Share via

disable quarantine from container registry

Michael Heberle 25 Reputation points
2025-08-07T20:38:38.2766667+00:00

Azure Support Ticket

Subject: Urgent: Unable to Disable Quarantine Policy on ACR - Production Deployment Blocked

Service: Azure Container Registry Subscription ID: blinded Resource Group: blinded Container Registry Name: blinded

Problem Description

We are experiencing a critical production deployment blockage for our application. All attempts to deploy our Azure Container Apps are failing because they are unable to pull images from our Azure Container Registry (blinded).

The deployment logs show a clear error message: IMAGE_QUARANTINED: The image is quarantined.

This issue has blocked our critical "Wave 4" release for over 48 hours.

Technical Details and Evidence

The JSON representation of our ACR's policies confirms that the quarantinePolicy is enabled:

JSON

"policies"

This is preventing our Container Apps from pulling any images, causing the entire Bicep deployment to fail. Here is a sample error from the deployment logs for one of the container apps:

JSON

{

Troubleshooting Steps Already Taken

We have performed extensive troubleshooting and have ruled out all other potential causes:

Content Trust: We have successfully disabled the trustPolicy using the Azure CLI (az acr config content-trust update --status disabled).

RBAC Permissions: We have verified that all relevant user accounts and the Container Apps' Managed Identities have the necessary AcrPull and AcrPush roles assigned.

Admin Credentials: The docker push command fails with a 403 error even when using the ACR's admin user credentials, proving this is a policy issue, not a user permission issue.

Portal and CLI: We have been unable to find a setting in the Azure Portal or a command in the Azure CLI (including older versions) that allows us to directly disable this quarantinePolicy. The portal shows "Microsoft Defender for Cloud" as "Off," which seems to contradict the policy's enabled status.

Urgent Request

We require your assistance to manually disable the quarantinePolicy for our Azure Container Registry: blinded.

This is the final blocker for our critical production deployment. Please escalate this issue as appropriate.

Thank you.

Azure Container Registry
Azure Container Registry
An Azure service that provides a registry of Docker and Open Container Initiative images.
Accepted answer
  1. Himanshu Shekhar 160 Reputation points Microsoft External Staff Moderator
    2025-08-07T21:56:29.15+00:00

    Hello Michael Heberle ,

    Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

    Please follow the below suggested steps for removing the image from Quarantine using the Azure CLI command:

    az acr quarantine delete --name <acr-name> --image <image-name>:<tag>

    Replace <acr-name> with the name of your ACR instance, <image-name> with the name of your image, and <tag> with the tag of your image.

    This command removes the image from Quarantine and makes it available for use.

    Note: Quarantine is a feature of Azure Container Registry that allows you to prevent images with known vulnerabilities from being used.

    By default, Quarantine is not enabled for new ACR instances. 

    Hope this helps.

    1 person found this answer helpful.
    0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.