title: How to authenticate with Azure ACR from Azure container app service
body: <p>I'm trying to set up my App Container Service so that it can pull docker images from our ACR using Managed Identity, rather than storing the username and password in the app settings (apart from anything else we want to script these deployments and if the username and password are needed by the app service then we'd have to store them in source control).</p>
  
  <p>Unbelievably, I cannot find any docs on this scenario. The closest I've found is using Managed Identity to pull an ACR image from a <strong>VM</strong> [<a href="https://docs.microsoft.com/en-us/azure/container-registry/container-registry-authentication-managed-identity]" rel="noreferrer">https://docs.microsoft.com/en-us/azure/container-registry/container-registry-authentication-managed-identity]</a> , which I can't use as a guide as the final step (the only bit I'm missing) is to <em>SSH into the VM and run <code>az acr login --name myContainerRegistry</code> at the command line</em>.</p>
  
  <p>Where I've got to:</p>
  
  <ul>
  <li>I've created the ACR and the Container App Service</li>
  <li>I've granted the role <code>ACR Pull</code> and <code>Reader</code> to the system-assigned Identity of the app service</li>
  <li>The app service is getting <em>access denied</em> when trying to pull the container image</li>
  </ul>
  
  <p>I don't know what to do next; like I said, I can't find any guides on this scenario.</p>