> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cybedefend.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure Container Registry

> Scan container images stored in Azure Container Registry.

**Azure Container Registry (ACR)** is Microsoft Azure's managed Docker registry service. CybeDefend integrates with ACR to scan your container images using Service Principal authentication.

## CybeDefend Configuration

| Field                          | Description                                      | Example                                |
| ------------------------------ | ------------------------------------------------ | -------------------------------------- |
| **Login Server**               | Your ACR login server URL                        | `myregistry.azurecr.io`                |
| **Service Principal App ID**   | Application (client) ID of the service principal | `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx` |
| **Service Principal Password** | Service principal password/secret                | `*****`                                |
| **Description**                | Optional description for the registry            | `Production ACR registry`              |

## How to Get Azure Container Registry Credentials

### Option A: Admin User (Quick Setup)

<Steps>
  <Step title="Access Azure Portal">
    Go to Azure Portal → **Container Registries** → Select your registry
  </Step>

  <Step title="Enable Admin User">
    Go to **Settings** → **Access keys** → Enable **Admin user**
  </Step>

  <Step title="Copy Credentials">
    Copy the **username** and **password** provided
  </Step>
</Steps>

### Option B: Service Principal (Recommended)

<Steps>
  <Step title="Create Service Principal">
    Create a Service Principal with the **AcrPull** or **AcrPush** role
  </Step>

  <Step title="Assign Role">
    Assign the Service Principal to your ACR with appropriate permissions
  </Step>

  <Step title="Enter Credentials">
    Enter the Service Principal App ID and password in CybeDefend
  </Step>
</Steps>

<Warning>
  Using Admin User is convenient for testing but Service Principal is recommended for production environments.
</Warning>

## Security Best Practices

<CardGroup cols={2}>
  <Card title="Use Service Principals" icon="microsoft">
    Prefer Service Principals over Admin User for production environments.
  </Card>

  <Card title="AcrPull Role" icon="shield-halved">
    Use the minimal `AcrPull` role for scanning operations only.
  </Card>

  <Card title="Rotate Secrets" icon="rotate">
    Rotate Service Principal secrets regularly to minimize exposure.
  </Card>

  <Card title="Use Managed Identities" icon="fingerprint">
    When running in Azure, prefer Managed Identities for authentication.
  </Card>
</CardGroup>

## Troubleshooting

<AccordionGroup>
  <Accordion title="Authentication Failed" icon="circle-exclamation">
    * Verify Service Principal App ID and password are correct
    * Check if the client secret has expired
    * Ensure the login server URL is correct
  </Accordion>

  <Accordion title="Permission Denied" icon="ban">
    * Verify the Service Principal has `AcrPull` role
    * Check RBAC assignments on the registry
  </Accordion>
</AccordionGroup>