Changes to az commands to support managed identity in Connected Registry [DRAFT] by dhawal777 · Pull Request #33910 · Azure/azure-cli

Dhawal Jain (dhawal777) · 2026-08-17T19:05:49Z

Related command

Description

Testing Guide

History Notes

[Component Name 1] BREAKING CHANGE: az command a: Make some customer-facing breaking change
[Component Name 2] az command b: Add some customer-facing feature

This checklist is used to make sure that common guidelines for a pull request are followed.

The PR title and description has followed the guideline in Submitting Pull Requests.
I adhere to the Command Guidelines.
I adhere to the Error Handling Guidelines.

Add user-assigned managed identity as an authentication mode between a connected registry and its parent, alongside existing sync-token auth. New / changed CLI surface ------------------------- * `az acr connected-registry create` * `--auth-type {SyncToken, ManagedIdentity}` (default: `SyncToken`). * `--identity <user-assigned identity resource id>` (required when `--auth-type ManagedIdentity`). * `--sync-token` and `--repository` are rejected in `ManagedIdentity` mode. * `az acr connected-registry update` * Supports migrating an existing connected registry between `SyncToken` and `ManagedIdentity` auth modes. * Registry must be in `Offline` state; same-mode credential rotation is not supported. * Migration MI -> SyncToken deliberately omits `identity` from the PATCH payload to avoid ARM `ConflictingAuthInput`. * `az acr connected-registry get-settings` * When the target is `ManagedIdentity`-mode, emits a MI-flavored connection string with `ACR_MANAGED_IDENTITY_CLIENT_ID` and `ACR_MANAGED_IDENTITY_RESOURCE_ID` and skips sync-token password generation. * `az acr connected-registry permissions {show, update}` * Reject with a clear error against `ManagedIdentity`-mode registries (sync-token scope map is not applicable in that mode). Implementation notes -------------------- * Direct imports of `AuthType`, `ConnectionState`, `ManagedServiceIdentity`, `ManagedServiceIdentityType`, `UserAssignedIdentity` etc. from the flat `azure.mgmt.containerregistry.models` namespace; SDK enums are coerced via `.value` because they are not `StrEnum`. * `_get_current_auth_type` is defensive against both raw-string and enum server responses (bug guard). * Delete skips sync-token / scope-map cleanup for MI-mode registries (bug guard). Tests ----- * Unit tests: `test_acr_connected_registry_mi_unit.py` (31 tests) cover create/update validation, migration state machine (both directions, including MI -> SyncToken identity-omission regression guard), delete MI-mode cleanup guard, `get-settings` MI branch, and permissions MI-mode rejection. * Scenario test: `test_acr_connectedregistry_managed_identity` added (currently `@record_only()`; cassette pending because the SDK preview API is not yet available on the public control plane). Dependencies ------------ * Bump `azure-mgmt-containerregistry` to `15.1.0b3` for the preview api-version that exposes the connected-registry MI contract.

…ntity

azure-client-tools-bot-prd · 2026-08-17T19:05:54Z

Hi Dhawal Jain (@dhawal777),
Since the current milestone time is less than 7 days, this pr may not catch up with this release.

azure-pipelines · 2026-08-17T19:05:58Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

Copilot

Pull request overview

This PR updates the ACR connected-registry command set to support Managed Identity (user-assigned) authentication in addition to the existing SyncToken flow, including migration between the two modes.

Changes:

Adds --auth-type (SyncToken | ManagedIdentity) and --identity to az acr connected-registry create/update, plus migration validation logic.
Updates get-settings output and blocks permissions operations for ManagedIdentity-mode registries.
Bumps azure-mgmt-containerregistry to 15.1.0b3 and adds scenario + unit test coverage for MI paths.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/azure-cli/setup.py	Bumps `azure-mgmt-containerregistry` dependency to `15.1.0b3`.
src/azure-cli/HISTORY.rst	Adds upcoming release notes for MI support and SDK bump.
src/azure-cli/azure/cli/command_modules/acr/connected_registry.py	Implements MI auth support, migration validation, MI-aware delete/get-settings/permissions behavior.
src/azure-cli/azure/cli/command_modules/acr/_params.py	Introduces CLI parameters `--auth-type`, `--identity`, and update-only `--sync-token` for migration.
src/azure-cli/azure/cli/command_modules/acr/_help.py	Documents MI create and migration examples; updates permissions group description.
src/azure-cli/azure/cli/command_modules/acr/tests/latest/test_acr_connectedregistry_commands.py	Adds a recorded scenario test covering MI create/show/get-settings/delete.
src/azure-cli/azure/cli/command_modules/acr/tests/latest/test_acr_connected_registry_mi_unit.py	Adds unit tests for MI mode validation, PATCH shape, MI-mode delete behavior, and MI get-settings output.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Aditya Pujara (a0x1ab) · 2026-08-17T19:11:46Z

