Microsoft.ContainerRegistry registries/credentialSets 2026-03-01-preview

Bicep resource definition

The registries/credentialSets resource type can be deployed with operations that target:

For a list of changed properties in each API version, see change log.

Usage Examples

Bicep Samples

A basic example of deploying Container Registry Credential Set.

param location string = 'eastus'
@secure()
@description('The username for the container registry credential')
param credentialUsername string = 'testuser'
@secure()
@description('The password for the container registry credential')
param credentialPassword string
param resourceName string = 'acctest0001'

resource vault 'Microsoft.KeyVault/vaults@2023-02-01' = {
  name: '${resourceName}vault'
  location: location
  properties: {
    accessPolicies: [
      {
        objectId: deployer().objectId
        permissions: {
          certificates: []
          keys: []
          secrets: [
            'Get'
            'Set'
            'Delete'
            'Purge'
          ]
          storage: []
        }
        tenantId: tenant().tenantId
      }
    ]
    createMode: 'default'
    enableRbacAuthorization: false
    enableSoftDelete: true
    enabledForDeployment: false
    enabledForDiskEncryption: false
    enabledForTemplateDeployment: false
    publicNetworkAccess: 'Enabled'
    sku: {
      family: 'A'
      name: 'standard'
    }
    softDeleteRetentionInDays: 7
    tenantId: tenant().tenantId
  }
}

resource registry 'Microsoft.ContainerRegistry/registries@2023-11-01-preview' = {
  name: resourceName
  location: location
  sku: {
    name: 'Basic'
  }
  properties: {
    adminUserEnabled: false
    anonymousPullEnabled: false
    dataEndpointEnabled: false
    networkRuleBypassOptions: 'AzureServices'
    policies: {
      exportPolicy: {
        status: 'enabled'
      }
      quarantinePolicy: {
        status: 'disabled'
      }
      retentionPolicy: {}
      trustPolicy: {}
    }
    publicNetworkAccess: 'Enabled'
    zoneRedundancy: 'Disabled'
  }
}

resource credentialSet 'Microsoft.ContainerRegistry/registries/credentialSets@2023-07-01' = {
  name: '${resourceName}-acr-credential-set'
  parent: registry
  properties: {
    authCredentials: [
      {
        name: 'Credential1'
        passwordSecretIdentifier: 'https://${resourceName}vault.vault.azure.net/secrets/password'
        usernameSecretIdentifier: 'https://${resourceName}vault.vault.azure.net/secrets/username'
      }
    ]
    loginServer: 'docker.io'
  }
}

resource passwordSecret 'Microsoft.KeyVault/vaults/secrets@2023-02-01' = {
  name: 'password'
  parent: vault
  properties: {
    value: credentialPassword
  }
}

resource usernameSecret 'Microsoft.KeyVault/vaults/secrets@2023-02-01' = {
  name: 'username'
  parent: vault
  properties: {
    value: credentialUsername
  }
}

Resource format

To create a Microsoft.ContainerRegistry/registries/credentialSets resource, add the following Bicep to your template.

resource symbolicname 'Microsoft.ContainerRegistry/registries/credentialSets@2026-03-01-preview' = {
  parent: resourceSymbolicName
  identity: {
    type: 'string'
    userAssignedIdentities: {
      {customized property}: {}
    }
  }
  name: 'string'
  properties: {
    authCredentials: [
      {
        name: 'string'
        passwordSecretIdentifier: 'string'
        usernameSecretIdentifier: 'string'
      }
    ]
    loginServer: 'string'
  }
}

Property Values

Microsoft.ContainerRegistry/registries/credentialSets

Name Description Value
identity Identities associated with the resource. This is used to access the KeyVault secrets. IdentityProperties
name The resource name string

Constraints:
Min length = 5
Max length = 50
Pattern = ^[a-zA-Z0-9-]*$ (required)
parent In Bicep, you can specify the parent resource for a child resource. You only need to add this property when the child resource is declared outside of the parent resource.

