[ACR] az acr import: Add cross-tenant import support

[Bin Du (northtyphoon)]

Related command

az acr import

Description

Add --registry-tenant to support importing images from an Azure Container Registry in another tenant.

When specified, Azure CLI uses the current identity to acquire an auxiliary ARM token for the source registry tenant and includes it on the import management API request. The option is accepted only when --registry is a Container Registry resource ID; registry names, login servers, missing registry values, and non-ACR resource IDs are rejected.

This change also adds command help and a cross-tenant example.

Testing Guide

python -m unittest azure.cli.command_modules.acr.tests.latest.test_acr_client_factory
az acr import --help

Confirm that help includes --registry-tenant, and that using it with a registry name fails before an import request is sent.

---

• The PR title and description has followed the guideline in Submitting Pull Requests.
• I adhere to the Command Guidelines.
• I adhere to the Error Handling Guidelines.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟡 Changes recommended

Managed-identity and Cloud Shell logins silently omit the auxiliary token, causing advertised cross-tenant imports to fail.

1 open finding

• Auxiliary tenant credentials ignored for managed identity and Cloud Shell logins · New

What changed in this PR

Adds cross-tenant ACR image imports using auxiliary ARM authentication.

Changes:

• Adds --registry-tenant with validation and help.
• Uses an auxiliary tenant when creating the import client.
• Adds focused client-factory tests.

File	Description
_client_factory.py	Validates source registry IDs and configures auxiliary authentication.
commands.py	Registers the import-specific client factory.
_params.py	Defines --registry-tenant.
_help.py	Adds a cross-tenant example.
test_acr_client_factory.py	Tests validation and tenant forwarding.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Bin Du (northtyphoon)]

Addressed in 4136ed7. --registry-tenant now rejects managed identity and Cloud Shell login modes before client creation, with focused unit coverage.

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Yong Zhang (yonzhan)]

Please fix CI issues

[Bin Du (northtyphoon)]

Pushed 4136ed7 to address the review and linter failures: exposed registry_tenant in the command handler signature, added scenario coverage for --registry-tenant, and rejected managed identity/Cloud Shell authentication before sending the import request.

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Bin Du (northtyphoon)]

Fixed the pylint failure in 1f54ef5. registry_tenant intentionally remains in the handler signature so the CLI parser exposes --registry-tenant; its value is consumed by the import client factory, so the handler parameter now uses the standard inline unused-argument suppression.

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Jaime Wu (Zefty)]

LGTM

[Cesar Gray (cegraybl)]

LGTM