/azp run

azure-pipelines · 2026-08-17T19:12:06Z

Azure Pipelines: Successfully started running 3 pipeline(s).

Aditya Pujara (a0x1ab) · 2026-08-18T03:00:40Z

/azp run

azure-pipelines · 2026-08-18T03:00:57Z

Azure Pipelines: Successfully started running 3 pipeline(s).

x-engineering-agent · 2026-08-19T05:05:24Z

Live test results — `azdev test --live --series` (changed test files only)

⚠️ NO TESTS SELECTED — changed test files did not resolve to runnable tests

Selectors: test_acr_connected_registry_mi_unit test_acr_connectedregistry_commands (module)
PR head ref: dhja_acr-connected-registry-managed-identity
PR head sha: aa111523db33a8c37c7a9b10a9b22ad6ed30015a
PR base ref: dev
New test files in PR: true

Changed test files run

src/azure-cli/azure/cli/command_modules/acr/tests/latest/test_acr_connected_registry_mi_unit.py
src/azure-cli/azure/cli/command_modules/acr/tests/latest/test_acr_connectedregistry_commands.py

New test files

src/azure-cli/azure/cli/command_modules/acr/tests/latest/test_acr_connected_registry_mi_unit.py

Workflow run: https://github.com/Azure/issue-sentinel/actions/runs/32217890823

Last 80 lines of azdev output


=============
| Run Tests |
=============


=====================
| Discovering Tests |
=====================

/home/runner/work/issue-sentinel/issue-sentinel/azure-cli/src/azure-cli/azure/cli/command_modules/vm/tests/latest/test_vm_commands.py:13640: SyntaxWarning: invalid escape sequence '\]'
  self.cmd('vmss application set -g {rg} -n {vmss} --app-version-ids {vid1} {vid2} --enable-automatic-upgrade True\]', checks=[
ERROR: 'NoneType' object has no attribute '__dict__'
Traceback (most recent call last):
  File "/home/runner/work/issue-sentinel/issue-sentinel/.venv/lib/python3.12/site-packages/knack/cli.py", line 233, in invoke
    cmd_result = self.invocation.execute(args)
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/runner/work/issue-sentinel/issue-sentinel/.venv/lib/python3.12/site-packages/knack/invocation.py", line 224, in execute
    cmd_result = parsed_args.func(params)
                 ^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/runner/work/issue-sentinel/issue-sentinel/.venv/lib/python3.12/site-packages/knack/commands.py", line 149, in __call__
    return self.handler(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/runner/work/issue-sentinel/issue-sentinel/.venv/lib/python3.12/site-packages/knack/commands.py", line 256, in _command_handler
    result = op(client, **command_args) if client else op(**command_args)
                                                       ^^^^^^^^^^^^^^^^^^
  File "/home/runner/work/issue-sentinel/issue-sentinel/.venv/lib/python3.12/site-packages/azdev/operations/testtool/__init__.py", line 58, in run_tests
    test_index = _get_test_index(profile or current_profile(), discover, target_tests=target_tests)
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/runner/work/issue-sentinel/issue-sentinel/.venv/lib/python3.12/site-packages/azdev/operations/testtool/__init__.py", line 327, in _get_test_index
