identity-based registry authorization avoids embedding broadly reusable credentials. In this case, a container deployment fails because it cannot pull a private registry image. “Managed identity with scoped registry access where supported” would not satisfy that requirement; the supported action is “Registry pull authorization for the deployment identity”. Private image downloads require the runtime principal to have pull permission.

image pushes address the registry endpoint and repository path for the artifact. In this case, a container deployment fails because it cannot pull a private registry image. “The intended Azure Container Registry login server and repository” would not satisfy that requirement; the supported action is “Registry pull authorization for the deployment identity”. Private image downloads require the runtime principal to have pull permission.

aCR stores and distributes container images under Azure identity and network controls. In this case, a container deployment fails because it cannot pull a private registry image. “Azure Container Registry (ACR)” would not satisfy that requirement; the supported action is “Registry pull authorization for the deployment identity”. Private image downloads require the runtime principal to have pull permission.

aCR stores and distributes container images under Azure identity and network controls. In this case, a team must prevent registry access from arbitrary networks. “Azure Container Registry (ACR)” would not satisfy that requirement; the supported action is “ACR firewall, private endpoint and approved network configuration”. Container Registry network controls can restrict access independently of credentials.

identity-based registry authorization avoids embedding broadly reusable credentials. In this case, a team must prevent registry access from arbitrary networks. “Managed identity with scoped registry access where supported” would not satisfy that requirement; the supported action is “ACR firewall, private endpoint and approved network configuration”. Container Registry network controls can restrict access independently of credentials.

image pushes address the registry endpoint and repository path for the artifact. In this case, a team must prevent registry access from arbitrary networks. “The intended Azure Container Registry login server and repository” would not satisfy that requirement; the supported action is “ACR firewall, private endpoint and approved network configuration”. Container Registry network controls can restrict access independently of credentials.

private image downloads require the runtime principal to have pull permission. In this case, an application uses a shared registry password in deployment scripts. “Registry pull authorization for the deployment identity” would not satisfy that requirement; the supported action is “Managed identity with scoped registry access where supported”. Identity-based registry authorization avoids embedding broadly reusable credentials.

image pushes address the registry endpoint and repository path for the artifact. In this case, an application uses a shared registry password in deployment scripts. “The intended Azure Container Registry login server and repository” would not satisfy that requirement; the supported action is “Managed identity with scoped registry access where supported”. Identity-based registry authorization avoids embedding broadly reusable credentials.

push permissions authorize artifact upload without needing broad registry management privileges. In this case, an application uses a shared registry password in deployment scripts. “The appropriate registry/repository push permission under its RBAC mode” would not satisfy that requirement; the supported action is “Managed identity with scoped registry access where supported”. Identity-based registry authorization avoids embedding broadly reusable credentials.

container deployments resolve tags and digests; an incorrect reference can keep running older content. In this case, a repository contains images with mutable tags that confuse reproducibility. “The image repository, tag-to-digest mapping and deployment reference” would not satisfy that requirement; the supported action is “A verified image digest for immutable artifact selection”. Digest references select exact image content instead of a potentially retargeted tag.

aCR stores and distributes container images under Azure identity and network controls. In this case, a repository contains images with mutable tags that confuse reproducibility. “Azure Container Registry (ACR)” would not satisfy that requirement; the supported action is “A verified image digest for immutable artifact selection”. Digest references select exact image content instead of a potentially retargeted tag.

private image downloads require the runtime principal to have pull permission. In this case, a repository contains images with mutable tags that confuse reproducibility. “Registry pull authorization for the deployment identity” would not satisfy that requirement; the supported action is “A verified image digest for immutable artifact selection”. Digest references select exact image content instead of a potentially retargeted tag.

aCR stores and distributes container images under Azure identity and network controls. In this case, an administrator needs a CLI destination for signing in and publishing an image to a registry. “Azure Container Registry (ACR)” would not satisfy that requirement; the supported action is “The intended Azure Container Registry login server and repository”. Image pushes address the registry endpoint and repository path for the artifact.

private image downloads require the runtime principal to have pull permission. In this case, an administrator needs a CLI destination for signing in and publishing an image to a registry. “Registry pull authorization for the deployment identity” would not satisfy that requirement; the supported action is “The intended Azure Container Registry login server and repository”. Image pushes address the registry endpoint and repository path for the artifact.

push permissions authorize artifact upload without needing broad registry management privileges. In this case, an administrator needs a CLI destination for signing in and publishing an image to a registry. “The appropriate registry/repository push permission under its RBAC mode” would not satisfy that requirement; the supported action is “The intended Azure Container Registry login server and repository”. Image pushes address the registry endpoint and repository path for the artifact.

removing a completed group cleans up the managed instance and its allocated resource definition. In this case, a short-lived troubleshooting command must run a container without managing Kubernetes nodes. “The completed ACI container group” would not satisfy that requirement; the supported action is “Azure Container Instances (ACI)”. ACI runs standalone container groups without maintaining an orchestration cluster.

