- Once the public network access is disabled, Instances of certain Azure services including Azure DevOps Services are currently unable to access the container registry.
- Private endpoints are not currently supported with Azure DevOps managed agents. You will need to use a self-hosted agent with network line of sight to the private endpoint.
- Access to Azure Container Registry (ACR) can be restricted to the virtual network using Private Endpoints. This will limit ACR exposure to public internet. Since private ACR is available only within the vnet, self-hosted devops agents comes to the rescue.
Configure the agent to access the private ACR: If you're using a self-hosted agent, ensure that the agent has access to the private ACR. You can do this by adding the agent's IP address to the allowed list in the ACR's firewall settings or by configuring the agent to use a private endpoint.