Container Registry SKU is not suitable for production workloads

July 12, 2025 ยท View on GitHub

SYNOPSIS

The Basic SKU provides limited performance and features for production container registry workloads.

DESCRIPTION

Azure Container Registry (ACR) provides a range of different service tiers (also known as SKUs). These service tiers provide different levels of performance and features.

Three service tiers are available: Basic, Standard, and Premium. Basic container registries are only recommended for non-production deployments. Use a minimum of Standard for production container registries.

The Premium SKU provides higher image throughput and included storage, and is required for:

  • Geo-replication
  • Availability zones
  • Private Endpoints
  • Firewall restrictions
  • Tokens and scope-maps

RECOMMENDATION

Consider using the Premium Container Registry SKU for production deployments.

EXAMPLES

Configure with Bicep

To deploy registries that pass this rule:

  • Set the sku.name property to Premium or Standard.

For example:

resource registry 'Microsoft.ContainerRegistry/registries@2025-05-01-preview' = {
  name: name
  location: location
  sku: {
    name: 'Premium'
  }
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    adminUserEnabled: false
    anonymousPullEnabled: false
    publicNetworkAccess: 'Disabled'
    zoneRedundancy: 'Enabled'
    policies: {
      quarantinePolicy: {
        status: 'enabled'
      }
      retentionPolicy: {
        days: 30
        status: 'enabled'
      }
      softDeletePolicy: {
        retentionDays: 90
        status: 'enabled'
      }
      exportPolicy: {
        status: 'disabled'
      }
    }
  }
}

Configure with Azure template

To deploy registries that pass this rule:

  • Set the sku.name property to Premium or Standard.

For example:

{
  "type": "Microsoft.ContainerRegistry/registries",
  "apiVersion": "2025-05-01-preview",
  "name": "[parameters('name')]",
  "location": "[parameters('location')]",
  "sku": {
    "name": "Premium"
  },
  "identity": {
    "type": "SystemAssigned"
  },
  "properties": {
    "adminUserEnabled": false,
    "anonymousPullEnabled": false,
    "publicNetworkAccess": "Disabled",
    "zoneRedundancy": "Enabled",
    "policies": {
      "quarantinePolicy": {
        "status": "enabled"
      },
      "retentionPolicy": {
        "days": 30,
        "status": "enabled"
      },
      "softDeletePolicy": {
        "retentionDays": 90,
        "status": "enabled"
      },
      "exportPolicy": {
        "status": "disabled"
      }
    }
  }
}