AZ-104 Practice Question 37: ACR Admin Account Alternatives
Microsoft Azure Administrator Associate (AZ-104) · Test 4 · question 7 of 10
An audit finds that everything touching the container registry acrcontoso authenticates with the registry's admin account: six developers pulling images from their laptops, and a container app that pulls its image at start-up. The password sits in a shared password manager.
The auditors require that every push and pull be attributable to a specific identity, that access be governed by Azure RBAC, and that no long-lived registry credential be stored for the Azure workload.
What should you implement?
Show answer and explanation
Answer:
Microsoft's guidance is to split interactive access from headless access. For people: "when working with your registry directly, such as pulling images and pushing images from a development workstation ... authenticate by using your individual Azure identity", which "enables Azure role-based access control". For the workload, a managed identity for Azure resources supports "unattended pull to Azure services" with Entra RBAC and no credential to store or rotate. That retires the admin account, which Microsoft warns "is designed for a single user to access the registry, mainly for testing purposes ... All users authenticating with the admin account appear as a single user", the exact attribution problem the audit raised.
Option A preserves the finding. Rotating a shared secret changes the secret, not the fact that six people and a workload share one opaque identity with full push and pull rights.
Option B trades one shared secret for another. A service principal is the right answer for headless CI/CD, but handing its credentials to six developers destroys per-user attribution again, and its password expires by default after a year.
Option D gives up the requirement that was stated. Token-based repository permissions are useful for scoping access to individual repositories, but they are "not currently integrated with Microsoft Entra ID" and don't support Entra RBAC role assignments.
Reference: Authentication options for Azure Container Registry