Distributing Bicep Modules with Token-Based Access Using ACR

This article explains how to distribute Bicep modules using Azure Container Registry (ACR) with repository-scoped tokens for token-based access. It covers the experimental ociEnabled feature in Bicep 0.45.6, which routes module pulls through ORAS using Docker-style credentials, but notes a routing rule that prevents direct use with *.azurecr.io hostnames. The author provides a workaround using a custom domain with an NGINX reverse proxy on Container Apps to bypass this limitation, enabling token-based authentication for module distribution. Targeted at MSPs and platform engineers building shared infrastructure tooling.