I am using terraform to setup the Azure container registry webhook like this with basic auth disabled:

resource "azurerm_container_registry_webhook" "cr_webhook_myapp" {
  name                = "myappnamewebhook"
  resource_group_name = data.azurerm_container_registry.cr_mycontainerregistry.resource_group_name
  registry_name       = data.azurerm_container_registry.cr_mycontainerregistry.name
  location            = data.azurerm_container_registry.cr_mycontainerregistry.location

  # disabled registry webhooks using basic auth with app service kudu
  # service_uri = "https://$kudu_username:[email protected]/api/registry/webhook"
  service_uri = "https://${azurerm_linux_web_app.webapp_myapp.name}.scm.azurewebsites.net/api/registry/webhook"

  status      = "enabled"
  scope       = "myapp:latest"
  actions     = ["push"]
  custom_headers = {
  }
  tags = {
    source = "terraform"
  }
}

But the webhook push event fails by returning with a 401 code, trying to connect to the ‘myapp’ AppService endpoint.

Ideally, I’d like to use a system-managed identity to authenticate the container registry to the app service, or some EntraID application.

Using basic auth on Kudu like this

service_uri = "https://$kudu_username:[email protected]/api/registry/webhook"

works fine however.

Also, once the push event is received by the app service, the pull works fine with the system-managed identity enabled and an ‘AcrPull‘Azure Role defined on the AppService (linux).