Container registries should have the admin user disabled
Evaluates each container registry and inspects its admin user setting to determine whether the admin user is disabled. The check reads the registry configuration and reports the state of that setting for every registry in scope.
Using a shared, always-valid admin credential grants full push/pull and lacks attribution. Compromise enables unauthorized image pulls (confidentiality), malicious pushes or tag changes (integrity), and deletions or lockout (availability), enabling supply-chain attacks and lateral movement.
What this control checks
Fails if the container registry admin user is enabled; passes if it is disabled.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Configure container registries to disable local admin account." (79fdfe03-ffcb-4e55-b4d0-b925b8241759) and "Container registries should have local admin account disabled." (dc921057-6b28-4fbe-9b83-f7bec05db6c2); Prowler check containerregistry_admin_user_disabled (prowler azure --checks containerregistry_admin_user_disabled); PowerPipe control azure_compliance.control.container_registry_admin_user_disabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_137; KICS query "Admin User Enabled For Container Registry" (b897dfbf-322c-45a8-b67c-1e698beeaa51).
Framework-specific interpretation
NIS2 Directive (EU 2022/2555): Mapped to 2.1.2.g (identify and prioritise appropriate risk treatment options and measures;) and 6.7.2.e (not use systems used for administration of the security policy implementation for other purposes;).
Framework mappings
The clauses this control is mapped to in each framework.
- 2 Risk management policy
- 6 Security in network and information systems acquisition, development and maintenance
RBI Cyber Security Framework for UCBs
- Annex I (1.1)
- IAM-04.06B If the cloud service provider defines break glass accounts to be used when the main procedure for authentication is not available, then the cloud service provider defines and enforces specific requirements and procedures for secure usage of those accounts.
- OPS-32.01B Guidelines and instructions with technical and organisational measures for the planning and management of containers are documented, communicated and provided in accordance with SP-01. These guidelines and instructions contain specifications for the entire container life cycle...
- PSS-11.01B If cloud service customers operate virtual machines or containers with the cloud service, the cloud service provider ensures the following aspects: - Cloud service customers can restrict the selection of images of virtual machines or containers according to their specifications, so...
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
container_registry_admin_user_disabled - Checkov Check:
CKV_AZURE_137 - Powerpipe Control:
azure_compliance.control.container_registry_admin_user_disabled - Prowler Check:
containerregistry_admin_user_disabled - Azure Policy Definitions:
79fdfe03-ffcb-4e55-b4d0-b925b8241759,dc921057-6b28-4fbe-9b83-f7bec05db6c2 - KICS Query:
b897dfbf-322c-45a8-b67c-1e698beeaa51
Last reviewed: 2026-10-11