runtime diagnostics reveal startup failures, image issues and container exit codes. In this case, a short-lived troubleshooting command must run a container without managing Kubernetes nodes. “ACI container state, events and logs” would not satisfy that requirement; the supported action is “Azure Container Instances (ACI)”. ACI runs standalone container groups without maintaining an orchestration cluster.

aCI provides direct container execution with environment variable and image settings. In this case, a short-lived troubleshooting command must run a container without managing Kubernetes nodes. “An Azure Container Instance with the required environment configuration” would not satisfy that requirement; the supported action is “Azure Container Instances (ACI)”. ACI runs standalone container groups without maintaining an orchestration cluster.

removing a completed group cleans up the managed instance and its allocated resource definition. In this case, a job needs two closely coupled containers sharing a lifecycle and network namespace. “The completed ACI container group” would not satisfy that requirement; the supported action is “A multi-container container group”. Containers in one ACI group share the group lifecycle and associated network environment.

aCI compute resources are allocated by group/container requests, not an App Service plan. In this case, a job needs two closely coupled containers sharing a lifecycle and network namespace. “The container group's requested CPU and memory resources” would not satisfy that requirement; the supported action is “A multi-container container group”. Containers in one ACI group share the group lifecycle and associated network environment.

aCI runs standalone container groups without maintaining an orchestration cluster. In this case, a job needs two closely coupled containers sharing a lifecycle and network namespace. “Azure Container Instances (ACI)” would not satisfy that requirement; the supported action is “A multi-container container group”. Containers in one ACI group share the group lifecycle and associated network environment.

aCI runs standalone container groups without maintaining an orchestration cluster. In this case, a container task must run once and stop rather than serve HTTP traffic continuously. “Azure Container Instances (ACI)” would not satisfy that requirement; the supported action is “An OnFailure or Never restart policy chosen for the job”. ACI restart behavior can represent job execution rather than an always-on service.

a container group's network placement determines private reachability and exposure. In this case, a container task must run once and stop rather than serve HTTP traffic continuously. “Supported virtual network deployment and private connectivity” would not satisfy that requirement; the supported action is “An OnFailure or Never restart policy chosen for the job”. ACI restart behavior can represent job execution rather than an always-on service.

aCI compute resources are allocated by group/container requests, not an App Service plan. In this case, a container task must run once and stop rather than serve HTTP traffic continuously. “The container group's requested CPU and memory resources” would not satisfy that requirement; the supported action is “An OnFailure or Never restart policy chosen for the job”. ACI restart behavior can represent job execution rather than an always-on service.

aCI runs standalone container groups without maintaining an orchestration cluster. In this case, a private container must access internal Azure resources without public exposure. “Azure Container Instances (ACI)” would not satisfy that requirement; the supported action is “Supported virtual network deployment and private connectivity”. A container group's network placement determines private reachability and exposure.

aCI restart behavior can represent job execution rather than an always-on service. In this case, a private container must access internal Azure resources without public exposure. “An OnFailure or Never restart policy chosen for the job” would not satisfy that requirement; the supported action is “Supported virtual network deployment and private connectivity”. A container group's network placement determines private reachability and exposure.

containers in one ACI group share the group lifecycle and associated network environment. In this case, a private container must access internal Azure resources without public exposure. “A multi-container container group” would not satisfy that requirement; the supported action is “Supported virtual network deployment and private connectivity”. A container group's network placement determines private reachability and exposure.

containers in one ACI group share the group lifecycle and associated network environment. In this case, an ACI workload is running out of memory. “A multi-container container group” would not satisfy that requirement; the supported action is “The container group's requested CPU and memory resources”. ACI compute resources are allocated by group/container requests, not an App Service plan.

removing a completed group cleans up the managed instance and its allocated resource definition. In this case, an ACI workload is running out of memory. “The completed ACI container group” would not satisfy that requirement; the supported action is “The container group's requested CPU and memory resources”. ACI compute resources are allocated by group/container requests, not an App Service plan.

aCI provides direct container execution with environment variable and image settings. In this case, an ACI workload is running out of memory. “An Azure Container Instance with the required environment configuration” would not satisfy that requirement; the supported action is “The container group's requested CPU and memory resources”. ACI compute resources are allocated by group/container requests, not an App Service plan.

aCI runs standalone container groups without maintaining an orchestration cluster. In this case, a one-off data conversion must be launched from a known image with environment variables. “Azure Container Instances (ACI)” would not satisfy that requirement; the supported action is “An Azure Container Instance with the required environment configuration”. ACI provides direct container execution with environment variable and image settings.

containers in one ACI group share the group lifecycle and associated network environment. In this case, a one-off data conversion must be launched from a known image with environment variables. “A multi-container container group” would not satisfy that requirement; the supported action is “An Azure Container Instance with the required environment configuration”. ACI provides direct container execution with environment variable and image settings.

runtime diagnostics reveal startup failures, image issues and container exit codes. In this case, a one-off data conversion must be launched from a known image with environment variables. “ACI container state, events and logs” would not satisfy that requirement; the supported action is “An Azure Container Instance with the required environment configuration”. ACI provides direct container execution with environment variable and image settings.