Enabling app system assigned identity

Since the app service references an image from your ACR, you need a way for your app to authenticate to ACR to pull the image. To start the authentication process, you need to set a managed identity to your app service, which is what the command below is for. The principal ID is the identifier of the new identity.

az webapp identity assign \
    --resource-group $RESOURCE_GROUP \
    --name $APP_NAME
{
  "principalId": "<redacted>",
  "tenantId": "<redacted>",
  "type": "SystemAssigned",
  "userAssignedIdentities": null
}