    test_index = _discover_tests(profile, target_tests)
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/runner/work/issue-sentinel/issue-sentinel/.venv/lib/python3.12/site-packages/azdev/operations/testtool/__init__.py", line 243, in _discover_tests
    tests = _discover_module_tests(mod_name, mod_data)
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/runner/work/issue-sentinel/issue-sentinel/.venv/lib/python3.12/site-packages/azdev/operations/testtool/__init__.py", line 177, in _discover_module_tests
    module = import_module(test_file_path)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/hostedtoolcache/Python/3.12.13/x64/lib/python3.12/importlib/__init__.py", line 90, in import_module
    return _bootstrap._gcd_import(name[level:], package, level)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "<frozen importlib._bootstrap>", line 1387, in _gcd_import
  File "<frozen importlib._bootstrap>", line 1360, in _find_and_load
  File "<frozen importlib._bootstrap>", line 1331, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 935, in _load_unlocked
  File "<frozen importlib._bootstrap_external>", line 999, in exec_module
  File "<frozen importlib._bootstrap>", line 488, in _call_with_frames_removed
  File "/home/runner/work/issue-sentinel/issue-sentinel/azure-cli/src/azure-cli/azure/cli/command_modules/vm/tests/latest/test_custom_vm_commands.py", line 33, in <module>
    CachingTypes = get_sdk(DummyCli(), ResourceType.MGMT_COMPUTE, 'NetworkProfile', 'StorageProfile', 'DataDisk', 'OSDisk',
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/runner/work/issue-sentinel/issue-sentinel/azure-cli/src/azure-cli-core/azure/cli/core/profiles/__init__.py", line 91, in get_sdk
    return _sdk_get_versioned_sdk(cli_ctx.cloud.profile, resource_type, *attr_args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/runner/work/issue-sentinel/issue-sentinel/azure-cli/src/azure-cli-core/azure/cli/core/profiles/_shared.py", line 474, in get_versioned_sdk
    sdk_path = get_versioned_sdk_path(api_profile, resource_type, operation_group)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/runner/work/issue-sentinel/issue-sentinel/azure-cli/src/azure-cli-core/azure/cli/core/profiles/_shared.py", line 466, in get_versioned_sdk_path
    api_version = getattr(api_version, operation_group)
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/runner/work/issue-sentinel/issue-sentinel/azure-cli/src/azure-cli-core/azure/cli/core/profiles/_shared.py", line 261, in __getattr__
    self._resolve()
  File "/home/runner/work/issue-sentinel/issue-sentinel/azure-cli/src/azure-cli-core/azure/cli/core/profiles/_shared.py", line 248, in _resolve
    for operation_group_name, operation_type in self._client_type.__dict__.items():
                                                ^^^^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: 'NoneType' object has no attribute '__dict__'. Did you mean: '__dir__'?

Posted by agent-assist live-test workflow.

x-engineering-agent

The following CI checks are failing:

