Back to Checks
azure

Container Registry admin user is disabled

containerregistry_admin_user_disabled
Service: containerregistrySeverity: high
OfficialBuilt-inVerified
Categories:identity-accesssecrets
Resource Type:microsoft.containerregistry/registries

Azure Container Registry admin account configuration, confirming the built-in admin user is disabled so access relies on Microsoft Entra-based RBAC identities and scoped roles.

Prowler logoProwlerprowler-provider-azure

Risk

Using a shared, always-valid admin credential grants full push/pull and lacks attribution. Compromise enables unauthorized image pulls (confidentiality), malicious pushes or tag changes (integrity), and deletions or lockout (availability), enabling supply-chain attacks and lateral movement.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks containerregistry_admin_user_disabled

Recommendation

Disable the admin account and require Microsoft Entra-backed RBAC. Assign least-privilege roles to users, service principals, or managed identities. Prefer short-lived credentials, rotate any residual secrets, and apply defense-in-depth with network restrictions and continuous auditing of registry access.

Remediation

CLI

az acr update --name <RegistryName> --resource-group <ResourceGroupName> --admin-enabled false

Terraform

resource "azurerm_container_registry" "example" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  location            = "<location>"
  sku                 = "<SKU_NAME>"

  admin_enabled = false # Critical: disables ACR admin user to pass the check
}

NativeIaC

// Azure Container Registry with admin user disabled
resource acr 'Microsoft.ContainerRegistry/registries@2025-11-01' = {
  name: '<example_resource_name>'
  location: '<location>'
  sku: {
    name: '<SKU_NAME>'
  }
  properties: {
    adminUserEnabled: false // Critical: disables the admin user to pass the check
  }
}

Other

1In Azure Portal, go to Container registries and select your registry
2Under Settings, open Access keys
3Set Admin user to Disabled
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.containerregistry.containerregistry_client import (
    containerregistry_client,
)


class containerregistry_admin_user_disabled(Check):
    def execute(self) -> list[Check_Report_Azure]:
        findings = []

        for subscription, registries in containerregistry_client.registries.items():
            subscription_name = containerregistry_client.subscriptions.get(
                subscription, subscription
            )
            for container_registry_info in registries.values():
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=container_registry_info
                )
                report.subscription = subscription
                report.status = "FAIL"
                report.status_extended = f"Container Registry {container_registry_info.name} from subscription {subscription_name} ({subscription}) has its admin user enabled."

                if not container_registry_info.admin_user_enabled:
                    report.status = "PASS"
                    report.status_extended = f"Container Registry {container_registry_info.name} from subscription {subscription_name} ({subscription}) has its admin user disabled."

                findings.append(report)

        return findings

References