diff --git a/src/azure-cli/azure/cli/command_modules/acr/_help.py b/src/azure-cli/azure/cli/command_modules/acr/_help.py
index e6865fa8da4..2bafa530bfe 100644
--- a/src/azure-cli/azure/cli/command_modules/acr/_help.py
+++ b/src/azure-cli/azure/cli/command_modules/acr/_help.py
@@ -1526,6 +1526,9 @@
   - name: Enable regional endpoints on an existing registry.
     text: >
         az acr update -n myregistry --regional-endpoints enabled
+  - name: Update the endpoint protocol for an Azure Container Registry.
+    text: >
+        az acr update -n myregistry --endpoint-protocol IPv4AndIPv6
 """
 
 helps['acr webhook'] = """
diff --git a/src/azure-cli/azure/cli/command_modules/acr/_params.py b/src/azure-cli/azure/cli/command_modules/acr/_params.py
index 97e3e92cfb5..27f8cd3d591 100644
--- a/src/azure-cli/azure/cli/command_modules/acr/_params.py
+++ b/src/azure-cli/azure/cli/command_modules/acr/_params.py
@@ -134,6 +134,7 @@ def load_arguments(self, _):  # pylint: disable=too-many-statements
 
     with self.argument_context('acr update', arg_group='Network Rule') as c:
         c.argument('data_endpoint_enabled', get_three_state_flag(), help="Enable dedicated data endpoint for client firewall configuration")
+        c.argument('endpoint_protocol', arg_type=get_enum_type(['IPv4', 'IPv4AndIPv6']), options_list=['--endpoint-protocol'], is_preview=True, help="The endpoint protocol for the registry. Allowed values: IPv4, IPv4AndIPv6.")
 
     with self.argument_context('acr update') as c:
         c.argument('anonymous_pull_enabled', get_three_state_flag(), help="Enable registry-wide pull from unauthenticated clients")
diff --git a/src/azure-cli/azure/cli/command_modules/acr/custom.py b/src/azure-cli/azure/cli/command_modules/acr/custom.py
index 083ecf85edd..058b941bbc5 100644
--- a/src/azure-cli/azure/cli/command_modules/acr/custom.py
+++ b/src/azure-cli/azure/cli/command_modules/acr/custom.py
@@ -160,7 +160,8 @@ def acr_update_custom(cmd,
                       tags=None,
                       allow_metadata_search=None,
                       role_assignment_mode=None,
-                      regional_endpoints=None):
+                      regional_endpoints=None,
+                      endpoint_protocol=None):
     if sku is not None:
         Sku = cmd.get_models('Sku')
         instance.sku = Sku(name=sku)
@@ -192,6 +193,9 @@ def acr_update_custom(cmd,
     if regional_endpoints is not None:
         _configure_regional_endpoints(cmd, instance, sku, regional_endpoints)
 
+    if endpoint_protocol is not None:
+        instance.endpoint_protocol = endpoint_protocol
+
     _handle_network_bypass(cmd, instance, allow_trusted_services)
     _handle_export_policy(cmd, instance, allow_exports)
 
diff --git a/src/azure-cli/azure/cli/command_modules/acr/tests/latest/test_acr_commands.py b/src/azure-cli/azure/cli/command_modules/acr/tests/latest/test_acr_commands.py
index 229f124b687..303c122cb2e 100644
--- a/src/azure-cli/azure/cli/command_modules/acr/tests/latest/test_acr_commands.py
+++ b/src/azure-cli/azure/cli/command_modules/acr/tests/latest/test_acr_commands.py
@@ -795,6 +795,19 @@ def test_acr_with_anonymous_pull(self, resource_group, resource_group_location):
         self.cmd('acr update --name {registry_name} --resource-group {rg} --anonymous-pull-enabled false',
                  checks=[self.check('anonymousPullEnabled', False)])
 
+    @ResourceGroupPreparer()
+    @live_only()
+    def test_acr_with_dual_stack_endpoints(self, resource_group, resource_group_location):
+        self.kwargs.update({
+            'registry_name': self.create_random_name('testreg', 20)
+        })
+        self.cmd('acr create --name {registry_name} --resource-group {rg} --sku premium -l eastus',
+                 checks=[self.check('endpointProtocol', 'IPv4')])
+        self.cmd('acr update --name {registry_name} --resource-group {rg} --endpoint-protocol IPv4AndIPv6',
+                 checks=[self.check('endpointProtocol', 'IPv4AndIPv6')])
+        self.cmd('acr update --name {registry_name} --resource-group {rg} --endpoint-protocol IPv4',
+                 checks=[self.check('endpointProtocol', 'IPv4')])
+
     @ResourceGroupPreparer()
     @live_only()
     def test_acr_create_invalid_name(self, resource_group):