azdev-linter
azdev-style
Azure.azure-cli
Azure.azure-cli (Integration Test against Profiles Python314)
Azure.azure-cli (Integration Test against Profiles Python312)
Azure.azure-cli (Test Python Wheels Python314)
Azure.azure-cli (Test Python Wheels Python312)
Azure.azure-cli (Test Extensions Loading Python314)
Azure.azure-cli (Build Windows MSI x86)
Azure.azure-cli (Build Windows MSI x64)
Azure.azure-cli (Build Windows ZIP x64)
Azure.azure-cli Full Test
Azure.azure-cli Full Test (Automation Full Test Python314 Profile Latest instance7)
Azure.azure-cli Full Test (Automation Full Test Python314 Profile Latest instance8)
Azure.azure-cli Full Test (Automation Full Test Python314 Profile Latest instance2)
Azure.azure-cli Full Test (Automation Full Test Python314 Profile Latest instance5)
Azure.azure-cli Full Test (Automation Full Test Python314 Profile Latest instance6)
Azure.azure-cli Full Test (Automation Full Test Python314 Profile Latest instance1)
Azure.azure-cli Full Test (Automation Full Test Python314 Profile Latest instance4)
Azure.azure-cli Full Test (Automation Full Test Python312 Profile Latest instance7)
Azure.azure-cli Full Test (Automation Full Test Python314 Profile Latest instance3)
Azure.azure-cli Full Test (Automation Full Test Python312 Profile Latest instance6)
Azure.azure-cli Breaking Change Test
Azure.azure-cli (PerformanceCheck Python312)
Azure.azure-cli (Secret Scan)
Azure.azure-cli Full Test (Automation Full Test Python312 Profile Latest instance1)
Azure.azure-cli Full Test (Automation Full Test Python312 Profile Latest instance2)
Azure.azure-cli Full Test (Automation Full Test Python312 Profile Latest instance5)
Azure.azure-cli Full Test (Automation Full Test Python312 Profile Latest instance8)
Azure.azure-cli Full Test (Automation Full Test Python312 Profile Latest instance3)
Azure.azure-cli (Unit Test for Telemetry Python312)
Azure.azure-cli (Unit Test for Telemetry Python314)
Azure.azure-cli Full Test (Automation Full Test Python312 Profile Latest instance4)
Azure.azure-cli (Check License, History, and DocMap)
Azure.azure-cli (Check the Format of Pull Request Title and Content)
Azure.azure-cli (PerformanceCheck Python314)
Azure.azure-cli (Verify latest index assets)
Azure.azure-cli (Unit Test for Core Python312)
Azure.azure-cli (Check CLI Linter)
Azure.azure-cli (Verify src/azure-cli/requirements.*.Linux.txt)
Azure.azure-cli (Unit Test for Core Python314)
Azure.azure-cli (Check CLI Style)
Azure.azure-cli (Verify src/azure-cli/requirements.*.Windows.txt)
Azure.azure-cli (Verify src/azure-cli/requirements.*.Darwin.txt)
azdev-style
azdev-linter
Live test run failed (see the dispatched live-test.yml workflow run for details).

Zoey Li (lizMSFT) · 2026-08-24T01:03:37Z

    'azure-mgmt-compute~=34.1.0',
    'azure-mgmt-containerinstance==10.2.0b1',
-    'azure-mgmt-containerregistry==15.1.0b2',
+    'azure-mgmt-containerregistry==15.1.0b3',


Also need to update the files below once the SDK is ready:
src/azure-cli/requirements.py3.Linux.txt
src/azure-cli/requirements.py3.Linux.txt
src/azure-cli/requirements.py3.Darwin.txt

Aditya Pujara (a0x1ab) · 2026-08-27T17:37:40Z

/azp run

azure-pipelines · 2026-08-27T17:37:59Z

Azure Pipelines: Successfully started running 3 pipeline(s).

…SyncToken -> ManagedIdentity

Aditya Pujara (a0x1ab) · 2026-08-27T20:04:08Z

/azp run

azure-pipelines · 2026-08-27T20:04:28Z

Azure Pipelines: Successfully started running 3 pipeline(s).

Zoey Li (lizMSFT) · 2026-08-31T03:42:37Z

Could we also update the summaries for az acr connected-registry permissions show and az acr connected-registry permissions update to clarify that these commands support only connected registries using SyncToken authentication? The help text defined for the permissions group does not appear in the help output for the individual subcommands.

- Simplify _get_current_auth_type to use authType as the sole source of truth (drop identity-based inference and try/except guard; matches pre-existing direct-access style). - get-settings (MI mode): emit only the spec-required connection string; drop the extra ACR_MANAGED_IDENTITY_CLIENT_ID / ACR_MANAGED_IDENTITY_RESOURCE_ID env vars. - Coerce connection_state via .value before comparing to CONNECTION_STATE_OFFLINE (defensive against future SDK regen; symmetry with auth_type). - Help/params/constants tidy-ups: typo fixes (midnight, its, immediate), MI parameter help, SyncToken caveats on permissions show/update. - Tests: update _fake_cr helper so has_identity=True implies MI auth_type; rework TestGetCurrentAuthType; add plain-Enum coercion regression guard for connection_state; tighten MI get-settings assertions.

Aditya Pujara (a0x1ab) · 2026-09-03T15:17:58Z

/azp run

azure-pipelines · 2026-09-03T15:18:19Z

Azure Pipelines: Successfully started running 3 pipeline(s).

