Edit

Share via

Conditional Access policy for Azure Container Registry

  • Article

Azure Container Registry (ACR) gives you the option to create and configure the Conditional Access policy. Conditional Access policies, which are typically associated with Azure Active Directory (Azure AD), are used to enforce strong authentication and access controls for various Azure services, including ACR.

The Conditional Access policy applies after the first-factor authentication to the Azure Container Registry is complete. The purpose of Conditional Access for ACR is for user authentication only. The policy enables the user to choose the controls and further blocks or grants access based on the policy decisions.

The Conditional Access policy is designed to enforce strong authentication. The policy enables the security to meet the organizations compliance requirements and keep the data and user accounts safe.

Important

To configure Conditional Access policy for the registry, you must disable authentication-as-arm for all the registries within the desired tenant.

Learn more about Conditional Access policy, the conditions you'll take it into consideration to make policy decisions.

In this tutorial, you learn how to:

  • Create and configure Conditional Access policy for Azure Container Registry.
  • Troubleshoot Conditional Access policy.

Prerequisites

Create and configure a Conditional Access policy - Azure portal

ACR supports Conditional Access policy for Active Directory users only. It currently doesn't support Conditional Access policy for Service Principal. To configure Conditional Access policy for the registry, you must disable authentication-as-arm for all the registries within the desired tenant. In this tutorial, we'll create a basic Conditional Access policy for the Azure Container Registry from the Azure portal.

Create a Conditional Access policy and assign your test group of users as follows:

  1. Sign in to the Azure portal by using an account with Conditional Access Administrator permissions.

  2. Search for and select Microsoft Entra ID. Then select Security from the menu on the left-hand side.

  3. Select Conditional Access, select + New policy, and then select Create new policy.

    A screenshot of the Conditional Access page, where you select 'New policy' and then select 'Create new policy'.

  4. Enter a name for the policy, such as demo.

  5. Under Assignments, select the current value under Users or workload identities.

    A screenshot of the Conditional Access page, where you select the current value under 'Users or workload identities'.

  6. Under What does this policy apply to?, verify and select Users and groups.

  7. Under Include, choose Select users and groups, and then select All users.

    A screenshot of the page for creating a new policy, where you select options to specify users.

  8. Under Exclude, choose Select users and groups, to exclude any choice of selection.

  9. Under Cloud apps or actions, choose Cloud apps.

  10. Under Include, choose Select apps.

    A screenshot of the page for creating a new policy, where you select options to specify cloud apps.

  11. Browse for and select apps to apply Conditional Access, in this case Azure Container Registry, then choose Select.

    A screenshot of the list of apps, with results filtered, and 'Azure Container Registry' selected.

  12. Under Conditions , configure control access level with options such as User risk level, Sign-in risk level, Sign-in risk detections (Preview), Device platforms, Locations, Client apps, Time (Preview), Filter for devices.

  13. Under Grant, filter and choose from options to enforce grant access or block access, during a sign-in event to the Azure portal. In this case grant access with Require multifactor authentication, then choose Select.

    Tip

    To configure and grant multi-factor authentication, see configure and conditions for multi-factor authentication.

  14. Under Session, filter and choose from options to enable any control on session level experience of the cloud apps.

  15. After selecting and confirming, Under Enable policy, select On.

  16. To apply and activate the policy, Select Create.

    A screenshot showing how to activate the Conditional Access policy.

We have now completed creating the Conditional Access policy for the Azure Container Registry.

Troubleshoot Conditional Access policy

Next steps

Azure Policy definitions and effects. Common access concerns that Conditional Access policies can help with. Conditional Access policy components.