Downgrade ACR

Question

Downgrade ACR

Subin Sabu 40

Hi, I have a premium private ACR, with service endpoints enabled on my VNet for access from AKS. Now I want to downgrade the ACR to basic or standard since I no longer need a private ACR, I changed the public network access to all networks and there are no private endpoints. Below is the error I'm getting

Could not update registry ''
Cannot update the registry SKU due to reason: Registry has virtual network rules. Please remove them before proceeding. For more information, please visit https://aka.ms/acr/vnet.. For more information on SKU tiers, please visit https://aka.ms/acr/tiers.

I even removed the service endpoint to container registry to be sure. Below is the detailed information of my ACR.

{                                                                                                                         "adminUserEnabled": false,                                                                                              "anonymousPullEnabled": false,                                                                                          "creationDate": "",                                                                     "dataEndpointEnabled": false,                                                                                           "dataEndpointHostNames": [],                                                                                            "encryption": {                                                                                                           "keyVaultProperties": null,                                                                                             "status": "disabled"                                                                                                  },                                                                                                                      "id": "",                                                                                               "identity": null,                                                                                                       "location": "",                                                                                                  "loginServer": "",                                                                "metadataSearch": "Disabled",                                                                                           "name": "",                                                                                                   "networkRuleBypassOptions": "AzureServices",                                                                            "networkRuleSet": {                                                                                                       "defaultAction": "Allow",                                                                                               "ipRules": []                                                                                                         },                                                                                                                      "policies": {                                                                                                             "azureAdAuthenticationAsArmPolicy": {                                                                                     "status": "enabled"                                                                                                   },                                                                                                                      "exportPolicy": {                                                                                                         "status": "enabled"                                                                                                   },                                                                                                                      "quarantinePolicy": {                                                                                                     "status": "disabled"                                                                                                  },                                                                                                                      "retentionPolicy": {                                                                                                      "days": 7,                                                                                                              "lastUpdatedTime": "",                                                                  "status": "disabled"                                                                                                  },                                                                                                                      "softDeletePolicy": {                                                                                                     "lastUpdatedTime": "",                                                                  "retentionDays": 7,                                                                                                     "status": "disabled"                                                                                                  },                                                                                                                      "trustPolicy": {                                                                                                          "status": "disabled",                                                                                                   "type": "Notary"                                                                                                      }                                                                                                                     },                                                                                                                      "privateEndpointConnections": [],                                                                                       "provisioningState": "Succeeded",                                                                                       "publicNetworkAccess": "Enabled",                                                                                       "resourceGroup": "",                                                                                           "sku": {                                                                                                                  "name": "Premium",                                                                                                      "tier": "Premium"                                                                                                     },                                                                                                                      "status": null,                                                                                                         "systemData": {                                                                                                           "createdAt": "",                                                                        "createdBy": "",                                                                                    "createdByType": "User",                                                                                                "lastModifiedAt": "",                                                                   "lastModifiedBy": "",                                                                               "lastModifiedByType": "User"                                                                                          },                                                                                                                      "tags": {                                                                                                                 "se": ""                                                                                                      },                                                                                                                      "type": "Microsoft.ContainerRegistry/registries",                                                                       "zoneRedundancy": "Disabled"                                                                                          }

Subin Sabu 40 Reputation points

2025-07-24T04:25:07.7366667+00:00

So this is what I did, I ran az acr network-rule list and saw there was a virtualNetworkRules to my subnet. So I removed it using az acr network-rule remove and downgrade was successful. Thanks guys @Durga Reshma Malthi and @Marcin Policht

2 answers

Your answer

Subin Sabu 40 Reputation points

2025-07-24T04:25:07.7366667+00:00

So this is what I did, I ran az acr network-rule list and saw there was a virtualNetworkRules to my subnet. So I removed it using az acr network-rule remove and downgrade was successful. Thanks guys @Durga Reshma Malthi and @Marcin Policht

Answer 1

Durga Reshma Malthi 9,595 Microsoft External Staff Moderator

Hi Subin Sabu

To downgrade your Azure Container Registry (ACR) from Premium to Basic or Standard, you need to ensure that there is no virtual network rules associated with the registry.

Navigate to your ACR resource -> Under Networking, click on "Private access (virtual networks)" and remove any listed subnets or VNet associations.

You can also try using the Az CLI Commands:

If you’re unsure of the VNet/Subnet name, you can list them using:

  az acr network-rule list --name <your-acr-name> --resource-group <your-rg-name>

Run the below command to check if virtualNetworkRules are still present:

  az acr show --name <your-acr-name> --resource-group <your-rg> --query "networkRuleSet.virtualNetworkRules"

If present, then remove it:

  az acr update --name <your-acr-name> --resource-group <your-rg> --network-rule-set virtual-network-rules=[]

After removing, try downgrading the SKU

  az acr update --name <your-acr-name> --resource-group <your-rg> --sku Standard

Hope this helps!

Please Let me know if you have any queries.

Durga Reshma Malthi 9,595 Reputation points Microsoft External Staff Moderator

2025-07-24T05:13:30.51+00:00

Hi Subin Sabu

Thanks for your update.

Feel free to reach out if you have any further queries.

If you found the information helpful, please click "Upvote" on the post to let us know and consider accepting the answer as the token of appreciation. Thank You.
Durga Reshma Malthi 9,595 Reputation points Microsoft External Staff Moderator

2025-07-25T08:26:17.44+00:00

Hi Subin Sabu

If you found the information helpful, please click "Upvote" on the post to let us know and consider accepting the answer as the token of appreciation. Thank You.

Answer 2

Marcin Policht 53,675 MVP Volunteer Moderator

Remove virtual network rules - more at https://learn.microsoft.com/en-us/azure/container-registry/container-registry-vnet

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Share via

Downgrade ACR

2 answers

Your answer