enable the system-assigned managed identity on the container app.
- 2Assign the AcrPull role to the container app's system-assigned managed identity on the Azure Container Registry.
- 3Configure the container app's registry settings to use the system-assigned managed identity.
Answer
To configure the container app, first enable the system-assigned managed identity on the container app, then assign the AcrPull role to the container app's system-assigned managed identity on the Azure Container Registry, and finally configure the container app's registry credentials to use the system-assigned managed identity.
To allow a container app to pull images from a private Azure Container Registry using a system-assigned identity, you must first enable the system-assigned identity on the container app resource so that Microsoft Entra ID registers it. Next, you assign the AcrPull role to this identity at the registry's scope to authorize access. Finally, you update the container app's registry configuration to use the system-assigned identity for authentication.
Step-by-Step Solution
Key Concept
Configuring private container registry access for Azure Container Apps using a system-assigned managed identity.