Which identity should a Container App use to pull from a private ACR?

1. A The ACR admin account stored as a secret
2. ✓ B A user-assigned or system-assigned managed identity granted AcrPull (correct answer)
3. C A repository-scoped token in the container image
4. D The Container Apps environment identity only

Shortcut: Container Apps supports managed identity for registry authentication. Assign the identity AcrPull on the registry and reference it in the app's registry configuration, avoiding stored credentials.