For more information, see Child resource outside parent resource.		 Symbolic name for resource of type: registries
properties The properties of the credential set. CredentialSetProperties

AuthCredential

Name Description Value
name The name of the credential. 'Credential1'
passwordSecretIdentifier KeyVault Secret URI for accessing the password. string
usernameSecretIdentifier KeyVault Secret URI for accessing the username. string

CredentialSetProperties

Name Description Value
authCredentials List of authentication credentials stored for an upstream.
Usually consists of a primary and an optional secondary credential.		 AuthCredential[]
loginServer The credentials are stored for this upstream or login server. string

IdentityProperties

Name Description Value
type The identity type. 'None'
'SystemAssigned'
'SystemAssigned, UserAssigned'
'UserAssigned'
userAssignedIdentities The list of user identities associated with the resource. The user identity
dictionary key references will be ARM resource ids in the form:
'/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/
providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}'.		 IdentityPropertiesUserAssignedIdentities

IdentityPropertiesUserAssignedIdentities

Name Description Value

UserIdentityProperties

Name Description Value

ARM template resource definition

The registries/credentialSets resource type can be deployed with operations that target:

Usage Examples

Resource format

To create a Microsoft.ContainerRegistry/registries/credentialSets resource, add the following JSON to your template.

{
  "type": "Microsoft.ContainerRegistry/registries/credentialSets",
  "apiVersion": "2026-03-01-preview",
  "name": "string",
  "identity": {
    "type": "string",
    "userAssignedIdentities": {
      "{customized property}": {
      }
    }
  },
  "properties": {
    "authCredentials": [
      {
        "name": "string",
        "passwordSecretIdentifier": "string",
        "usernameSecretIdentifier": "string"
      }
    ],
    "loginServer": "string"
  }
}

Property Values

Microsoft.ContainerRegistry/registries/credentialSets

Name Description Value
apiVersion The api version '2026-03-01-preview'
identity Identities associated with the resource. This is used to access the KeyVault secrets. IdentityProperties
name The resource name string

Constraints:
Min length = 5
Max length = 50
Pattern = ^[a-zA-Z0-9-]*$ (required)
properties The properties of the credential set. CredentialSetProperties
type The resource type 'Microsoft.ContainerRegistry/registries/credentialSets'

AuthCredential

Name Description Value
name The name of the credential. 'Credential1'
passwordSecretIdentifier KeyVault Secret URI for accessing the password. string
usernameSecretIdentifier KeyVault Secret URI for accessing the username. string

CredentialSetProperties

Name Description Value
authCredentials List of authentication credentials stored for an upstream.
Usually consists of a primary and an optional secondary credential.		 AuthCredential[]
loginServer The credentials are stored for this upstream or login server. string

IdentityProperties

Name Description Value
type The identity type. 'None'
'SystemAssigned'
'SystemAssigned, UserAssigned'
'UserAssigned'
userAssignedIdentities The list of user identities associated with the resource. The user identity
dictionary key references will be ARM resource ids in the form:
'/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/
providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}'.		 IdentityPropertiesUserAssignedIdentities

IdentityPropertiesUserAssignedIdentities

Name Description Value

UserIdentityProperties

Name Description Value

Terraform (AzAPI provider) resource definition

The registries/credentialSets resource type can be deployed with operations that target:

  • Resource groups For a list of changed properties in each API version, see change log.

Usage Examples

Terraform Samples

A basic example of deploying Container Registry Credential Set.

terraform {
  required_providers {
    azapi = {
      source = "Azure/azapi"
    }
  }
}

provider "azapi" {
  skip_provider_registration = false
}

data "azapi_client_config" "current" {}

variable "resource_name" {
  type    = string
  default = "acctest0001"
}

variable "location" {
  type    = string
  default = "eastus"
}

variable "credential_username" {
  type        = string
  sensitive   = true
  description = "The username for the container registry credential"
  default     = "testuser"
}

variable "credential_password" {
  type        = string
  sensitive   = true
  description = "The password for the container registry credential"
}

resource "azapi_resource" "resourceGroup" {
  type     = "Microsoft.Resources/resourceGroups@2020-06-01"
  name     = var.resource_name
  location = var.location
}

resource "azapi_resource" "registry" {
  type      = "Microsoft.ContainerRegistry/registries@2023-11-01-preview"
  parent_id = azapi_resource.resourceGroup.id
  name      = var.resource_name
  location  = var.location
  body = {
    properties = {
      adminUserEnabled         = false
      anonymousPullEnabled     = false
      dataEndpointEnabled      = false
      networkRuleBypassOptions = "AzureServices"
      policies = {
        exportPolicy = {
          status = "enabled"
        }
        quarantinePolicy = {
          status = "disabled"
        }
        retentionPolicy = {}
        trustPolicy     = {}
      }
      publicNetworkAccess = "Enabled"
      zoneRedundancy      = "Disabled"
    }
    sku = {
      name = "Basic"
    }
  }
}

