Container Registry public network access is disabled

Check ID: containerregistry_not_publicly_accessible
Provider: Azure
Service: containerregistry
Severity: HIGH
Categories: internet-exposed
Resource type: microsoft.containerregistry/registries

What this check verifies

Azure Container Registry configuration indicates whether the registry permits unrestricted public access based on the Public network access setting.

Risk

Internet-exposed ACR expands attack paths impacting CIA:

Confidentiality: unauthorized image pulls leak code/secrets
Integrity: compromised creds allow tampered image pushes (supply-chain)
Availability: pull storms or scans exhaust quotas, causing outages and cost spikes

Recommendation

Set Public network access to Disabled and use Private Link for registry access. If public reachability is required, allow only selected IPs, enforce least privilege and token rotation, and apply defense in depth (egress control, network segmentation, logging of push/pull events).

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az acr update —name <registry-name> —public-network-enabled false

resource "azurerm_container_registry" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  location            = "<location>"
  sku                 = "Basic"

  public_network_access_enabled = false # Critical: disables public endpoint to block unrestricted access
}

// Azure Container Registry with public network access disabled
resource <example_resource_name> 'Microsoft.ContainerRegistry/registries@2025-11-01' = {
  name: '<example_resource_name>'
  location: '<location>'
  sku: {
    name: 'Basic'
  }
  properties: {
    publicNetworkAccess: 'Disabled' // Critical: disables the public endpoint to prevent unrestricted access
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = containerregistry_not_publicly_accessible. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

Container Registry admin user is disabled Container Registry uses a private endpoint (Private Link)

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires