In the previous days, we’ve created an app plan and app service, enabled a system-assigned identity on the app, and assigned AcrPull role to the app. The command below now configures the web app to its own identity to access ACR instead of registry admin credentials.
az webapp config set \
--resource-group $RESOURCE_GROUP \
--name $APP_NAME \
--acr-use-identity true \
--acr-identity "[system]"
{
"acrUseManagedIdentityCreds": true,
"acrUserManagedIdentityId": "",
"id": "/subscriptions/<redacted>/resourceGroups/<resource-group>/providers/Microsoft.Web/sites/<app-name>",
"linuxFxVersion": "DOCKER|<registry>.azurecr.io/docprocessor:v1",
"name": "<app-name>",
"resourceGroup": "<resource-group>"
}