resource "azapi_resource" "vault" {
  type      = "Microsoft.KeyVault/vaults@2023-02-01"
  parent_id = azapi_resource.resourceGroup.id
  name      = "${var.resource_name}vault"
  location  = var.location
  body = {
    properties = {
      accessPolicies = [{
        objectId = data.azapi_client_config.current.object_id
        permissions = {
          certificates = []
          keys         = []
          secrets      = ["Get", "Set", "Delete", "Purge"]
          storage      = []
        }
        tenantId = data.azapi_client_config.current.tenant_id
      }]
      createMode                   = "default"
      enableRbacAuthorization      = false
      enableSoftDelete             = true
      enabledForDeployment         = false
      enabledForDiskEncryption     = false
      enabledForTemplateDeployment = false
      publicNetworkAccess          = "Enabled"
      sku = {
        family = "A"
        name   = "standard"
      }
      softDeleteRetentionInDays = 7
      tenantId                  = data.azapi_client_config.current.tenant_id
    }
  }
}

resource "azapi_resource" "usernameSecret" {
  type      = "Microsoft.KeyVault/vaults/secrets@2023-02-01"
  parent_id = azapi_resource.vault.id
  name      = "username"
  body = {
    properties = {
      value = var.credential_username
    }
  }
}

resource "azapi_resource" "passwordSecret" {
  type      = "Microsoft.KeyVault/vaults/secrets@2023-02-01"
  parent_id = azapi_resource.vault.id
  name      = "password"
  body = {
    properties = {
      value = var.credential_password
    }
  }
}

resource "azapi_resource" "credentialSet" {
  type      = "Microsoft.ContainerRegistry/registries/credentialSets@2023-07-01"
  parent_id = azapi_resource.registry.id
  name      = "${var.resource_name}-acr-credential-set"
  identity {
    type         = "SystemAssigned"
    identity_ids = []
  }
  body = {
    properties = {
      authCredentials = [{
        name                     = "Credential1"
        passwordSecretIdentifier = "https://${var.resource_name}vault.vault.azure.net/secrets/password"
        usernameSecretIdentifier = "https://${var.resource_name}vault.vault.azure.net/secrets/username"
      }]
      loginServer = "docker.io"
    }
  }
}

Resource format

To create a Microsoft.ContainerRegistry/registries/credentialSets resource, add the following Terraform to your template.

resource "azapi_resource" "symbolicname" {
  type = "Microsoft.ContainerRegistry/registries/credentialSets@2026-03-01-preview"
  name = "string"
  parent_id = "string"
  identity {
    type = "string"
    identity_ids = [
      "string"
    ]
  }
  body = {
    properties = {
      authCredentials = [
        {
          name = "string"
          passwordSecretIdentifier = "string"
          usernameSecretIdentifier = "string"
        }
      ]
      loginServer = "string"
    }
  }
}

Property Values

Microsoft.ContainerRegistry/registries/credentialSets

Name Description Value
identity Identities associated with the resource. This is used to access the KeyVault secrets. IdentityProperties
name The resource name string

Constraints:
Min length = 5
Max length = 50
Pattern = ^[a-zA-Z0-9-]*$ (required)
parent_id The ID of the resource that is the parent for this resource. ID for resource of type: registries
properties The properties of the credential set. CredentialSetProperties
type The resource type "Microsoft.ContainerRegistry/registries/credentialSets@2026-03-01-preview"

AuthCredential

Name Description Value
name The name of the credential. 'Credential1'
passwordSecretIdentifier KeyVault Secret URI for accessing the password. string
usernameSecretIdentifier KeyVault Secret URI for accessing the username. string

CredentialSetProperties

Name Description Value
authCredentials List of authentication credentials stored for an upstream.
Usually consists of a primary and an optional secondary credential.		 AuthCredential[]
loginServer The credentials are stored for this upstream or login server. string

IdentityProperties

Name Description Value
type The identity type. 'None'
'SystemAssigned'
'SystemAssigned, UserAssigned'
'UserAssigned'
userAssignedIdentities The list of user identities associated with the resource. The user identity
dictionary key references will be ARM resource ids in the form:
'/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/
providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}'.		 IdentityPropertiesUserAssignedIdentities

IdentityPropertiesUserAssignedIdentities

Name Description Value

UserIdentityProperties

Name Description Value
  • Last updated on