Service principle assign to who? ACR or App service?

Question

I have an azure app service that pulls an image from azure ACR and fire up the image to run the application.

I would like the action that the app service pulling the image from ACR by service principle. My question is which resource should I assign the service principal to? The ACR or the web service?

Answer 1

My question is which resource should I assign the service principle to? The ACR or the web service?

The short answer is the ACR. Actually, the correct understanding is that the service principal should have the permission to pull images from ACR, so you need to assign the permission of the ACR to the service principal.

Answer 2

Use a managed identity on the app service to provision a service principal for the App Service on the back end. You can then use RBAC to allow the app service plan identity to access the ACR.

This shows how to do it with a VM but it applies to any azure service that supports MI