You are preparing to deploy a secure backend microservice to Azure Container Apps. The container image for the microservice is stored in a private Azure Container Registry (ACR). You must configure the Container App to pull the image from the private ACR using a user-assigned managed identity. Which four actions should you perform in sequence? To answer, arrange the actions in the correct order.
- 1Create a user-assigned managed identity in Azure Active Directory / Microsoft Entra ID.
- 2Assign the AcrPull role to the user-assigned managed identity at the scope of the Azure Container Registry.
- 3Create an Azure Container Apps environment.
- 4Deploy the Container App, configuring it to use the user-assigned managed identity for registry authentication.
Answer
The correct sequence of actions is: 1) Create a user-assigned managed identity in Azure Active Directory / Microsoft Entra ID; 2) Assign the AcrPull role to the user-assigned managed identity at the scope of the Azure Container Registry; 3) Create an Azure Container Apps environment; 4) Deploy the Container App, configuring it to use the user-assigned managed identity for registry authentication.
The correct sequence begins by creating the user-assigned managed identity so that its identity credentials exist in Azure. Next, the AcrPull role must be assigned to this identity on the Azure Container Registry to authorize image retrieval. After ensuring the Azure Container Apps environment is created, the Container App can be deployed using the managed identity configuration to authenticate with the registry and pull the image.
Step-by-Step Solution
Key Concept
Deploying Azure Container Apps with Private Registry Authentication using Managed Identities