when updating the ACR the user that deployed dose not have the needed permisons

[james-annages]

Remember to label the issue with the appropriate area, and also assign it to yourself if you plan to work on the issue in the near future.

Describe the bug
When deploying a update the user did not have the needed permisons on the ACR, as when it was deployed the admin_enabled was set to true.

Steps to reproduce

1. Be on <0.23.0
2. Update to 0.26.0

Azure TRE release version (e.g. v0.14.0 or main):
0.26.0
Deployed Azure TRE components - click the (i) in the UI:
N/A

[james-annages]

Error message:

Unable to get AAD authorization tokens with message: 2025-12-16 15:20:26.398183 An error occurred: CONNECTIVITY_REFRESH_TOKEN_ERROR
Access to registry '************.azurecr.io' was denied. Response code: 403. Please try running 'az login' again to refresh permissions.
Unable to get admin user credentials with message: Admin user is disabled.

[marrobi]

@james-annages can you provide any more info? Which part of the deployment fails? The deployer ID should be an owner on the ACR I believe.

Also do you know which release brings this issue - I typically recommend going a release at a time when are jumping a few as if there are migrations they get removed in later releases.

[james-annages]

@marrobi sorry been fighting with our tre. the parts that fail in the deployment are any steps that need to talk to the ACR. From memoery the older way of connecting was to use the Admin accout.
I added my user to AcrPush and it seamed to work?

[marrobi]

@james-annages odd, not something heard before.

Are you upgrading with a different user account that was used to deploy? The Owner -- i.e. original deployer ID, should be able to push.

[james-annages]

I think it was a diffrent user.

[marrobi]

@james-annages Ok, makes sense. Most people use a fixed principal ID in a pipeline for production deployments.

We could maybe add an explicit role assignment to the ACR as per

AzureTRE/devops/terraform/main.tf

Lines 131 to 136 in 9a989fb

	resource "azurerm_role_assignment" "current_user_to_key_vault_crypto_officer" {
	count = var.enable_cmk_encryption && var.external_key_store_id == "" ? 1 : 0
	scope = azurerm_key_vault.encryption_kv[0].id
	role_definition_name = "Key Vault Crypto Officer"
	principal_id = data.azurerm_client_config.current.object_id
	}

.

Have you hit any other issues realated to this?

[james-annages]

@marrobi not yet. And have a branch i was going to add a fix too then PR.