Enabling the admin user on an Azure Container Registry creates a shared username/password credential that can be leaked or abused to push or pull images, increasing the risk of unauthorized access and lateral movement.
For Ansible resources using azure_rm_containerregistry or azure.azcollection.azure_rm_containerregistry, the admin_user_enabled property must be set to false or omitted (it defaults to false). Tasks with admin_user_enabled: true are flagged. Use Azure AD RBAC with scoped service principals or managed identities for registry access instead.
Secure example (explicitly disabling the admin user):
