<p>This issue, for me, was caused by not assigning myself the AcrPush role in the azure portal (even though I created the test registry within my own subscription so I'm a contributor by default \o/).</p>
<p>However, for your use-case you can probably just enable the admin user (a tick box inside the 'access keys' blade of your azure container registry page in the azure portal) to make the error go away. Just be aware of what you're doing if you do this!</p>
<p>Further detail can be found in this existing answer over in SO: <a href="https://stackoverflow.com/a/67599570/747633">https://stackoverflow.com/a/67599570/747633</a></p>

CC BY-SA 4.0
2024-01-30T17:29:44.013Z
2024-01-30T17:51:59.640Z
2024-01-30T17:51:59.640Z
ciaranj
<p>(Real need: I want to set up a customized-to-my-needs container for development. I have the dockerfile but my impression is that I need to go through ACR. So:)</p>
<p>I'm logged in to Azure both with the CLI (<code>az login</code>) and with the Azure Portal in a browser. Following <a href="https://learn.microsoft.com/en-us/azure/container-instances/container-instances-tutorial-prepare-acr" rel="nofollow noreferrer">this Learn tutorial</a> I set up an ACR but the tutorial fails for me at step <code>az acr --login &lt;acrname&gt;</code> with:</p>
<pre><code>Unable to get AAD authorization tokens with message: 2023-12-06 19:20:09.434724 An error occurred: CONNECTIVITY_REFRESH_TOKEN_ERROR
Access to registry 'foobar.azurecr.io' was denied. Response code: 401. Please try running 'az login' again to refresh permissions.
Unable to get admin user credentials with message: Admin user is disabled.
</code></pre>
<p>I then get a User/Pass prompt but when I put in my Azure login credentials, that fails with <code>unauthorized: Application not registered with AAD.</code></p>
<p>This is not a &quot;refresh permissions&quot; issue, as I can <code>az login</code> immediately prior to this command and the login succeeds and allows me to do other CLI stuff. In Azure Portal, when I open the ACR and look at &quot;Access Control&quot;|&quot;View my access&quot; I have &quot;Classic Administrators (1) / Service Administrator&quot;.</p>
<p>I get the same result using the CLI from both a WSL-based terminal and a Powershell-based terminal.</p>
<p>Do I <em>really</em> need to set up AAD to access ACR, which I only need to serve a single image from? Is there no &quot;just choose compute and upload a Dockerfile&quot; workflow?</p>

<azure><authentication>
Azure ACR login fails with "Admin user is disabled" but Portal shows me as Service Admin
Larry OBrien
# Azure ACR login fails with "Admin user is disabled" but Portal shows me as Service Admin

(Asked by: username_0 on 2023-12-06)

(Real need: I want to set up a customized-to-my-needs container for development. I have the dockerfile but my impression is that I need to go through ACR. So:)
I'm logged in to Azure both with the CLI (az login) and with the Azure Portal in a browser. Following this Learn tutorial I set up an ACR but the tutorial fails for me at step az acr --login  with:
Unable to get AAD authorization tokens with message: 2023-12-06 19:20:09.434724 An error occurred: CONNECTIVITY_REFRESH_TOKEN_ERROR
Access to registry 'foobar.azurecr.io' was denied. Response code: 401. Please try running 'az login' again to refresh permissions.
Unable to get admin user credentials with message: Admin user is disabled.

I then get a User/Pass prompt but when I put in my Azure login credentials, that fails with unauthorized: Application not registered with AAD.
This is not a "refresh permissions" issue, as I can az login immediately prior to this command and the login succeeds and allows me to do other CLI stuff. In Azure Portal, when I open the ACR and look at "Access Control"|"View my access" I have "Classic Administrators (1) / Service Administrator".
I get the same result using the CLI from both a WSL-based terminal and a Powershell-based terminal.
Do I really need to set up AAD to access ACR, which I only need to serve a single image from? Is there no "just choose compute and upload a Dockerfile" workflow?

**Tags:** azure, authentication


---

## 1 answers

### Answer by username_1 on 2024-01-30. Score: 0

This issue, for me, was caused by not assigning myself the AcrPush role in the azure portal (even though I created the test registry within my own subscription so I'm a contributor by default \o/).

However, for your use-case you can probably just enable the admin user (a tick box inside the 'access keys' blade of your azure container registry page in the azure portal) to make the error go away. Just be aware of what you're doing if you do this!

Further detail can be found in this existing answer over in SO: <https://stackoverflow.com/a/67599570/747633>


---

