Microsoft AzureOverview
ACR admin user provides shared username/password access and should be disabled in favor of Entra ID and RBAC.
Remediation guidance
Azure Remediation
Service-Wide (Recommended)
Apply Azure Policy to deny or audit registries with admin user enabled.
Azure Portal (Asset-Level)
- Open Container Registry.
- Go to Access keys.
- Disable Admin user.
Azure CLI (Asset-Level)
az acr update --name <acr-name> --resource-group <resource-group> --admin-enabled false
References
- https://learn.microsoft.com/en-us/azure/container-registry/container-registry-authentication
Query logic
These are the stored checks tied to this control.
Container registries with admin user enabled
Connectors
Microsoft Azure
Covered asset types
ContainerRegistry
Expected check: eq []
{ containerRegistries(where: { adminUserEnabled: true }) { ...AssetFragment } }
