Azure Container Apps "az containerapp up ... image pull failed" in CI

Container Apps created a revision but could not pull the image: the registry path is wrong, or the app has no credentials/managed identity authorized to pull from the registry. The revision is marked unhealthy.

What this error means

az containerapp up or update fails or the revision never activates, with "image pull failed", "unauthorized", or "manifest unknown" referencing the ACR or other registry image.

ERROR: The following field(s) are either invalid or not present:
'configuration.registries.passwordSecretRef'.
... Failed to pull image "myacr.azurecr.io/api:latest": failed to authorize:
unauthorized

Common causes

The app has no registry credentials configured

Container Apps needs a registry username/password secret or a managed identity with AcrPull. Without it, the pull is unauthorized.

The image reference or tag is wrong

A mistyped registry host or a tag that was never pushed produces manifest unknown, so no image can be pulled.

How to fix it

Pass registry credentials to the deploy

1. Provide the ACR login server and credentials (or attach a managed identity with AcrPull).
2. Reference the exact image tag that was pushed.
3. Re-run the deploy.

az containerapp up --name api --resource-group rg \
  --image myacr.azurecr.io/api:$GITHUB_SHA \
  --registry-server myacr.azurecr.io \
  --registry-username "$ACR_USER" --registry-password "$ACR_PASS"

Use a managed identity with AcrPull

Assign the app a managed identity and grant it AcrPull so no static registry password is needed.

az containerapp registry set --name api --resource-group rg \
  --server myacr.azurecr.io --identity system

How to prevent it

• Attach registry credentials or a managed identity when creating the app.
• Derive the image tag from the commit so push and deploy agree.
• Grant AcrPull to the app identity, not just the pushing identity.

Related guides