During review of ARO MiWi permissions, some permissions in the Image Registry CredentialsRequest for Azure having other permissions identified through a linked action that are missing.

A linked access check is an action performed by Azure Resource Manager during a incoming request. For example, when you issue a create operation to a network interface ( Microsoft.Network/networkInterfaces/write ) you specify a subnet in the payload. ARM parses the payload, sees you're setting a subnet property, and as a result requires the linked access check Microsoft.Network/virtualNetworks/subnets/join/action to the subnet resource specified in the network interface. If you update a resource but don't include the property in the payload, it will not perform the permission check.

The following permissions were identified as possibly needed in Image Registry CredsRequest as they are specified as linked action of one of Image Registry 's existing permissions

Microsoft.ManagedIdentity/userAssignedIdentities/assign/action

Each permission needs to be validated as to whether it is needed by Image Registry through any of its code paths.