A partner CI pipeline for the harbor lock-gate images must push only to repositories under lockgate/* and must not list every registry repository. Which access approach meets least privilege for Azure Container Registry?
Select an answer to reveal the explanation.
Short Explanation
Think of the harbor catalog as many docks—the partner only needs the lockgate slip, not the master key to every berth. Scope the token or ABAC to lockgate/* and leave the registry admin password in the drawer.
Full Explanation
For the partner CI pipeline that must push harbor lock-gate images only under lockgate/, Azure Container Registry least privilege means a repository-scoped token or Microsoft Entra attribute-based access control limited to that repository prefix—not a registry-wide credential. Scoped tokens and Entra ABAC repository permissions can allow push (and related actions you explicitly grant) under lockgate/ while preventing the pipeline from listing or mutating unrelated municipal image repositories. That is the control that matches a partner slip on one berth rather than a master key to every dock in the harbor catalog.
Sharing the registry admin username and password with the pipeline service connection fails by concept because admin credentials authorize broad registry operations and typically expose far more than a single prefix, including the ability to reach every repository. Assigning AcrPull at the subscription and relying on content trust alone fails because AcrPull is pull-oriented and content trust addresses image signing integrity, not repository inventory scope or push confinement to lockgate/*. Granting the pipeline Owner on the ACR resource group and disabling repository permissions fails because Owner is a management-plane blast-radius expansion that contradicts least privilege and removes the very repository scoping the scenario requires.
Exam caveat: distinguish registry admin credentials and coarse registry or subscription roles from repository-scoped tokens and Entra ABAC on repositories—signing/content trust is not a substitute for push-scope confinement. Operational check: issue a lockgate/-scoped token or ABAC assignment to the pipeline identity, attempt a push under lockgate/, confirm a push or list against an out-of-scope repository is denied, and document the partner scope in the municipal change record so night-shift operators know which berths the CI connection may touch.