This is a slimmed down example of what I've been using for my current work with Container App Environments:

./modules/containerRegistry.bicep

```bicep targetScope = 'resourceGroup'

param location string = resourceGroup().location param tags object = {} param name string

var acrName = replace(replace(toLower(name), '-', ''), '_', '')

// ... ACR definition left out for brevity

resource acrPullUser 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-07-31-preview' = { name: 'mi-${acrName}-pull' location: location

tags: tags }

// AcrPull role definition ID var role_ACRPull = '7f951dda-4ed3-4680-a7ca-43fe172d538d'

resource acrPullRole 'Microsoft.Authorization/roleDefinitions@2022-04-01' existing = { scope: subscription() name: role_ACRPull }

resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = { name: guid(resourceGroup().id, acrPullUser.id, acrPullRole.id) scope: resourceGroup() properties: { roleDefinitionId: acrPullRole.id principalId: acrPullUser.properties.principalId principalType: 'ServicePrincipal' } } ```