Dhawal Jain and others added 2 commits August 13, 2026 17:04

Merge branch 'Azure:dev' into dhja_acr-connected-registry-managed-ide…

d093fdc

…ntity

Copilot AI lite review requested due to automatic review settings August 17, 2026 19:05

Dhawal Jain (dhawal777) requested review from a team as code owners August 17, 2026 19:05

azure-client-tools-bot-prd Bot added this to the September 2026 (2026-09-01) milestone Aug 17, 2026

Copilot started reviewing on behalf of Dhawal Jain (dhawal777) August 17, 2026 19:06 View session

Copilot AI reviewed Aug 17, 2026

View reviewed changes

Comment thread src/azure-cli/azure/cli/command_modules/acr/connected_registry.py

Comment thread src/azure-cli/azure/cli/command_modules/acr/_help.py Outdated

Yong Zhang (yonzhan) assigned Julie Zhu (yanzhudd) Aug 17, 2026

{ACR} az acr connected-registry delete: handle MI-mode + minor fixes

aa11152

Dhawal Jain (dhawal777) changed the title ~~Changes to az commands to support managed identity in Connected Registry~~ Changes to az commands to support managed identity in Connected Registry [DRAFT] Aug 18, 2026

Aditya Pujara (a0x1ab) added the Azure Client Tools Agent Requested label Aug 19, 2026

x-engineering-agent Bot added the azure-client-tools-agent label Aug 19, 2026

x-engineering-agent Bot reviewed Aug 19, 2026

View reviewed changes

x-engineering-agent Bot removed the Azure Client Tools Agent Requested label Aug 19, 2026

Zoey Li (lizMSFT) reviewed Aug 23, 2026

View reviewed changes

Comment thread src/azure-cli/azure/cli/command_modules/acr/_params.py Outdated

Zoey Li (lizMSFT) reviewed Aug 23, 2026

View reviewed changes

Comment thread src/azure-cli/HISTORY.rst Outdated

Zoey Li (lizMSFT) reviewed Aug 23, 2026

View reviewed changes

Comment thread src/azure-cli/azure/cli/command_modules/acr/_params.py Outdated

Zoey Li (lizMSFT) reviewed Aug 24, 2026

View reviewed changes

Comment thread src/azure-cli/azure/cli/command_modules/acr/_help.py Outdated

Comment thread src/azure-cli/azure/cli/command_modules/acr/_help.py

Comment thread src/azure-cli/azure/cli/command_modules/acr/_params.py Outdated

{ACR} az acr connected-registry: address PR review comments

d28705e

{ACR} az acr connected-registry update: restrict auth migration to …

7f5ad04

…SyncToken -> ManagedIdentity

Zoey Li (lizMSFT) reviewed Aug 31, 2026

View reviewed changes

Aditya Pujara (a0x1ab) added X Engineering Agent Reviewed Pull request reviewed by X Engineering Agent and removed azure-client-tools-agent labels Sep 2, 2026

Uh oh!

Conversation

Dhawal Jain (dhawal777) commented Aug 17, 2026

Uh oh!

azure-client-tools-bot-prd Bot commented Aug 17, 2026

Uh oh!

azure-pipelines Bot commented Aug 17, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Aditya Pujara (a0x1ab) commented Aug 17, 2026

Uh oh!

azure-pipelines Bot commented Aug 17, 2026

Uh oh!

Aditya Pujara (a0x1ab) commented Aug 18, 2026

Uh oh!

azure-pipelines Bot commented Aug 18, 2026

Uh oh!

x-engineering-agent Bot commented Aug 19, 2026

Live test results — azdev test --live --series (changed test files only)

Uh oh!

x-engineering-agent Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Zoey Li (lizMSFT) Aug 24, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Aditya Pujara (a0x1ab) commented Aug 27, 2026

Uh oh!

azure-pipelines Bot commented Aug 27, 2026

Uh oh!

Aditya Pujara (a0x1ab) commented Aug 27, 2026

Uh oh!

azure-pipelines Bot commented Aug 27, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Zoey Li (lizMSFT) Aug 31, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Aditya Pujara (a0x1ab) commented Sep 3, 2026

Uh oh!

azure-pipelines Bot commented Sep 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Live test results — `azdev test --live --series` (changed test files only)