One of the two steps to assigning the AcrPull role to a web app so it can pull an image from an ACR is to get the ACR ID (as the scope), which is done with this command:
az acr show \
--resource-group $RESOURCE_GROUP \
--name $ACR_NAME \
--query id \
--output tsv
/subscriptions/<redacted>/resourceGroups/acr-task-demo/providers/Microsoft.ContainerRegistry/registries/acre357b213