Is there a better way for `az acr import ...` instead of `AzureCLI@2` in Azure DevOps?

I need to "sync/import/copy" a Container Image from registry A in subscription A to registry B to subscription B. It is possible to make this with az acr import ... as documented in Import from a registry in a different subscription .

The flow should be like the following description.

• Image in registry A is build and tested by Dev Peoples.
• After some tests and several builds is a deployable Image in registry A
• Via a Webhook in Azure DevOps Pipeline will the image:vX.V from registry A "sync/import/copy" to registry B.
• Azure DevOps Pipeline triggers the az acr import ... to import the image:vX.V from registry A to registry B

I think it's something similar to GitOps with Azure DevOps and Flux .

Now the question: Is the AzureCLI@2 - Azure CLI v2 task the "best" way to copy such images between ACR's?

It is recommended to use the AzureCLI@2 task to run the Azure CLI commands in Azure Pipelines.

For your case, if you want to run the related command (az acr import) to sync/import/copy images across subscriptions within the same Azure AD (Microsoft Entra ID), you can do like as below.

1. In your Azure AD:

   • Create a management group and add the subscriptions into it.
   • Create a service principal and assign it with the Contributor role at least on the subscriptions.

2. In your Azure DevOps project in which you run the pipeline, go to "Project Settings" > "Service connections" to create a new ARM service connection (Azure Resource Manager service connection) using the service principal.

   • Complete "Step 1: Basics", give a custom name to the new ARM service connection.

     

   • At "Step 2: Service Principal Details", you can see the 'Issuer' and 'Subject identifier'. Copy their values to the service principal to create a new federated credential.

     

   • Complete "Step 2: Service Principal Details". Scope Level is Management Group. Enter the ID and name of the management group. Enter the ID of the service principal and the Azure AD.

     

3. Then on the AzureCLI@2 task, you can use this new ARM service connection. By this way, the task can run the Azure CLI commands to access resources across subscriptions within the management group. Because the task will use the service principal to login on the management group level. And this also can avoid storing your login passwords/tokens as variables in the pipeline.