For an unattended, third-party CI/CD utility that requires Azure AD-managed authentication, a service principal is the appropriate identity type. Service principals are designed for applications and automated services to access Azure resources without human interaction.

To adhere to the principle of least privilege, the utility should only be granted permissions to push and pull images. The AcrPush role is the most specific built-in role for this purpose. It includes permissions to both pull images (Microsoft.ContainerRegistry/registries/pull/read) and push images (Microsoft.ContainerRegistry/registries/push/write), without granting unnecessary administrative permissions found in the Contributor or Owner roles. The AcrPull role would be insufficient as it does not allow pushing images.

Microsoft. (2023). Azure Container Registry authentication with service principals. Microsoft Docs. Retrieved from https://docs.microsoft.com/en-us/azure/container-registry/container-registry-auth-service-principal. In the "Scenarios" section, it states, "In a scripted, 'headless,' or automated scenario, you can provide a service principal with permissions to an Azure container registry."

Microsoft. (2023). Azure Container Registry roles and permissions. Microsoft Docs. Retrieved from https://docs.microsoft.com/en-us/azure/container-registry/container-registry-roles-permissions. The documentation table under "Role permissions" specifies that the AcrPush role includes both Microsoft.ContainerRegistry/registries/pull/read and Microsoft.ContainerRegistry/registries/push/write actions, making it the least-privileged choice for CI/CD scenarios that need to both read and write images.

National Institute of Standards and Technology (NIST). (2013). Security and Privacy Controls for Federal Information Systems and Organizations (Special Publication 800-53 Rev. 4). §AC-6, "Principle of Least Privilege". Retrieved from https://doi.org/10.6028/NIST.SP.800-53r4. This document formally defines the principle of least privilege, which requires that users and processes are granted only those permissions necessary to perform their assigned functions. This principle directly supports the selection of AcrPush over more permissive roles.