ACR SKUs
| SKU | Storage | Geo-replication | Private endpoint | Best For |
|---|---|---|---|---|
| Basic | 10 GB | ❌ | ❌ | Dev/test, learning |
| Standard | 100 GB | ❌ | ❌ | Most production workloads |
| Premium | 500 GB | ✅ | ✅ | Enterprise, multi-region, high throughput |
Creating an ACR
Azure CLICreate Azure Container Registry
# Create ACR (Standard SKU)
az acr create \
--name myregistry2026 \
--resource-group myRG \
--location centralindia \
--sku Standard
# View login server URL
az acr show \
--name myregistry2026 \
--query loginServer \
--output tsv
# Output: myregistry2026.azurecr.ioAuthentication
Three ways to authenticate to ACR:
1. Azure CLI Login (Development)
Azure CLILogin with Azure credentials
az acr login --name myregistry20262. Service Principal (CI/CD Pipelines)
Azure CLICreate service principal for ACR access
# Get ACR ID
ACR_ID=$(az acr show --name myregistry2026 --query id --output tsv)
# Create service principal with pull access
az ad sp create-for-rbac \
--name acr-pull-sp \
--role AcrPull \
--scope $ACR_ID
# Use the appId as username and password as password in CI/CD3. Managed Identity (Azure Services)
Grant AKS, App Service, or Container Instances access to ACR using Managed Identity — no credentials needed:
Azure CLIAttach ACR to AKS cluster
# Grant AKS permission to pull from ACR
az aks update \
--name myAKSCluster \
--resource-group myRG \
--attach-acr myregistry2026Disable Admin Account ACR has an admin account (username/password) that can be used for quick access. Disable it in production — use Service Principals or Managed Identities instead. Admin credentials are static and harder to rotate securely.
Pushing and Pulling Images
Docker + Azure CLIPush and pull from ACR
# Login to ACR
az acr login --name myregistry2026
# Tag image with ACR login server
docker tag myapp:v1 myregistry2026.azurecr.io/myapp:v1
# Push to ACR
docker push myregistry2026.azurecr.io/myapp:v1
# Pull from ACR
docker pull myregistry2026.azurecr.io/myapp:v1
# List repositories in ACR
az acr repository list --name myregistry2026 --output table
# List tags for a repository
az acr repository show-tags \
--name myregistry2026 \
--repository myapp \
--output tableACR Tasks
ACR Tasks automate container image builds and updates in Azure — no local Docker needed:
- Quick task — Build on demand:
az acr build - Triggered task — Build on Git commit or base image update
- Scheduled task — Build on a cron schedule
Azure CLIBuild image using ACR Tasks
# Quick build — sends context to Azure and builds there
az acr build \
--registry myregistry2026 \
--image myapp:v1 .Geo-Replication (Premium)
Premium ACR supports geo-replication — replicate your registry to multiple Azure regions. Benefits:
- Faster image pulls for services in different regions
- Single registry endpoint — Azure routes to nearest replica
- High availability — if one region is down, others serve traffic
Azure CLIAdd geo-replication to ACR
az acr replication create \
--registry myregistry2026 \
--location eastusSecurity
- Private endpoint — Remove public access, connect only via VNet (Premium)
- Firewall rules — Restrict which IPs can access the registry
- Content trust — Sign images to ensure authenticity
- Vulnerability scanning — Microsoft Defender for Containers scans images in ACR
- RBAC roles — AcrPull (pull only), AcrPush (push), AcrDelete, Owner
AZ-204 Exam Tip Know the three SKUs and that geo-replication and private endpoints require Premium. Know the three auth methods — CLI login (dev), Service Principal (CI/CD), Managed Identity (Azure services). Know that AcrPull grants pull-only access and AcrPush grants push access.