Hardening Azure Container Registry: Soft Delete & Retention Policies

Your recovery and cleanup goals make sense, but Steps 1 and 2 cannot be enabled together: ACR disallows combining soft delete with the untagged-manifest retention policy.

Soft delete remains preview, supports all SKUs and 1–90 days, and excludes registries with geo-replication or artifact cache. Soft-deleted artifacts continue incurring storage charges. Untagged retention is a separate Premium preview feature; its deletion is irreversible and excludes existing untagged manifests predating activation and OCI manifests.

Choose the policy model first, then test the exact purge command with --dry-run in a nonproduction registry. Review tags and digests against deployed workloads before enforcement; age and --keep do not establish that an image is unused or vulnerability-free. Use Defender findings to prioritize remediation rather than treating age as a CVE detector. Validate deletion and restoration with disposable images before production; a purge dry run alone does not validate the complete recovery design.