A partner CI pipeline for the harbor lock-gate images must push only to repositories under lockgate/* and must not list every registry repository. Which access approach meets least privilege for Azure Container Registry?
Select an answer to reveal the explanation.
Short Explanation
Think of the harbor catalog as many docks—the partner only needs the lockgate slip, not the master key to every berth. Scope the token or ABAC to lockgate/* and leave the registry admin password in the drawer.
Full Explanation
Azure Container Registry supports least-privilege push and pull through repository-scoped tokens and Microsoft Entra attribute-based access control on repositories. That lets a pipeline write only under a prefix such as lockgate/* without listing or mutating unrelated repositories. Registry admin credentials and broad Owner or AcrPush at the whole registry expand blast radius. Content trust addresses image signing, not repository inventory scope.