AZ-500 Question 136
Single answerYour organization hosts an Azure Container Registry (ACR) named ContosoRegistry. The development team needs to push and pull container images using Azure Active Directory (Azure AD) credentials, and you must eliminate reliance on the registry’s admin user credentials. Each developer should have only the permissions necessary to push and pull images and should not be able to delete or manage the registry. Which approach should you implement first to meet these requirements?
- A
A) Disable the ACR admin user and assign the built-in Contributor role at the subscription level to each developer.
- B
B) Disable the ACR admin user, create a service principal, and assign the AcrPush role at the registry scope to that principal.
- C
C) Keep the ACR admin user enabled and share those credentials with each developer to push and pull images.
- D
D) Disable the ACR admin user and assign all developers the Owner role at the ACR resource group level.
Show answer and explanation
Correct answer: B
Explanation
To manage access to Azure Container Registry securely, it is recommended to disable the local admin user to eliminate shared credentials and instead use Azure Active Directory-based authentication. Assigning the AcrPush role at the container registry scope ensures developers can push and pull images without granting them unnecessary permissions. For more details, refer to the official Azure Container Registry documentation on access and authentication (https://learn.microsoft.com/azure/container-registry/container-registry-authentication).
- A. Incorrect.
Option A: Assigning the Contributor role at the subscription level grants more permissions than necessary (e.g., the ability to manage resources beyond the registry). This violates the principle of least privilege.
- B. Correct.
Option B: Disabling the admin user blocks reliance on local credentials, and creating a service principal with the AcrPush role at the registry scope correctly limits permissions to pushing and pulling images only. This aligns with best practices for least privilege and Azure AD-based authentication.
- C. Incorrect.
Option C: Keeping the admin user enabled introduces security risks because it uses shared local credentials, contradicting the goal of enforcing Azure AD authentication and avoiding shared secrets.
- D. Incorrect.
Option D: Assigning the Owner role at the resource group level grants full access to the registry (and potentially other resources in the group). This is again more permissions than needed for simply pushing and pulling images.