Container Registry admin user is disabled

Check ID: containerregistry_admin_user_disabled
Provider: Azure
Service: containerregistry
Severity: HIGH
Categories: identity-access, secrets
Resource type: microsoft.containerregistry/registries

What this check verifies

Azure Container Registry admin account configuration, confirming the built-in admin user is disabled so access relies on Microsoft Entra-based RBAC identities and scoped roles.

Risk

Using a shared, always-valid admin credential grants full push/pull and lacks attribution. Compromise enables unauthorized image pulls (confidentiality), malicious pushes or tag changes (integrity), and deletions or lockout (availability), enabling supply-chain attacks and lateral movement.

Recommendation

Disable the admin account and require Microsoft Entra-backed RBAC. Assign least-privilege roles to users, service principals, or managed identities. Prefer short-lived credentials, rotate any residual secrets, and apply defense-in-depth with network restrictions and continuous auditing of registry access.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az acr update —name <RegistryName> —resource-group <ResourceGroupName> —admin-enabled false

resource "azurerm_container_registry" "example" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  location            = "<location>"
  sku                 = "<SKU_NAME>"

  admin_enabled = false # Critical: disables ACR admin user to pass the check
}

// Azure Container Registry with admin user disabled
resource acr 'Microsoft.ContainerRegistry/registries@2025-11-01' = {
  name: '<example_resource_name>'
  location: '<location>'
  sku: {
    name: '<SKU_NAME>'
  }
  properties: {
    adminUserEnabled: false // Critical: disables the admin user to pass the check
  }
}

References

https://learn.microsoft.com/en-us/azure/container-registry/container-registry-authentication?tabs=azure-cli#admin-account

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = containerregistry_admin_user_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

Subscription has an Application Insights resource Container Registry public network access is disabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires