Repository navigation
"az containerapp job create" does not recognize *.azurecr.us registry domain as one that can use identity instead of username:password for auth #32194
Description
Describe the bug
When invoking the command, if you supply an ACR domain with *azurecr.us, which is used in usgov / GCCH tenants for Azure Container Registry, it requires --registry-username and --registry-password instead of allowing the use of --registry-identitiy for auth with an MSI.
Related command
az containerapp job create
Errors
Usage error: --registry-server, --registry-password and --registry-username are required together if not using Azure Container Registry
Issue script & Debug output
It doesn't pass validation, likely the domain for the usgov regions azurecr.us needs to be added.
File "/usr/lib64/az/lib/python3.12/site-packages/knack/cli.py", line 233, in invoke
cmd_result = self.invocation.execute(args)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/__init__.py", line 654, in execute
self._validation(expanded_arg)
File "/usr/lib64/az/lib/python3.12/site-packages/knack/invocation.py", line 113, in _validation
self._validate_arg_level(parsed_ns)
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/__init__.py", line 925, in _validate_arg_level
validator(**self._build_kwargs(validator, ns))
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/command_modules/containerapp/_validators.py", line 110, in validate_registry_server
raise ValidationError("Usage error: --registry-server, --registry-password and --registry-username are required together if not using Azure Container Registry")
azure.cli.core.azclierror.ValidationError: Usage error: --registry-server, --registry-password and --registry-username are required together if not using Azure Container Registry
Expected behavior
This is targeting an azure container registry, not a docker one. It should accept managed identity for auth.
Environment Summary
From Azure Cloud Shell:
azure-cli 2.76.0 *
core 2.76.0 *
telemetry 1.1.0
Extensions:
ml 2.38.0
ssh 2.0.6
Dependencies:
msal 1.33.0b1
azure-mgmt-resource 23.3.0
Python location '/usr/bin/python3.12'
Config directory '/home/bryce/.azure'
Extensions directory '/home/bryce/.azure/cliextensions'
Extensions system directory '/usr/lib/python3.12/site-packages/azure-cli-extensions'
Additional context
I am fairly certain that using an identity for pulling the image is supported in these tenants, but if I am wrong, and that is not the case then this is expected behavior. Thanks!
Activity
azure-client-tools-bot-prd commentedon Sep 29, 2025
Hi Bryce (@bitdeft),
2.76.0 is not the latest Azure CLI(2.77.0).
If you haven't already attempted to do so, please upgrade to the latest Azure CLI version by following https://learn.microsoft.com/en-us/cli/azure/update-azure-cli.
yonzhan commentedon Sep 29, 2025
Thank you for opening this issue, we will look into it.
microsoft-github-policy-service commentedon Sep 29, 2025
Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc Hong Wang (@howang-ms), Greedygre (@Greedygre).
Greedygre commentedon Oct 16, 2025
Thanks for reporting this issue. We will have a look and fix it.
azclibot commentedon Jun 22, 2026
Routed to Azure/azure-cli-extensions as #10016 (Azure/azure-cli-extensions#10016) because this targets the
containerappextension, whose source lives inAzure/azure-cli-extensions.Posted by agent-assist (autonomous bug-fix pipeline).