Skip to content

[AppService]Update auth configuration instructions for ACR pulls #128528

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sarsharma wants to merge 4 commits into
base: main
Choose a base branch
from
Open

[AppService]Update auth configuration instructions for ACR pulls #128528

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
ac3bd1e
Update managed identity configuration instructions
sarsharma May 26, 2026
58965c9
Potential fix for pull request finding
sarsharma May 26, 2026
cb8f4f0
Update configure-custom-container.md
sarsharma May 26, 2026
6e59e30
Potential fix for pull request finding
sarsharma May 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions articles/app-service/configure-custom-container.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,16 @@ Supply the sign-in credentials for your private registry account in the *\<usern

Use the following steps to configure your web app to pull from Azure Container Registry by using managed identity. The steps use system-assigned managed identity, but you can also use user-assigned managed identity.

> [!IMPORTANT]
> Your Azure Container Registry must allow ARM audience tokens for authentication in order to use managed identity to pull images. If this setting is disabled, image pulls fail with an `UNAUTHORIZED` "token validation failed" error. To check and enable this setting, run the following commands:
>
> ```azurecli-interactive
> az acr config authentication-as-arm show -r <registry-name>
> az acr config authentication-as-arm update -r <registry-name> --status enabled
> ```
>
> For more information, see [Configure registry acceptance of Microsoft Entra authentication scopes](/azure/container-registry/container-registry-disable-authentication-as-arm).

1. Enable the [system-assigned managed identity](./overview-managed-identity.md) for the web app by using the [`az webapp identity assign`](/cli/azure/webapp/identity#az-webapp-identity-assign) command:

```azurecli-interactive
Expand Down